linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 5.14 000/334] 5.14.4-rc1 review
@ 2021-09-13 13:10 Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 001/334] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
                   ` (339 more replies)
  0 siblings, 340 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, jonathanh, f.fainelli, stable

This is the start of the stable review cycle for the 5.14.4 release.
There are 334 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.14.4-rc1

Linus Walleij <linus.walleij@linaro.org>
    clk: kirkwood: Fix a clocking boot regression

Helge Deller <deller@gmx.de>
    parisc: Fix unaligned-access crash in bootloader

Daniel Thompson <daniel.thompson@linaro.org>
    backlight: pwm_bl: Improve bootloader/kernel device handover

Julio Faracco <jcfaracco@gmail.com>
    bootconfig: Fix missing return check of xbc_node_compose_key function

Niklas Schnelle <schnelle@linux.ibm.com>
    RDMA/mlx5: Fix number of allocated XLT entries

Aubrey Li <aubrey.li@intel.com>
    ACPI: PRM: Find PRMT table before parsing it

Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
    fbmem: don't allow too huge resolutions

THOBY Simon <Simon.THOBY@viveris.fr>
    IMA: remove the dependency on CRYPTO_MD5

Austin Kim <austin.kim@lge.com>
    IMA: remove -Wmissing-prototypes warning

Miklos Szeredi <mszeredi@redhat.com>
    fuse: wait for writepages in syncfs

Miklos Szeredi <mszeredi@redhat.com>
    fuse: flush extending writes

Miklos Szeredi <mszeredi@redhat.com>
    fuse: truncate pagecache on atomic_o_trunc

Adrian Ratiu <adrian.ratiu@collabora.com>
    char: tpm: Kconfig: remove bad i2c cr50 select

Xiao Ni <xni@redhat.com>
    md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard

Jens Axboe <axboe@kernel.dk>
    io-wq: check max_worker limits if a worker transitions bound state

Claudiu Beznea <claudiu.beznea@microchip.com>
    ARM: dts: at91: add pinctrl-{names, 0} for all gpios

Marc Zyngier <maz@kernel.org>
    KVM: arm64: vgic: Resample HW pending state on deactivation

Marc Zyngier <maz@kernel.org>
    KVM: arm64: Unregister HYP sections from kmemleak in protected mode

Sean Christopherson <seanjc@google.com>
    KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter

Maxim Levitsky <mlevitsk@redhat.com>
    KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation

Sean Christopherson <seanjc@google.com>
    KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats

Paolo Bonzini <pbonzini@redhat.com>
    KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level

Zelin Deng <zelin.deng@linux.alibaba.com>
    KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted

Halil Pasic <pasic@linux.ibm.com>
    KVM: s390: index kvm->arch.idle_mask by vcpu_idx

Sean Christopherson <seanjc@google.com>
    Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"

Alexander Antonov <alexander.antonov@linux.intel.com>
    perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX

Nguyen Dinh Phi <phind.uet@gmail.com>
    tty: Fix data race between tiocsti() and flush_to_ldisc()

Steve French <stfrench@microsoft.com>
    smb3: fix posix extensions mount option

Ronnie Sahlberg <lsahlber@redhat.com>
    cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED

Guoqing Jiang <jiangguoqing@kylinos.cn>
    raid1: ensure write behind bio has less than BIO_MAX_VECS sectors

Pavel Begunkov <asml.silence@gmail.com>
    bio: fix page leak bio_add_hw_page failure

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: fail links of cancelled timeouts

Jens Axboe <axboe@kernel.dk>
    io_uring: io_uring_complete() trace should take an integer

Jens Axboe <axboe@kernel.dk>
    io_uring: IORING_OP_WRITE needs hash_reg_file set

Pavel Begunkov <asml.silence@gmail.com>
    io_uring: limit fixed table size by RLIMIT_NOFILE

Lars Poeschel <poeschel@lemonage.de>
    auxdisplay: hd44780: Fix oops on module unloading

Lukas Hannen <lukas.hannen@opensource.tttech-industrial.com>
    time: Handle negative seconds correctly in timespec64_to_ns()

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: guarantee to write dirty data when enabling checkpoint back

Justin M. Forbes <jforbes@fedoraproject.org>
    iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha

Douglas Anderson <dianders@chromium.org>
    ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()

Eric Dumazet <edumazet@google.com>
    ipv4: fix endianness issue in inet_rtm_getroute_build_skb()

Sunil Goutham <sgoutham@marvell.com>
    octeontx2-af: Set proper errorcode for IPv4 checksum errors

Subbaraya Sundeep <sbhatta@marvell.com>
    octeontx2-af: Fix static code analyzer reported issues

Subbaraya Sundeep <sbhatta@marvell.com>
    octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg

Subbaraya Sundeep <sbhatta@marvell.com>
    octeontx2-af: Fix loop in free and unmap counter

Stefan Wahren <stefan.wahren@i2se.com>
    net: qualcomm: fix QCA7000 checksum handling

Xiyu Yang <xiyuyang19@fudan.edu.cn>
    net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed

Maxim Mikityanskiy <maximmi@nvidia.com>
    sch_htb: Fix inconsistency when leaf qdisc creation fails

Dan Carpenter <dan.carpenter@oracle.com>
    net: qrtr: make checks in qrtr_endpoint_post() stricter

Eric Dumazet <edumazet@google.com>
    ipv4: make exception cache less predictible

Eric Dumazet <edumazet@google.com>
    ipv6: make exception cache less predictible

Ahmad Fatoum <a.fatoum@pengutronix.de>
    brcmfmac: pcie: fix oops on failure to resume and reprobe

Zenghui Yu <yuzenghui@huawei.com>
    bcma: Fix memory leak for internally-handled cores

Sudarsana Reddy Kalluru <skalluru@marvell.com>
    atlantic: Fix driver resume flow.

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Add lowlatency module option

Dan Carpenter <dan.carpenter@oracle.com>
    ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list

Brett Creeley <brett.creeley@intel.com>
    ice: Only lock to update netdev dev_addr

Jacob Keller <jacob.e.keller@intel.com>
    ice: restart periodic outputs around time changes

Jacob Keller <jacob.e.keller@intel.com>
    ice: add lock around Tx timestamp tracker flush

Jacob Keller <jacob.e.keller@intel.com>
    ice: fix Tx queue iteration for Tx timestamp enablement

Mihai Carabas <mihai.carabas@oracle.com>
    misc/pvpanic: fix set driver data

Dmytro Linkin <dlinkin@nvidia.com>
    net/mlx5e: Use correct eswitch for stack devices with lag

Maor Dickman <maord@nvidia.com>
    net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group

Roi Dayan <roid@nvidia.com>
    net/mlx5e: Fix possible use-after-free deleting fdb rule

Leon Romanovsky <leon@kernel.org>
    net/mlx5: Remove all auxiliary devices at the unregister event

Dima Chumak <dchumak@nvidia.com>
    net/mlx5: Lag, fix multipath lag activation

Abhishek Naik <abhishek.naik@intel.com>
    iwlwifi: skip first element in the WTAS ACPI table

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ASoC: wcd9335: Disable irq on slave ports in the remove function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    ASoC: wcd9335: Fix a double irq free in the remove function

Andy Duan <fugang.duan@nxp.com>
    tty: serial: fsl_lpuart: fix the wrong mapbase value

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    usb: bdc: Fix a resource leak in the error handling path of 'bdc_probe()'

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available

Evgeny Novikov <novikov@ispras.ru>
    usb: ehci-orion: Handle errors of clk_prepare_enable() in probe

Yang Yingliang <yangyingliang@huawei.com>
    octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg()

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: xlp9xx: fix main IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: mt65xx: fix IRQ check

Len Baker <len.baker@gmx.com>
    CIFS: Fix a potencially linear read overflow

Vitaly Kuznetsov <vkuznets@redhat.com>
    hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer

Andrey Ignatov <rdna@fb.com>
    bpf: Fix possible out of bound write in narrow load handling

Charles Keepax <ckeepax@opensource.cirrus.com>
    ASoC: wm_adsp: Put debugfs_remove_recursive back in

Tony Lindgren <tony@atomide.com>
    mmc: moxart: Fix issue with uninitialized dma_slave_config

Tony Lindgren <tony@atomide.com>
    mmc: dw_mmc: Fix issue with uninitialized dma_slave_config

Tony Lindgren <tony@atomide.com>
    mmc: sdhci: Fix issue with uninitialized dma_slave_config

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: Intel: Skylake: Fix module resource and format selection

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs

Cezary Rojewski <cezary.rojewski@intel.com>
    ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373

Dan Carpenter <dan.carpenter@oracle.com>
    m68k: coldfire: return success for clk_enable(NULL)

Geetha sowjanya <gakula@marvell.com>
    octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1

Sunil Goutham <sgoutham@marvell.com>
    octeontx2-pf: Fix algorithm index in MCAM rules with RSS action

Sunil Goutham <sgoutham@marvell.com>
    octeontx2-pf: Don't install VLAN offload rule if netdev is down

Geetha sowjanya <gakula@marvell.com>
    octeontx2-af: Check capability flag while freeing ipolicer memory

Naveen Mamindlapalli <naveenm@marvell.com>
    octeontx2-pf: send correct vlan priority mask to npc_install_flow_req

Subbaraya Sundeep <sbhatta@marvell.com>
    octeontx2-af: cn10k: Fix SDP base channel number

Dan Carpenter <dan.carpenter@oracle.com>
    rsi: fix an error code in rsi_probe()

Dan Carpenter <dan.carpenter@oracle.com>
    rsi: fix error code in rsi_load_9116_firmware()

Wei Yongjun <weiyongjun1@huawei.com>
    drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker()

Bob Peterson <rpeterso@redhat.com>
    gfs2: init system threads before freeze lock

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: hix5hd2: fix IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: s3c2410: fix IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: iop3xx: fix deferred probing

Pavel Skripkin <paskripkin@gmail.com>
    Bluetooth: add timeout sanity check to hci_inquiry

Kevin Mitchell <kevmitch@arista.com>
    lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ

Xu Yu <xuyu@linux.alibaba.com>
    mm/swap: consider max pages in iomap_swapfile_add_extent

Nadezda Lutovinova <lutovinova@ispras.ru>
    usb: gadget: mv_u3d: request_irq() after initializing UDC

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    firmware: raspberrypi: Fix a leak in 'rpi_firmware_get()'

Shengjiu Wang <shengjiu.wang@nxp.com>
    ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks

Lukas Bulwahn <lukas.bulwahn@gmail.com>
    hwmon: remove amd_energy driver in Makefile

Chris Packham <chris.packham@alliedtelesis.co.nz>
    hwmon: (pmbus/bpa-rs600) Don't use rated limits as warn limits

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: synquacer: fix deferred probing

Lukas Bulwahn <lukas.bulwahn@gmail.com>
    clk: staging: correct reference to config IOMEM to config HAS_IOMEM

Pali Rohár <pali@kernel.org>
    arm64: dts: marvell: armada-37xx: Extend PCIe MEM space

J. Bruce Fields <bfields@redhat.com>
    nfsd4: Fix forced-expiry locking

Chuck Lever <chuck.lever@oracle.com>
    SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()

Benjamin Coddington <bcodding@redhat.com>
    lockd: Fix invalid lockowner cast after vfs_test_lock

Thomas Gleixner <tglx@linutronix.de>
    locking/local_lock: Add missing owner initialization

Chih-Kang Chang <gary.chang@realtek.com>
    mac80211: Fix insufficient headroom issue for AMSDU

Andrii Nakryiko <andrii@kernel.org>
    libbpf: Re-build libbpf.so when libbpf.map changes

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: phy: tahvo: add IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: host: ohci-tmio: add IRQ check

Valentin Schneider <valentin.schneider@arm.com>
    PM: cpu: Make notifier chain use a raw_spinlock_t

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Bluetooth: Move shutdown callback before flushing tx and rx queue

Voon Weifeng <weifeng.voon@intel.com>
    net: stmmac: fix INTR TBU status affecting irq count statistic

Juhee Kang <claudiajkang@gmail.com>
    samples: pktgen: add missing IPv6 option to pktgen scripts

Leon Romanovsky <leon@kernel.org>
    devlink: Clear whole devlink_flash_notify struct

Ilya Leoshkevich <iii@linux.ibm.com>
    selftests/bpf: Fix test_core_autosize on big-endian machines

Geert Uytterhoeven <geert+renesas@glider.be>
    usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: phy: twl6030: add IRQ checks

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: phy: fsl-usb: add IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: misc: brcmstb-usb-pinmap: add IRQ check

Dan Carpenter <dan.carpenter@oracle.com>
    mac80211: remove unnecessary NULL check in ieee80211_register_hw()

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: gadget: udc: s3c2410: add IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: gadget: udc: at91: add IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: dwc3: qcom: add IRQ check

Sergey Shtylyov <s.shtylyov@omp.ru>
    usb: dwc3: meson-g12a: add IRQ check

Rob Clark <robdclark@chromium.org>
    drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors

Douglas Anderson <dianders@chromium.org>
    ASoC: rt5682: Properly turn off regulators if wrong device ID

Parav Pandit <parav@nvidia.com>
    net/mlx5: Fix unpublish devlink parameters

Kuogee Hsieh <khsieh@codeaurora.org>
    drm/msm/dp: replug event is converted into an unplug followed by an plug events

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    drm/msm/dsi: Fix some reference counted resource leaks

Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
    Bluetooth: fix repeated calls to sco_sock_kill

Curtis Malainey <cujomalainey@chromium.org>
    ASoC: Intel: Fix platform ID matching

Waiman Long <longman@redhat.com>
    cgroup/cpuset: Fix violation of cpuset locking rule

Waiman Long <longman@redhat.com>
    cgroup/cpuset: Miscellaneous code cleanup

William Breathitt Gray <vilhelm.gray@gmail.com>
    counter: 104-quad-8: Return error when invalid mode during ceiling_write

Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
    arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs

Kuogee Hsieh <khsieh@codeaurora.org>
    drm/msm/dp: update is_connected status base on sink count at dp_pm_resume()

David Heidelberg <david@ixit.cz>
    drm/msm/mdp4: move HW revision detection to earlier phase

David Heidelberg <david@ixit.cz>
    drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision

Wei Li <liwei391@huawei.com>
    drm/msm: Fix error return code in msm_drm_init()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    leds: lgm-sso: Propagate error codes from callee to caller

Jose Blanquicet <josebl@microsoft.com>
    selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP

Lukasz Luba <lukasz.luba@arm.com>
    PM: EM: Increase energy calculation precision

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: don't disable multicast flooding to the CPU even without an IGMP querier

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: mt7530: remove the .port_set_mrouter implementation

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: stop syncing the bridge mcast_router attribute at join time

Vignesh Raghavendra <vigneshr@ti.com>
    net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop()

Robert Foss <robert.foss@linaro.org>
    drm: bridge: it66121: Check drm_bridge_attach retval

Alex Elder <elder@linaro.org>
    arm64: dts: qcom: sm8350: fix IPA interconnects

Sibi Sankar <sibis@codeaurora.org>
    arm64: dts: qcom: sc7280: Fixup the cpufreq node

Colin Ian King <colin.king@canonical.com>
    Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow

Sven Eckelmann <sven@narfation.org>
    debugfs: Return error during {full/open}_proxy_open() on rmmod

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled

Vladimir Oltean <vladimir.oltean@nxp.com>
    net: dsa: build tag_8021q.c as part of DSA core

Stephan Gerhold <stephan@gerhold.net>
    soc: qcom: smsm: Fix missed interrupts if state changes while masked

Matthew Cover <werekraken@gmail.com>
    bpf, samples: Add missing mprog-disable to xdp_redirect_cpu's optstring

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Enable PME if it can be signaled from D3cold

Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently

CK Hu <ck.hu@mediatek.com>
    soc: mmsys: mediatek: add mask to mmsys routes

Mansur Alisha Shaik <mansur@codeaurora.org>
    media: venus: helper: do not set constrained parameters for UBWC

Colin Ian King <colin.king@canonical.com>
    media: venus: venc: Fix potential null pointer dereference on pointer fmt

Zhen Lei <thunder.leizhen@huawei.com>
    media: venus: hfi: fix return value check in sys_get_prop_image_version()

Wei Yongjun <weiyongjun1@huawei.com>
    media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete()

Dongliang Mu <mudongliangabcd@gmail.com>
    media: em28xx-input: fix refcount bug in em28xx_usb_disconnect

Hans de Goede <hdegoede@redhat.com>
    leds: trigger: audio: Add an activate callback to ensure the initial brightness is set

Andy Shevchenko <andy.shevchenko@gmail.com>
    leds: rt8515: Put fwnode in any case during ->probe()

Andy Shevchenko <andy.shevchenko@gmail.com>
    leds: lt3593: Put fwnode in any case during ->probe()

Andy Shevchenko <andy.shevchenko@gmail.com>
    leds: lgm-sso: Don't spam logs when probe is deferred

Andy Shevchenko <andy.shevchenko@gmail.com>
    leds: lgm-sso: Put fwnode in any case during ->probe()

Sergey Shtylyov <s.shtylyov@omp.ru>
    i2c: highlander: add IRQ check

Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
    net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set()

Douglas Anderson <dianders@chromium.org>
    drm/bridge: ti-sn65dsi86: Add some 100 us delays

Douglas Anderson <dianders@chromium.org>
    drm/bridge: ti-sn65dsi86: Fix power off sequence

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge

Douglas Anderson <dianders@chromium.org>
    drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()

Douglas Anderson <dianders@chromium.org>
    drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC

Leon Romanovsky <leon@kernel.org>
    devlink: Break parameter notification sequence to be before/after unload/load driver

Biju Das <biju.das.jz@bp.renesas.com>
    arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay

Quentin Monnet <quentin@isovalent.com>
    tools: Free BTF objects at various locations

Quentin Monnet <quentin@isovalent.com>
    libbpf: Return non-null error on failures in libbpf_find_prog_btf_id()

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    lib/test_scanf: Handle n_bits == 0 in random tests

Luben Tuikov <luben.tuikov@amd.com>
    drm/amd/pm: Fix a bug in semaphore double-lock

Tedd Ho-Jeong An <tedd.an@intel.com>
    Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd

Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
    drm: rcar-du: Don't put reference to drm_device in rcar_du_remove()

Leon Romanovsky <leon@kernel.org>
    net: ti: am65-cpsw-nuss: fix wrong devlink release order

Pavel Skripkin <paskripkin@gmail.com>
    net: cipso: fix warnings in netlbl_cipsov4_add_std

Marek Vasut <marex@denx.de>
    drm: mxsfb: Clear FIFO_CLEAR bit

Marek Vasut <marex@denx.de>
    drm: mxsfb: Increase number of outstanding requests on V4 and newer HW

Marek Vasut <marex@denx.de>
    drm: mxsfb: Enable recovery on underflow

Waiman Long <longman@redhat.com>
    cgroup/cpuset: Fix a partition bug with hotplug

Maxim Mikityanskiy <maximmi@nvidia.com>
    net/mlx5e: Block LRO if firmware asks for tunneled LRO

Maxim Mikityanskiy <maximmi@nvidia.com>
    net/mlx5e: Prohibit inner indir TIRs in IPoIB

Anand Moon <linux.amoon@gmail.com>
    ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties

Anand Moon <linux.amoon@gmail.com>
    ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties

Anand Moon <linux.amoon@gmail.com>
    ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    ARM: dts: meson8: Use a higher default GPU clock frequency

Martin KaFai Lau <kafai@fb.com>
    tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos

Luben Tuikov <luben.tuikov@amd.com>
    drm/amd/pm: Fix a bug communicating with the SMU (v5)

Kai-Heng Feng <kai.heng.feng@canonical.com>
    drm/amdgpu/acp: Make PM domain really work

Colin Ian King <colin.king@canonical.com>
    6lowpan: iphc: Fix an off-by-one check of array index

Jun Miao <jun.miao@windriver.com>
    Bluetooth: btusb: Fix a unspported condition to set available debug features

Dan Carpenter <dan.carpenter@oracle.com>
    Bluetooth: sco: prevent information leak in sco_conn_defer_accept()

Yizhuo <yzhai003@ucr.edu>
    media: atomisp: fix the uninitialized use and rename "retvalue"

Philipp Zabel <p.zabel@pengutronix.de>
    media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats

Dan Carpenter <dan.carpenter@oracle.com>
    media: rockchip/rga: fix error handling in probe

Dan Carpenter <dan.carpenter@oracle.com>
    media: v4l2-subdev: fix some NULL vs IS_ERR() checks

Pavel Skripkin <paskripkin@gmail.com>
    media: go7007: remove redundant initialization

Pavel Skripkin <paskripkin@gmail.com>
    media: go7007: fix memory leak in go7007_usb_probe

Oleksij Rempel <linux@rempel-privat.de>
    net: usb: asix: ax88772: add missing stop

Dongliang Mu <mudongliangabcd@gmail.com>
    media: dvb-usb: Fix error handling in dvb_usb_i2c_init

Dongliang Mu <mudongliangabcd@gmail.com>
    media: dvb-usb: fix uninit-value in vp702x_read_mac_addr

Dongliang Mu <mudongliangabcd@gmail.com>
    media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init

Leon Romanovsky <leon@kernel.org>
    ionic: cleanly release devlink instance

Zhen Lei <thunder.leizhen@huawei.com>
    driver core: Fix error return code in really_probe()

Zhen Lei <thunder.leizhen@huawei.com>
    firmware: fix theoretical UAF race with firmware cache and resume

John Fastabend <john.fastabend@gmail.com>
    bpf, selftests: Fix test_maps now that sockmap supports UDP

Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
    arm64: dts: qcom: sm8250: fix usb2 qmp phy node

Colin Ian King <colin.king@canonical.com>
    gfs2: Fix memory leak of object lsi on error return path

Martynas Pumputis <m@lambda.lt>
    libbpf: Fix removal of inner map in bpf_object__create_map

Bjorn Andersson <bjorn.andersson@linaro.org>
    soc: qcom: rpmhpd: Use corner in power_off

Judy Hsiao <judyhsiao@chromium.org>
    arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms

Stefan Assmann <sassmann@kpanic.de>
    i40e: improve locking of mac_filter_hash

Geert Uytterhoeven <geert@linux-m68k.org>
    arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties

Andrew Jeffery <andrew@aj.id.au>
    ARM: dts: everest: Add phase corrections for eMMC

Dylan Hung <dylan_hung@aspeedtech.com>
    ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi

Shuyi Cheng <chengshuyi@linux.alibaba.com>
    libbpf: Fix the possible memory leak on error

Haiyue Wang <haiyue.wang@intel.com>
    gve: fix the wrong AdminQ buffer overflow check

Steven Price <steven.price@arm.com>
    drm/of: free the iterator object on failure

He Fengqing <hefengqing@huawei.com>
    bpf: Fix potential memleak and UAF in the verifier.

Kuniyuki Iwashima <kuniyu@amazon.co.jp>
    bpf: Fix a typo of reuseport map in bpf.h.

Julia Lawall <Julia.Lawall@inria.fr>
    drm/of: free the right object

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    media: cxd2880-spi: Fix an error handling path

Geert Uytterhoeven <geert+renesas@glider.be>
    soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally

Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
    leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()

Krzysztof Hałasa <khalasa@piap.pl>
    media: TDA1997x: enable EDID support

Eugen Hristev <eugen.hristev@microchip.com>
    media: atmel: atmel-sama5d2-isc: fix YUYV format

Marek Vasut <marex@denx.de>
    ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe

Zhang Qilong <zhangqilong3@huawei.com>
    ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe

Harshvardhan Jha <harshvardhan.jha@oracle.com>
    drm/gma500: Fix end of loop tests for list_for_each_entry

Wei Yongjun <weiyongjun1@huawei.com>
    drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()

Quanyang Wang <quanyang.wang@windriver.com>
    spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible

Chunyan Zhang <chunyan.zhang@unisoc.com>
    spi: sprd: Fix the wrong WDG_LOAD_VAL

Chen-Yu Tsai <wenst@chromium.org>
    regulator: vctrl: Avoid lockdep warning in enable/disable ops

Chen-Yu Tsai <wenst@chromium.org>
    regulator: vctrl: Use locked regulator_get_voltage in probe path

Eric Biggers <ebiggers@google.com>
    blk-crypto: fix check for too-large dun_bytes

Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
    spi: davinci: invoke chipselect callback

Borislav Petkov <bp@alien8.de>
    x86/mce: Defer processing of early errors

Qiuxu Zhuo <qiuxu.zhuo@intel.com>
    EDAC/i10nm: Fix NVDIMM detection

Stefan Berger <stefanb@linux.ibm.com>
    tpm: ibmvtpm: Avoid error message when process gets signal while waiting

Stefan Berger <stefanb@linux.ibm.com>
    certs: Trigger creation of RSA module signing key if it's not an RSA key

Geert Uytterhoeven <geert@linux-m68k.org>
    m68k: Fix asm register constraints for atomic ops

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - use proper type for vf_mask

Chen-Yu Tsai <wenst@chromium.org>
    irqchip/gic-v3: Fix priority comparison when non-secure priorities are used

Sven Peter <sven@svenpeter.dev>
    irqchip/apple-aic: Fix irq_disable from within irq handlers

Christophe JAILLET <christophe.jaillet@wanadoo.fr>
    spi: coldfire-qspi: Use clk_disable_unprepare in the remove function

Pavel Skripkin <paskripkin@gmail.com>
    block: nbd: add sanity check for first_minor

Hou Tao <houtao1@huawei.com>
    nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT

Phong Hoang <phong.hoang.wz@renesas.com>
    clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel

Hongbo Li <herberthbli@tencent.com>
    lib/mpi: use kcalloc in mpi_resize

Huacai Chen <chenhuacai@kernel.org>
    irqchip/loongson-pch-pic: Improve edge triggered interrupt support

Zhen Lei <thunder.leizhen@huawei.com>
    genirq/timings: Fix error return code in irq_timings_test_irqs()

Tony Lindgren <tony@atomide.com>
    spi: spi-pic32: Fix issue with uninitialized dma_slave_config

Tony Lindgren <tony@atomide.com>
    spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config

Ming Lei <ming.lei@redhat.com>
    block: return ELEVATOR_DISCARD_MERGE if possible

Geert Uytterhoeven <geert@linux-m68k.org>
    m68k: Fix invalid RMW_INSNS on CPUs that lack CAS

Yanfei Xu <yanfei.xu@windriver.com>
    rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock

Yanfei Xu <yanfei.xu@windriver.com>
    rcu: Fix to include first blocked task in stall warning

Quentin Perret <qperret@google.com>
    sched: Fix UCLAMP_FLAG_IDLE setting

Mika Penttilä <mika.penttila@gmail.com>
    sched/numa: Fix is_core_idle()

Mian Yousaf Kaukab <ykaukab@suse.de>
    crypto: ecc - handle unaligned input buffer in ecc_swap_digits

Ard Biesheuvel <ardb@kernel.org>
    crypto: x86/aes-ni - add missing error checks in XTS code

Pavel Skripkin <paskripkin@gmail.com>
    m68k: emu: Fix invalid free in nfeth_cleanup()

Peter Robinson <pbrobinson@gmail.com>
    power: supply: cw2015: use dev_err_probe to allow deferred probe

Valentin Schneider <valentin.schneider@arm.com>
    sched/debug: Don't update sched_domain debug directories before sched_debug_init()

Alexander Gordeev <agordeev@linux.ibm.com>
    s390/smp: enable DAT before CPU restart callback is called

Harald Freudenberger <freude@linux.ibm.com>
    s390/ap: fix state machine hang after failure to enable irq

Peter Oberparleiter <oberpar@linux.ibm.com>
    s390/debug: fix debug area life cycle

Peter Oberparleiter <oberpar@linux.ibm.com>
    s390/debug: keep debug data on resize

Niklas Schnelle <schnelle@linux.ibm.com>
    s390/pci: fix misleading rc in clp_set_pci_fn()

Alexander Gordeev <agordeev@linux.ibm.com>
    s390/kasan: fix large PMD pages address alignment check

Jens Axboe <axboe@kernel.dk>
    io-wq: remove GFP_ATOMIC allocation off schedule out path

Stian Skjelstad <stian.skjelstad@gmail.com>
    udf_get_extendedattr() had no boundary checks.

Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
    fcntl: fix potential deadlock for &fasync_struct.fa_lock

Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
    fcntl: fix potential deadlocks for &fown_struct.lock

Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    crypto: tcrypt - Fix missing return value check

Kai Ye <yekai13@huawei.com>
    crypto: hisilicon/sec - modify the hardware endian configuration

Kai Ye <yekai13@huawei.com>
    crypto: hisilicon/sec - fix the abnormal exiting process

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - do not export adf_iov_putmsg()

Marco Chiappero <marco.chiappero@intel.com>
    crypto: qat - fix naming for init/shutdown VF to PF notifications

Marco Chiappero <marco.chiappero@intel.com>
    crypto: qat - fix reuse of completion variable

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - handle both source of interrupt in VF ISR

Giovanni Cabiddu <giovanni.cabiddu@intel.com>
    crypto: qat - do not ignore errors from enable_vf2pf_comms()

Ben Hutchings <ben.hutchings@mind.be>
    crypto: omap - Fix inconsistent locking of device lists

Valentin Schneider <valentin.schneider@arm.com>
    sched/topology: Skip updating masks for non-online nodes

Damien Le Moal <damien.lemoal@wdc.com>
    libata: fix ata_host_start()

Harald Freudenberger <freude@linux.ibm.com>
    s390/zcrypt: fix wrong offset index for APKA master key valid state

Vineeth Vijayan <vneethv@linux.ibm.com>
    s390/cio: add dev_busid sysfs entry for each subchannel

Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
    power: supply: max17042_battery: fix typo in MAx17042_TOFF

Dmitry Osipenko <digetx@gmail.com>
    power: supply: smb347-charger: Add missing pin control activation

Amit Engel <amit.engel@dell.com>
    nvmet: pass back cntlid on successful completion

Ruozhu Li <liruozhu@huawei.com>
    nvme-rdma: don't update queue count when failing to set io queues

Ruozhu Li <liruozhu@huawei.com>
    nvme-tcp: don't update queue count when failing to set io queues

Chunguang Xu <brookxu@tencent.com>
    blk-throtl: optimize IOPS throttle for large IO scenarios

Baokun Li <libaokun1@huawei.com>
    nbd: add the check to prevent overflow in __nbd_ioctl()

Christoph Hellwig <hch@lst.de>
    bcache: add proper error unwinding in bcache_device_init

Pali Rohár <pali@kernel.org>
    isofs: joliet: Fix iocharset=utf8 mount option

Pali Rohár <pali@kernel.org>
    udf: Fix iocharset=utf8 mount option

Jan Kara <jack@suse.cz>
    udf: Check LVID earlier

Thomas Gleixner <tglx@linutronix.de>
    hrtimer: Ensure timerfd notification for HIGHRES=n

Thomas Gleixner <tglx@linutronix.de>
    hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()

Frederic Weisbecker <frederic@kernel.org>
    posix-cpu-timers: Force next expiration recalc after itimer reset

Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
    EDAC/mce_amd: Do not load edac_mce_amd module on guests

Sergey Senozhatsky <senozhatsky@chromium.org>
    rcu/tree: Handle VM stoppage in stall detection

Dietmar Eggemann <dietmar.eggemann@arm.com>
    sched/deadline: Fix missing clock update in migrate_task_rq_dl()

Tony Lindgren <tony@atomide.com>
    crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()

Hans de Goede <hdegoede@redhat.com>
    power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors

Quentin Perret <qperret@google.com>
    sched/deadline: Fix reset_on_fork reporting of DL tasks

Sean Anderson <sean.anderson@seco.com>
    crypto: mxs-dcp - Check for DMA mapping errors

Dmitry Osipenko <digetx@gmail.com>
    regulator: tps65910: Silence deferred probe error

Jeongtae Park <jeongtae.park@gmail.com>
    regmap: fix the offset of register error log

Peter Zijlstra <peterz@infradead.org>
    locking/mutex: Fix HANDOFF condition


-------------

Diffstat:

 Documentation/fault-injection/provoke-crashes.rst  |   2 +-
 Makefile                                           |   4 +-
 arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts       |   2 +-
 arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi           |   4 +-
 arch/arm/boot/dts/at91-sam9x60ek.dts               |  16 +-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts        |  29 +++
 arch/arm/boot/dts/at91-sama5d4_xplained.dts        |  19 ++
 arch/arm/boot/dts/meson8.dtsi                      |   5 +
 arch/arm/boot/dts/meson8b-ec100.dts                |   4 +-
 arch/arm/boot/dts/meson8b-mxq.dts                  |   4 +-
 arch/arm/boot/dts/meson8b-odroidc1.dts             |   4 +-
 arch/arm64/boot/dts/exynos/exynos7.dtsi            |   2 +-
 .../boot/dts/marvell/armada-3720-turris-mox.dts    |  17 ++
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi       |  11 +-
 .../arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi |   2 +-
 arch/arm64/boot/dts/qcom/sc7280.dtsi               |   6 +-
 arch/arm64/boot/dts/qcom/sm8250.dtsi               |   2 +-
 arch/arm64/boot/dts/qcom/sm8350.dtsi               |   8 +-
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi    |   1 +
 arch/arm64/boot/dts/renesas/r8a77995-draak.dts     |   4 -
 arch/arm64/kvm/arm.c                               |   7 +
 arch/arm64/kvm/vgic/vgic-v2.c                      |  36 +--
 arch/arm64/kvm/vgic/vgic-v3.c                      |  36 +--
 arch/arm64/kvm/vgic/vgic.c                         |  38 +++
 arch/arm64/kvm/vgic/vgic.h                         |   2 +
 arch/m68k/Kconfig.cpu                              |   8 +-
 arch/m68k/coldfire/clk.c                           |   2 +-
 arch/m68k/emu/nfeth.c                              |   4 +-
 arch/m68k/include/asm/atomic.h                     |   4 +-
 arch/parisc/boot/compressed/misc.c                 |   2 +-
 arch/s390/include/asm/kvm_host.h                   |   1 +
 arch/s390/include/asm/lowcore.h                    |   3 +-
 arch/s390/include/asm/processor.h                  |   2 +
 arch/s390/kernel/asm-offsets.c                     |   1 +
 arch/s390/kernel/debug.c                           | 176 ++++++++-----
 arch/s390/kernel/entry.S                           |  11 +-
 arch/s390/kernel/ipl.c                             |   3 -
 arch/s390/kernel/machine_kexec.c                   |   1 -
 arch/s390/kernel/setup.c                           |   9 +-
 arch/s390/kernel/smp.c                             |  31 ++-
 arch/s390/kvm/interrupt.c                          |  12 +-
 arch/s390/kvm/kvm-s390.c                           |   2 +-
 arch/s390/kvm/kvm-s390.h                           |   2 +-
 arch/s390/mm/kasan_init.c                          |  41 ++-
 arch/s390/pci/pci.c                                |   7 +-
 arch/s390/pci/pci_clp.c                            |  33 ++-
 arch/x86/crypto/aesni-intel_glue.c                 |   5 +
 arch/x86/events/intel/uncore_snbep.c               |  40 ++-
 arch/x86/include/asm/mce.h                         |   1 +
 arch/x86/kernel/cpu/mce/core.c                     |  11 +-
 arch/x86/kvm/mmu/mmu.c                             |  19 +-
 arch/x86/kvm/mmu/tdp_mmu.c                         |  20 +-
 arch/x86/kvm/vmx/nested.c                          |   7 +-
 arch/x86/kvm/vmx/vmx.c                             |   3 +
 arch/x86/kvm/x86.c                                 |   4 +
 block/bfq-iosched.c                                |   3 +
 block/bio.c                                        |  15 +-
 block/blk-crypto.c                                 |   2 +-
 block/blk-merge.c                                  |  18 +-
 block/blk-throttle.c                               |  32 +++
 block/blk.h                                        |   2 +
 block/elevator.c                                   |   3 +
 block/mq-deadline.c                                |   2 +
 certs/Makefile                                     |   8 +
 crypto/ecc.h                                       |   5 +-
 crypto/tcrypt.c                                    |  29 ++-
 drivers/acpi/prmt.c                                |  10 +-
 drivers/ata/libata-core.c                          |   2 +-
 drivers/auxdisplay/hd44780.c                       |   2 +-
 drivers/base/dd.c                                  |  16 +-
 drivers/base/firmware_loader/main.c                |  20 +-
 drivers/base/regmap/regmap.c                       |   2 +-
 drivers/bcma/main.c                                |   6 +-
 drivers/block/nbd.c                                |  86 ++++++-
 drivers/bluetooth/btusb.c                          |  18 +-
 drivers/char/tpm/Kconfig                           |   1 -
 drivers/char/tpm/tpm_ibmvtpm.c                     |  26 +-
 drivers/char/tpm/tpm_ibmvtpm.h                     |   2 +-
 drivers/clk/mvebu/kirkwood.c                       |   1 +
 drivers/clocksource/sh_cmt.c                       |  30 ++-
 drivers/counter/104-quad-8.c                       |   5 +-
 drivers/crypto/hisilicon/sec2/sec.h                |   5 -
 drivers/crypto/hisilicon/sec2/sec_main.c           |  34 +--
 drivers/crypto/mxs-dcp.c                           |  45 +++-
 drivers/crypto/omap-aes.c                          |   8 +-
 drivers/crypto/omap-des.c                          |   8 +-
 drivers/crypto/omap-sham.c                         |  14 +-
 .../crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c   |   4 +-
 drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c |   4 +-
 drivers/crypto/qat/qat_common/adf_common_drv.h     |   8 +-
 drivers/crypto/qat/qat_common/adf_init.c           |   5 +-
 drivers/crypto/qat/qat_common/adf_isr.c            |   7 +-
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c      |   3 +-
 drivers/crypto/qat/qat_common/adf_vf2pf_msg.c      |  12 +-
 drivers/crypto/qat/qat_common/adf_vf_isr.c         |   7 +-
 .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c    |   4 +-
 drivers/edac/i10nm_base.c                          |   6 +-
 drivers/edac/mce_amd.c                             |   3 +
 drivers/firmware/raspberrypi.c                     |  10 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c            |  54 ++--
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c             | 286 +++++++++++++++++----
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h             |   3 +-
 drivers/gpu/drm/bridge/ite-it66121.c               |   2 +
 drivers/gpu/drm/bridge/ti-sn65dsi86.c              |  97 ++++---
 drivers/gpu/drm/drm_of.c                           |   6 +-
 drivers/gpu/drm/exynos/exynos_drm_g2d.c            |   3 +-
 drivers/gpu/drm/gma500/oaktrail_lvds.c             |   2 +-
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c         |  10 +-
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c           |  68 ++---
 drivers/gpu/drm/msm/dp/dp_display.c                |  31 ++-
 drivers/gpu/drm/msm/dsi/dsi.c                      |   6 +-
 drivers/gpu/drm/msm/msm_drv.c                      |   1 +
 drivers/gpu/drm/mxsfb/mxsfb_drv.c                  |   3 +
 drivers/gpu/drm/mxsfb/mxsfb_drv.h                  |   1 +
 drivers/gpu/drm/mxsfb/mxsfb_kms.c                  |  40 +++
 drivers/gpu/drm/mxsfb/mxsfb_regs.h                 |   9 +
 drivers/gpu/drm/panfrost/panfrost_device.c         |   3 +-
 drivers/gpu/drm/rcar-du/rcar_du_drv.c              |   2 -
 drivers/hv/hv_snapshot.c                           |   1 +
 drivers/hwmon/Makefile                             |   1 -
 drivers/hwmon/pmbus/bpa-rs600.c                    |  25 --
 drivers/i2c/busses/i2c-highlander.c                |   2 +-
 drivers/i2c/busses/i2c-hix5hd2.c                   |   2 +-
 drivers/i2c/busses/i2c-iop3xx.c                    |   6 +-
 drivers/i2c/busses/i2c-mt65xx.c                    |   2 +-
 drivers/i2c/busses/i2c-s3c2410.c                   |   2 +-
 drivers/i2c/busses/i2c-synquacer.c                 |   2 +-
 drivers/i2c/busses/i2c-xlp9xx.c                    |   2 +-
 drivers/infiniband/hw/mlx5/mr.c                    |   2 +-
 drivers/irqchip/irq-apple-aic.c                    |   2 +-
 drivers/irqchip/irq-gic-v3.c                       |  23 +-
 drivers/irqchip/irq-loongson-pch-pic.c             |  19 +-
 drivers/leds/blink/leds-lgm-sso.c                  |  23 +-
 drivers/leds/flash/leds-rt8515.c                   |   4 +-
 drivers/leds/leds-is31fl32xx.c                     |   1 +
 drivers/leds/leds-lt3593.c                         |   5 +-
 drivers/leds/trigger/ledtrig-audio.c               |  37 ++-
 drivers/md/bcache/super.c                          |  16 +-
 drivers/md/raid1.c                                 |  19 ++
 drivers/md/raid10.c                                |  14 +-
 drivers/media/i2c/tda1997x.c                       |   1 +
 drivers/media/platform/atmel/atmel-sama5d2-isc.c   |  17 ++
 drivers/media/platform/coda/coda-bit.c             |  18 +-
 drivers/media/platform/omap3isp/isp.c              |   4 +-
 drivers/media/platform/qcom/venus/helpers.c        |   3 +
 drivers/media/platform/qcom/venus/hfi_msgs.c       |   2 +-
 drivers/media/platform/qcom/venus/venc.c           |   2 +
 drivers/media/platform/rcar-vin/rcar-v4l2.c        |   4 +-
 drivers/media/platform/rockchip/rga/rga.c          |  27 +-
 drivers/media/platform/vsp1/vsp1_entity.c          |   4 +-
 drivers/media/spi/cxd2880-spi.c                    |   7 +-
 drivers/media/usb/dvb-usb/dvb-usb-i2c.c            |   9 +-
 drivers/media/usb/dvb-usb/dvb-usb-init.c           |   2 +-
 drivers/media/usb/dvb-usb/nova-t-usb2.c            |   6 +-
 drivers/media/usb/dvb-usb/vp702x.c                 |  12 +-
 drivers/media/usb/em28xx/em28xx-input.c            |   1 -
 drivers/media/usb/go7007/go7007-driver.c           |  26 --
 drivers/media/usb/go7007/go7007-usb.c              |   2 +-
 drivers/misc/lkdtm/core.c                          |   2 +-
 drivers/misc/pvpanic/pvpanic.c                     |   2 +
 drivers/mmc/host/dw_mmc.c                          |   1 +
 drivers/mmc/host/moxart-mmc.c                      |   1 +
 drivers/mmc/host/sdhci.c                           |   1 +
 drivers/net/dsa/b53/b53_common.c                   |  10 -
 drivers/net/dsa/b53/b53_priv.h                     |   2 -
 drivers/net/dsa/bcm_sf2.c                          |   1 -
 drivers/net/dsa/mt7530.c                           |  13 -
 drivers/net/dsa/mv88e6xxx/chip.c                   |  18 --
 .../net/ethernet/aquantia/atlantic/aq_pci_func.c   |   3 +
 drivers/net/ethernet/google/gve/gve_adminq.c       |   6 +-
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |  23 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  13 +-
 drivers/net/ethernet/intel/ice/ice_ptp.c           |  55 +++-
 drivers/net/ethernet/marvell/octeontx2/af/common.h |   2 -
 .../net/ethernet/marvell/octeontx2/af/rvu_cn10k.c  |  35 ++-
 .../net/ethernet/marvell/octeontx2/af/rvu_nix.c    |   9 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_npc.c    |  22 +-
 .../net/ethernet/marvell/octeontx2/af/rvu_reg.h    |   2 +-
 .../ethernet/marvell/octeontx2/nic/otx2_common.c   |  16 +-
 .../ethernet/marvell/octeontx2/nic/otx2_common.h   |   3 +
 .../ethernet/marvell/octeontx2/nic/otx2_flows.c    |   1 +
 .../net/ethernet/marvell/octeontx2/nic/otx2_tc.c   |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/dev.c      |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c  |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/en/fs.h    |   6 -
 drivers/net/ethernet/mellanox/mlx5/core/en/qos.c   |  15 +-
 drivers/net/ethernet/mellanox/mlx5/core/en/qos.h   |   4 +-
 .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c  |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_fs.c    |  10 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |  18 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |  18 ++
 .../ethernet/mellanox/mlx5/core/esw/indir_table.c  |   1 +
 .../ethernet/mellanox/mlx5/core/eswitch_offloads.c |   5 +-
 .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c  |  18 +-
 drivers/net/ethernet/mellanox/mlx5/core/lag.c      |   1 +
 drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c   |   8 +
 drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h   |   2 +
 .../net/ethernet/pensando/ionic/ionic_devlink.c    |  14 +-
 drivers/net/ethernet/qualcomm/qca_spi.c            |   2 +-
 drivers/net/ethernet/qualcomm/qca_uart.c           |   2 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c   |   5 +-
 drivers/net/ethernet/ti/am65-cpsw-nuss.c           |  47 ++--
 drivers/net/ethernet/ti/am65-cpsw-nuss.h           |   2 +
 drivers/net/phy/marvell10g.c                       |   8 +
 drivers/net/usb/asix_devices.c                     |   1 +
 drivers/net/wireless/ath/ath6kl/wmi.c              |   4 +-
 .../wireless/broadcom/brcm80211/brcmfmac/pcie.c    |   2 +-
 drivers/net/wireless/intel/iwlwifi/fw/acpi.c       |  14 +-
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c      |   1 +
 drivers/net/wireless/rsi/rsi_91x_hal.c             |   4 +-
 drivers/net/wireless/rsi/rsi_91x_usb.c             |   1 +
 drivers/nvme/host/rdma.c                           |   4 +-
 drivers/nvme/host/tcp.c                            |   4 +-
 drivers/nvme/target/fabrics-cmd.c                  |   9 +-
 drivers/pci/pci.c                                  |  25 +-
 drivers/power/supply/axp288_fuel_gauge.c           |   4 +-
 drivers/power/supply/cw2015_battery.c              |   4 +-
 drivers/power/supply/max17042_battery.c            |   2 +-
 drivers/power/supply/smb347-charger.c              |  10 +
 drivers/regulator/tps65910-regulator.c             |  10 +-
 drivers/regulator/vctrl-regulator.c                |  73 +++---
 drivers/s390/cio/css.c                             |  17 ++
 drivers/s390/crypto/ap_bus.c                       |  25 +-
 drivers/s390/crypto/ap_bus.h                       |  10 +-
 drivers/s390/crypto/ap_queue.c                     |  20 +-
 drivers/s390/crypto/zcrypt_ccamisc.c               |   8 +-
 drivers/soc/mediatek/mt8183-mmsys.h                |  21 +-
 drivers/soc/mediatek/mtk-mmsys.c                   |   7 +-
 drivers/soc/mediatek/mtk-mmsys.h                   | 133 +++++++---
 drivers/soc/qcom/rpmhpd.c                          |   5 +-
 drivers/soc/qcom/smsm.c                            |  11 +-
 drivers/soc/rockchip/Kconfig                       |   4 +-
 drivers/spi/spi-coldfire-qspi.c                    |   2 +-
 drivers/spi/spi-davinci.c                          |   8 +-
 drivers/spi/spi-fsl-dspi.c                         |   1 +
 drivers/spi/spi-pic32.c                            |   1 +
 drivers/spi/spi-sprd-adi.c                         |   2 +-
 drivers/spi/spi-zynq-qspi.c                        |   8 +-
 drivers/staging/clocking-wizard/Kconfig            |   2 +-
 .../staging/media/atomisp/i2c/atomisp-mt9m114.c    |  11 +-
 drivers/staging/media/tegra-video/vi.c             |   4 +-
 drivers/tty/serial/fsl_lpuart.c                    |   2 +-
 drivers/tty/tty_io.c                               |   4 +-
 drivers/usb/dwc3/dwc3-meson-g12a.c                 |   2 +
 drivers/usb/dwc3/dwc3-qcom.c                       |   4 +
 drivers/usb/gadget/udc/at91_udc.c                  |   4 +-
 drivers/usb/gadget/udc/bdc/bdc_core.c              |  30 +--
 drivers/usb/gadget/udc/mv_u3d_core.c               |  19 +-
 drivers/usb/gadget/udc/renesas_usb3.c              |  17 +-
 drivers/usb/gadget/udc/s3c2410_udc.c               |   4 +
 drivers/usb/host/ehci-orion.c                      |   8 +-
 drivers/usb/host/ohci-tmio.c                       |   3 +
 drivers/usb/misc/brcmstb-usb-pinmap.c              |   2 +
 drivers/usb/phy/phy-fsl-usb.c                      |   2 +
 drivers/usb/phy/phy-tahvo.c                        |   4 +-
 drivers/usb/phy/phy-twl6030-usb.c                  |   5 +
 drivers/video/backlight/pwm_bl.c                   |  54 ++--
 drivers/video/fbdev/core/fbmem.c                   |   6 +
 fs/cifs/cifs_unicode.c                             |   9 +-
 fs/cifs/fs_context.c                               |  11 +-
 fs/cifs/readdir.c                                  |  23 +-
 fs/debugfs/file.c                                  |   8 +-
 fs/f2fs/file.c                                     |   5 +-
 fs/f2fs/super.c                                    |  11 +-
 fs/fcntl.c                                         |  18 +-
 fs/fuse/file.c                                     |  30 ++-
 fs/fuse/fuse_i.h                                   |  19 ++
 fs/fuse/inode.c                                    |  60 +++++
 fs/gfs2/ops_fstype.c                               |  43 ++++
 fs/gfs2/super.c                                    |  61 +----
 fs/io-wq.c                                         | 105 +++++---
 fs/io_uring.c                                      |   5 +
 fs/iomap/swapfile.c                                |   6 +
 fs/isofs/inode.c                                   |  27 +-
 fs/isofs/isofs.h                                   |   1 -
 fs/isofs/joliet.c                                  |   4 +-
 fs/lockd/svclock.c                                 |   2 +-
 fs/nfsd/nfs4state.c                                |   4 +-
 fs/udf/misc.c                                      |  13 +-
 fs/udf/super.c                                     |  75 +++---
 fs/udf/udf_sb.h                                    |   2 -
 fs/udf/unicode.c                                   |   4 +-
 include/linux/blkdev.h                             |  16 ++
 include/linux/energy_model.h                       |  16 ++
 include/linux/hrtimer.h                            |   5 -
 include/linux/local_lock_internal.h                |  42 +--
 include/linux/mlx5/mlx5_ifc.h                      |   3 +-
 include/linux/power/max17042_battery.h             |   2 +-
 include/linux/sunrpc/svc.h                         |   1 +
 include/linux/time64.h                             |   9 +-
 include/net/dsa.h                                  |   2 -
 include/net/pkt_cls.h                              |   3 +-
 include/trace/events/io_uring.h                    |   6 +-
 include/trace/events/sunrpc.h                      |   8 +-
 include/uapi/linux/bpf.h                           |   2 +-
 kernel/bpf/verifier.c                              |  31 ++-
 kernel/cgroup/cpuset.c                             |  95 ++++---
 kernel/cpu_pm.c                                    |  50 +++-
 kernel/irq/timings.c                               |   2 +
 kernel/locking/mutex.c                             |  15 +-
 kernel/power/energy_model.c                        |   4 +-
 kernel/rcu/tree_stall.h                            |  26 +-
 kernel/sched/core.c                                |  25 +-
 kernel/sched/deadline.c                            |   8 +-
 kernel/sched/debug.c                               |   7 +
 kernel/sched/fair.c                                |   2 +-
 kernel/sched/sched.h                               |   2 +
 kernel/sched/topology.c                            |  65 +++++
 kernel/time/hrtimer.c                              |  92 +++++--
 kernel/time/posix-cpu-timers.c                     |   2 -
 kernel/time/tick-internal.h                        |   3 +
 lib/mpi/mpiutil.c                                  |   2 +-
 lib/test_scanf.c                                   |   4 +-
 net/6lowpan/debugfs.c                              |   3 +-
 net/bluetooth/cmtp/cmtp.h                          |   2 +-
 net/bluetooth/hci_core.c                           |  22 +-
 net/bluetooth/mgmt.c                               |   2 +-
 net/bluetooth/sco.c                                |  11 +-
 net/core/devlink.c                                 |  36 ++-
 net/dsa/Kconfig                                    |  13 +-
 net/dsa/Makefile                                   |   3 +-
 net/dsa/dsa_priv.h                                 |   2 -
 net/dsa/port.c                                     |  21 --
 net/dsa/slave.c                                    |   6 -
 net/dsa/tag_8021q.c                                |   2 -
 net/ipv4/route.c                                   |  48 ++--
 net/ipv4/tcp_ipv4.c                                |   5 +-
 net/ipv6/route.c                                   |   5 +-
 net/mac80211/main.c                                |   2 +-
 net/mac80211/tx.c                                  |   4 +-
 net/netlabel/netlabel_cipso_v4.c                   |   8 +-
 net/qrtr/qrtr.c                                    |   8 +-
 net/sched/sch_cbq.c                                |   2 +-
 net/sched/sch_htb.c                                |  97 ++++---
 net/sunrpc/svc.c                                   |  15 ++
 samples/bpf/xdp_redirect_cpu_user.c                |   2 +-
 samples/pktgen/pktgen_sample04_many_flows.sh       |  12 +-
 samples/pktgen/pktgen_sample05_flow_per_thread.sh  |  12 +-
 security/integrity/ima/Kconfig                     |   1 -
 security/integrity/ima/ima_mok.c                   |   2 +-
 sound/soc/codecs/rt5682-i2c.c                      |  15 +-
 sound/soc/codecs/tlv320aic32x4.c                   |   2 +-
 sound/soc/codecs/wcd9335.c                         |  23 +-
 sound/soc/codecs/wm_adsp.c                         |   2 +
 sound/soc/fsl/fsl_rpmsg.c                          |  20 +-
 sound/soc/intel/boards/kbl_da7219_max98927.c       |  55 +---
 sound/soc/intel/common/soc-acpi-intel-cml-match.c  |   2 +-
 sound/soc/intel/common/soc-acpi-intel-kbl-match.c  |   2 +-
 sound/soc/intel/skylake/skl-topology.c             |  25 +-
 sound/soc/mediatek/mt8183/mt8183-afe-pcm.c         |  43 ++--
 sound/soc/mediatek/mt8192/mt8192-afe-pcm.c         |  27 +-
 sound/usb/card.c                                   |   4 +
 sound/usb/pcm.c                                    |   3 +-
 sound/usb/usbaudio.h                               |   1 +
 tools/bootconfig/main.c                            |   4 +-
 tools/bpf/bpftool/prog.c                           |   5 +-
 tools/include/uapi/linux/bpf.h                     |   2 +-
 tools/lib/bpf/Makefile                             |  10 +-
 tools/lib/bpf/libbpf.c                             |  20 +-
 tools/perf/util/bpf-event.c                        |   4 +-
 tools/perf/util/bpf_counter.c                      |   3 +-
 tools/testing/selftests/bpf/prog_tests/btf.c       |   1 +
 tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c  |   2 +-
 .../selftests/bpf/progs/test_core_autosize.c       |  20 +-
 tools/testing/selftests/bpf/test_maps.c            |   4 +-
 365 files changed, 3272 insertions(+), 1796 deletions(-)



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 001/334] locking/mutex: Fix HANDOFF condition
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
@ 2021-09-13 13:10 ` Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 002/334] regmap: fix the offset of register error log Greg Kroah-Hartman
                   ` (338 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yanfei Xu, Peter Zijlstra (Intel),
	Waiman Long, Sasha Levin

From: Peter Zijlstra <peterz@infradead.org>

[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]

Yanfei reported that setting HANDOFF should not depend on recomputing
@first, only on @first state. Which would then give:

  if (ww_ctx || !first)
    first = __mutex_waiter_is_first(lock, &waiter);
  if (first)
    __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);

But because 'ww_ctx || !first' is basically 'always' and the test for
first is relatively cheap, omit that first branch entirely.

Reported-by: Yanfei Xu <yanfei.xu@windriver.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Waiman Long <longman@redhat.com>
Reviewed-by: Yanfei Xu <yanfei.xu@windriver.com>
Link: https://lore.kernel.org/r/20210630154114.896786297@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/mutex.c | 15 +++++----------
 1 file changed, 5 insertions(+), 10 deletions(-)

diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c
index d2df5e68b503..fb30e1436dfb 100644
--- a/kernel/locking/mutex.c
+++ b/kernel/locking/mutex.c
@@ -928,7 +928,6 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
 		    struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx)
 {
 	struct mutex_waiter waiter;
-	bool first = false;
 	struct ww_mutex *ww;
 	int ret;
 
@@ -1007,6 +1006,8 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
 
 	set_current_state(state);
 	for (;;) {
+		bool first;
+
 		/*
 		 * Once we hold wait_lock, we're serialized against
 		 * mutex_unlock() handing the lock off to us, do a trylock
@@ -1035,15 +1036,9 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas
 		spin_unlock(&lock->wait_lock);
 		schedule_preempt_disabled();
 
-		/*
-		 * ww_mutex needs to always recheck its position since its waiter
-		 * list is not FIFO ordered.
-		 */
-		if (ww_ctx || !first) {
-			first = __mutex_waiter_is_first(lock, &waiter);
-			if (first)
-				__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
-		}
+		first = __mutex_waiter_is_first(lock, &waiter);
+		if (first)
+			__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);
 
 		set_current_state(state);
 		/*
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 002/334] regmap: fix the offset of register error log
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 001/334] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
@ 2021-09-13 13:10 ` Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 003/334] regulator: tps65910: Silence deferred probe error Greg Kroah-Hartman
                   ` (337 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeongtae Park, Mark Brown, Sasha Levin

From: Jeongtae Park <jeongtae.park@gmail.com>

[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ]

This patch fixes the offset of register error log
by using regmap_get_offset().

Signed-off-by: Jeongtae Park <jeongtae.park@gmail.com>
Link: https://lore.kernel.org/r/20210701142630.44936-1-jeongtae.park@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/regmap/regmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index fe3e38dd5324..2fc826e97591 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1667,7 +1667,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,
 			if (ret) {
 				dev_err(map->dev,
 					"Error in caching of register: %x ret: %d\n",
-					reg + i, ret);
+					reg + regmap_get_offset(map, i), ret);
 				return ret;
 			}
 		}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 003/334] regulator: tps65910: Silence deferred probe error
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 001/334] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 002/334] regmap: fix the offset of register error log Greg Kroah-Hartman
@ 2021-09-13 13:10 ` Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 004/334] crypto: mxs-dcp - Check for DMA mapping errors Greg Kroah-Hartman
                   ` (336 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Mark Brown,
	Sasha Levin, Matt Merhar

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit e301df76472cc929fa62d923bc3892931f7ad71d ]

The TPS65910 regulator now gets a deferred probe until supply regulator is
registered. Silence noisy error message about the deferred probe.

Reported-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Tested-by: Matt Merhar <mattmerhar@protonmail.com> # Ouya T30
Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Link: https://lore.kernel.org/r/20210705201211.16082-1-digetx@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/tps65910-regulator.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 1d5b0a1b86f7..06cbe60c990f 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -1211,12 +1211,10 @@ static int tps65910_probe(struct platform_device *pdev)
 
 		rdev = devm_regulator_register(&pdev->dev, &pmic->desc[i],
 					       &config);
-		if (IS_ERR(rdev)) {
-			dev_err(tps65910->dev,
-				"failed to register %s regulator\n",
-				pdev->name);
-			return PTR_ERR(rdev);
-		}
+		if (IS_ERR(rdev))
+			return dev_err_probe(tps65910->dev, PTR_ERR(rdev),
+					     "failed to register %s regulator\n",
+					     pdev->name);
 
 		/* Save regulator for cleanup */
 		pmic->rdev[i] = rdev;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 004/334] crypto: mxs-dcp - Check for DMA mapping errors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2021-09-13 13:10 ` [PATCH 5.14 003/334] regulator: tps65910: Silence deferred probe error Greg Kroah-Hartman
@ 2021-09-13 13:10 ` Greg Kroah-Hartman
  2021-09-13 13:10 ` [PATCH 5.14 005/334] sched/deadline: Fix reset_on_fork reporting of DL tasks Greg Kroah-Hartman
                   ` (335 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Anderson, Richard Weinberger,
	Herbert Xu, Sasha Levin

From: Sean Anderson <sean.anderson@seco.com>

[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ]

After calling dma_map_single(), we must also call dma_mapping_error().
This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG:

[  311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c
[  311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single]

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 10 deletions(-)

diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c
index d6a7784d2988..f397cc5bf102 100644
--- a/drivers/crypto/mxs-dcp.c
+++ b/drivers/crypto/mxs-dcp.c
@@ -170,15 +170,19 @@ static struct dcp *global_sdcp;
 
 static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
 {
+	int dma_err;
 	struct dcp *sdcp = global_sdcp;
 	const int chan = actx->chan;
 	uint32_t stat;
 	unsigned long ret;
 	struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
-
 	dma_addr_t desc_phys = dma_map_single(sdcp->dev, desc, sizeof(*desc),
 					      DMA_TO_DEVICE);
 
+	dma_err = dma_mapping_error(sdcp->dev, desc_phys);
+	if (dma_err)
+		return dma_err;
+
 	reinit_completion(&sdcp->completion[chan]);
 
 	/* Clear status register. */
@@ -216,18 +220,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)
 static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
 			   struct skcipher_request *req, int init)
 {
+	dma_addr_t key_phys, src_phys, dst_phys;
 	struct dcp *sdcp = global_sdcp;
 	struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];
 	struct dcp_aes_req_ctx *rctx = skcipher_request_ctx(req);
 	int ret;
 
-	dma_addr_t key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
-					     2 * AES_KEYSIZE_128,
-					     DMA_TO_DEVICE);
-	dma_addr_t src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
-					     DCP_BUF_SZ, DMA_TO_DEVICE);
-	dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
-					     DCP_BUF_SZ, DMA_FROM_DEVICE);
+	key_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_key,
+				  2 * AES_KEYSIZE_128, DMA_TO_DEVICE);
+	ret = dma_mapping_error(sdcp->dev, key_phys);
+	if (ret)
+		return ret;
+
+	src_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_in_buf,
+				  DCP_BUF_SZ, DMA_TO_DEVICE);
+	ret = dma_mapping_error(sdcp->dev, src_phys);
+	if (ret)
+		goto err_src;
+
+	dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf,
+				  DCP_BUF_SZ, DMA_FROM_DEVICE);
+	ret = dma_mapping_error(sdcp->dev, dst_phys);
+	if (ret)
+		goto err_dst;
 
 	if (actx->fill % AES_BLOCK_SIZE) {
 		dev_err(sdcp->dev, "Invalid block size!\n");
@@ -265,10 +280,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx,
 	ret = mxs_dcp_start_dma(actx);
 
 aes_done_run:
+	dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
+err_dst:
+	dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
+err_src:
 	dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128,
 			 DMA_TO_DEVICE);
-	dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE);
-	dma_unmap_single(sdcp->dev, dst_phys, DCP_BUF_SZ, DMA_FROM_DEVICE);
 
 	return ret;
 }
@@ -557,6 +574,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
 	dma_addr_t buf_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_in_buf,
 					     DCP_BUF_SZ, DMA_TO_DEVICE);
 
+	ret = dma_mapping_error(sdcp->dev, buf_phys);
+	if (ret)
+		return ret;
+
 	/* Fill in the DMA descriptor. */
 	desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE |
 		    MXS_DCP_CONTROL0_INTERRUPT |
@@ -589,6 +610,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)
 	if (rctx->fini) {
 		digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf,
 					     DCP_SHA_PAY_SZ, DMA_FROM_DEVICE);
+		ret = dma_mapping_error(sdcp->dev, digest_phys);
+		if (ret)
+			goto done_run;
+
 		desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM;
 		desc->payload = digest_phys;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 005/334] sched/deadline: Fix reset_on_fork reporting of DL tasks
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2021-09-13 13:10 ` [PATCH 5.14 004/334] crypto: mxs-dcp - Check for DMA mapping errors Greg Kroah-Hartman
@ 2021-09-13 13:10 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 006/334] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Greg Kroah-Hartman
                   ` (334 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:10 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Perret,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Quentin Perret <qperret@google.com>

[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ]

It is possible for sched_getattr() to incorrectly report the state of
the reset_on_fork flag when called on a deadline task.

Indeed, if the flag was set on a deadline task using sched_setattr()
with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then
p->sched_reset_on_fork will be set, but __setscheduler() will bail out
early, which means that the dl_se->flags will not get updated by
__setscheduler_params()->__setparam_dl(). Consequently, if
sched_getattr() is then called on the task, __getparam_dl() will
override kattr.sched_flags with the now out-of-date copy in dl_se->flags
and report the stale value to userspace.

To fix this, make sure to only copy the flags that are relevant to
sched_deadline to and from the dl_se->flags field.

Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20210727101103.2729607-2-qperret@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/deadline.c | 7 ++++---
 kernel/sched/sched.h    | 2 ++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index aaacd6cfd42f..5cafc642e647 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2741,7 +2741,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr)
 	dl_se->dl_runtime = attr->sched_runtime;
 	dl_se->dl_deadline = attr->sched_deadline;
 	dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
-	dl_se->flags = attr->sched_flags;
+	dl_se->flags = attr->sched_flags & SCHED_DL_FLAGS;
 	dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
 	dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime);
 }
@@ -2754,7 +2754,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr)
 	attr->sched_runtime = dl_se->dl_runtime;
 	attr->sched_deadline = dl_se->dl_deadline;
 	attr->sched_period = dl_se->dl_period;
-	attr->sched_flags = dl_se->flags;
+	attr->sched_flags &= ~SCHED_DL_FLAGS;
+	attr->sched_flags |= dl_se->flags;
 }
 
 /*
@@ -2851,7 +2852,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)
 	if (dl_se->dl_runtime != attr->sched_runtime ||
 	    dl_se->dl_deadline != attr->sched_deadline ||
 	    dl_se->dl_period != attr->sched_period ||
-	    dl_se->flags != attr->sched_flags)
+	    dl_se->flags != (attr->sched_flags & SCHED_DL_FLAGS))
 		return true;
 
 	return false;
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index ddefb0419d7a..d53d19770866 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -227,6 +227,8 @@ static inline void update_avg(u64 *avg, u64 sample)
  */
 #define SCHED_FLAG_SUGOV	0x10000000
 
+#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV)
+
 static inline bool dl_entity_is_special(struct sched_dl_entity *dl_se)
 {
 #ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 006/334] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2021-09-13 13:10 ` [PATCH 5.14 005/334] sched/deadline: Fix reset_on_fork reporting of DL tasks Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 007/334] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Greg Kroah-Hartman
                   ` (333 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Sebastian Reichel,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ]

When fuel_gauge_reg_readb()/_writeb() fails, report which register we
were trying to read / write when the error happened.

Also reword the message a bit:
- Drop the axp288 prefix, dev_err() already prints this
- Switch from telegram / abbreviated style to a normal sentence, aligning
  the message with those from fuel_gauge_read_*bit_word()

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/axp288_fuel_gauge.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c
index 2ba2d8d6b8e6..d1bcc52e67c3 100644
--- a/drivers/power/supply/axp288_fuel_gauge.c
+++ b/drivers/power/supply/axp288_fuel_gauge.c
@@ -147,7 +147,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg)
 	}
 
 	if (ret < 0) {
-		dev_err(&info->pdev->dev, "axp288 reg read err:%d\n", ret);
+		dev_err(&info->pdev->dev, "Error reading reg 0x%02x err: %d\n", reg, ret);
 		return ret;
 	}
 
@@ -161,7 +161,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val)
 	ret = regmap_write(info->regmap, reg, (unsigned int)val);
 
 	if (ret < 0)
-		dev_err(&info->pdev->dev, "axp288 reg write err:%d\n", ret);
+		dev_err(&info->pdev->dev, "Error writing reg 0x%02x err: %d\n", reg, ret);
 
 	return ret;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 007/334] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 006/334] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 008/334] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Greg Kroah-Hartman
                   ` (332 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lokesh Vutla, Tero Kristo,
	Tony Lindgren, Herbert Xu, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ]

We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is
done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the
end of omap_sham_update_dma_stop().

The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not
need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be
applied as clean-up.

Cc: Lokesh Vutla <lokeshvutla@ti.com>
Cc: Tero Kristo <kristo@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-sham.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index dd53ad9987b0..a47ac60a4ee1 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -1736,7 +1736,7 @@ static void omap_sham_done_task(unsigned long data)
 		if (test_and_clear_bit(FLAGS_OUTPUT_READY, &dd->flags))
 			goto finish;
 	} else if (test_bit(FLAGS_DMA_READY, &dd->flags)) {
-		if (test_and_clear_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
+		if (test_bit(FLAGS_DMA_ACTIVE, &dd->flags)) {
 			omap_sham_update_dma_stop(dd);
 			if (dd->err) {
 				err = dd->err;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 008/334] sched/deadline: Fix missing clock update in migrate_task_rq_dl()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 007/334] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 009/334] rcu/tree: Handle VM stoppage in stall detection Greg Kroah-Hartman
                   ` (331 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bruno Goncalves, Dietmar Eggemann,
	Peter Zijlstra (Intel),
	Daniel Bristot de Oliveira, Juri Lelli, Sasha Levin

From: Dietmar Eggemann <dietmar.eggemann@arm.com>

[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ]

A missing clock update is causing the following warning:

rq->clock_update_flags < RQCF_ACT_SKIP
WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453
sub_running_bw.isra.0+0x190/0x1a0
...
CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1
Hardware name: WIWYNN Mt.Jade Server System
B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP:
1.06.20210526) 2021/05/26
...
Call trace:
  sub_running_bw.isra.0+0x190/0x1a0
  migrate_task_rq_dl+0xf8/0x1e0
  set_task_cpu+0xa8/0x1f0
  try_to_wake_up+0x150/0x3d4
  wake_up_q+0x64/0xc0
  __up_write+0xd0/0x1c0
  up_write+0x4c/0x2b0
  cppc_set_perf+0x120/0x2d0
  cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq]
  __cpufreq_driver_target+0x74/0x140
  sugov_work+0x64/0x80
  kthread_worker_fn+0xe0/0x230
  kthread+0x138/0x140
  ret_from_fork+0x10/0x18

The task causing this is the `cppc_fie` DL task introduced by
commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency
invariance").

With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on
slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm
Server):

DL task `curr=sugov:112` lets `p=cppc_fie` migrate and since the latter
is in `non_contending` state, migrate_task_rq_dl() calls

  sub_running_bw()->__sub_running_bw()->cpufreq_update_util()->
  rq_clock()->assert_clock_updated()

on p.

Fix this by updating the clock for a non_contending task in
migrate_task_rq_dl() before calling sub_running_bw().

Reported-by: Bruno Goncalves <bgoncalv@redhat.com>
Signed-off-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Acked-by: Juri Lelli <juri.lelli@redhat.com>
Link: https://lore.kernel.org/r/20210804135925.3734605-1-dietmar.eggemann@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/deadline.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 5cafc642e647..e94314633b39 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1733,6 +1733,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused
 	 */
 	raw_spin_rq_lock(rq);
 	if (p->dl.dl_non_contending) {
+		update_rq_clock(rq);
 		sub_running_bw(&p->dl, &rq->dl);
 		p->dl.dl_non_contending = 0;
 		/*
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 009/334] rcu/tree: Handle VM stoppage in stall detection
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 008/334] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 010/334] EDAC/mce_amd: Do not load edac_mce_amd module on guests Greg Kroah-Hartman
                   ` (330 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Senozhatsky,
	Signed-off-by: Paul E. McKenney, Sasha Levin

From: Sergey Senozhatsky <senozhatsky@chromium.org>

[ Upstream commit ccfc9dd6914feaa9a81f10f9cce56eb0f7712264 ]

The soft watchdog timer function checks if a virtual machine
was suspended and hence what looks like a lockup in fact
is a false positive.

This is what kvm_check_and_clear_guest_paused() does: it
tests guest PVCLOCK_GUEST_STOPPED (which is set by the host)
and if it's set then we need to touch all watchdogs and bail
out.

Watchdog timer function runs from IRQ, so PVCLOCK_GUEST_STOPPED
check works fine.

There is, however, one more watchdog that runs from IRQ, so
watchdog timer fn races with it, and that watchdog is not aware
of PVCLOCK_GUEST_STOPPED - RCU stall detector.

apic_timer_interrupt()
 smp_apic_timer_interrupt()
  hrtimer_interrupt()
   __hrtimer_run_queues()
    tick_sched_timer()
     tick_sched_handle()
      update_process_times()
       rcu_sched_clock_irq()

This triggers RCU stalls on our devices during VM resume.

If tick_sched_handle()->rcu_sched_clock_irq() runs on a VCPU
before watchdog_timer_fn()->kvm_check_and_clear_guest_paused()
then there is nothing on this VCPU that touches watchdogs and
RCU reads stale gp stall timestamp and new jiffies value, which
makes it think that RCU has stalled.

Make RCU stall watchdog aware of PVCLOCK_GUEST_STOPPED and
don't report RCU stalls when we resume the VM.

Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Signed-off-by: Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree_stall.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
index 6c76988cc019..3d11155e0033 100644
--- a/kernel/rcu/tree_stall.h
+++ b/kernel/rcu/tree_stall.h
@@ -7,6 +7,8 @@
  * Author: Paul E. McKenney <paulmck@linux.ibm.com>
  */
 
+#include <linux/kvm_para.h>
+
 //////////////////////////////////////////////////////////////////////////////
 //
 // Controlling CPU stall warnings, including delay calculation.
@@ -696,6 +698,14 @@ static void check_cpu_stall(struct rcu_data *rdp)
 	    (READ_ONCE(rnp->qsmask) & rdp->grpmask) &&
 	    cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) {
 
+		/*
+		 * If a virtual machine is stopped by the host it can look to
+		 * the watchdog like an RCU stall. Check to see if the host
+		 * stopped the vm.
+		 */
+		if (kvm_check_and_clear_guest_paused())
+			return;
+
 		/* We haven't checked in, so go dump stack. */
 		print_cpu_stall(gps);
 		if (READ_ONCE(rcu_cpu_stall_ftrace_dump))
@@ -705,6 +715,14 @@ static void check_cpu_stall(struct rcu_data *rdp)
 		   ULONG_CMP_GE(j, js + RCU_STALL_RAT_DELAY) &&
 		   cmpxchg(&rcu_state.jiffies_stall, js, jn) == js) {
 
+		/*
+		 * If a virtual machine is stopped by the host it can look to
+		 * the watchdog like an RCU stall. Check to see if the host
+		 * stopped the vm.
+		 */
+		if (kvm_check_and_clear_guest_paused())
+			return;
+
 		/* They had a few time units to dump stack, so complain. */
 		print_other_cpu_stall(gs2, gps);
 		if (READ_ONCE(rcu_cpu_stall_ftrace_dump))
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 010/334] EDAC/mce_amd: Do not load edac_mce_amd module on guests
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 009/334] rcu/tree: Handle VM stoppage in stall detection Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 011/334] posix-cpu-timers: Force next expiration recalc after itimer reset Greg Kroah-Hartman
                   ` (329 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Borislav Petkov, Smita Koralahalli,
	Yazen Ghannam, Kim Phillips, Sasha Levin

From: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>

[ Upstream commit 767f4b620edadac579c9b8b6660761d4285fa6f9 ]

Hypervisors likely do not expose the SMCA feature to the guest and
loading this module leads to false warnings. This module should not be
loaded in guests to begin with, but people tend to do so, especially
when testing kernels in VMs. And then they complain about those false
warnings.

Do the practical thing and do not load this module when running as a
guest to avoid all that complaining.

 [ bp: Rewrite commit message. ]

Suggested-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Smita Koralahalli <Smita.KoralahalliChannabasappa@amd.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com>
Tested-by: Kim Phillips <kim.phillips@amd.com>
Link: https://lkml.kernel.org/r/20210628172740.245689-1-Smita.KoralahalliChannabasappa@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/mce_amd.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
index 27d56920b469..67dbf4c31271 100644
--- a/drivers/edac/mce_amd.c
+++ b/drivers/edac/mce_amd.c
@@ -1246,6 +1246,9 @@ static int __init mce_amd_init(void)
 	    c->x86_vendor != X86_VENDOR_HYGON)
 		return -ENODEV;
 
+	if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR))
+		return -ENODEV;
+
 	if (boot_cpu_has(X86_FEATURE_SMCA)) {
 		xec_mask = 0x3f;
 		goto out;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 011/334] posix-cpu-timers: Force next expiration recalc after itimer reset
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 010/334] EDAC/mce_amd: Do not load edac_mce_amd module on guests Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 012/334] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Greg Kroah-Hartman
                   ` (328 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Frederic Weisbecker, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Frederic Weisbecker <frederic@kernel.org>

[ Upstream commit 406dd42bd1ba0c01babf9cde169bb319e52f6147 ]

When an itimer deactivates a previously armed expiration, it simply doesn't
do anything. As a result the process wide cputime counter keeps running and
the tick dependency stays set until it reaches the old ghost expiration
value.

This can be reproduced with the following snippet:

	void trigger_process_counter(void)
	{
		struct itimerval n = {};

		n.it_value.tv_sec = 100;
		setitimer(ITIMER_VIRTUAL, &n, NULL);
		n.it_value.tv_sec = 0;
		setitimer(ITIMER_VIRTUAL, &n, NULL);
	}

Fix this with resetting the relevant base expiration. This is similar to
disarming a timer.

Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20210726125513.271824-4-frederic@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/posix-cpu-timers.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 517be7fd175e..a002685f688d 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -1346,8 +1346,6 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clkid,
 			}
 		}
 
-		if (!*newval)
-			return;
 		*newval += now;
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 012/334] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 011/334] posix-cpu-timers: Force next expiration recalc after itimer reset Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 013/334] hrtimer: Ensure timerfd notification for HIGHRES=n Greg Kroah-Hartman
                   ` (327 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lorenzo Colitti, Thomas Gleixner,
	Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ]

If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then
the timer has to be canceled first and then added back. If the timer is the
first expiring timer then on removal the clockevent device is reprogrammed
to the next expiring timer to avoid that the pending expiry fires needlessly.

If the new expiry time ends up to be the first expiry again then the clock
event device has to reprogrammed again.

Avoid this by checking whether the timer is the first to expire and in that
case, keep the timer on the current CPU and delay the reprogramming up to
the point where the timer has been enqueued again.

Reported-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210713135157.873137732@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 53 insertions(+), 7 deletions(-)

diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index 4a66725b1d4a..ba2e0d0a0e5a 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -1030,12 +1030,13 @@ static void __remove_hrtimer(struct hrtimer *timer,
  * remove hrtimer, called with base lock held
  */
 static inline int
-remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restart)
+remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base,
+	       bool restart, bool keep_local)
 {
 	u8 state = timer->state;
 
 	if (state & HRTIMER_STATE_ENQUEUED) {
-		int reprogram;
+		bool reprogram;
 
 		/*
 		 * Remove the timer and force reprogramming when high
@@ -1048,8 +1049,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool rest
 		debug_deactivate(timer);
 		reprogram = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
 
+		/*
+		 * If the timer is not restarted then reprogramming is
+		 * required if the timer is local. If it is local and about
+		 * to be restarted, avoid programming it twice (on removal
+		 * and a moment later when it's requeued).
+		 */
 		if (!restart)
 			state = HRTIMER_STATE_INACTIVE;
+		else
+			reprogram &= !keep_local;
 
 		__remove_hrtimer(timer, base, state, reprogram);
 		return 1;
@@ -1103,9 +1112,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
 				    struct hrtimer_clock_base *base)
 {
 	struct hrtimer_clock_base *new_base;
+	bool force_local, first;
 
-	/* Remove an active timer from the queue: */
-	remove_hrtimer(timer, base, true);
+	/*
+	 * If the timer is on the local cpu base and is the first expiring
+	 * timer then this might end up reprogramming the hardware twice
+	 * (on removal and on enqueue). To avoid that by prevent the
+	 * reprogram on removal, keep the timer local to the current CPU
+	 * and enforce reprogramming after it is queued no matter whether
+	 * it is the new first expiring timer again or not.
+	 */
+	force_local = base->cpu_base == this_cpu_ptr(&hrtimer_bases);
+	force_local &= base->cpu_base->next_timer == timer;
+
+	/*
+	 * Remove an active timer from the queue. In case it is not queued
+	 * on the current CPU, make sure that remove_hrtimer() updates the
+	 * remote data correctly.
+	 *
+	 * If it's on the current CPU and the first expiring timer, then
+	 * skip reprogramming, keep the timer local and enforce
+	 * reprogramming later if it was the first expiring timer.  This
+	 * avoids programming the underlying clock event twice (once at
+	 * removal and once after enqueue).
+	 */
+	remove_hrtimer(timer, base, true, force_local);
 
 	if (mode & HRTIMER_MODE_REL)
 		tim = ktime_add_safe(tim, base->get_time());
@@ -1115,9 +1146,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
 	hrtimer_set_expires_range_ns(timer, tim, delta_ns);
 
 	/* Switch the timer base, if necessary: */
-	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+	if (!force_local) {
+		new_base = switch_hrtimer_base(timer, base,
+					       mode & HRTIMER_MODE_PINNED);
+	} else {
+		new_base = base;
+	}
+
+	first = enqueue_hrtimer(timer, new_base, mode);
+	if (!force_local)
+		return first;
 
-	return enqueue_hrtimer(timer, new_base, mode);
+	/*
+	 * Timer was forced to stay on the current CPU to avoid
+	 * reprogramming on removal and enqueue. Force reprogram the
+	 * hardware by evaluating the new first expiring timer.
+	 */
+	hrtimer_force_reprogram(new_base->cpu_base, 1);
+	return 0;
 }
 
 /**
@@ -1183,7 +1229,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer)
 	base = lock_hrtimer_base(timer, &flags);
 
 	if (!hrtimer_callback_running(timer))
-		ret = remove_hrtimer(timer, base, false);
+		ret = remove_hrtimer(timer, base, false, false);
 
 	unlock_hrtimer_base(timer, &flags);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 013/334] hrtimer: Ensure timerfd notification for HIGHRES=n
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 012/334] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 014/334] udf: Check LVID earlier Greg Kroah-Hartman
                   ` (326 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit 8c3b5e6ec0fee18bc2ce38d1dfe913413205f908 ]

If high resolution timers are disabled the timerfd notification about a
clock was set event is not happening for all cases which use
clock_was_set_delayed() because that's a NOP for HIGHRES=n, which is wrong.

Make clock_was_set_delayed() unconditially available to fix that.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210713135158.196661266@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/hrtimer.h     |  5 -----
 kernel/time/hrtimer.c       | 32 ++++++++++++++++----------------
 kernel/time/tick-internal.h |  3 +++
 3 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index bb5e7b0a4274..77295af72426 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -318,16 +318,12 @@ struct clock_event_device;
 
 extern void hrtimer_interrupt(struct clock_event_device *dev);
 
-extern void clock_was_set_delayed(void);
-
 extern unsigned int hrtimer_resolution;
 
 #else
 
 #define hrtimer_resolution	(unsigned int)LOW_RES_NSEC
 
-static inline void clock_was_set_delayed(void) { }
-
 #endif
 
 static inline ktime_t
@@ -351,7 +347,6 @@ hrtimer_expires_remaining_adjusted(const struct hrtimer *timer)
 						    timer->base->get_time());
 }
 
-extern void clock_was_set(void);
 #ifdef CONFIG_TIMERFD
 extern void timerfd_clock_was_set(void);
 #else
diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c
index ba2e0d0a0e5a..5af758473488 100644
--- a/kernel/time/hrtimer.c
+++ b/kernel/time/hrtimer.c
@@ -758,22 +758,6 @@ static void hrtimer_switch_to_hres(void)
 	retrigger_next_event(NULL);
 }
 
-static void clock_was_set_work(struct work_struct *work)
-{
-	clock_was_set();
-}
-
-static DECLARE_WORK(hrtimer_work, clock_was_set_work);
-
-/*
- * Called from timekeeping and resume code to reprogram the hrtimer
- * interrupt device on all cpus.
- */
-void clock_was_set_delayed(void)
-{
-	schedule_work(&hrtimer_work);
-}
-
 #else
 
 static inline int hrtimer_is_hres_enabled(void) { return 0; }
@@ -891,6 +875,22 @@ void clock_was_set(void)
 	timerfd_clock_was_set();
 }
 
+static void clock_was_set_work(struct work_struct *work)
+{
+	clock_was_set();
+}
+
+static DECLARE_WORK(hrtimer_work, clock_was_set_work);
+
+/*
+ * Called from timekeeping and resume code to reprogram the hrtimer
+ * interrupt device on all cpus and to notify timerfd.
+ */
+void clock_was_set_delayed(void)
+{
+	schedule_work(&hrtimer_work);
+}
+
 /*
  * During resume we might have to reprogram the high resolution timer
  * interrupt on all online CPUs.  However, all other CPUs will be
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 6a742a29e545..cd610faa2523 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -165,3 +165,6 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases);
 
 extern u64 get_next_timer_interrupt(unsigned long basej, u64 basem);
 void timer_clear_idle(void);
+
+void clock_was_set(void);
+void clock_was_set_delayed(void);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 014/334] udf: Check LVID earlier
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 013/334] hrtimer: Ensure timerfd notification for HIGHRES=n Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 015/334] udf: Fix iocharset=utf8 mount option Greg Kroah-Hartman
                   ` (325 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+7fbfe5fed73ebb675748,
	Jan Kara, Sasha Levin

From: Jan Kara <jack@suse.cz>

[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]

We were checking validity of LVID entries only when getting
implementation use information from LVID in udf_sb_lvidiu(). However if
the LVID is suitably corrupted, it can cause problems also to code such
as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity
of LVID already when loading it from the disk and just disable LVID
altogether when it is not valid.

Reported-by: syzbot+7fbfe5fed73ebb675748@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/super.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 2f83c1204e20..1eeb75a1efd2 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -108,16 +108,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)
 		return NULL;
 	lvid = (struct logicalVolIntegrityDesc *)UDF_SB(sb)->s_lvid_bh->b_data;
 	partnum = le32_to_cpu(lvid->numOfPartitions);
-	if ((sb->s_blocksize - sizeof(struct logicalVolIntegrityDescImpUse) -
-	     offsetof(struct logicalVolIntegrityDesc, impUse)) /
-	     (2 * sizeof(uint32_t)) < partnum) {
-		udf_err(sb, "Logical volume integrity descriptor corrupted "
-			"(numOfPartitions = %u)!\n", partnum);
-		return NULL;
-	}
 	/* The offset is to skip freeSpaceTable and sizeTable arrays */
 	offset = partnum * 2 * sizeof(uint32_t);
-	return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]);
+	return (struct logicalVolIntegrityDescImpUse *)
+					(((uint8_t *)(lvid + 1)) + offset);
 }
 
 /* UDF filesystem type */
@@ -1542,6 +1536,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
 	struct udf_sb_info *sbi = UDF_SB(sb);
 	struct logicalVolIntegrityDesc *lvid;
 	int indirections = 0;
+	u32 parts, impuselen;
 
 	while (++indirections <= UDF_MAX_LVID_NESTING) {
 		final_bh = NULL;
@@ -1568,15 +1563,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_
 
 		lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;
 		if (lvid->nextIntegrityExt.extLength == 0)
-			return;
+			goto check;
 
 		loc = leea_to_cpu(lvid->nextIntegrityExt);
 	}
 
 	udf_warn(sb, "Too many LVID indirections (max %u), ignoring.\n",
 		UDF_MAX_LVID_NESTING);
+out_err:
 	brelse(sbi->s_lvid_bh);
 	sbi->s_lvid_bh = NULL;
+	return;
+check:
+	parts = le32_to_cpu(lvid->numOfPartitions);
+	impuselen = le32_to_cpu(lvid->lengthOfImpUse);
+	if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize ||
+	    sizeof(struct logicalVolIntegrityDesc) + impuselen +
+	    2 * parts * sizeof(u32) > sb->s_blocksize) {
+		udf_warn(sb, "Corrupted LVID (parts=%u, impuselen=%u), "
+			 "ignoring.\n", parts, impuselen);
+		goto out_err;
+	}
 }
 
 /*
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 015/334] udf: Fix iocharset=utf8 mount option
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 014/334] udf: Check LVID earlier Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 016/334] isofs: joliet: " Greg Kroah-Hartman
                   ` (324 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Jan Kara, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit b645333443712d2613e4e863f81090d5dc509657 ]

Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset,
it is required to use utf8 mount option.

Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount
option.

If UTF-8 as iocharset is used then s_nls_map is set to NULL. So simplify
code around, remove UDF_FLAG_NLS_MAP and UDF_FLAG_UTF8 flags as to
distinguish between UTF-8 and non-UTF-8 it is needed just to check if
s_nls_map set to NULL or not.

Link: https://lore.kernel.org/r/20210808162453.1653-4-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/super.c   | 50 ++++++++++++++++++------------------------------
 fs/udf/udf_sb.h  |  2 --
 fs/udf/unicode.c |  4 ++--
 3 files changed, 21 insertions(+), 35 deletions(-)

diff --git a/fs/udf/super.c b/fs/udf/super.c
index 1eeb75a1efd2..b2d7c57d0688 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -343,10 +343,10 @@ static int udf_show_options(struct seq_file *seq, struct dentry *root)
 		seq_printf(seq, ",lastblock=%u", sbi->s_last_block);
 	if (sbi->s_anchor != 0)
 		seq_printf(seq, ",anchor=%u", sbi->s_anchor);
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8))
-		seq_puts(seq, ",utf8");
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP) && sbi->s_nls_map)
+	if (sbi->s_nls_map)
 		seq_printf(seq, ",iocharset=%s", sbi->s_nls_map->charset);
+	else
+		seq_puts(seq, ",iocharset=utf8");
 
 	return 0;
 }
@@ -552,19 +552,24 @@ static int udf_parse_options(char *options, struct udf_options *uopt,
 			/* Ignored (never implemented properly) */
 			break;
 		case Opt_utf8:
-			uopt->flags |= (1 << UDF_FLAG_UTF8);
+			if (!remount) {
+				unload_nls(uopt->nls_map);
+				uopt->nls_map = NULL;
+			}
 			break;
 		case Opt_iocharset:
 			if (!remount) {
-				if (uopt->nls_map)
-					unload_nls(uopt->nls_map);
-				/*
-				 * load_nls() failure is handled later in
-				 * udf_fill_super() after all options are
-				 * parsed.
-				 */
+				unload_nls(uopt->nls_map);
+				uopt->nls_map = NULL;
+			}
+			/* When nls_map is not loaded then UTF-8 is used */
+			if (!remount && strcmp(args[0].from, "utf8") != 0) {
 				uopt->nls_map = load_nls(args[0].from);
-				uopt->flags |= (1 << UDF_FLAG_NLS_MAP);
+				if (!uopt->nls_map) {
+					pr_err("iocharset %s not found\n",
+						args[0].from);
+					return 0;
+				}
 			}
 			break;
 		case Opt_uforget:
@@ -2146,21 +2151,6 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
 	if (!udf_parse_options((char *)options, &uopt, false))
 		goto parse_options_failure;
 
-	if (uopt.flags & (1 << UDF_FLAG_UTF8) &&
-	    uopt.flags & (1 << UDF_FLAG_NLS_MAP)) {
-		udf_err(sb, "utf8 cannot be combined with iocharset\n");
-		goto parse_options_failure;
-	}
-	if ((uopt.flags & (1 << UDF_FLAG_NLS_MAP)) && !uopt.nls_map) {
-		uopt.nls_map = load_nls_default();
-		if (!uopt.nls_map)
-			uopt.flags &= ~(1 << UDF_FLAG_NLS_MAP);
-		else
-			udf_debug("Using default NLS map\n");
-	}
-	if (!(uopt.flags & (1 << UDF_FLAG_NLS_MAP)))
-		uopt.flags |= (1 << UDF_FLAG_UTF8);
-
 	fileset.logicalBlockNum = 0xFFFFFFFF;
 	fileset.partitionReferenceNum = 0xFFFF;
 
@@ -2315,8 +2305,7 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent)
 error_out:
 	iput(sbi->s_vat_inode);
 parse_options_failure:
-	if (uopt.nls_map)
-		unload_nls(uopt.nls_map);
+	unload_nls(uopt.nls_map);
 	if (lvid_open)
 		udf_close_lvid(sb);
 	brelse(sbi->s_lvid_bh);
@@ -2366,8 +2355,7 @@ static void udf_put_super(struct super_block *sb)
 	sbi = UDF_SB(sb);
 
 	iput(sbi->s_vat_inode);
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
-		unload_nls(sbi->s_nls_map);
+	unload_nls(sbi->s_nls_map);
 	if (!sb_rdonly(sb))
 		udf_close_lvid(sb);
 	brelse(sbi->s_lvid_bh);
diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
index 758efe557a19..4fa620543d30 100644
--- a/fs/udf/udf_sb.h
+++ b/fs/udf/udf_sb.h
@@ -20,8 +20,6 @@
 #define UDF_FLAG_UNDELETE		6
 #define UDF_FLAG_UNHIDE			7
 #define UDF_FLAG_VARCONV		8
-#define UDF_FLAG_NLS_MAP		9
-#define UDF_FLAG_UTF8			10
 #define UDF_FLAG_UID_FORGET     11    /* save -1 for uid to disk */
 #define UDF_FLAG_GID_FORGET     12
 #define UDF_FLAG_UID_SET	13
diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
index 5fcfa96463eb..622569007b53 100644
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -177,7 +177,7 @@ static int udf_name_from_CS0(struct super_block *sb,
 		return 0;
 	}
 
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
+	if (UDF_SB(sb)->s_nls_map)
 		conv_f = UDF_SB(sb)->s_nls_map->uni2char;
 	else
 		conv_f = NULL;
@@ -285,7 +285,7 @@ static int udf_name_to_CS0(struct super_block *sb,
 	if (ocu_max_len <= 0)
 		return 0;
 
-	if (UDF_QUERY_FLAG(sb, UDF_FLAG_NLS_MAP))
+	if (UDF_SB(sb)->s_nls_map)
 		conv_f = UDF_SB(sb)->s_nls_map->char2uni;
 	else
 		conv_f = NULL;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 016/334] isofs: joliet: Fix iocharset=utf8 mount option
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 015/334] udf: Fix iocharset=utf8 mount option Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 017/334] bcache: add proper error unwinding in bcache_device_init Greg Kroah-Hartman
                   ` (323 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Jan Kara, Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ]

Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset,
it is required to use utf8 mount option.

Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount
option.

If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So
simplify code around, remove s_utf8 field as to distinguish between UTF-8
and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL
or not.

Link: https://lore.kernel.org/r/20210808162453.1653-5-pali@kernel.org
Signed-off-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/isofs/inode.c  | 27 +++++++++++++--------------
 fs/isofs/isofs.h  |  1 -
 fs/isofs/joliet.c |  4 +---
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 21edc423b79f..678e2c51b855 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -155,7 +155,6 @@ struct iso9660_options{
 	unsigned int overriderockperm:1;
 	unsigned int uid_set:1;
 	unsigned int gid_set:1;
-	unsigned int utf8:1;
 	unsigned char map;
 	unsigned char check;
 	unsigned int blocksize;
@@ -356,7 +355,6 @@ static int parse_options(char *options, struct iso9660_options *popt)
 	popt->gid = GLOBAL_ROOT_GID;
 	popt->uid = GLOBAL_ROOT_UID;
 	popt->iocharset = NULL;
-	popt->utf8 = 0;
 	popt->overriderockperm = 0;
 	popt->session=-1;
 	popt->sbsector=-1;
@@ -389,10 +387,13 @@ static int parse_options(char *options, struct iso9660_options *popt)
 		case Opt_cruft:
 			popt->cruft = 1;
 			break;
+#ifdef CONFIG_JOLIET
 		case Opt_utf8:
-			popt->utf8 = 1;
+			kfree(popt->iocharset);
+			popt->iocharset = kstrdup("utf8", GFP_KERNEL);
+			if (!popt->iocharset)
+				return 0;
 			break;
-#ifdef CONFIG_JOLIET
 		case Opt_iocharset:
 			kfree(popt->iocharset);
 			popt->iocharset = match_strdup(&args[0]);
@@ -495,7 +496,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
 	if (sbi->s_nocompress)		seq_puts(m, ",nocompress");
 	if (sbi->s_overriderockperm)	seq_puts(m, ",overriderockperm");
 	if (sbi->s_showassoc)		seq_puts(m, ",showassoc");
-	if (sbi->s_utf8)		seq_puts(m, ",utf8");
 
 	if (sbi->s_check)		seq_printf(m, ",check=%c", sbi->s_check);
 	if (sbi->s_mapping)		seq_printf(m, ",map=%c", sbi->s_mapping);
@@ -518,9 +518,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)
 		seq_printf(m, ",fmode=%o", sbi->s_fmode);
 
 #ifdef CONFIG_JOLIET
-	if (sbi->s_nls_iocharset &&
-	    strcmp(sbi->s_nls_iocharset->charset, CONFIG_NLS_DEFAULT) != 0)
+	if (sbi->s_nls_iocharset)
 		seq_printf(m, ",iocharset=%s", sbi->s_nls_iocharset->charset);
+	else
+		seq_puts(m, ",iocharset=utf8");
 #endif
 	return 0;
 }
@@ -863,14 +864,13 @@ root_found:
 	sbi->s_nls_iocharset = NULL;
 
 #ifdef CONFIG_JOLIET
-	if (joliet_level && opt.utf8 == 0) {
+	if (joliet_level) {
 		char *p = opt.iocharset ? opt.iocharset : CONFIG_NLS_DEFAULT;
-		sbi->s_nls_iocharset = load_nls(p);
-		if (! sbi->s_nls_iocharset) {
-			/* Fail only if explicit charset specified */
-			if (opt.iocharset)
+		if (strcmp(p, "utf8") != 0) {
+			sbi->s_nls_iocharset = opt.iocharset ?
+				load_nls(opt.iocharset) : load_nls_default();
+			if (!sbi->s_nls_iocharset)
 				goto out_freesbi;
-			sbi->s_nls_iocharset = load_nls_default();
 		}
 	}
 #endif
@@ -886,7 +886,6 @@ root_found:
 	sbi->s_gid = opt.gid;
 	sbi->s_uid_set = opt.uid_set;
 	sbi->s_gid_set = opt.gid_set;
-	sbi->s_utf8 = opt.utf8;
 	sbi->s_nocompress = opt.nocompress;
 	sbi->s_overriderockperm = opt.overriderockperm;
 	/*
diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
index 055ec6c586f7..dcdc191ed183 100644
--- a/fs/isofs/isofs.h
+++ b/fs/isofs/isofs.h
@@ -44,7 +44,6 @@ struct isofs_sb_info {
 	unsigned char s_session;
 	unsigned int  s_high_sierra:1;
 	unsigned int  s_rock:2;
-	unsigned int  s_utf8:1;
 	unsigned int  s_cruft:1; /* Broken disks with high byte of length
 				  * containing junk */
 	unsigned int  s_nocompress:1;
diff --git a/fs/isofs/joliet.c b/fs/isofs/joliet.c
index be8b6a9d0b92..c0f04a1e7f69 100644
--- a/fs/isofs/joliet.c
+++ b/fs/isofs/joliet.c
@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)
 int
 get_joliet_filename(struct iso_directory_record * de, unsigned char *outname, struct inode * inode)
 {
-	unsigned char utf8;
 	struct nls_table *nls;
 	unsigned char len = 0;
 
-	utf8 = ISOFS_SB(inode->i_sb)->s_utf8;
 	nls = ISOFS_SB(inode->i_sb)->s_nls_iocharset;
 
-	if (utf8) {
+	if (!nls) {
 		len = utf16s_to_utf8s((const wchar_t *) de->name,
 				de->name_len[0] >> 1, UTF16_BIG_ENDIAN,
 				outname, PAGE_SIZE);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 017/334] bcache: add proper error unwinding in bcache_device_init
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 016/334] isofs: joliet: " Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl() Greg Kroah-Hartman
                   ` (322 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Coly Li,
	Jens Axboe, Sasha Levin

From: Christoph Hellwig <hch@lst.de>

[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ]

Except for the IDA none of the allocations in bcache_device_init is
unwound on error, fix that.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Coly Li <colyli@suse.de>
Link: https://lore.kernel.org/r/20210809064028.1198327-7-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/md/bcache/super.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 185246a0d855..d0f08e946453 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -931,20 +931,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
 	n = BITS_TO_LONGS(d->nr_stripes) * sizeof(unsigned long);
 	d->full_dirty_stripes = kvzalloc(n, GFP_KERNEL);
 	if (!d->full_dirty_stripes)
-		return -ENOMEM;
+		goto out_free_stripe_sectors_dirty;
 
 	idx = ida_simple_get(&bcache_device_idx, 0,
 				BCACHE_DEVICE_IDX_MAX, GFP_KERNEL);
 	if (idx < 0)
-		return idx;
+		goto out_free_full_dirty_stripes;
 
 	if (bioset_init(&d->bio_split, 4, offsetof(struct bbio, bio),
 			BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER))
-		goto err;
+		goto out_ida_remove;
 
 	d->disk = blk_alloc_disk(NUMA_NO_NODE);
 	if (!d->disk)
-		goto err;
+		goto out_bioset_exit;
 
 	set_capacity(d->disk, sectors);
 	snprintf(d->disk->disk_name, DISK_NAME_LEN, "bcache%i", idx);
@@ -987,8 +987,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,
 
 	return 0;
 
-err:
+out_bioset_exit:
+	bioset_exit(&d->bio_split);
+out_ida_remove:
 	ida_simple_remove(&bcache_device_idx, idx);
+out_free_full_dirty_stripes:
+	kvfree(d->full_dirty_stripes);
+out_free_stripe_sectors_dirty:
+	kvfree(d->stripe_sectors_dirty);
 	return -ENOMEM;
 
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 017/334] bcache: add proper error unwinding in bcache_device_init Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 16:22   ` Naresh Kamboju
  2021-09-13 13:11 ` [PATCH 5.14 019/334] blk-throtl: optimize IOPS throttle for large IO scenarios Greg Kroah-Hartman
                   ` (321 subsequent siblings)
  339 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Baokun Li, Josef Bacik,
	Jens Axboe, Sasha Levin

From: Baokun Li <libaokun1@huawei.com>

[ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ]

If user specify a large enough value of NBD blocks option, it may trigger
signed integer overflow which may lead to nbd->config->bytesize becomes a
large or small value, zero in particular.

UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31
signed integer overflow:
1024 * 4611686155866341414 cannot be represented in type 'long long int'
[...]
Call trace:
[...]
 handle_overflow+0x188/0x1dc lib/ubsan.c:192
 __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213
 nbd_size_set drivers/block/nbd.c:325 [inline]
 __nbd_ioctl drivers/block/nbd.c:1342 [inline]
 nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395
 __blkdev_driver_ioctl block/ioctl.c:311 [inline]
[...]

Although it is not a big deal, still silence the UBSAN by limit
the input value.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Link: https://lore.kernel.org/r/20210804021212.990223-1-libaokun1@huawei.com
[axboe: dropped unlikely()]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/nbd.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 19f5d5a8b16a..acf3f85bf3c7 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 		       unsigned int cmd, unsigned long arg)
 {
 	struct nbd_config *config = nbd->config;
+	loff_t bytesize;
 
 	switch (cmd) {
 	case NBD_DISCONNECT:
@@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
 	case NBD_SET_SIZE:
 		return nbd_set_size(nbd, arg, config->blksize);
 	case NBD_SET_SIZE_BLOCKS:
-		return nbd_set_size(nbd, arg * config->blksize,
-				    config->blksize);
+		if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
+			return -EINVAL;
+		return nbd_set_size(nbd, bytesize, config->blksize);
 	case NBD_SET_TIMEOUT:
 		nbd_set_cmd_timeout(nbd, arg);
 		return 0;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 019/334] blk-throtl: optimize IOPS throttle for large IO scenarios
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 020/334] nvme-tcp: dont update queue count when failing to set io queues Greg Kroah-Hartman
                   ` (320 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunguang Xu, Tejun Heo, Jens Axboe,
	Sasha Levin

From: Chunguang Xu <brookxu@tencent.com>

[ Upstream commit 4f1e9630afe6332de7286820fedd019f19eac057 ]

After patch 54efd50 (block: make generic_make_request handle
arbitrarily sized bios), the IO through io-throttle may be larger,
and these IOs may be further split into more small IOs. However,
IOPS throttle does not seem to be aware of this change, which
makes the calculation of IOPS of large IOs incomplete, resulting
in disk-side IOPS that does not meet expectations. Maybe we should
fix this problem.

We can reproduce it by set max_sectors_kb of disk to 128, set
blkio.write_iops_throttle to 100, run a dd instance inside blkio
and use iostat to watch IOPS:

dd if=/dev/zero of=/dev/sdb bs=1M count=1000 oflag=direct

As a result, without this change the average IOPS is 1995, with
this change the IOPS is 98.

Signed-off-by: Chunguang Xu <brookxu@tencent.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/65869aaad05475797d63b4c3fed4f529febe3c26.1627876014.git.brookxu@tencent.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-merge.c    |  2 ++
 block/blk-throttle.c | 32 ++++++++++++++++++++++++++++++++
 block/blk.h          |  2 ++
 3 files changed, 36 insertions(+)

diff --git a/block/blk-merge.c b/block/blk-merge.c
index a11b3b53717e..22eeaad190d7 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -348,6 +348,8 @@ void __blk_queue_split(struct bio **bio, unsigned int *nr_segs)
 		trace_block_split(split, (*bio)->bi_iter.bi_sector);
 		submit_bio_noacct(*bio);
 		*bio = split;
+
+		blk_throtl_charge_bio_split(*bio);
 	}
 }
 
diff --git a/block/blk-throttle.c b/block/blk-throttle.c
index b1b22d863bdf..55c49015e533 100644
--- a/block/blk-throttle.c
+++ b/block/blk-throttle.c
@@ -178,6 +178,9 @@ struct throtl_grp {
 	unsigned int bad_bio_cnt; /* bios exceeding latency threshold */
 	unsigned long bio_cnt_reset_time;
 
+	atomic_t io_split_cnt[2];
+	atomic_t last_io_split_cnt[2];
+
 	struct blkg_rwstat stat_bytes;
 	struct blkg_rwstat stat_ios;
 };
@@ -777,6 +780,8 @@ static inline void throtl_start_new_slice_with_credit(struct throtl_grp *tg,
 	tg->bytes_disp[rw] = 0;
 	tg->io_disp[rw] = 0;
 
+	atomic_set(&tg->io_split_cnt[rw], 0);
+
 	/*
 	 * Previous slice has expired. We must have trimmed it after last
 	 * bio dispatch. That means since start of last slice, we never used
@@ -799,6 +804,9 @@ static inline void throtl_start_new_slice(struct throtl_grp *tg, bool rw)
 	tg->io_disp[rw] = 0;
 	tg->slice_start[rw] = jiffies;
 	tg->slice_end[rw] = jiffies + tg->td->throtl_slice;
+
+	atomic_set(&tg->io_split_cnt[rw], 0);
+
 	throtl_log(&tg->service_queue,
 		   "[%c] new slice start=%lu end=%lu jiffies=%lu",
 		   rw == READ ? 'R' : 'W', tg->slice_start[rw],
@@ -1031,6 +1039,9 @@ static bool tg_may_dispatch(struct throtl_grp *tg, struct bio *bio,
 				jiffies + tg->td->throtl_slice);
 	}
 
+	if (iops_limit != UINT_MAX)
+		tg->io_disp[rw] += atomic_xchg(&tg->io_split_cnt[rw], 0);
+
 	if (tg_with_in_bps_limit(tg, bio, bps_limit, &bps_wait) &&
 	    tg_with_in_iops_limit(tg, bio, iops_limit, &iops_wait)) {
 		if (wait)
@@ -2052,12 +2063,14 @@ static void throtl_downgrade_check(struct throtl_grp *tg)
 	}
 
 	if (tg->iops[READ][LIMIT_LOW]) {
+		tg->last_io_disp[READ] += atomic_xchg(&tg->last_io_split_cnt[READ], 0);
 		iops = tg->last_io_disp[READ] * HZ / elapsed_time;
 		if (iops >= tg->iops[READ][LIMIT_LOW])
 			tg->last_low_overflow_time[READ] = now;
 	}
 
 	if (tg->iops[WRITE][LIMIT_LOW]) {
+		tg->last_io_disp[WRITE] += atomic_xchg(&tg->last_io_split_cnt[WRITE], 0);
 		iops = tg->last_io_disp[WRITE] * HZ / elapsed_time;
 		if (iops >= tg->iops[WRITE][LIMIT_LOW])
 			tg->last_low_overflow_time[WRITE] = now;
@@ -2176,6 +2189,25 @@ static inline void throtl_update_latency_buckets(struct throtl_data *td)
 }
 #endif
 
+void blk_throtl_charge_bio_split(struct bio *bio)
+{
+	struct blkcg_gq *blkg = bio->bi_blkg;
+	struct throtl_grp *parent = blkg_to_tg(blkg);
+	struct throtl_service_queue *parent_sq;
+	bool rw = bio_data_dir(bio);
+
+	do {
+		if (!parent->has_rules[rw])
+			break;
+
+		atomic_inc(&parent->io_split_cnt[rw]);
+		atomic_inc(&parent->last_io_split_cnt[rw]);
+
+		parent_sq = parent->service_queue.parent_sq;
+		parent = sq_to_tg(parent_sq);
+	} while (parent);
+}
+
 bool blk_throtl_bio(struct bio *bio)
 {
 	struct request_queue *q = bio->bi_bdev->bd_disk->queue;
diff --git a/block/blk.h b/block/blk.h
index cb01429c162c..f10cc9b2c27f 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -289,11 +289,13 @@ int create_task_io_context(struct task_struct *task, gfp_t gfp_mask, int node);
 extern int blk_throtl_init(struct request_queue *q);
 extern void blk_throtl_exit(struct request_queue *q);
 extern void blk_throtl_register_queue(struct request_queue *q);
+extern void blk_throtl_charge_bio_split(struct bio *bio);
 bool blk_throtl_bio(struct bio *bio);
 #else /* CONFIG_BLK_DEV_THROTTLING */
 static inline int blk_throtl_init(struct request_queue *q) { return 0; }
 static inline void blk_throtl_exit(struct request_queue *q) { }
 static inline void blk_throtl_register_queue(struct request_queue *q) { }
+static inline void blk_throtl_charge_bio_split(struct bio *bio) { }
 static inline bool blk_throtl_bio(struct bio *bio) { return false; }
 #endif /* CONFIG_BLK_DEV_THROTTLING */
 #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 020/334] nvme-tcp: dont update queue count when failing to set io queues
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 019/334] blk-throtl: optimize IOPS throttle for large IO scenarios Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 021/334] nvme-rdma: " Greg Kroah-Hartman
                   ` (319 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ruozhu Li, Christoph Hellwig, Sasha Levin

From: Ruozhu Li <liruozhu@huawei.com>

[ Upstream commit 664227fde63844d69e9ec9e90a8a7801e6ff072d ]

We update ctrl->queue_count and schedule another reconnect when io queue
count is zero.But we will never try to create any io queue in next reco-
nnection, because ctrl->queue_count already set to zero.We will end up
having an admin-only session in Live state, which is exactly what we try
to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/tcp.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
index 8cb15ee5b249..18bd68b82d78 100644
--- a/drivers/nvme/host/tcp.c
+++ b/drivers/nvme/host/tcp.c
@@ -1769,13 +1769,13 @@ static int nvme_tcp_alloc_io_queues(struct nvme_ctrl *ctrl)
 	if (ret)
 		return ret;
 
-	ctrl->queue_count = nr_io_queues + 1;
-	if (ctrl->queue_count < 2) {
+	if (nr_io_queues == 0) {
 		dev_err(ctrl->device,
 			"unable to set any I/O queues\n");
 		return -ENOMEM;
 	}
 
+	ctrl->queue_count = nr_io_queues + 1;
 	dev_info(ctrl->device,
 		"creating %d I/O queues.\n", nr_io_queues);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 021/334] nvme-rdma: dont update queue count when failing to set io queues
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 020/334] nvme-tcp: dont update queue count when failing to set io queues Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 022/334] nvmet: pass back cntlid on successful completion Greg Kroah-Hartman
                   ` (318 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ruozhu Li, Sagi Grimberg,
	Christoph Hellwig, Sasha Levin

From: Ruozhu Li <liruozhu@huawei.com>

[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ]

We update ctrl->queue_count and schedule another reconnect when io queue
count is zero.But we will never try to create any io queue in next reco-
nnection, because ctrl->queue_count already set to zero.We will end up
having an admin-only session in Live state, which is exactly what we try
to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.

Signed-off-by: Ruozhu Li <liruozhu@huawei.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/host/rdma.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
index 7f6b3a991501..3bd9cbc80246 100644
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -735,13 +735,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)
 	if (ret)
 		return ret;
 
-	ctrl->ctrl.queue_count = nr_io_queues + 1;
-	if (ctrl->ctrl.queue_count < 2) {
+	if (nr_io_queues == 0) {
 		dev_err(ctrl->ctrl.device,
 			"unable to set any I/O queues\n");
 		return -ENOMEM;
 	}
 
+	ctrl->ctrl.queue_count = nr_io_queues + 1;
 	dev_info(ctrl->ctrl.device,
 		"creating %d I/O queues.\n", nr_io_queues);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 022/334] nvmet: pass back cntlid on successful completion
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 021/334] nvme-rdma: " Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 023/334] power: supply: smb347-charger: Add missing pin control activation Greg Kroah-Hartman
                   ` (317 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amit Engel, Christoph Hellwig, Sasha Levin

From: Amit Engel <amit.engel@dell.com>

[ Upstream commit e804d5abe2d74cfe23f5f83be580d1cdc9307111 ]

According to the NVMe specification, the response dword 0 value of the
Connect command is based on status code: return cntlid for successful
compeltion return IPO and IATTR for connect invalid parameters.  Fix
a missing error information for a zero sized queue, and return the
cntlid also for I/O queue Connect commands.

Signed-off-by: Amit Engel <amit.engel@dell.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/nvme/target/fabrics-cmd.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 7d0f3523fdab..8ef564c3b32c 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -120,6 +120,7 @@ static u16 nvmet_install_queue(struct nvmet_ctrl *ctrl, struct nvmet_req *req)
 	if (!sqsize) {
 		pr_warn("queue size zero!\n");
 		req->error_loc = offsetof(struct nvmf_connect_command, sqsize);
+		req->cqe->result.u32 = IPO_IATTR_CONNECT_SQE(sqsize);
 		ret = NVME_SC_CONNECT_INVALID_PARAM | NVME_SC_DNR;
 		goto err;
 	}
@@ -260,11 +261,11 @@ static void nvmet_execute_io_connect(struct nvmet_req *req)
 	}
 
 	status = nvmet_install_queue(ctrl, req);
-	if (status) {
-		/* pass back cntlid that had the issue of installing queue */
-		req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid);
+	if (status)
 		goto out_ctrl_put;
-	}
+
+	/* pass back cntlid for successful completion */
+	req->cqe->result.u16 = cpu_to_le16(ctrl->cntlid);
 
 	pr_debug("adding queue %d to ctrl %d.\n", qid, ctrl->cntlid);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 023/334] power: supply: smb347-charger: Add missing pin control activation
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 022/334] nvmet: pass back cntlid on successful completion Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 024/334] power: supply: max17042_battery: fix typo in MAx17042_TOFF Greg Kroah-Hartman
                   ` (316 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Osipenko, Sebastian Reichel,
	Sasha Levin

From: Dmitry Osipenko <digetx@gmail.com>

[ Upstream commit efe2175478d5237949e33c84d9a722fc084b218c ]

Pin control needs to be activated by setting the enable bit, otherwise
hardware rejects all pin changes. Previously this stayed unnoticed on
Nexus 7 because pin control was enabled by default after rebooting from
downstream kernel, which uses driver that enables the bit and charger
registers are non-volatile until power supply (battery) is disconnected.
Configure the pin control enable bit. This fixes the potentially
never-enabled charging on devices that use pin control.

Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/smb347-charger.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/power/supply/smb347-charger.c b/drivers/power/supply/smb347-charger.c
index df240420f2de..9d8c2fadd4d0 100644
--- a/drivers/power/supply/smb347-charger.c
+++ b/drivers/power/supply/smb347-charger.c
@@ -55,6 +55,7 @@
 #define CFG_PIN_EN_CTRL_ACTIVE_LOW		0x60
 #define CFG_PIN_EN_APSD_IRQ			BIT(1)
 #define CFG_PIN_EN_CHARGER_ERROR		BIT(2)
+#define CFG_PIN_EN_CTRL				BIT(4)
 #define CFG_THERM				0x07
 #define CFG_THERM_SOFT_HOT_COMPENSATION_MASK	0x03
 #define CFG_THERM_SOFT_HOT_COMPENSATION_SHIFT	0
@@ -724,6 +725,15 @@ static int smb347_hw_init(struct smb347_charger *smb)
 	if (ret < 0)
 		goto fail;
 
+	/* Activate pin control, making it writable. */
+	switch (smb->enable_control) {
+	case SMB3XX_CHG_ENABLE_PIN_ACTIVE_LOW:
+	case SMB3XX_CHG_ENABLE_PIN_ACTIVE_HIGH:
+		ret = regmap_set_bits(smb->regmap, CFG_PIN, CFG_PIN_EN_CTRL);
+		if (ret < 0)
+			goto fail;
+	}
+
 	/*
 	 * Make the charging functionality controllable by a write to the
 	 * command register unless pin control is specified in the platform
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 024/334] power: supply: max17042_battery: fix typo in MAx17042_TOFF
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 023/334] power: supply: smb347-charger: Add missing pin control activation Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 025/334] s390/cio: add dev_busid sysfs entry for each subchannel Greg Kroah-Hartman
                   ` (315 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sebastian Krzyszkowiak,
	Sebastian Reichel, Sasha Levin

From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>

[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ]

Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/max17042_battery.c | 2 +-
 include/linux/power/max17042_battery.h  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c
index ce2041b30a06..215e77d3b6d9 100644
--- a/drivers/power/supply/max17042_battery.c
+++ b/drivers/power/supply/max17042_battery.c
@@ -748,7 +748,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)
 	struct max17042_config_data *config = chip->pdata->config_data;
 
 	max17042_override_por(map, MAX17042_TGAIN, config->tgain);
-	max17042_override_por(map, MAx17042_TOFF, config->toff);
+	max17042_override_por(map, MAX17042_TOFF, config->toff);
 	max17042_override_por(map, MAX17042_CGAIN, config->cgain);
 	max17042_override_por(map, MAX17042_COFF, config->coff);
 
diff --git a/include/linux/power/max17042_battery.h b/include/linux/power/max17042_battery.h
index d55c746ac56e..e00ad1cfb1f1 100644
--- a/include/linux/power/max17042_battery.h
+++ b/include/linux/power/max17042_battery.h
@@ -69,7 +69,7 @@ enum max17042_register {
 	MAX17042_RelaxCFG	= 0x2A,
 	MAX17042_MiscCFG	= 0x2B,
 	MAX17042_TGAIN		= 0x2C,
-	MAx17042_TOFF		= 0x2D,
+	MAX17042_TOFF		= 0x2D,
 	MAX17042_CGAIN		= 0x2E,
 	MAX17042_COFF		= 0x2F,
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 025/334] s390/cio: add dev_busid sysfs entry for each subchannel
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 024/334] power: supply: max17042_battery: fix typo in MAx17042_TOFF Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 026/334] s390/zcrypt: fix wrong offset index for APKA master key valid state Greg Kroah-Hartman
                   ` (314 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vineeth Vijayan, Peter Oberparleiter,
	Vasily Gorbik, Sasha Levin

From: Vineeth Vijayan <vneethv@linux.ibm.com>

[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ]

Introduce dev_busid, which exports the device-id associated with the
io-subchannel (and message-subchannel). The dev_busid indicates that of
the device which may be physically installed on the corrosponding
subchannel. The dev_busid value "none" indicates that the subchannel
is not valid, there is no I/O device currently associated with the
subchannel.

The dev_busid information would be helpful to write device-specific
udev-rules associated with the subchannel. The dev_busid interface would
be available even when the sch is not bound to any driver or if there is
no operational device connected on it. Hence this attribute can be used to
write udev-rules which are specific to the device associated with the
subchannel.

Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/cio/css.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index a974943c27da..9fcdb8d81eee 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -430,9 +430,26 @@ static ssize_t pimpampom_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(pimpampom);
 
+static ssize_t dev_busid_show(struct device *dev,
+			      struct device_attribute *attr,
+			      char *buf)
+{
+	struct subchannel *sch = to_subchannel(dev);
+	struct pmcw *pmcw = &sch->schib.pmcw;
+
+	if ((pmcw->st == SUBCHANNEL_TYPE_IO ||
+	     pmcw->st == SUBCHANNEL_TYPE_MSG) && pmcw->dnv)
+		return sysfs_emit(buf, "0.%x.%04x\n", sch->schid.ssid,
+				  pmcw->dev);
+	else
+		return sysfs_emit(buf, "none\n");
+}
+static DEVICE_ATTR_RO(dev_busid);
+
 static struct attribute *io_subchannel_type_attrs[] = {
 	&dev_attr_chpids.attr,
 	&dev_attr_pimpampom.attr,
+	&dev_attr_dev_busid.attr,
 	NULL,
 };
 ATTRIBUTE_GROUPS(io_subchannel_type);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 026/334] s390/zcrypt: fix wrong offset index for APKA master key valid state
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 025/334] s390/cio: add dev_busid sysfs entry for each subchannel Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 027/334] libata: fix ata_host_start() Greg Kroah-Hartman
                   ` (313 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harald Freudenberger, Vasily Gorbik,
	Sasha Levin

From: Harald Freudenberger <freude@linux.ibm.com>

[ Upstream commit 8617bb74006252cb2286008afe7d6575a6425857 ]

Tests showed a mismatch between what the CCA tool reports about
the APKA master key state and what's displayed by the zcrypt dd
in sysfs. After some investigation, we found out that the
documentation which was the source for the zcrypt dd implementation
lacks the listing of 3 fields. So this patch now moves the
evaluation of the APKA master key state to the correct offset.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/crypto/zcrypt_ccamisc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
index bc34bedf9db8..6a3c2b460965 100644
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1724,10 +1724,10 @@ static int fetch_cca_info(u16 cardnr, u16 domain, struct cca_info *ci)
 	rlen = vlen = PAGE_SIZE/2;
 	rc = cca_query_crypto_facility(cardnr, domain, "STATICSB",
 				       rarray, &rlen, varray, &vlen);
-	if (rc == 0 && rlen >= 10*8 && vlen >= 240) {
-		ci->new_apka_mk_state = (char) rarray[7*8];
-		ci->cur_apka_mk_state = (char) rarray[8*8];
-		ci->old_apka_mk_state = (char) rarray[9*8];
+	if (rc == 0 && rlen >= 13*8 && vlen >= 240) {
+		ci->new_apka_mk_state = (char) rarray[10*8];
+		ci->cur_apka_mk_state = (char) rarray[11*8];
+		ci->old_apka_mk_state = (char) rarray[12*8];
 		if (ci->old_apka_mk_state == '2')
 			memcpy(&ci->old_apka_mkvp, varray + 208, 8);
 		if (ci->cur_apka_mk_state == '2')
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 027/334] libata: fix ata_host_start()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 026/334] s390/zcrypt: fix wrong offset index for APKA master key valid state Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 028/334] sched/topology: Skip updating masks for non-online nodes Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Damien Le Moal,
	Hannes Reinecke, Jens Axboe, Sasha Levin

From: Damien Le Moal <damien.lemoal@wdc.com>

[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ]

The loop on entry of ata_host_start() may not initialize host->ops to a
non NULL value. The test on the host_stop field of host->ops must then
be preceded by a check that host->ops is not NULL.

Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Link: https://lore.kernel.org/r/20210816014456.2191776-3-damien.lemoal@wdc.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/ata/libata-core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 61c762961ca8..44f434acfce0 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -5573,7 +5573,7 @@ int ata_host_start(struct ata_host *host)
 			have_stop = 1;
 	}
 
-	if (host->ops->host_stop)
+	if (host->ops && host->ops->host_stop)
 		have_stop = 1;
 
 	if (have_stop) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 028/334] sched/topology: Skip updating masks for non-online nodes
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 027/334] libata: fix ata_host_start() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 029/334] crypto: omap - Fix inconsistent locking of device lists Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geetika Moolchandani,
	Srikar Dronamraju, Valentin Schneider, Peter Zijlstra (Intel),
	Sasha Levin

From: Valentin Schneider <valentin.schneider@arm.com>

[ Upstream commit 0083242c93759dde353a963a90cb351c5c283379 ]

The scheduler currently expects NUMA node distances to be stable from
init onwards, and as a consequence builds the related data structures
once-and-for-all at init (see sched_init_numa()).

Unfortunately, on some architectures node distance is unreliable for
offline nodes and may very well change upon onlining.

Skip over offline nodes during sched_init_numa(). Track nodes that have
been onlined at least once, and trigger a build of a node's NUMA masks
when it is first onlined post-init.

Reported-by: Geetika Moolchandani <Geetika.Moolchandani1@ibm.com>
Signed-off-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20210818074333.48645-1-srikar@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/topology.c | 65 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index b77ad49dc14f..4e8698e62f07 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c
@@ -1482,6 +1482,8 @@ int				sched_max_numa_distance;
 static int			*sched_domains_numa_distance;
 static struct cpumask		***sched_domains_numa_masks;
 int __read_mostly		node_reclaim_distance = RECLAIM_DISTANCE;
+
+static unsigned long __read_mostly *sched_numa_onlined_nodes;
 #endif
 
 /*
@@ -1833,6 +1835,16 @@ void sched_init_numa(void)
 			sched_domains_numa_masks[i][j] = mask;
 
 			for_each_node(k) {
+				/*
+				 * Distance information can be unreliable for
+				 * offline nodes, defer building the node
+				 * masks to its bringup.
+				 * This relies on all unique distance values
+				 * still being visible at init time.
+				 */
+				if (!node_online(j))
+					continue;
+
 				if (sched_debug() && (node_distance(j, k) != node_distance(k, j)))
 					sched_numa_warn("Node-distance not symmetric");
 
@@ -1886,6 +1898,53 @@ void sched_init_numa(void)
 	sched_max_numa_distance = sched_domains_numa_distance[nr_levels - 1];
 
 	init_numa_topology_type();
+
+	sched_numa_onlined_nodes = bitmap_alloc(nr_node_ids, GFP_KERNEL);
+	if (!sched_numa_onlined_nodes)
+		return;
+
+	bitmap_zero(sched_numa_onlined_nodes, nr_node_ids);
+	for_each_online_node(i)
+		bitmap_set(sched_numa_onlined_nodes, i, 1);
+}
+
+static void __sched_domains_numa_masks_set(unsigned int node)
+{
+	int i, j;
+
+	/*
+	 * NUMA masks are not built for offline nodes in sched_init_numa().
+	 * Thus, when a CPU of a never-onlined-before node gets plugged in,
+	 * adding that new CPU to the right NUMA masks is not sufficient: the
+	 * masks of that CPU's node must also be updated.
+	 */
+	if (test_bit(node, sched_numa_onlined_nodes))
+		return;
+
+	bitmap_set(sched_numa_onlined_nodes, node, 1);
+
+	for (i = 0; i < sched_domains_numa_levels; i++) {
+		for (j = 0; j < nr_node_ids; j++) {
+			if (!node_online(j) || node == j)
+				continue;
+
+			if (node_distance(j, node) > sched_domains_numa_distance[i])
+				continue;
+
+			/* Add remote nodes in our masks */
+			cpumask_or(sched_domains_numa_masks[i][node],
+				   sched_domains_numa_masks[i][node],
+				   sched_domains_numa_masks[0][j]);
+		}
+	}
+
+	/*
+	 * A new node has been brought up, potentially changing the topology
+	 * classification.
+	 *
+	 * Note that this is racy vs any use of sched_numa_topology_type :/
+	 */
+	init_numa_topology_type();
 }
 
 void sched_domains_numa_masks_set(unsigned int cpu)
@@ -1893,8 +1952,14 @@ void sched_domains_numa_masks_set(unsigned int cpu)
 	int node = cpu_to_node(cpu);
 	int i, j;
 
+	__sched_domains_numa_masks_set(node);
+
 	for (i = 0; i < sched_domains_numa_levels; i++) {
 		for (j = 0; j < nr_node_ids; j++) {
+			if (!node_online(j))
+				continue;
+
+			/* Set ourselves in the remote node's masks */
 			if (node_distance(j, node) <= sched_domains_numa_distance[i])
 				cpumask_set_cpu(cpu, sched_domains_numa_masks[i][j]);
 		}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 029/334] crypto: omap - Fix inconsistent locking of device lists
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 028/334] sched/topology: Skip updating masks for non-online nodes Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 030/334] crypto: qat - do not ignore errors from enable_vf2pf_comms() Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Herbert Xu, Sasha Levin

From: Ben Hutchings <ben.hutchings@mind.be>

[ Upstream commit fe4d55773b879c785ae61da9b1c2160f0110f67e ]

lockdep complains that in omap-aes, the list_lock is taken both with
softirqs enabled at probe time, and also in softirq context, which
could lead to a deadlock:

    ================================
    WARNING: inconsistent lock state
    5.14.0-rc1-00035-gc836005b01c5-dirty #69 Not tainted
    --------------------------------
    inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
    ksoftirqd/0/7 [HC0[0]:SC1[3]:HE1:SE0] takes:
    bf00e014 (list_lock){+.?.}-{2:2}, at: omap_aes_find_dev+0x18/0x54 [omap_aes_driver]
    {SOFTIRQ-ON-W} state was registered at:
      _raw_spin_lock+0x40/0x50
      omap_aes_probe+0x1d4/0x664 [omap_aes_driver]
      platform_probe+0x58/0xb8
      really_probe+0xbc/0x314
      __driver_probe_device+0x80/0xe4
      driver_probe_device+0x30/0xc8
      __driver_attach+0x70/0xf4
      bus_for_each_dev+0x70/0xb4
      bus_add_driver+0xf0/0x1d4
      driver_register+0x74/0x108
      do_one_initcall+0x84/0x2e4
      do_init_module+0x5c/0x240
      load_module+0x221c/0x2584
      sys_finit_module+0xb0/0xec
      ret_fast_syscall+0x0/0x2c
      0xbed90b30
    irq event stamp: 111800
    hardirqs last  enabled at (111800): [<c02a21e4>] __kmalloc+0x484/0x5ec
    hardirqs last disabled at (111799): [<c02a21f0>] __kmalloc+0x490/0x5ec
    softirqs last  enabled at (111776): [<c01015f0>] __do_softirq+0x2b8/0x4d0
    softirqs last disabled at (111781): [<c0135948>] run_ksoftirqd+0x34/0x50

    other info that might help us debug this:
     Possible unsafe locking scenario:

           CPU0
           ----
      lock(list_lock);
      <Interrupt>
        lock(list_lock);

     *** DEADLOCK ***

    2 locks held by ksoftirqd/0/7:
     #0: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb+0x6c/0x260
     #1: c0f5e8c8 (rcu_read_lock){....}-{1:2}, at: ip_local_deliver_finish+0x2c/0xdc

    stack backtrace:
    CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 5.14.0-rc1-00035-gc836005b01c5-dirty #69
    Hardware name: Generic AM43 (Flattened Device Tree)
    [<c010e6e0>] (unwind_backtrace) from [<c010b9d0>] (show_stack+0x10/0x14)
    [<c010b9d0>] (show_stack) from [<c017c640>] (mark_lock.part.17+0x5bc/0xd04)
    [<c017c640>] (mark_lock.part.17) from [<c017d9e4>] (__lock_acquire+0x960/0x2fa4)
    [<c017d9e4>] (__lock_acquire) from [<c0180980>] (lock_acquire+0x10c/0x358)
    [<c0180980>] (lock_acquire) from [<c093d324>] (_raw_spin_lock_bh+0x44/0x58)
    [<c093d324>] (_raw_spin_lock_bh) from [<bf00b258>] (omap_aes_find_dev+0x18/0x54 [omap_aes_driver])
    [<bf00b258>] (omap_aes_find_dev [omap_aes_driver]) from [<bf00b328>] (omap_aes_crypt+0x94/0xd4 [omap_aes_driver])
    [<bf00b328>] (omap_aes_crypt [omap_aes_driver]) from [<c08ac6d0>] (esp_input+0x1b0/0x2c8)
    [<c08ac6d0>] (esp_input) from [<c08c9e90>] (xfrm_input+0x410/0x1290)
    [<c08c9e90>] (xfrm_input) from [<c08b6374>] (xfrm4_esp_rcv+0x54/0x11c)
    [<c08b6374>] (xfrm4_esp_rcv) from [<c0838840>] (ip_protocol_deliver_rcu+0x48/0x3bc)
    [<c0838840>] (ip_protocol_deliver_rcu) from [<c0838c50>] (ip_local_deliver_finish+0x9c/0xdc)
    [<c0838c50>] (ip_local_deliver_finish) from [<c0838dd8>] (ip_local_deliver+0x148/0x1b0)
    [<c0838dd8>] (ip_local_deliver) from [<c0838f5c>] (ip_rcv+0x11c/0x180)
    [<c0838f5c>] (ip_rcv) from [<c077e3a4>] (__netif_receive_skb_one_core+0x54/0x74)
    [<c077e3a4>] (__netif_receive_skb_one_core) from [<c077e588>] (netif_receive_skb+0xa8/0x260)
    [<c077e588>] (netif_receive_skb) from [<c068d6d4>] (cpsw_rx_handler+0x224/0x2fc)
    [<c068d6d4>] (cpsw_rx_handler) from [<c0688ccc>] (__cpdma_chan_process+0xf4/0x188)
    [<c0688ccc>] (__cpdma_chan_process) from [<c068a0c0>] (cpdma_chan_process+0x3c/0x5c)
    [<c068a0c0>] (cpdma_chan_process) from [<c0690e14>] (cpsw_rx_mq_poll+0x44/0x98)
    [<c0690e14>] (cpsw_rx_mq_poll) from [<c0780810>] (__napi_poll+0x28/0x268)
    [<c0780810>] (__napi_poll) from [<c0780c64>] (net_rx_action+0xcc/0x204)
    [<c0780c64>] (net_rx_action) from [<c0101478>] (__do_softirq+0x140/0x4d0)
    [<c0101478>] (__do_softirq) from [<c0135948>] (run_ksoftirqd+0x34/0x50)
    [<c0135948>] (run_ksoftirqd) from [<c01583b8>] (smpboot_thread_fn+0xf4/0x1d8)
    [<c01583b8>] (smpboot_thread_fn) from [<c01546dc>] (kthread+0x14c/0x174)
    [<c01546dc>] (kthread) from [<c010013c>] (ret_from_fork+0x14/0x38)
    ...

The omap-des and omap-sham drivers appear to have a similar issue.

Fix this by using spin_{,un}lock_bh() around device list access in all
the probe and remove functions.

Signed-off-by: Ben Hutchings <ben.hutchings@mind.be>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/omap-aes.c  |  8 ++++----
 drivers/crypto/omap-des.c  |  8 ++++----
 drivers/crypto/omap-sham.c | 12 ++++++------
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c
index 0dd4c6b157de..9b968ac4ee7b 100644
--- a/drivers/crypto/omap-aes.c
+++ b/drivers/crypto/omap-aes.c
@@ -1175,9 +1175,9 @@ static int omap_aes_probe(struct platform_device *pdev)
 	spin_lock_init(&dd->lock);
 
 	INIT_LIST_HEAD(&dd->list);
-	spin_lock(&list_lock);
+	spin_lock_bh(&list_lock);
 	list_add_tail(&dd->list, &dev_list);
-	spin_unlock(&list_lock);
+	spin_unlock_bh(&list_lock);
 
 	/* Initialize crypto engine */
 	dd->engine = crypto_engine_alloc_init(dev, 1);
@@ -1264,9 +1264,9 @@ static int omap_aes_remove(struct platform_device *pdev)
 	if (!dd)
 		return -ENODEV;
 
-	spin_lock(&list_lock);
+	spin_lock_bh(&list_lock);
 	list_del(&dd->list);
-	spin_unlock(&list_lock);
+	spin_unlock_bh(&list_lock);
 
 	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
 		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
index bc8631363d72..be77656864e3 100644
--- a/drivers/crypto/omap-des.c
+++ b/drivers/crypto/omap-des.c
@@ -1033,9 +1033,9 @@ static int omap_des_probe(struct platform_device *pdev)
 
 
 	INIT_LIST_HEAD(&dd->list);
-	spin_lock(&list_lock);
+	spin_lock_bh(&list_lock);
 	list_add_tail(&dd->list, &dev_list);
-	spin_unlock(&list_lock);
+	spin_unlock_bh(&list_lock);
 
 	/* Initialize des crypto engine */
 	dd->engine = crypto_engine_alloc_init(dev, 1);
@@ -1094,9 +1094,9 @@ static int omap_des_remove(struct platform_device *pdev)
 	if (!dd)
 		return -ENODEV;
 
-	spin_lock(&list_lock);
+	spin_lock_bh(&list_lock);
 	list_del(&dd->list);
-	spin_unlock(&list_lock);
+	spin_unlock_bh(&list_lock);
 
 	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
 		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--)
diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
index a47ac60a4ee1..63beea7cdba5 100644
--- a/drivers/crypto/omap-sham.c
+++ b/drivers/crypto/omap-sham.c
@@ -2144,9 +2144,9 @@ static int omap_sham_probe(struct platform_device *pdev)
 		(rev & dd->pdata->major_mask) >> dd->pdata->major_shift,
 		(rev & dd->pdata->minor_mask) >> dd->pdata->minor_shift);
 
-	spin_lock(&sham.lock);
+	spin_lock_bh(&sham.lock);
 	list_add_tail(&dd->list, &sham.dev_list);
-	spin_unlock(&sham.lock);
+	spin_unlock_bh(&sham.lock);
 
 	dd->engine = crypto_engine_alloc_init(dev, 1);
 	if (!dd->engine) {
@@ -2194,9 +2194,9 @@ err_algs:
 err_engine_start:
 	crypto_engine_exit(dd->engine);
 err_engine:
-	spin_lock(&sham.lock);
+	spin_lock_bh(&sham.lock);
 	list_del(&dd->list);
-	spin_unlock(&sham.lock);
+	spin_unlock_bh(&sham.lock);
 err_pm:
 	pm_runtime_disable(dev);
 	if (!dd->polling_mode)
@@ -2215,9 +2215,9 @@ static int omap_sham_remove(struct platform_device *pdev)
 	dd = platform_get_drvdata(pdev);
 	if (!dd)
 		return -ENODEV;
-	spin_lock(&sham.lock);
+	spin_lock_bh(&sham.lock);
 	list_del(&dd->list);
-	spin_unlock(&sham.lock);
+	spin_unlock_bh(&sham.lock);
 	for (i = dd->pdata->algs_info_size - 1; i >= 0; i--)
 		for (j = dd->pdata->algs_info[i].registered - 1; j >= 0; j--) {
 			crypto_unregister_ahash(
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 030/334] crypto: qat - do not ignore errors from enable_vf2pf_comms()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 029/334] crypto: omap - Fix inconsistent locking of device lists Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 031/334] crypto: qat - handle both source of interrupt in VF ISR Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ]

The function adf_dev_init() ignores the error code reported by
enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible
with the pf, then the load of the VF driver progresses.
This patch changes adf_dev_init() so that the error code from
enable_vf2pf_comms() is returned to the caller.

Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_init.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c
index 744c40351428..02864985dbb0 100644
--- a/drivers/crypto/qat/qat_common/adf_init.c
+++ b/drivers/crypto/qat/qat_common/adf_init.c
@@ -61,6 +61,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
 	struct service_hndl *service;
 	struct list_head *list_itr;
 	struct adf_hw_device_data *hw_data = accel_dev->hw_device;
+	int ret;
 
 	if (!hw_data) {
 		dev_err(&GET_DEV(accel_dev),
@@ -127,9 +128,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)
 	}
 
 	hw_data->enable_error_correction(accel_dev);
-	hw_data->enable_vf2pf_comms(accel_dev);
+	ret = hw_data->enable_vf2pf_comms(accel_dev);
 
-	return 0;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(adf_dev_init);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 031/334] crypto: qat - handle both source of interrupt in VF ISR
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 030/334] crypto: qat - do not ignore errors from enable_vf2pf_comms() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 032/334] crypto: qat - fix reuse of completion variable Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ]

The top half of the VF drivers handled only a source at the time.
If an interrupt for PF2VF and bundle occurred at the same time, the ISR
scheduled only the bottom half for PF2VF.
This patch fixes the VF top half so that if both sources of interrupt
trigger at the same time, both bottom halves are scheduled.

This patch is based on earlier work done by Conor McLoughlin.

Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/qat/qat_common/adf_vf_isr.c b/drivers/crypto/qat/qat_common/adf_vf_isr.c
index 888388acb6bd..3e4f64d248f9 100644
--- a/drivers/crypto/qat/qat_common/adf_vf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_vf_isr.c
@@ -160,6 +160,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
 	struct adf_bar *pmisc =
 			&GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
 	void __iomem *pmisc_bar_addr = pmisc->virt_addr;
+	bool handled = false;
 	u32 v_int;
 
 	/* Read VF INT source CSR to determine the source of VF interrupt */
@@ -172,7 +173,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)
 
 		/* Schedule tasklet to handle interrupt BH */
 		tasklet_hi_schedule(&accel_dev->vf.pf2vf_bh_tasklet);
-		return IRQ_HANDLED;
+		handled = true;
 	}
 
 	/* Check bundle interrupt */
@@ -184,10 +185,10 @@ static irqreturn_t adf_isr(int irq, void *privdata)
 		csr_ops->write_csr_int_flag_and_col(bank->csr_addr,
 						    bank->bank_number, 0);
 		tasklet_hi_schedule(&bank->resp_handler);
-		return IRQ_HANDLED;
+		handled = true;
 	}
 
-	return IRQ_NONE;
+	return handled ? IRQ_HANDLED : IRQ_NONE;
 }
 
 static int adf_request_msi_irq(struct adf_accel_dev *accel_dev)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 032/334] crypto: qat - fix reuse of completion variable
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 031/334] crypto: qat - handle both source of interrupt in VF ISR Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 033/334] crypto: qat - fix naming for init/shutdown VF to PF notifications Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Marco Chiappero <marco.chiappero@intel.com>

[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ]

Use reinit_completion() to set to a clean state a completion variable,
used to coordinate the VF to PF request-response flow, before every
new VF request.

Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index a1b77bd7a894..663638bb5c97 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -316,6 +316,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev)
 	msg |= ADF_PFVF_COMPATIBILITY_VERSION << ADF_VF2PF_COMPAT_VER_REQ_SHIFT;
 	BUILD_BUG_ON(ADF_PFVF_COMPATIBILITY_VERSION > 255);
 
+	reinit_completion(&accel_dev->vf.iov_msg_completion);
+
 	/* Send request from VF to PF */
 	ret = adf_iov_putmsg(accel_dev, msg, 0);
 	if (ret) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 033/334] crypto: qat - fix naming for init/shutdown VF to PF notifications
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 032/334] crypto: qat - fix reuse of completion variable Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 034/334] crypto: qat - do not export adf_iov_putmsg() Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marco Chiappero, Giovanni Cabiddu,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Marco Chiappero <marco.chiappero@intel.com>

[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ]

At start and shutdown, VFs notify the PF about their state. These
notifications are carried out through a message exchange using the PFVF
protocol.

Function names lead to believe they do perform init or shutdown logic.
This is to fix the naming to better reflect their purpose.

Signed-off-by: Marco Chiappero <marco.chiappero@intel.com>
Co-developed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c |  4 ++--
 drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c   |  4 ++--
 drivers/crypto/qat/qat_common/adf_common_drv.h       |  8 ++++----
 drivers/crypto/qat/qat_common/adf_vf2pf_msg.c        | 12 ++++++------
 .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c      |  4 ++--
 5 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
index 15f6b9bdfb22..ddf42fb32625 100644
--- a/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c
@@ -81,10 +81,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data)
 	hw_data->enable_error_correction = adf_vf_void_noop;
 	hw_data->init_admin_comms = adf_vf_int_noop;
 	hw_data->exit_admin_comms = adf_vf_void_noop;
-	hw_data->send_admin_init = adf_vf2pf_init;
+	hw_data->send_admin_init = adf_vf2pf_notify_init;
 	hw_data->init_arb = adf_vf_int_noop;
 	hw_data->exit_arb = adf_vf_void_noop;
-	hw_data->disable_iov = adf_vf2pf_shutdown;
+	hw_data->disable_iov = adf_vf2pf_notify_shutdown;
 	hw_data->get_accel_mask = get_accel_mask;
 	hw_data->get_ae_mask = get_ae_mask;
 	hw_data->get_num_accels = get_num_accels;
diff --git a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
index d231583428c9..7e202ef92523 100644
--- a/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
+++ b/drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c
@@ -81,10 +81,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data)
 	hw_data->enable_error_correction = adf_vf_void_noop;
 	hw_data->init_admin_comms = adf_vf_int_noop;
 	hw_data->exit_admin_comms = adf_vf_void_noop;
-	hw_data->send_admin_init = adf_vf2pf_init;
+	hw_data->send_admin_init = adf_vf2pf_notify_init;
 	hw_data->init_arb = adf_vf_int_noop;
 	hw_data->exit_arb = adf_vf_void_noop;
-	hw_data->disable_iov = adf_vf2pf_shutdown;
+	hw_data->disable_iov = adf_vf2pf_notify_shutdown;
 	hw_data->get_accel_mask = get_accel_mask;
 	hw_data->get_ae_mask = get_ae_mask;
 	hw_data->get_num_accels = get_num_accels;
diff --git a/drivers/crypto/qat/qat_common/adf_common_drv.h b/drivers/crypto/qat/qat_common/adf_common_drv.h
index c61476553728..dd4a811b7e89 100644
--- a/drivers/crypto/qat/qat_common/adf_common_drv.h
+++ b/drivers/crypto/qat/qat_common/adf_common_drv.h
@@ -198,8 +198,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,
 void adf_enable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
 void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev);
 
-int adf_vf2pf_init(struct adf_accel_dev *accel_dev);
-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev);
+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev);
+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev);
 int adf_init_pf_wq(void);
 void adf_exit_pf_wq(void);
 int adf_init_vf_wq(void);
@@ -222,12 +222,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev)
 {
 }
 
-static inline int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+static inline int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
 {
 	return 0;
 }
 
-static inline void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+static inline void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
 {
 }
 
diff --git a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
index e85bd62d134a..3e25fac051b2 100644
--- a/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_vf2pf_msg.c
@@ -5,14 +5,14 @@
 #include "adf_pf2vf_msg.h"
 
 /**
- * adf_vf2pf_init() - send init msg to PF
+ * adf_vf2pf_notify_init() - send init msg to PF
  * @accel_dev:  Pointer to acceleration VF device.
  *
  * Function sends an init message from the VF to a PF
  *
  * Return: 0 on success, error code otherwise.
  */
-int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
+int adf_vf2pf_notify_init(struct adf_accel_dev *accel_dev)
 {
 	u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
 		(ADF_VF2PF_MSGTYPE_INIT << ADF_VF2PF_MSGTYPE_SHIFT));
@@ -25,17 +25,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)
 	set_bit(ADF_STATUS_PF_RUNNING, &accel_dev->status);
 	return 0;
 }
-EXPORT_SYMBOL_GPL(adf_vf2pf_init);
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_init);
 
 /**
- * adf_vf2pf_shutdown() - send shutdown msg to PF
+ * adf_vf2pf_notify_shutdown() - send shutdown msg to PF
  * @accel_dev:  Pointer to acceleration VF device.
  *
  * Function sends a shutdown message from the VF to a PF
  *
  * Return: void
  */
-void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
+void adf_vf2pf_notify_shutdown(struct adf_accel_dev *accel_dev)
 {
 	u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM |
 	    (ADF_VF2PF_MSGTYPE_SHUTDOWN << ADF_VF2PF_MSGTYPE_SHIFT));
@@ -45,4 +45,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)
 			dev_err(&GET_DEV(accel_dev),
 				"Failed to send Shutdown event to PF\n");
 }
-EXPORT_SYMBOL_GPL(adf_vf2pf_shutdown);
+EXPORT_SYMBOL_GPL(adf_vf2pf_notify_shutdown);
diff --git a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
index f14fb82ed6df..744734caaf7b 100644
--- a/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
+++ b/drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c
@@ -81,10 +81,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data)
 	hw_data->enable_error_correction = adf_vf_void_noop;
 	hw_data->init_admin_comms = adf_vf_int_noop;
 	hw_data->exit_admin_comms = adf_vf_void_noop;
-	hw_data->send_admin_init = adf_vf2pf_init;
+	hw_data->send_admin_init = adf_vf2pf_notify_init;
 	hw_data->init_arb = adf_vf_int_noop;
 	hw_data->exit_arb = adf_vf_void_noop;
-	hw_data->disable_iov = adf_vf2pf_shutdown;
+	hw_data->disable_iov = adf_vf2pf_notify_shutdown;
 	hw_data->get_accel_mask = get_accel_mask;
 	hw_data->get_ae_mask = get_ae_mask;
 	hw_data->get_num_accels = get_num_accels;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 034/334] crypto: qat - do not export adf_iov_putmsg()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 033/334] crypto: qat - fix naming for init/shutdown VF to PF notifications Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 035/334] crypto: hisilicon/sec - fix the abnormal exiting process Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Fiona Trahe,
	Herbert Xu, Sasha Levin

From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ]

The function adf_iov_putmsg() is only used inside the intel_qat module
therefore should not be exported.
Remove EXPORT_SYMBOL for the function adf_iov_putmsg().

Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
index 663638bb5c97..efa4bffb4f60 100644
--- a/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
+++ b/drivers/crypto/qat/qat_common/adf_pf2vf_msg.c
@@ -186,7 +186,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)
 
 	return ret;
 }
-EXPORT_SYMBOL_GPL(adf_iov_putmsg);
 
 void adf_vf2pf_req_hndl(struct adf_accel_vf_info *vf_info)
 {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 035/334] crypto: hisilicon/sec - fix the abnormal exiting process
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 034/334] crypto: qat - do not export adf_iov_putmsg() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 036/334] crypto: hisilicon/sec - modify the hardware endian configuration Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai Ye, Herbert Xu, Sasha Levin

From: Kai Ye <yekai13@huawei.com>

[ Upstream commit 90367a027a22c3a9ca8b8bac15df34d9e859fc11 ]

Because the algs registration process has added a judgment.
So need to add the judgment for the abnormal exiting process.

Signed-off-by: Kai Ye <yekai13@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/sec2/sec_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 490db7bccf61..8addbd7a3339 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -984,7 +984,8 @@ static int sec_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 err_alg_unregister:
-	hisi_qm_alg_unregister(qm, &sec_devices);
+	if (qm->qp_num >= ctx_q_num)
+		hisi_qm_alg_unregister(qm, &sec_devices);
 err_qm_stop:
 	sec_debugfs_exit(qm);
 	hisi_qm_stop(qm, QM_NORMAL);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 036/334] crypto: hisilicon/sec - modify the hardware endian configuration
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 035/334] crypto: hisilicon/sec - fix the abnormal exiting process Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 037/334] crypto: tcrypt - Fix missing return value check Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai Ye, Herbert Xu, Sasha Levin

From: Kai Ye <yekai13@huawei.com>

[ Upstream commit a52626106d6f7edf3d106c065e13a0313cfeb82f ]

When the endian configuration of the hardware is abnormal, it will
cause the SEC engine is faulty that reports empty message. And it
will affect the normal function of the hardware. Currently the soft
configuration method can't restore the faulty device. The endian
needs to be configured according to the system properties. So fix it.

Signed-off-by: Kai Ye <yekai13@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/hisilicon/sec2/sec.h      |  5 ----
 drivers/crypto/hisilicon/sec2/sec_main.c | 31 +++++++-----------------
 2 files changed, 9 insertions(+), 27 deletions(-)

diff --git a/drivers/crypto/hisilicon/sec2/sec.h b/drivers/crypto/hisilicon/sec2/sec.h
index 018415b9840a..d97cf02b1df7 100644
--- a/drivers/crypto/hisilicon/sec2/sec.h
+++ b/drivers/crypto/hisilicon/sec2/sec.h
@@ -157,11 +157,6 @@ struct sec_ctx {
 	struct device *dev;
 };
 
-enum sec_endian {
-	SEC_LE = 0,
-	SEC_32BE,
-	SEC_64BE
-};
 
 enum sec_debug_file_index {
 	SEC_CLEAR_ENABLE,
diff --git a/drivers/crypto/hisilicon/sec2/sec_main.c b/drivers/crypto/hisilicon/sec2/sec_main.c
index 8addbd7a3339..a0cc46b649a3 100644
--- a/drivers/crypto/hisilicon/sec2/sec_main.c
+++ b/drivers/crypto/hisilicon/sec2/sec_main.c
@@ -312,31 +312,20 @@ static const struct pci_device_id sec_dev_ids[] = {
 };
 MODULE_DEVICE_TABLE(pci, sec_dev_ids);
 
-static u8 sec_get_endian(struct hisi_qm *qm)
+static void sec_set_endian(struct hisi_qm *qm)
 {
 	u32 reg;
 
-	/*
-	 * As for VF, it is a wrong way to get endian setting by
-	 * reading a register of the engine
-	 */
-	if (qm->pdev->is_virtfn) {
-		dev_err_ratelimited(&qm->pdev->dev,
-				    "cannot access a register in VF!\n");
-		return SEC_LE;
-	}
 	reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG);
-	/* BD little endian mode */
-	if (!(reg & BIT(0)))
-		return SEC_LE;
+	reg &= ~(BIT(1) | BIT(0));
+	if (!IS_ENABLED(CONFIG_64BIT))
+		reg |= BIT(1);
 
-	/* BD 32-bits big endian mode */
-	else if (!(reg & BIT(1)))
-		return SEC_32BE;
 
-	/* BD 64-bits big endian mode */
-	else
-		return SEC_64BE;
+	if (!IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN))
+		reg |= BIT(0);
+
+	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
 }
 
 static void sec_open_sva_prefetch(struct hisi_qm *qm)
@@ -429,9 +418,7 @@ static int sec_engine_init(struct hisi_qm *qm)
 		       qm->io_base + SEC_BD_ERR_CHK_EN_REG3);
 
 	/* config endian */
-	reg = readl_relaxed(qm->io_base + SEC_CONTROL_REG);
-	reg |= sec_get_endian(qm);
-	writel_relaxed(reg, qm->io_base + SEC_CONTROL_REG);
+	sec_set_endian(qm);
 
 	return 0;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 037/334] crypto: tcrypt - Fix missing return value check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 036/334] crypto: hisilicon/sec - modify the hardware endian configuration Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 038/334] fcntl: fix potential deadlocks for &fown_struct.lock Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tianjia Zhang, Vitaly Chikunov,
	Herbert Xu, Sasha Levin

From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

[ Upstream commit 7b3d52683b3a47c0ba1dfd6b5994a3a795b06972 ]

There are several places where the return value check of crypto_aead_setkey
and crypto_aead_setauthsize were lost. It is necessary to add these checks.

At the same time, move the crypto_aead_setauthsize() call out of the loop,
and only need to call it once after load transform.

Fixee: 53f52d7aecb4 ("crypto: tcrypt - Added speed tests for AEAD crypto alogrithms in tcrypt test suite")
Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
Reviewed-by: Vitaly Chikunov <vt@altlinux.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/tcrypt.c | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
index f8d06da78e4f..6863e57b088d 100644
--- a/crypto/tcrypt.c
+++ b/crypto/tcrypt.c
@@ -290,6 +290,11 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs,
 	}
 
 	ret = crypto_aead_setauthsize(tfm, authsize);
+	if (ret) {
+		pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo,
+		       ret);
+		goto out_free_tfm;
+	}
 
 	for (i = 0; i < num_mb; ++i)
 		if (testmgr_alloc_buf(data[i].xbuf)) {
@@ -315,7 +320,7 @@ static void test_mb_aead_speed(const char *algo, int enc, int secs,
 	for (i = 0; i < num_mb; ++i) {
 		data[i].req = aead_request_alloc(tfm, GFP_KERNEL);
 		if (!data[i].req) {
-			pr_err("alg: skcipher: Failed to allocate request for %s\n",
+			pr_err("alg: aead: Failed to allocate request for %s\n",
 			       algo);
 			while (i--)
 				aead_request_free(data[i].req);
@@ -567,13 +572,19 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
 	sgout = &sg[9];
 
 	tfm = crypto_alloc_aead(algo, 0, 0);
-
 	if (IS_ERR(tfm)) {
 		pr_err("alg: aead: Failed to load transform for %s: %ld\n", algo,
 		       PTR_ERR(tfm));
 		goto out_notfm;
 	}
 
+	ret = crypto_aead_setauthsize(tfm, authsize);
+	if (ret) {
+		pr_err("alg: aead: Failed to setauthsize for %s: %d\n", algo,
+		       ret);
+		goto out_noreq;
+	}
+
 	crypto_init_wait(&wait);
 	printk(KERN_INFO "\ntesting speed of %s (%s) %s\n", algo,
 			get_driver_name(crypto_aead, tfm), e);
@@ -611,8 +622,13 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
 					break;
 				}
 			}
+
 			ret = crypto_aead_setkey(tfm, key, *keysize);
-			ret = crypto_aead_setauthsize(tfm, authsize);
+			if (ret) {
+				pr_err("setkey() failed flags=%x: %d\n",
+					crypto_aead_get_flags(tfm), ret);
+				goto out;
+			}
 
 			iv_len = crypto_aead_ivsize(tfm);
 			if (iv_len)
@@ -622,15 +638,8 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs,
 			printk(KERN_INFO "test %u (%d bit key, %d byte blocks): ",
 					i, *keysize * 8, bs);
 
-
 			memset(tvmem[0], 0xff, PAGE_SIZE);
 
-			if (ret) {
-				pr_err("setkey() failed flags=%x\n",
-						crypto_aead_get_flags(tfm));
-				goto out;
-			}
-
 			sg_init_aead(sg, xbuf, bs + (enc ? 0 : authsize),
 				     assoc, aad_size);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 038/334] fcntl: fix potential deadlocks for &fown_struct.lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 037/334] crypto: tcrypt - Fix missing return value check Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 039/334] fcntl: fix potential deadlock for &fasync_struct.fa_lock Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi, Jeff Layton,
	Sasha Levin, syzbot+e6d5398a02c516ce5e70

From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

[ Upstream commit f671a691e299f58835d4660d642582bf0e8f6fda ]

Syzbot reports a potential deadlock in do_fcntl:

========================================================
WARNING: possible irq lock inversion dependency detected
5.12.0-syzkaller #0 Not tainted
--------------------------------------------------------
syz-executor132/8391 just changed the state of lock:
ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: f_getown_ex fs/fcntl.c:211 [inline]
ffff888015967bf8 (&f->f_owner.lock){.+..}-{2:2}, at: do_fcntl+0x8b4/0x1200 fs/fcntl.c:395
but this lock was taken by another, HARDIRQ-safe lock in the past:
 (&dev->event_lock){-...}-{2:2}

and interrupts could create inverse lock ordering between them.

other info that might help us debug this:
Chain exists of:
  &dev->event_lock --> &new->fa_lock --> &f->f_owner.lock

 Possible interrupt unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  lock(&f->f_owner.lock);
                               local_irq_disable();
                               lock(&dev->event_lock);
                               lock(&new->fa_lock);
  <Interrupt>
    lock(&dev->event_lock);

 *** DEADLOCK ***

This happens because there is a lock hierarchy of
&dev->event_lock --> &new->fa_lock --> &f->f_owner.lock
from the following call chain:

  input_inject_event():
    spin_lock_irqsave(&dev->event_lock,...);
    input_handle_event():
      input_pass_values():
        input_to_handler():
          evdev_events():
            evdev_pass_values():
              spin_lock(&client->buffer_lock);
              __pass_event():
                kill_fasync():
                  kill_fasync_rcu():
                    read_lock(&fa->fa_lock);
                    send_sigio():
                      read_lock_irqsave(&fown->lock,...);

However, since &dev->event_lock is HARDIRQ-safe, interrupts have to be
disabled while grabbing &f->f_owner.lock, otherwise we invert the lock
hierarchy.

Hence, we replace calls to read_lock/read_unlock on &f->f_owner.lock,
with read_lock_irq/read_unlock_irq.

Reported-and-tested-by: syzbot+e6d5398a02c516ce5e70@syzkaller.appspotmail.com
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fcntl.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index f946bec8f1f1..932ec1e9f5bf 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -150,7 +150,8 @@ void f_delown(struct file *filp)
 pid_t f_getown(struct file *filp)
 {
 	pid_t pid = 0;
-	read_lock(&filp->f_owner.lock);
+
+	read_lock_irq(&filp->f_owner.lock);
 	rcu_read_lock();
 	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type)) {
 		pid = pid_vnr(filp->f_owner.pid);
@@ -158,7 +159,7 @@ pid_t f_getown(struct file *filp)
 			pid = -pid;
 	}
 	rcu_read_unlock();
-	read_unlock(&filp->f_owner.lock);
+	read_unlock_irq(&filp->f_owner.lock);
 	return pid;
 }
 
@@ -208,7 +209,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
 	struct f_owner_ex owner = {};
 	int ret = 0;
 
-	read_lock(&filp->f_owner.lock);
+	read_lock_irq(&filp->f_owner.lock);
 	rcu_read_lock();
 	if (pid_task(filp->f_owner.pid, filp->f_owner.pid_type))
 		owner.pid = pid_vnr(filp->f_owner.pid);
@@ -231,7 +232,7 @@ static int f_getown_ex(struct file *filp, unsigned long arg)
 		ret = -EINVAL;
 		break;
 	}
-	read_unlock(&filp->f_owner.lock);
+	read_unlock_irq(&filp->f_owner.lock);
 
 	if (!ret) {
 		ret = copy_to_user(owner_p, &owner, sizeof(owner));
@@ -249,10 +250,10 @@ static int f_getowner_uids(struct file *filp, unsigned long arg)
 	uid_t src[2];
 	int err;
 
-	read_lock(&filp->f_owner.lock);
+	read_lock_irq(&filp->f_owner.lock);
 	src[0] = from_kuid(user_ns, filp->f_owner.uid);
 	src[1] = from_kuid(user_ns, filp->f_owner.euid);
-	read_unlock(&filp->f_owner.lock);
+	read_unlock_irq(&filp->f_owner.lock);
 
 	err  = put_user(src[0], &dst[0]);
 	err |= put_user(src[1], &dst[1]);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 039/334] fcntl: fix potential deadlock for &fasync_struct.fa_lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 038/334] fcntl: fix potential deadlocks for &fown_struct.lock Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 040/334] udf_get_extendedattr() had no boundary checks Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi, Jeff Layton,
	Sasha Levin

From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]

There is an existing lock hierarchy of
&dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock
from the following call chain:

  input_inject_event():
    spin_lock_irqsave(&dev->event_lock,...);
    input_handle_event():
      input_pass_values():
        input_to_handler():
          evdev_events():
            evdev_pass_values():
              spin_lock(&client->buffer_lock);
              __pass_event():
                kill_fasync():
                  kill_fasync_rcu():
                    read_lock(&fa->fa_lock);
                    send_sigio():
                      read_lock_irqsave(&fown->lock,...);

&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled
while grabbing &fasync_struct.fa_lock, otherwise we invert the lock
hierarchy. However, since kill_fasync which calls kill_fasync_rcu is
an exported symbol, it may not necessarily be called with interrupts
disabled.

As kill_fasync_rcu may be called with interrupts disabled (for
example, in the call chain above), we replace calls to
read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu
with read_lock_irqsave/read_unlock_irqrestore.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/fcntl.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 932ec1e9f5bf..68added37c15 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -1004,13 +1004,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
 	while (fa) {
 		struct fown_struct *fown;
+		unsigned long flags;
 
 		if (fa->magic != FASYNC_MAGIC) {
 			printk(KERN_ERR "kill_fasync: bad magic number in "
 			       "fasync_struct!\n");
 			return;
 		}
-		read_lock(&fa->fa_lock);
+		read_lock_irqsave(&fa->fa_lock, flags);
 		if (fa->fa_file) {
 			fown = &fa->fa_file->f_owner;
 			/* Don't send SIGURG to processes which have not set a
@@ -1019,7 +1020,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 			if (!(sig == SIGURG && fown->signum == 0))
 				send_sigio(fown, fa->fa_fd, band);
 		}
-		read_unlock(&fa->fa_lock);
+		read_unlock_irqrestore(&fa->fa_lock, flags);
 		fa = rcu_dereference(fa->fa_next);
 	}
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 040/334] udf_get_extendedattr() had no boundary checks.
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 039/334] fcntl: fix potential deadlock for &fasync_struct.fa_lock Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 041/334] io-wq: remove GFP_ATOMIC allocation off schedule out path Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stian Skjelstad, Jan Kara, Sasha Levin

From: Stian Skjelstad <stian.skjelstad@gmail.com>

[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]

When parsing the ExtendedAttr data, malicous or corrupt attribute length
could cause kernel hangs and buffer overruns in some special cases.

Link: https://lore.kernel.org/r/20210822093332.25234-1-stian.skjelstad@gmail.com
Signed-off-by: Stian Skjelstad <stian.skjelstad@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/udf/misc.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/fs/udf/misc.c b/fs/udf/misc.c
index eab94527340d..1614d308d0f0 100644
--- a/fs/udf/misc.c
+++ b/fs/udf/misc.c
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,
 		else
 			offset = le32_to_cpu(eahd->appAttrLocation);
 
-		while (offset < iinfo->i_lenEAttr) {
+		while (offset + sizeof(*gaf) < iinfo->i_lenEAttr) {
+			uint32_t attrLength;
+
 			gaf = (struct genericFormat *)&ea[offset];
+			attrLength = le32_to_cpu(gaf->attrLength);
+
+			/* Detect undersized elements and buffer overflows */
+			if ((attrLength < sizeof(*gaf)) ||
+			    (attrLength > (iinfo->i_lenEAttr - offset)))
+				break;
+
 			if (le32_to_cpu(gaf->attrType) == type &&
 					gaf->attrSubtype == subtype)
 				return gaf;
 			else
-				offset += le32_to_cpu(gaf->attrLength);
+				offset += attrLength;
 		}
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 041/334] io-wq: remove GFP_ATOMIC allocation off schedule out path
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 040/334] udf_get_extendedattr() had no boundary checks Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 042/334] s390/kasan: fix large PMD pages address alignment check Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Wagner, Peter Zijlstra (Intel),
	Jens Axboe, Sasha Levin

From: Jens Axboe <axboe@kernel.dk>

[ Upstream commit d3e9f732c415cf22faa33d6f195e291ad82dc92e ]

Daniel reports that the v5.14-rc4-rt4 kernel throws a BUG when running
stress-ng:

| [   90.202543] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:35
| [   90.202549] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 2047, name: iou-wrk-2041
| [   90.202555] CPU: 5 PID: 2047 Comm: iou-wrk-2041 Tainted: G        W         5.14.0-rc4-rt4+ #89
| [   90.202559] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
| [   90.202561] Call Trace:
| [   90.202577]  dump_stack_lvl+0x34/0x44
| [   90.202584]  ___might_sleep.cold+0x87/0x94
| [   90.202588]  rt_spin_lock+0x19/0x70
| [   90.202593]  ___slab_alloc+0xcb/0x7d0
| [   90.202598]  ? newidle_balance.constprop.0+0xf5/0x3b0
| [   90.202603]  ? dequeue_entity+0xc3/0x290
| [   90.202605]  ? io_wqe_dec_running.isra.0+0x98/0xe0
| [   90.202610]  ? pick_next_task_fair+0xb9/0x330
| [   90.202612]  ? __schedule+0x670/0x1410
| [   90.202615]  ? io_wqe_dec_running.isra.0+0x98/0xe0
| [   90.202618]  kmem_cache_alloc_trace+0x79/0x1f0
| [   90.202621]  io_wqe_dec_running.isra.0+0x98/0xe0
| [   90.202625]  io_wq_worker_sleeping+0x37/0x50
| [   90.202628]  schedule+0x30/0xd0
| [   90.202630]  schedule_timeout+0x8f/0x1a0
| [   90.202634]  ? __bpf_trace_tick_stop+0x10/0x10
| [   90.202637]  io_wqe_worker+0xfd/0x320
| [   90.202641]  ? finish_task_switch.isra.0+0xd3/0x290
| [   90.202644]  ? io_worker_handle_work+0x670/0x670
| [   90.202646]  ? io_worker_handle_work+0x670/0x670
| [   90.202649]  ret_from_fork+0x22/0x30

which is due to the RT kernel not liking a GFP_ATOMIC allocation inside
a raw spinlock. Besides that not working on RT, doing any kind of
allocation from inside schedule() is kind of nasty and should be avoided
if at all possible.

This particular path happens when an io-wq worker goes to sleep, and we
need a new worker to handle pending work. We currently allocate a small
data item to hold the information we need to create a new worker, but we
can instead include this data in the io_worker struct itself and just
protect it with a single bit lock. We only really need one per worker
anyway, as we will have run pending work between to sleep cycles.

https://lore.kernel.org/lkml/20210804082418.fbibprcwtzyt5qax@beryllium.lan/
Reported-by: Daniel Wagner <dwagner@suse.de>
Tested-by: Daniel Wagner <dwagner@suse.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/io-wq.c | 72 ++++++++++++++++++++++++++++++------------------------
 1 file changed, 40 insertions(+), 32 deletions(-)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 7d2ed8c7dd31..4ce83bb48021 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -51,6 +51,10 @@ struct io_worker {
 
 	struct completion ref_done;
 
+	unsigned long create_state;
+	struct callback_head create_work;
+	int create_index;
+
 	struct rcu_head rcu;
 };
 
@@ -272,24 +276,18 @@ static void io_wqe_inc_running(struct io_worker *worker)
 	atomic_inc(&acct->nr_running);
 }
 
-struct create_worker_data {
-	struct callback_head work;
-	struct io_wqe *wqe;
-	int index;
-};
-
 static void create_worker_cb(struct callback_head *cb)
 {
-	struct create_worker_data *cwd;
+	struct io_worker *worker;
 	struct io_wq *wq;
 	struct io_wqe *wqe;
 	struct io_wqe_acct *acct;
 	bool do_create = false, first = false;
 
-	cwd = container_of(cb, struct create_worker_data, work);
-	wqe = cwd->wqe;
+	worker = container_of(cb, struct io_worker, create_work);
+	wqe = worker->wqe;
 	wq = wqe->wq;
-	acct = &wqe->acct[cwd->index];
+	acct = &wqe->acct[worker->create_index];
 	raw_spin_lock_irq(&wqe->lock);
 	if (acct->nr_workers < acct->max_workers) {
 		if (!acct->nr_workers)
@@ -299,33 +297,42 @@ static void create_worker_cb(struct callback_head *cb)
 	}
 	raw_spin_unlock_irq(&wqe->lock);
 	if (do_create) {
-		create_io_worker(wq, wqe, cwd->index, first);
+		create_io_worker(wq, wqe, worker->create_index, first);
 	} else {
 		atomic_dec(&acct->nr_running);
 		io_worker_ref_put(wq);
 	}
-	kfree(cwd);
+	clear_bit_unlock(0, &worker->create_state);
+	io_worker_release(worker);
 }
 
-static void io_queue_worker_create(struct io_wqe *wqe, struct io_wqe_acct *acct)
+static void io_queue_worker_create(struct io_wqe *wqe, struct io_worker *worker,
+				   struct io_wqe_acct *acct)
 {
-	struct create_worker_data *cwd;
 	struct io_wq *wq = wqe->wq;
 
 	/* raced with exit, just ignore create call */
 	if (test_bit(IO_WQ_BIT_EXIT, &wq->state))
 		goto fail;
+	if (!io_worker_get(worker))
+		goto fail;
+	/*
+	 * create_state manages ownership of create_work/index. We should
+	 * only need one entry per worker, as the worker going to sleep
+	 * will trigger the condition, and waking will clear it once it
+	 * runs the task_work.
+	 */
+	if (test_bit(0, &worker->create_state) ||
+	    test_and_set_bit_lock(0, &worker->create_state))
+		goto fail_release;
 
-	cwd = kmalloc(sizeof(*cwd), GFP_ATOMIC);
-	if (cwd) {
-		init_task_work(&cwd->work, create_worker_cb);
-		cwd->wqe = wqe;
-		cwd->index = acct->index;
-		if (!task_work_add(wq->task, &cwd->work, TWA_SIGNAL))
-			return;
-
-		kfree(cwd);
-	}
+	init_task_work(&worker->create_work, create_worker_cb);
+	worker->create_index = acct->index;
+	if (!task_work_add(wq->task, &worker->create_work, TWA_SIGNAL))
+		return;
+	clear_bit_unlock(0, &worker->create_state);
+fail_release:
+	io_worker_release(worker);
 fail:
 	atomic_dec(&acct->nr_running);
 	io_worker_ref_put(wq);
@@ -343,7 +350,7 @@ static void io_wqe_dec_running(struct io_worker *worker)
 	if (atomic_dec_and_test(&acct->nr_running) && io_wqe_run_queue(wqe)) {
 		atomic_inc(&acct->nr_running);
 		atomic_inc(&wqe->wq->worker_refs);
-		io_queue_worker_create(wqe, acct);
+		io_queue_worker_create(wqe, worker, acct);
 	}
 }
 
@@ -1004,12 +1011,12 @@ err_wq:
 
 static bool io_task_work_match(struct callback_head *cb, void *data)
 {
-	struct create_worker_data *cwd;
+	struct io_worker *worker;
 
 	if (cb->func != create_worker_cb)
 		return false;
-	cwd = container_of(cb, struct create_worker_data, work);
-	return cwd->wqe->wq == data;
+	worker = container_of(cb, struct io_worker, create_work);
+	return worker->wqe->wq == data;
 }
 
 void io_wq_exit_start(struct io_wq *wq)
@@ -1026,12 +1033,13 @@ static void io_wq_exit_workers(struct io_wq *wq)
 		return;
 
 	while ((cb = task_work_cancel_match(wq->task, io_task_work_match, wq)) != NULL) {
-		struct create_worker_data *cwd;
+		struct io_worker *worker;
 
-		cwd = container_of(cb, struct create_worker_data, work);
-		atomic_dec(&cwd->wqe->acct[cwd->index].nr_running);
+		worker = container_of(cb, struct io_worker, create_work);
+		atomic_dec(&worker->wqe->acct[worker->create_index].nr_running);
 		io_worker_ref_put(wq);
-		kfree(cwd);
+		clear_bit_unlock(0, &worker->create_state);
+		io_worker_release(worker);
 	}
 
 	rcu_read_lock();
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 042/334] s390/kasan: fix large PMD pages address alignment check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 041/334] io-wq: remove GFP_ATOMIC allocation off schedule out path Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 043/334] s390/pci: fix misleading rc in clp_set_pci_fn() Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Gordeev, Vasily Gorbik,
	Heiko Carstens, Sasha Levin

From: Alexander Gordeev <agordeev@linux.ibm.com>

[ Upstream commit ddd63c85ef67ea9ea7282ad35eafb6568047126e ]

It is currently possible to initialize a large PMD page when
the address is not aligned on page boundary.

Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Reviewed-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/mm/kasan_init.c | 41 +++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 21 deletions(-)

diff --git a/arch/s390/mm/kasan_init.c b/arch/s390/mm/kasan_init.c
index a0fdc6dc5f9d..cc3af046c14e 100644
--- a/arch/s390/mm/kasan_init.c
+++ b/arch/s390/mm/kasan_init.c
@@ -107,6 +107,9 @@ static void __init kasan_early_pgtable_populate(unsigned long address,
 		sgt_prot &= ~_SEGMENT_ENTRY_NOEXEC;
 	}
 
+	/*
+	 * The first 1MB of 1:1 mapping is mapped with 4KB pages
+	 */
 	while (address < end) {
 		pg_dir = pgd_offset_k(address);
 		if (pgd_none(*pg_dir)) {
@@ -157,30 +160,26 @@ static void __init kasan_early_pgtable_populate(unsigned long address,
 
 		pm_dir = pmd_offset(pu_dir, address);
 		if (pmd_none(*pm_dir)) {
-			if (mode == POPULATE_ZERO_SHADOW &&
-			    IS_ALIGNED(address, PMD_SIZE) &&
+			if (IS_ALIGNED(address, PMD_SIZE) &&
 			    end - address >= PMD_SIZE) {
-				pmd_populate(&init_mm, pm_dir,
-						kasan_early_shadow_pte);
-				address = (address + PMD_SIZE) & PMD_MASK;
-				continue;
-			}
-			/* the first megabyte of 1:1 is mapped with 4k pages */
-			if (has_edat && address && end - address >= PMD_SIZE &&
-			    mode != POPULATE_ZERO_SHADOW) {
-				void *page;
-
-				if (mode == POPULATE_ONE2ONE) {
-					page = (void *)address;
-				} else {
-					page = kasan_early_alloc_segment();
-					memset(page, 0, _SEGMENT_SIZE);
+				if (mode == POPULATE_ZERO_SHADOW) {
+					pmd_populate(&init_mm, pm_dir, kasan_early_shadow_pte);
+					address = (address + PMD_SIZE) & PMD_MASK;
+					continue;
+				} else if (has_edat && address) {
+					void *page;
+
+					if (mode == POPULATE_ONE2ONE) {
+						page = (void *)address;
+					} else {
+						page = kasan_early_alloc_segment();
+						memset(page, 0, _SEGMENT_SIZE);
+					}
+					pmd_val(*pm_dir) = __pa(page) | sgt_prot;
+					address = (address + PMD_SIZE) & PMD_MASK;
+					continue;
 				}
-				pmd_val(*pm_dir) = __pa(page) | sgt_prot;
-				address = (address + PMD_SIZE) & PMD_MASK;
-				continue;
 			}
-
 			pt_dir = kasan_early_pte_alloc();
 			pmd_populate(&init_mm, pm_dir, pt_dir);
 		} else if (pmd_large(*pm_dir)) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 043/334] s390/pci: fix misleading rc in clp_set_pci_fn()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 042/334] s390/kasan: fix large PMD pages address alignment check Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 044/334] s390/debug: keep debug data on resize Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Rosato, Niklas Schnelle,
	Heiko Carstens, Sasha Levin

From: Niklas Schnelle <schnelle@linux.ibm.com>

[ Upstream commit f7addcdd527a6dddfebe20c358b87bdb95624612 ]

Currently clp_set_pci_fn() always returns 0 as long as the CLP request
itself succeeds even if the operation itself returns a response code
other than CLP_RC_OK or CLP_RC_SETPCIFN_ALRDY. This is highly misleading
because calling code assumes that a zero rc means that the operation was
successful.

Fix this by returning the response code or cc on failure with the
exception of the special handling for CLP_RC_SETPCIFN_ALRDY. Also let's
not assume that the returned function handle for CLP_RC_SETPCIFN_ALRDY
is 0, we don't need it anyway.

Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/pci/pci.c     |  7 ++++---
 arch/s390/pci/pci_clp.c | 33 ++++++++++++++++-----------------
 2 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index 8fcb7ecb7225..77cd965cffef 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -661,9 +661,10 @@ int zpci_enable_device(struct zpci_dev *zdev)
 {
 	int rc;
 
-	rc = clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES);
-	if (rc)
+	if (clp_enable_fh(zdev, ZPCI_NR_DMA_SPACES)) {
+		rc = -EIO;
 		goto out;
+	}
 
 	rc = zpci_dma_init_device(zdev);
 	if (rc)
@@ -684,7 +685,7 @@ int zpci_disable_device(struct zpci_dev *zdev)
 	 * The zPCI function may already be disabled by the platform, this is
 	 * detected in clp_disable_fh() which becomes a no-op.
 	 */
-	return clp_disable_fh(zdev);
+	return clp_disable_fh(zdev) ? -EIO : 0;
 }
 
 /**
diff --git a/arch/s390/pci/pci_clp.c b/arch/s390/pci/pci_clp.c
index d3331596ddbe..0a0e8b8293be 100644
--- a/arch/s390/pci/pci_clp.c
+++ b/arch/s390/pci/pci_clp.c
@@ -213,15 +213,19 @@ out:
 }
 
 static int clp_refresh_fh(u32 fid);
-/*
- * Enable/Disable a given PCI function and update its function handle if
- * necessary
+/**
+ * clp_set_pci_fn() - Execute a command on a PCI function
+ * @zdev: Function that will be affected
+ * @nr_dma_as: DMA address space number
+ * @command: The command code to execute
+ *
+ * Returns: 0 on success, < 0 for Linux errors (e.g. -ENOMEM), and
+ * > 0 for non-success platform responses
  */
 static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
 {
 	struct clp_req_rsp_set_pci *rrb;
 	int rc, retries = 100;
-	u32 fid = zdev->fid;
 
 	rrb = clp_alloc_block(GFP_KERNEL);
 	if (!rrb)
@@ -245,17 +249,16 @@ static int clp_set_pci_fn(struct zpci_dev *zdev, u8 nr_dma_as, u8 command)
 		}
 	} while (rrb->response.hdr.rsp == CLP_RC_SETPCIFN_BUSY);
 
-	if (rc || rrb->response.hdr.rsp != CLP_RC_OK) {
-		zpci_err("Set PCI FN:\n");
-		zpci_err_clp(rrb->response.hdr.rsp, rc);
-	}
-
 	if (!rc && rrb->response.hdr.rsp == CLP_RC_OK) {
 		zdev->fh = rrb->response.fh;
-	} else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY &&
-			rrb->response.fh == 0) {
+	} else if (!rc && rrb->response.hdr.rsp == CLP_RC_SETPCIFN_ALRDY) {
 		/* Function is already in desired state - update handle */
-		rc = clp_refresh_fh(fid);
+		rc = clp_refresh_fh(zdev->fid);
+	} else {
+		zpci_err("Set PCI FN:\n");
+		zpci_err_clp(rrb->response.hdr.rsp, rc);
+		if (!rc)
+			rc = rrb->response.hdr.rsp;
 	}
 	clp_free_block(rrb);
 	return rc;
@@ -301,17 +304,13 @@ int clp_enable_fh(struct zpci_dev *zdev, u8 nr_dma_as)
 
 	rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_PCI_FN);
 	zpci_dbg(3, "ena fid:%x, fh:%x, rc:%d\n", zdev->fid, zdev->fh, rc);
-	if (rc)
-		goto out;
-
-	if (zpci_use_mio(zdev)) {
+	if (!rc && zpci_use_mio(zdev)) {
 		rc = clp_set_pci_fn(zdev, nr_dma_as, CLP_SET_ENABLE_MIO);
 		zpci_dbg(3, "ena mio fid:%x, fh:%x, rc:%d\n",
 				zdev->fid, zdev->fh, rc);
 		if (rc)
 			clp_disable_fh(zdev);
 	}
-out:
 	return rc;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 044/334] s390/debug: keep debug data on resize
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 043/334] s390/pci: fix misleading rc in clp_set_pci_fn() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 045/334] s390/debug: fix debug area life cycle Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Oberparleiter, Heiko Carstens,
	Sasha Levin

From: Peter Oberparleiter <oberpar@linux.ibm.com>

[ Upstream commit 1204777867e8486a88dbb4793fe256b31ea05eeb ]

Any previously recorded s390dbf debug data is reset when a debug area
is resized using the 'pages' sysfs attribute. This can make
live-debugging unnecessarily complex.

Fix this by copying existing debug data to the newly allocated debug
area when resizing.

Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/debug.c | 74 ++++++++++++++++++++++++++++------------
 1 file changed, 53 insertions(+), 21 deletions(-)

diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 09b6c6402f9b..0dbe48f550ff 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -24,6 +24,7 @@
 #include <linux/export.h>
 #include <linux/init.h>
 #include <linux/fs.h>
+#include <linux/minmax.h>
 #include <linux/debugfs.h>
 
 #include <asm/debug.h>
@@ -92,6 +93,8 @@ static int debug_hex_ascii_format_fn(debug_info_t *id, struct debug_view *view,
 				     char *out_buf, const char *in_buf);
 static int debug_sprintf_format_fn(debug_info_t *id, struct debug_view *view,
 				   char *out_buf, debug_sprintf_entry_t *curr_event);
+static void debug_areas_swap(debug_info_t *a, debug_info_t *b);
+static void debug_events_append(debug_info_t *dest, debug_info_t *src);
 
 /* globals */
 
@@ -726,35 +729,28 @@ EXPORT_SYMBOL(debug_unregister);
  */
 static int debug_set_size(debug_info_t *id, int nr_areas, int pages_per_area)
 {
-	debug_entry_t ***new_areas;
+	debug_info_t *new_id;
 	unsigned long flags;
-	int rc = 0;
 
 	if (!id || (nr_areas <= 0) || (pages_per_area < 0))
 		return -EINVAL;
-	if (pages_per_area > 0) {
-		new_areas = debug_areas_alloc(pages_per_area, nr_areas);
-		if (!new_areas) {
-			pr_info("Allocating memory for %i pages failed\n",
-				pages_per_area);
-			rc = -ENOMEM;
-			goto out;
-		}
-	} else {
-		new_areas = NULL;
+
+	new_id = debug_info_alloc("", pages_per_area, nr_areas, id->buf_size,
+				  id->level, ALL_AREAS);
+	if (!new_id) {
+		pr_info("Allocating memory for %i pages failed\n",
+			pages_per_area);
+		return -ENOMEM;
 	}
+
 	spin_lock_irqsave(&id->lock, flags);
-	debug_areas_free(id);
-	id->areas = new_areas;
-	id->nr_areas = nr_areas;
-	id->pages_per_area = pages_per_area;
-	id->active_area = 0;
-	memset(id->active_entries, 0, sizeof(int)*id->nr_areas);
-	memset(id->active_pages, 0, sizeof(int)*id->nr_areas);
+	debug_events_append(new_id, id);
+	debug_areas_swap(new_id, id);
+	debug_info_free(new_id);
 	spin_unlock_irqrestore(&id->lock, flags);
 	pr_info("%s: set new size (%i pages)\n", id->name, pages_per_area);
-out:
-	return rc;
+
+	return 0;
 }
 
 /**
@@ -821,6 +817,42 @@ static inline debug_entry_t *get_active_entry(debug_info_t *id)
 				  id->active_entries[id->active_area]);
 }
 
+/* Swap debug areas of a and b. */
+static void debug_areas_swap(debug_info_t *a, debug_info_t *b)
+{
+	swap(a->nr_areas, b->nr_areas);
+	swap(a->pages_per_area, b->pages_per_area);
+	swap(a->areas, b->areas);
+	swap(a->active_area, b->active_area);
+	swap(a->active_pages, b->active_pages);
+	swap(a->active_entries, b->active_entries);
+}
+
+/* Append all debug events in active area from source to destination log. */
+static void debug_events_append(debug_info_t *dest, debug_info_t *src)
+{
+	debug_entry_t *from, *to, *last;
+
+	if (!src->areas || !dest->areas)
+		return;
+
+	/* Loop over all entries in src, starting with oldest. */
+	from = get_active_entry(src);
+	last = from;
+	do {
+		if (from->clock != 0LL) {
+			to = get_active_entry(dest);
+			memset(to, 0, dest->entry_size);
+			memcpy(to, from, min(src->entry_size,
+					     dest->entry_size));
+			proceed_active_entry(dest);
+		}
+
+		proceed_active_entry(src);
+		from = get_active_entry(src);
+	} while (from != last);
+}
+
 /*
  * debug_finish_entry:
  * - set timestamp, caller address, cpu number etc.
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 045/334] s390/debug: fix debug area life cycle
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 044/334] s390/debug: keep debug data on resize Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 046/334] s390/ap: fix state machine hang after failure to enable irq Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Oberparleiter, Heiko Carstens,
	Sasha Levin

From: Peter Oberparleiter <oberpar@linux.ibm.com>

[ Upstream commit 9372a82892c2caa6bccab9a4081166fa769699f8 ]

Currently allocation and registration of s390dbf debug areas are tied
together. As a result, a debug area cannot be unregistered and
re-registered while any process has an associated debugfs file open.

Fix this by splitting alloc/release from register/unregister.

Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/kernel/debug.c | 102 +++++++++++++++++++++------------------
 1 file changed, 56 insertions(+), 46 deletions(-)

diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index 0dbe48f550ff..05b765b8038e 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -314,24 +314,6 @@ static debug_info_t *debug_info_create(const char *name, int pages_per_area,
 		goto out;
 
 	rc->mode = mode & ~S_IFMT;
-
-	/* create root directory */
-	rc->debugfs_root_entry = debugfs_create_dir(rc->name,
-						    debug_debugfs_root_entry);
-
-	/* append new element to linked list */
-	if (!debug_area_first) {
-		/* first element in list */
-		debug_area_first = rc;
-		rc->prev = NULL;
-	} else {
-		/* append element to end of list */
-		debug_area_last->next = rc;
-		rc->prev = debug_area_last;
-	}
-	debug_area_last = rc;
-	rc->next = NULL;
-
 	refcount_set(&rc->ref_count, 1);
 out:
 	return rc;
@@ -391,27 +373,10 @@ static void debug_info_get(debug_info_t *db_info)
  */
 static void debug_info_put(debug_info_t *db_info)
 {
-	int i;
-
 	if (!db_info)
 		return;
-	if (refcount_dec_and_test(&db_info->ref_count)) {
-		for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
-			if (!db_info->views[i])
-				continue;
-			debugfs_remove(db_info->debugfs_entries[i]);
-		}
-		debugfs_remove(db_info->debugfs_root_entry);
-		if (db_info == debug_area_first)
-			debug_area_first = db_info->next;
-		if (db_info == debug_area_last)
-			debug_area_last = db_info->prev;
-		if (db_info->prev)
-			db_info->prev->next = db_info->next;
-		if (db_info->next)
-			db_info->next->prev = db_info->prev;
+	if (refcount_dec_and_test(&db_info->ref_count))
 		debug_info_free(db_info);
-	}
 }
 
 /*
@@ -635,6 +600,31 @@ static int debug_close(struct inode *inode, struct file *file)
 	return 0; /* success */
 }
 
+/* Create debugfs entries and add to internal list. */
+static void _debug_register(debug_info_t *id)
+{
+	/* create root directory */
+	id->debugfs_root_entry = debugfs_create_dir(id->name,
+						    debug_debugfs_root_entry);
+
+	/* append new element to linked list */
+	if (!debug_area_first) {
+		/* first element in list */
+		debug_area_first = id;
+		id->prev = NULL;
+	} else {
+		/* append element to end of list */
+		debug_area_last->next = id;
+		id->prev = debug_area_last;
+	}
+	debug_area_last = id;
+	id->next = NULL;
+
+	debug_register_view(id, &debug_level_view);
+	debug_register_view(id, &debug_flush_view);
+	debug_register_view(id, &debug_pages_view);
+}
+
 /**
  * debug_register_mode() - creates and initializes debug area.
  *
@@ -664,19 +654,16 @@ debug_info_t *debug_register_mode(const char *name, int pages_per_area,
 	if ((uid != 0) || (gid != 0))
 		pr_warn("Root becomes the owner of all s390dbf files in sysfs\n");
 	BUG_ON(!initialized);
-	mutex_lock(&debug_mutex);
 
 	/* create new debug_info */
 	rc = debug_info_create(name, pages_per_area, nr_areas, buf_size, mode);
-	if (!rc)
-		goto out;
-	debug_register_view(rc, &debug_level_view);
-	debug_register_view(rc, &debug_flush_view);
-	debug_register_view(rc, &debug_pages_view);
-out:
-	if (!rc)
+	if (rc) {
+		mutex_lock(&debug_mutex);
+		_debug_register(rc);
+		mutex_unlock(&debug_mutex);
+	} else {
 		pr_err("Registering debug feature %s failed\n", name);
-	mutex_unlock(&debug_mutex);
+	}
 	return rc;
 }
 EXPORT_SYMBOL(debug_register_mode);
@@ -705,6 +692,27 @@ debug_info_t *debug_register(const char *name, int pages_per_area,
 }
 EXPORT_SYMBOL(debug_register);
 
+/* Remove debugfs entries and remove from internal list. */
+static void _debug_unregister(debug_info_t *id)
+{
+	int i;
+
+	for (i = 0; i < DEBUG_MAX_VIEWS; i++) {
+		if (!id->views[i])
+			continue;
+		debugfs_remove(id->debugfs_entries[i]);
+	}
+	debugfs_remove(id->debugfs_root_entry);
+	if (id == debug_area_first)
+		debug_area_first = id->next;
+	if (id == debug_area_last)
+		debug_area_last = id->prev;
+	if (id->prev)
+		id->prev->next = id->next;
+	if (id->next)
+		id->next->prev = id->prev;
+}
+
 /**
  * debug_unregister() - give back debug area.
  *
@@ -718,8 +726,10 @@ void debug_unregister(debug_info_t *id)
 	if (!id)
 		return;
 	mutex_lock(&debug_mutex);
-	debug_info_put(id);
+	_debug_unregister(id);
 	mutex_unlock(&debug_mutex);
+
+	debug_info_put(id);
 }
 EXPORT_SYMBOL(debug_unregister);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 046/334] s390/ap: fix state machine hang after failure to enable irq
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 045/334] s390/debug: fix debug area life cycle Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 047/334] s390/smp: enable DAT before CPU restart callback is called Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harald Freudenberger, Heiko Carstens,
	Sasha Levin

From: Harald Freudenberger <freude@linux.ibm.com>

[ Upstream commit cabebb697c98fb1f05cc950a747a9b6ec61a5b01 ]

If for any reason the interrupt enable for an ap queue fails the
state machine run for the queue returned wrong return codes to the
caller. So the caller assumed interrupt support for this queue in
enabled and thus did not re-establish the high resolution timer used
for polling. In the end this let to a hang for the user space process
waiting "forever" for the reply.

This patch reworks these return codes to return correct indications
for the caller to re-establish the timer when a queue runs without
interrupt support.

Please note that this is fixing a wrong behavior after a first
failure (enable interrupt support for the queue) failed. However,
looks like this occasionally happens on KVM systems.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/s390/crypto/ap_bus.c   | 25 ++++++++-----------------
 drivers/s390/crypto/ap_bus.h   | 10 ++--------
 drivers/s390/crypto/ap_queue.c | 20 +++++++++++---------
 3 files changed, 21 insertions(+), 34 deletions(-)

diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 8d3a1d84a757..9c4f3c388934 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -127,22 +127,13 @@ static struct bus_type ap_bus_type;
 /* Adapter interrupt definitions */
 static void ap_interrupt_handler(struct airq_struct *airq, bool floating);
 
-static int ap_airq_flag;
+static bool ap_irq_flag;
 
 static struct airq_struct ap_airq = {
 	.handler = ap_interrupt_handler,
 	.isc = AP_ISC,
 };
 
-/**
- * ap_using_interrupts() - Returns non-zero if interrupt support is
- * available.
- */
-static inline int ap_using_interrupts(void)
-{
-	return ap_airq_flag;
-}
-
 /**
  * ap_airq_ptr() - Get the address of the adapter interrupt indicator
  *
@@ -152,7 +143,7 @@ static inline int ap_using_interrupts(void)
  */
 void *ap_airq_ptr(void)
 {
-	if (ap_using_interrupts())
+	if (ap_irq_flag)
 		return ap_airq.lsi_ptr;
 	return NULL;
 }
@@ -396,7 +387,7 @@ void ap_wait(enum ap_sm_wait wait)
 	switch (wait) {
 	case AP_SM_WAIT_AGAIN:
 	case AP_SM_WAIT_INTERRUPT:
-		if (ap_using_interrupts())
+		if (ap_irq_flag)
 			break;
 		if (ap_poll_kthread) {
 			wake_up(&ap_poll_wait);
@@ -471,7 +462,7 @@ static void ap_tasklet_fn(unsigned long dummy)
 	 * be received. Doing it in the beginning of the tasklet is therefor
 	 * important that no requests on any AP get lost.
 	 */
-	if (ap_using_interrupts())
+	if (ap_irq_flag)
 		xchg(ap_airq.lsi_ptr, 0);
 
 	spin_lock_bh(&ap_queues_lock);
@@ -541,7 +532,7 @@ static int ap_poll_thread_start(void)
 {
 	int rc;
 
-	if (ap_using_interrupts() || ap_poll_kthread)
+	if (ap_irq_flag || ap_poll_kthread)
 		return 0;
 	mutex_lock(&ap_poll_thread_mutex);
 	ap_poll_kthread = kthread_run(ap_poll_thread, NULL, "appoll");
@@ -1187,7 +1178,7 @@ static BUS_ATTR_RO(ap_adapter_mask);
 static ssize_t ap_interrupts_show(struct bus_type *bus, char *buf)
 {
 	return scnprintf(buf, PAGE_SIZE, "%d\n",
-			 ap_using_interrupts() ? 1 : 0);
+			 ap_irq_flag ? 1 : 0);
 }
 
 static BUS_ATTR_RO(ap_interrupts);
@@ -1912,7 +1903,7 @@ static int __init ap_module_init(void)
 	/* enable interrupts if available */
 	if (ap_interrupts_available()) {
 		rc = register_adapter_interrupt(&ap_airq);
-		ap_airq_flag = (rc == 0);
+		ap_irq_flag = (rc == 0);
 	}
 
 	/* Create /sys/bus/ap. */
@@ -1956,7 +1947,7 @@ out_work:
 out_bus:
 	bus_unregister(&ap_bus_type);
 out:
-	if (ap_using_interrupts())
+	if (ap_irq_flag)
 		unregister_adapter_interrupt(&ap_airq);
 	kfree(ap_qci_info);
 	return rc;
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 8f18abdbbc2b..6dd5e8f0380c 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -80,12 +80,6 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
 #define AP_FUNC_EP11  5
 #define AP_FUNC_APXA  6
 
-/*
- * AP interrupt states
- */
-#define AP_INTR_DISABLED	0	/* AP interrupt disabled */
-#define AP_INTR_ENABLED		1	/* AP interrupt enabled */
-
 /*
  * AP queue state machine states
  */
@@ -112,7 +106,7 @@ enum ap_sm_event {
  * AP queue state wait behaviour
  */
 enum ap_sm_wait {
-	AP_SM_WAIT_AGAIN,	/* retry immediately */
+	AP_SM_WAIT_AGAIN = 0,	/* retry immediately */
 	AP_SM_WAIT_TIMEOUT,	/* wait for timeout */
 	AP_SM_WAIT_INTERRUPT,	/* wait for thin interrupt (if available) */
 	AP_SM_WAIT_NONE,	/* no wait */
@@ -186,7 +180,7 @@ struct ap_queue {
 	enum ap_dev_state dev_state;	/* queue device state */
 	bool config;			/* configured state */
 	ap_qid_t qid;			/* AP queue id. */
-	int interrupt;			/* indicate if interrupts are enabled */
+	bool interrupt;			/* indicate if interrupts are enabled */
 	int queue_count;		/* # messages currently on AP queue. */
 	int pendingq_count;		/* # requests on pendingq list. */
 	int requestq_count;		/* # requests on requestq list. */
diff --git a/drivers/s390/crypto/ap_queue.c b/drivers/s390/crypto/ap_queue.c
index 669f96fddad6..d70c4d3d0907 100644
--- a/drivers/s390/crypto/ap_queue.c
+++ b/drivers/s390/crypto/ap_queue.c
@@ -19,7 +19,7 @@
 static void __ap_flush_queue(struct ap_queue *aq);
 
 /**
- * ap_queue_enable_interruption(): Enable interruption on an AP queue.
+ * ap_queue_enable_irq(): Enable interrupt support on this AP queue.
  * @qid: The AP queue number
  * @ind: the notification indicator byte
  *
@@ -27,7 +27,7 @@ static void __ap_flush_queue(struct ap_queue *aq);
  * value it waits a while and tests the AP queue if interrupts
  * have been switched on using ap_test_queue().
  */
-static int ap_queue_enable_interruption(struct ap_queue *aq, void *ind)
+static int ap_queue_enable_irq(struct ap_queue *aq, void *ind)
 {
 	struct ap_queue_status status;
 	struct ap_qirq_ctrl qirqctrl = { 0 };
@@ -218,7 +218,8 @@ static enum ap_sm_wait ap_sm_read(struct ap_queue *aq)
 		return AP_SM_WAIT_NONE;
 	case AP_RESPONSE_NO_PENDING_REPLY:
 		if (aq->queue_count > 0)
-			return AP_SM_WAIT_INTERRUPT;
+			return aq->interrupt ?
+				AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT;
 		aq->sm_state = AP_SM_STATE_IDLE;
 		return AP_SM_WAIT_NONE;
 	default:
@@ -272,7 +273,8 @@ static enum ap_sm_wait ap_sm_write(struct ap_queue *aq)
 		fallthrough;
 	case AP_RESPONSE_Q_FULL:
 		aq->sm_state = AP_SM_STATE_QUEUE_FULL;
-		return AP_SM_WAIT_INTERRUPT;
+		return aq->interrupt ?
+			AP_SM_WAIT_INTERRUPT : AP_SM_WAIT_TIMEOUT;
 	case AP_RESPONSE_RESET_IN_PROGRESS:
 		aq->sm_state = AP_SM_STATE_RESET_WAIT;
 		return AP_SM_WAIT_TIMEOUT;
@@ -322,7 +324,7 @@ static enum ap_sm_wait ap_sm_reset(struct ap_queue *aq)
 	case AP_RESPONSE_NORMAL:
 	case AP_RESPONSE_RESET_IN_PROGRESS:
 		aq->sm_state = AP_SM_STATE_RESET_WAIT;
-		aq->interrupt = AP_INTR_DISABLED;
+		aq->interrupt = false;
 		return AP_SM_WAIT_TIMEOUT;
 	default:
 		aq->dev_state = AP_DEV_STATE_ERROR;
@@ -355,7 +357,7 @@ static enum ap_sm_wait ap_sm_reset_wait(struct ap_queue *aq)
 	switch (status.response_code) {
 	case AP_RESPONSE_NORMAL:
 		lsi_ptr = ap_airq_ptr();
-		if (lsi_ptr && ap_queue_enable_interruption(aq, lsi_ptr) == 0)
+		if (lsi_ptr && ap_queue_enable_irq(aq, lsi_ptr) == 0)
 			aq->sm_state = AP_SM_STATE_SETIRQ_WAIT;
 		else
 			aq->sm_state = (aq->queue_count > 0) ?
@@ -396,7 +398,7 @@ static enum ap_sm_wait ap_sm_setirq_wait(struct ap_queue *aq)
 
 	if (status.irq_enabled == 1) {
 		/* Irqs are now enabled */
-		aq->interrupt = AP_INTR_ENABLED;
+		aq->interrupt = true;
 		aq->sm_state = (aq->queue_count > 0) ?
 			AP_SM_STATE_WORKING : AP_SM_STATE_IDLE;
 	}
@@ -586,7 +588,7 @@ static ssize_t interrupt_show(struct device *dev,
 	spin_lock_bh(&aq->lock);
 	if (aq->sm_state == AP_SM_STATE_SETIRQ_WAIT)
 		rc = scnprintf(buf, PAGE_SIZE, "Enable Interrupt pending.\n");
-	else if (aq->interrupt == AP_INTR_ENABLED)
+	else if (aq->interrupt)
 		rc = scnprintf(buf, PAGE_SIZE, "Interrupts enabled.\n");
 	else
 		rc = scnprintf(buf, PAGE_SIZE, "Interrupts disabled.\n");
@@ -767,7 +769,7 @@ struct ap_queue *ap_queue_create(ap_qid_t qid, int device_type)
 	aq->ap_dev.device.type = &ap_queue_type;
 	aq->ap_dev.device_type = device_type;
 	aq->qid = qid;
-	aq->interrupt = AP_INTR_DISABLED;
+	aq->interrupt = false;
 	spin_lock_init(&aq->lock);
 	INIT_LIST_HEAD(&aq->pendingq);
 	INIT_LIST_HEAD(&aq->requestq);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 047/334] s390/smp: enable DAT before CPU restart callback is called
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 046/334] s390/ap: fix state machine hang after failure to enable irq Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 048/334] sched/debug: Dont update sched_domain debug directories before sched_debug_init() Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Alexander Gordeev,
	Sasha Levin

From: Alexander Gordeev <agordeev@linux.ibm.com>

[ Upstream commit 915fea04f9320d0f4ab6ecbb6bf759eebcd2c41d ]

The restart interrupt is triggered whenever a secondary CPU is
brought online, a remote function call dispatched from another
CPU or a manual PSW restart is initiated and causes the system
to kdump. The handling routine is always called with DAT turned
off. It then initializes the stack frame and invokes a callback.

The existing callbacks handle DAT as follows:

  * __do_restart() and __machine_kexec() turn in on upon entry;
  * __ipl_run(), __reipl_run() and __dump_run() do not turn it
    right away, but all of them call diag308() - which turns DAT
    on, but only if kasan is enabled;

In addition to the described complexity all callbacks (and the
functions they call) should avoid kasan instrumentation while
DAT is off.

This update enables DAT in the assembler restart handler and
relieves any callbacks (which are mostly C functions) from
dealing with DAT altogether.

There are four types of CPU restart that initialize control
registers in different ways:

  1. Start of secondary CPU on boot - control registers are
     inherited from the IPL CPU;
  2. Restart of online CPU - control registers of the CPU being
     restarted are kept;
  3. Hotplug of offline CPU - control registers are inherited
     from the starting CPU;
  4. Start of offline CPU triggered by manual PSW restart -
     the control registers are read from the absolute lowcore
     and contain the boot time IPL CPU values updated with all
     follow-up calls of smp_ctl_set_bit() and smp_ctl_clear_bit()
     routines;

In first three cases contents of the control registers is the
most recent. In the latter case control registers are good
enough to facilitate successful completion of kdump operation.

Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/s390/include/asm/lowcore.h   |  3 ++-
 arch/s390/include/asm/processor.h |  2 ++
 arch/s390/kernel/asm-offsets.c    |  1 +
 arch/s390/kernel/entry.S          | 11 +++++++----
 arch/s390/kernel/ipl.c            |  3 ---
 arch/s390/kernel/machine_kexec.c  |  1 -
 arch/s390/kernel/setup.c          |  9 ++++++++-
 arch/s390/kernel/smp.c            | 31 ++++++++++++++++++++++---------
 8 files changed, 42 insertions(+), 19 deletions(-)

diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index 47bde5a20a41..11213c8bfca5 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -124,7 +124,8 @@ struct lowcore {
 	/* Restart function and parameter. */
 	__u64	restart_fn;			/* 0x0370 */
 	__u64	restart_data;			/* 0x0378 */
-	__u64	restart_source;			/* 0x0380 */
+	__u32	restart_source;			/* 0x0380 */
+	__u32	restart_flags;			/* 0x0384 */
 
 	/* Address space pointer. */
 	__u64	kernel_asce;			/* 0x0388 */
diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index ddc7858bbce4..879b8e3f609c 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -26,6 +26,8 @@
 #define _CIF_MCCK_GUEST		BIT(CIF_MCCK_GUEST)
 #define _CIF_DEDICATED_CPU	BIT(CIF_DEDICATED_CPU)
 
+#define RESTART_FLAG_CTLREGS	_AC(1 << 0, U)
+
 #ifndef __ASSEMBLY__
 
 #include <linux/cpumask.h>
diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c
index 77ff2130cb04..dc53b0452ce2 100644
--- a/arch/s390/kernel/asm-offsets.c
+++ b/arch/s390/kernel/asm-offsets.c
@@ -116,6 +116,7 @@ int main(void)
 	OFFSET(__LC_RESTART_FN, lowcore, restart_fn);
 	OFFSET(__LC_RESTART_DATA, lowcore, restart_data);
 	OFFSET(__LC_RESTART_SOURCE, lowcore, restart_source);
+	OFFSET(__LC_RESTART_FLAGS, lowcore, restart_flags);
 	OFFSET(__LC_KERNEL_ASCE, lowcore, kernel_asce);
 	OFFSET(__LC_USER_ASCE, lowcore, user_asce);
 	OFFSET(__LC_LPP, lowcore, lpp);
diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S
index 5a2f70cbd3a9..b9716a7e326d 100644
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -624,12 +624,15 @@ ENTRY(mcck_int_handler)
 4:	j	4b
 ENDPROC(mcck_int_handler)
 
-#
-# PSW restart interrupt handler
-#
 ENTRY(restart_int_handler)
 	ALTERNATIVE "", ".insn s,0xb2800000,_LPP_OFFSET", 40
 	stg	%r15,__LC_SAVE_AREA_RESTART
+	TSTMSK	__LC_RESTART_FLAGS,RESTART_FLAG_CTLREGS,4
+	jz	0f
+	la	%r15,4095
+	lctlg	%c0,%c15,__LC_CREGS_SAVE_AREA-4095(%r15)
+0:	larl	%r15,.Lstosm_tmp
+	stosm	0(%r15),0x04			# turn dat on, keep irqs off
 	lg	%r15,__LC_RESTART_STACK
 	xc	STACK_FRAME_OVERHEAD(__PT_SIZE,%r15),STACK_FRAME_OVERHEAD(%r15)
 	stmg	%r0,%r14,STACK_FRAME_OVERHEAD+__PT_R0(%r15)
@@ -638,7 +641,7 @@ ENTRY(restart_int_handler)
 	xc	0(STACK_FRAME_OVERHEAD,%r15),0(%r15)
 	lg	%r1,__LC_RESTART_FN		# load fn, parm & source cpu
 	lg	%r2,__LC_RESTART_DATA
-	lg	%r3,__LC_RESTART_SOURCE
+	lgf	%r3,__LC_RESTART_SOURCE
 	ltgr	%r3,%r3				# test source cpu address
 	jm	1f				# negative -> skip source stop
 0:	sigp	%r4,%r3,SIGP_SENSE		# sigp sense to source cpu
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 50e2c21e0ec9..911cd3912351 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -179,8 +179,6 @@ static inline int __diag308(unsigned long subcode, void *addr)
 
 int diag308(unsigned long subcode, void *addr)
 {
-	if (IS_ENABLED(CONFIG_KASAN))
-		__arch_local_irq_stosm(0x04); /* enable DAT */
 	diag_stat_inc(DIAG_STAT_X308);
 	return __diag308(subcode, addr);
 }
@@ -1843,7 +1841,6 @@ static struct kobj_attribute on_restart_attr = __ATTR_RW(on_restart);
 
 static void __do_restart(void *ignore)
 {
-	__arch_local_irq_stosm(0x04); /* enable DAT */
 	smp_send_stop();
 #ifdef CONFIG_CRASH_DUMP
 	crash_kexec(NULL);
diff --git a/arch/s390/kernel/machine_kexec.c b/arch/s390/kernel/machine_kexec.c
index 1005a6935fbe..c1fbc979e0e8 100644
--- a/arch/s390/kernel/machine_kexec.c
+++ b/arch/s390/kernel/machine_kexec.c
@@ -263,7 +263,6 @@ static void __do_machine_kexec(void *data)
  */
 static void __machine_kexec(void *data)
 {
-	__arch_local_irq_stosm(0x04); /* enable DAT */
 	pfault_fini();
 	tracing_off();
 	debug_locks_off();
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index ff0f9e838916..ee23908f1b96 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -421,7 +421,7 @@ static void __init setup_lowcore_dat_off(void)
 	lc->restart_stack = (unsigned long) restart_stack;
 	lc->restart_fn = (unsigned long) do_restart;
 	lc->restart_data = 0;
-	lc->restart_source = -1UL;
+	lc->restart_source = -1U;
 
 	mcck_stack = (unsigned long)memblock_alloc(THREAD_SIZE, THREAD_SIZE);
 	if (!mcck_stack)
@@ -450,12 +450,19 @@ static void __init setup_lowcore_dat_off(void)
 
 static void __init setup_lowcore_dat_on(void)
 {
+	struct lowcore *lc = lowcore_ptr[0];
+
 	__ctl_clear_bit(0, 28);
 	S390_lowcore.external_new_psw.mask |= PSW_MASK_DAT;
 	S390_lowcore.svc_new_psw.mask |= PSW_MASK_DAT;
 	S390_lowcore.program_new_psw.mask |= PSW_MASK_DAT;
 	S390_lowcore.io_new_psw.mask |= PSW_MASK_DAT;
+	__ctl_store(S390_lowcore.cregs_save_area, 0, 15);
 	__ctl_set_bit(0, 28);
+	mem_assign_absolute(S390_lowcore.restart_flags, RESTART_FLAG_CTLREGS);
+	mem_assign_absolute(S390_lowcore.program_new_psw, lc->program_new_psw);
+	memcpy_absolute(&S390_lowcore.cregs_save_area, lc->cregs_save_area,
+			sizeof(S390_lowcore.cregs_save_area));
 }
 
 static struct resource code_resource = {
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 8984711f72ed..8e8ace899407 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -252,6 +252,7 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu)
 	cpumask_set_cpu(cpu, &init_mm.context.cpu_attach_mask);
 	cpumask_set_cpu(cpu, mm_cpumask(&init_mm));
 	lc->cpu_nr = cpu;
+	lc->restart_flags = RESTART_FLAG_CTLREGS;
 	lc->spinlock_lockval = arch_spin_lockval(cpu);
 	lc->spinlock_index = 0;
 	lc->percpu_offset = __per_cpu_offset[cpu];
@@ -297,7 +298,7 @@ static void pcpu_start_fn(struct pcpu *pcpu, void (*func)(void *), void *data)
 	lc->restart_stack = lc->nodat_stack;
 	lc->restart_fn = (unsigned long) func;
 	lc->restart_data = (unsigned long) data;
-	lc->restart_source = -1UL;
+	lc->restart_source = -1U;
 	pcpu_sigp_retry(pcpu, SIGP_RESTART, 0);
 }
 
@@ -311,12 +312,12 @@ static void __pcpu_delegate(pcpu_delegate_fn *func, void *data)
 	func(data);	/* should not return */
 }
 
-static void __no_sanitize_address pcpu_delegate(struct pcpu *pcpu,
-						pcpu_delegate_fn *func,
-						void *data, unsigned long stack)
+static void pcpu_delegate(struct pcpu *pcpu,
+			  pcpu_delegate_fn *func,
+			  void *data, unsigned long stack)
 {
 	struct lowcore *lc = lowcore_ptr[pcpu - pcpu_devices];
-	unsigned long source_cpu = stap();
+	unsigned int source_cpu = stap();
 
 	__load_psw_mask(PSW_KERNEL_BITS | PSW_MASK_DAT);
 	if (pcpu->address == source_cpu) {
@@ -569,6 +570,9 @@ static void smp_ctl_bit_callback(void *info)
 	__ctl_load(cregs, 0, 15);
 }
 
+static DEFINE_SPINLOCK(ctl_lock);
+static unsigned long ctlreg;
+
 /*
  * Set a bit in a control register of all cpus
  */
@@ -576,6 +580,11 @@ void smp_ctl_set_bit(int cr, int bit)
 {
 	struct ec_creg_mask_parms parms = { 1UL << bit, -1UL, cr };
 
+	spin_lock(&ctl_lock);
+	memcpy_absolute(&ctlreg, &S390_lowcore.cregs_save_area[cr], sizeof(ctlreg));
+	__set_bit(bit, &ctlreg);
+	memcpy_absolute(&S390_lowcore.cregs_save_area[cr], &ctlreg, sizeof(ctlreg));
+	spin_unlock(&ctl_lock);
 	on_each_cpu(smp_ctl_bit_callback, &parms, 1);
 }
 EXPORT_SYMBOL(smp_ctl_set_bit);
@@ -587,6 +596,11 @@ void smp_ctl_clear_bit(int cr, int bit)
 {
 	struct ec_creg_mask_parms parms = { 0, ~(1UL << bit), cr };
 
+	spin_lock(&ctl_lock);
+	memcpy_absolute(&ctlreg, &S390_lowcore.cregs_save_area[cr], sizeof(ctlreg));
+	__clear_bit(bit, &ctlreg);
+	memcpy_absolute(&S390_lowcore.cregs_save_area[cr], &ctlreg, sizeof(ctlreg));
+	spin_unlock(&ctl_lock);
 	on_each_cpu(smp_ctl_bit_callback, &parms, 1);
 }
 EXPORT_SYMBOL(smp_ctl_clear_bit);
@@ -895,14 +909,13 @@ static void smp_init_secondary(void)
 /*
  *	Activate a secondary processor.
  */
-static void __no_sanitize_address smp_start_secondary(void *cpuvoid)
+static void smp_start_secondary(void *cpuvoid)
 {
 	S390_lowcore.restart_stack = (unsigned long) restart_stack;
 	S390_lowcore.restart_fn = (unsigned long) do_restart;
 	S390_lowcore.restart_data = 0;
-	S390_lowcore.restart_source = -1UL;
-	__ctl_load(S390_lowcore.cregs_save_area, 0, 15);
-	__load_psw_mask(PSW_KERNEL_BITS | PSW_MASK_DAT);
+	S390_lowcore.restart_source = -1U;
+	S390_lowcore.restart_flags = 0;
 	call_on_stack_noreturn(smp_init_secondary, S390_lowcore.kernel_stack);
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 048/334] sched/debug: Dont update sched_domain debug directories before sched_debug_init()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 047/334] s390/smp: enable DAT before CPU restart callback is called Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 049/334] power: supply: cw2015: use dev_err_probe to allow deferred probe Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Valentin Schneider,
	Peter Zijlstra (Intel),
	Sasha Levin

From: Valentin Schneider <valentin.schneider@arm.com>

[ Upstream commit 459b09b5a3254008b63382bf41a9b36d0b590f57 ]

Since CPU capacity asymmetry can stem purely from maximum frequency
differences (e.g. Pixel 1), a rebuild of the scheduler topology can be
issued upon loading cpufreq, see:

  arch_topology.c::init_cpu_capacity_callback()

Turns out that if this rebuild happens *before* sched_debug_init() is
run (which is a late initcall), we end up messing up the sched_domain debug
directory: passing a NULL parent to debugfs_create_dir() ends up creating
the directory at the debugfs root, which in this case creates
/sys/kernel/debug/domains (instead of /sys/kernel/debug/sched/domains).

This currently doesn't happen on asymmetric systems which use cpufreq-scpi
or cpufreq-dt drivers, as those are loaded via
deferred_probe_initcall() (it is also a late initcall, but appears to be
ordered *after* sched_debug_init()).

Ionela has been working on detecting maximum frequency asymmetry via ACPI,
and that actually happens via a *device* initcall, thus before
sched_debug_init(), and causes the aforementionned debugfs mayhem.

One option would be to punt sched_debug_init() down to
fs_initcall_sync(). Preventing update_sched_domain_debugfs() from running
before sched_debug_init() appears to be the safer option.

Fixes: 3b87f136f8fc ("sched,debug: Convert sysctl sched_domains to debugfs")
Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: http://lore.kernel.org/r/20210514095339.12979-1-ionela.voinescu@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/debug.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 0c5ec2776ddf..7e08e3d947c2 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -388,6 +388,13 @@ void update_sched_domain_debugfs(void)
 {
 	int cpu, i;
 
+	/*
+	 * This can unfortunately be invoked before sched_debug_init() creates
+	 * the debug directory. Don't touch sd_sysctl_cpus until then.
+	 */
+	if (!debugfs_sched)
+		return;
+
 	if (!cpumask_available(sd_sysctl_cpus)) {
 		if (!alloc_cpumask_var(&sd_sysctl_cpus, GFP_KERNEL))
 			return;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 049/334] power: supply: cw2015: use dev_err_probe to allow deferred probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 048/334] sched/debug: Dont update sched_domain debug directories before sched_debug_init() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 050/334] m68k: emu: Fix invalid free in nfeth_cleanup() Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Robinson,
	Javier Martinez Canillas, Sebastian Reichel, Sasha Levin

From: Peter Robinson <pbrobinson@gmail.com>

[ Upstream commit ad1abe476995d97bfe7546ea91bb4f3dcdfbf3ab ]

Deal with deferred probe using dev_err_probe so the error is handled
and avoid logging lots probe defer information like the following:

[    9.125121] cw2015 4-0062: Failed to register power supply
[    9.211131] cw2015 4-0062: Failed to register power supply

Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver")
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/power/supply/cw2015_battery.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index d110597746b0..091868e9e9e8 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -679,7 +679,9 @@ static int cw_bat_probe(struct i2c_client *client)
 						    &cw2015_bat_desc,
 						    &psy_cfg);
 	if (IS_ERR(cw_bat->rk_bat)) {
-		dev_err(cw_bat->dev, "Failed to register power supply\n");
+		/* try again if this happens */
+		dev_err_probe(&client->dev, PTR_ERR(cw_bat->rk_bat),
+			"Failed to register power supply\n");
 		return PTR_ERR(cw_bat->rk_bat);
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 050/334] m68k: emu: Fix invalid free in nfeth_cleanup()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 049/334] power: supply: cw2015: use dev_err_probe to allow deferred probe Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 051/334] crypto: x86/aes-ni - add missing error checks in XTS code Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Geert Uytterhoeven,
	Sasha Levin

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ]

In the for loop all nfeth_dev array members should be freed, not only
the first one.  Freeing only the first array member can cause
double-free bugs and memory leaks.

Fixes: 9cd7b148312f ("m68k/atari: ARAnyM - Add support for network access")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Link: https://lore.kernel.org/r/20210705204727.10743-1-paskripkin@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/emu/nfeth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/m68k/emu/nfeth.c b/arch/m68k/emu/nfeth.c
index d2875e32abfc..79e55421cfb1 100644
--- a/arch/m68k/emu/nfeth.c
+++ b/arch/m68k/emu/nfeth.c
@@ -254,8 +254,8 @@ static void __exit nfeth_cleanup(void)
 
 	for (i = 0; i < MAX_UNIT; i++) {
 		if (nfeth_dev[i]) {
-			unregister_netdev(nfeth_dev[0]);
-			free_netdev(nfeth_dev[0]);
+			unregister_netdev(nfeth_dev[i]);
+			free_netdev(nfeth_dev[i]);
 		}
 	}
 	free_irq(nfEtherIRQ, nfeth_interrupt);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 051/334] crypto: x86/aes-ni - add missing error checks in XTS code
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 050/334] m68k: emu: Fix invalid free in nfeth_cleanup() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 052/334] crypto: ecc - handle unaligned input buffer in ecc_swap_digits Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dave Hansen, syzbot, Ard Biesheuvel,
	Eric Biggers, Herbert Xu, Sasha Levin

From: Ard Biesheuvel <ardb@kernel.org>

[ Upstream commit 821720b9f34ec54106ebf012a712ba73bbcf47c2 ]

The updated XTS code fails to check the return code of skcipher_walk_virt,
which may lead to skcipher_walk_abort() or skcipher_walk_done() being called
while the walk argument is in an inconsistent state.

So check the return value after each such call, and bail on errors.

Fixes: 2481104fe98d ("crypto: x86/aes-ni-xts - rewrite and drop indirections via glue helper")
Reported-by: Dave Hansen <dave.hansen@intel.com>
Reported-by: syzbot <syzbot+5d1bad8042a8f0e8117a@syzkaller.appspotmail.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/crypto/aesni-intel_glue.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
index 2144e54a6c89..388643ca2177 100644
--- a/arch/x86/crypto/aesni-intel_glue.c
+++ b/arch/x86/crypto/aesni-intel_glue.c
@@ -849,6 +849,8 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)
 		return -EINVAL;
 
 	err = skcipher_walk_virt(&walk, req, false);
+	if (err)
+		return err;
 
 	if (unlikely(tail > 0 && walk.nbytes < walk.total)) {
 		int blocks = DIV_ROUND_UP(req->cryptlen, AES_BLOCK_SIZE) - 2;
@@ -862,7 +864,10 @@ static int xts_crypt(struct skcipher_request *req, bool encrypt)
 		skcipher_request_set_crypt(&subreq, req->src, req->dst,
 					   blocks * AES_BLOCK_SIZE, req->iv);
 		req = &subreq;
+
 		err = skcipher_walk_virt(&walk, req, false);
+		if (err)
+			return err;
 	} else {
 		tail = 0;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 052/334] crypto: ecc - handle unaligned input buffer in ecc_swap_digits
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 051/334] crypto: x86/aes-ni - add missing error checks in XTS code Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 053/334] sched/numa: Fix is_core_idle() Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Guillaume Gardet, Takashi Iwai,
	Mian Yousaf Kaukab, Stefan Berger, Herbert Xu, Sasha Levin

From: Mian Yousaf Kaukab <ykaukab@suse.de>

[ Upstream commit 0469dede0eeeefe12a9a2fd76078f4a266513457 ]

ecdsa_set_pub_key() makes an u64 pointer at 1 byte offset of the key.
This results in an unaligned u64 pointer. This pointer is passed to
ecc_swap_digits() which assumes natural alignment.

This causes a kernel crash on an armv7 platform:
[    0.409022] Unhandled fault: alignment exception (0x001) at 0xc2a0a6a9
...
[    0.416982] PC is at ecdsa_set_pub_key+0xdc/0x120
...
[    0.491492] Backtrace:
[    0.492059] [<c07c266c>] (ecdsa_set_pub_key) from [<c07c75d4>] (test_akcipher_one+0xf4/0x6c0)

Handle unaligned input buffer in ecc_swap_digits() by replacing
be64_to_cpu() to get_unaligned_be64(). Change type of in pointer to
void to reflect it doesn’t necessarily need to be aligned.

Fixes: 4e6602916bc6 ("crypto: ecdsa - Add support for ECDSA signature verification")
Reported-by: Guillaume Gardet <guillaume.gardet@arm.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mian Yousaf Kaukab <ykaukab@suse.de>
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 crypto/ecc.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/crypto/ecc.h b/crypto/ecc.h
index a006132646a4..1350e8eb6ac2 100644
--- a/crypto/ecc.h
+++ b/crypto/ecc.h
@@ -27,6 +27,7 @@
 #define _CRYPTO_ECC_H
 
 #include <crypto/ecc_curve.h>
+#include <asm/unaligned.h>
 
 /* One digit is u64 qword. */
 #define ECC_CURVE_NIST_P192_DIGITS  3
@@ -46,13 +47,13 @@
  * @out:      Output array
  * @ndigits:  Number of digits to copy
  */
-static inline void ecc_swap_digits(const u64 *in, u64 *out, unsigned int ndigits)
+static inline void ecc_swap_digits(const void *in, u64 *out, unsigned int ndigits)
 {
 	const __be64 *src = (__force __be64 *)in;
 	int i;
 
 	for (i = 0; i < ndigits; i++)
-		out[i] = be64_to_cpu(src[ndigits - 1 - i]);
+		out[i] = get_unaligned_be64(&src[ndigits - 1 - i]);
 }
 
 /**
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 053/334] sched/numa: Fix is_core_idle()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 052/334] crypto: ecc - handle unaligned input buffer in ecc_swap_digits Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 054/334] sched: Fix UCLAMP_FLAG_IDLE setting Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mika Penttilä,
	Peter Zijlstra (Intel),
	Mel Gorman, Pankaj Gupta, Sasha Levin

From: Mika Penttilä <mika.penttila@gmail.com>

[ Upstream commit 1c6829cfd3d5124b125e6df41158665aea413b35 ]

Use the loop variable instead of the function argument to test the
other SMT siblings for idle.

Fixes: ff7db0bf24db ("sched/numa: Prefer using an idle CPU as a migration target instead of comparing tasks")
Signed-off-by: Mika Penttilä <mika.penttila@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Pankaj Gupta <pankaj.gupta@ionos.com>
Link: https://lkml.kernel.org/r/20210722063946.28951-1-mika.penttila@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/fair.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 44c452072a1b..30a6984a58f7 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -1486,7 +1486,7 @@ static inline bool is_core_idle(int cpu)
 		if (cpu == sibling)
 			continue;
 
-		if (!idle_cpu(cpu))
+		if (!idle_cpu(sibling))
 			return false;
 	}
 #endif
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 054/334] sched: Fix UCLAMP_FLAG_IDLE setting
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 053/334] sched/numa: Fix is_core_idle() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 055/334] rcu: Fix to include first blocked task in stall warning Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rick Yiu, Quentin Perret,
	Peter Zijlstra (Intel),
	Qais Yousef, Dietmar Eggemann, Sasha Levin

From: Quentin Perret <qperret@google.com>

[ Upstream commit ca4984a7dd863f3e1c0df775ae3e744bff24c303 ]

The UCLAMP_FLAG_IDLE flag is set on a runqueue when dequeueing the last
uclamp active task (that is, when buckets.tasks reaches 0 for all
buckets) to maintain the last uclamp.max and prevent blocked util from
suddenly becoming visible.

However, there is an asymmetry in how the flag is set and cleared which
can lead to having the flag set whilst there are active tasks on the rq.
Specifically, the flag is cleared in the uclamp_rq_inc() path, which is
called at enqueue time, but set in uclamp_rq_dec_id() which is called
both when dequeueing a task _and_ in the update_uclamp_active() path. As
a result, when both uclamp_rq_{dec,ind}_id() are called from
update_uclamp_active(), the flag ends up being set but not cleared,
hence leaving the runqueue in a broken state.

Fix this by clearing the flag in update_uclamp_active() as well.

Fixes: e496187da710 ("sched/uclamp: Enforce last task's UCLAMP_MAX")
Reported-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Qais Yousef <qais.yousef@arm.com>
Tested-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Link: https://lore.kernel.org/r/20210805102154.590709-2-qperret@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/sched/core.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index f3b27c6c5153..a2403432f3ab 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1633,6 +1633,23 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p)
 		uclamp_rq_dec_id(rq, p, clamp_id);
 }
 
+static inline void uclamp_rq_reinc_id(struct rq *rq, struct task_struct *p,
+				      enum uclamp_id clamp_id)
+{
+	if (!p->uclamp[clamp_id].active)
+		return;
+
+	uclamp_rq_dec_id(rq, p, clamp_id);
+	uclamp_rq_inc_id(rq, p, clamp_id);
+
+	/*
+	 * Make sure to clear the idle flag if we've transiently reached 0
+	 * active tasks on rq.
+	 */
+	if (clamp_id == UCLAMP_MAX && (rq->uclamp_flags & UCLAMP_FLAG_IDLE))
+		rq->uclamp_flags &= ~UCLAMP_FLAG_IDLE;
+}
+
 static inline void
 uclamp_update_active(struct task_struct *p)
 {
@@ -1656,12 +1673,8 @@ uclamp_update_active(struct task_struct *p)
 	 * affecting a valid clamp bucket, the next time it's enqueued,
 	 * it will already see the updated clamp bucket value.
 	 */
-	for_each_clamp_id(clamp_id) {
-		if (p->uclamp[clamp_id].active) {
-			uclamp_rq_dec_id(rq, p, clamp_id);
-			uclamp_rq_inc_id(rq, p, clamp_id);
-		}
-	}
+	for_each_clamp_id(clamp_id)
+		uclamp_rq_reinc_id(rq, p, clamp_id);
 
 	task_rq_unlock(rq, p, &rf);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 055/334] rcu: Fix to include first blocked task in stall warning
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 054/334] sched: Fix UCLAMP_FLAG_IDLE setting Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 056/334] rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qais Yousef, Yanfei Xu,
	Paul E. McKenney, Sasha Levin

From: Yanfei Xu <yanfei.xu@windriver.com>

[ Upstream commit e6a901a44f76878ed1653626c9ff4cfc5a3f58f8 ]

The for loop in rcu_print_task_stall() always omits ts[0], which points
to the first task blocking the stalled grace period.  This in turn fails
to count this first task, which means that ndetected will be equal to
zero when all CPUs have passed through their quiescent states and only
one task is blocking the stalled grace period.  This zero value for
ndetected will in turn result in an incorrect "All QSes seen" message:

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu:    Tasks blocked on level-1 rcu_node (CPUs 12-23):
        (detected by 15, t=6504 jiffies, g=164777, q=9011209)
rcu: All QSes seen, last rcu_preempt kthread activity 1 (4295252379-4295252378), jiffies_till_next_fqs=1, root ->qsmask 0x2
BUG: sleeping function called from invalid context at include/linux/uaccess.h:156
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 70613, name: msgstress04
INFO: lockdep is turned off.
Preemption disabled at:
[<ffff8000104031a4>] create_object.isra.0+0x204/0x4b0
CPU: 15 PID: 70613 Comm: msgstress04 Kdump: loaded Not tainted
5.12.2-yoctodev-standard #1
Hardware name: Marvell OcteonTX CN96XX board (DT)
Call trace:
 dump_backtrace+0x0/0x2cc
 show_stack+0x24/0x30
 dump_stack+0x110/0x188
 ___might_sleep+0x214/0x2d0
 __might_sleep+0x7c/0xe0

This commit therefore fixes the loop to include ts[0].

Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled")
Tested-by: Qais Yousef <qais.yousef@arm.com>
Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree_stall.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
index 3d11155e0033..d56b4ede1db3 100644
--- a/kernel/rcu/tree_stall.h
+++ b/kernel/rcu/tree_stall.h
@@ -282,8 +282,8 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
 			break;
 	}
 	raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
-	for (i--; i; i--) {
-		t = ts[i];
+	while (i) {
+		t = ts[--i];
 		if (!try_invoke_on_locked_down_task(t, check_slow_task, &rscr))
 			pr_cont(" P%d", t->pid);
 		else
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 056/334] rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 055/334] rcu: Fix to include first blocked task in stall warning Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 057/334] m68k: Fix invalid RMW_INSNS on CPUs that lack CAS Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qais Yousef, Yanfei Xu,
	Paul E. McKenney, Sasha Levin

From: Yanfei Xu <yanfei.xu@windriver.com>

[ Upstream commit dc87740c8a6806bd2162bfb441770e4e53be5601 ]

If rcu_print_task_stall() is invoked on an rcu_node structure that does
not contain any tasks blocking the current grace period, it takes an
early exit that fails to release that rcu_node structure's lock.  This
results in a self-deadlock, which is detected by lockdep.

To reproduce this bug:

tools/testing/selftests/rcutorture/bin/kvm.sh --allcpus --duration 3 --trust-make --configs "TREE03" --kconfig "CONFIG_PROVE_LOCKING=y" --bootargs "rcutorture.stall_cpu=30 rcutorture.stall_cpu_block=1 rcutorture.fwd_progress=0 rcutorture.test_boost=0"

This will also result in other complaints, including RCU's scheduler
hook complaining about blocking rather than preemption and an rcutorture
writer stall.

Only a partial RCU CPU stall warning message will be printed because of
the self-deadlock.

This commit therefore releases the lock on the rcu_print_task_stall()
function's early exit path.

Fixes: c583bcb8f5ed ("rcu: Don't invoke try_invoke_on_locked_down_task() with irqs disabled")
Tested-by: Qais Yousef <qais.yousef@arm.com>
Signed-off-by: Yanfei Xu <yanfei.xu@windriver.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/rcu/tree_stall.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/rcu/tree_stall.h b/kernel/rcu/tree_stall.h
index d56b4ede1db3..0e7a60706d1c 100644
--- a/kernel/rcu/tree_stall.h
+++ b/kernel/rcu/tree_stall.h
@@ -269,8 +269,10 @@ static int rcu_print_task_stall(struct rcu_node *rnp, unsigned long flags)
 	struct task_struct *ts[8];
 
 	lockdep_assert_irqs_disabled();
-	if (!rcu_preempt_blocked_readers_cgp(rnp))
+	if (!rcu_preempt_blocked_readers_cgp(rnp)) {
+		raw_spin_unlock_irqrestore_rcu_node(rnp, flags);
 		return 0;
+	}
 	pr_err("\tTasks blocked on level-%d rcu_node (CPUs %d-%d):",
 	       rnp->level, rnp->grplo, rnp->grphi);
 	t = list_entry(rnp->gp_tasks->prev,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 057/334] m68k: Fix invalid RMW_INSNS on CPUs that lack CAS
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 056/334] rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 058/334] block: return ELEVATOR_DISCARD_MERGE if possible Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Arnd Bergmann,
	Geert Uytterhoeven, Sasha Levin

From: Geert Uytterhoeven <geert@linux-m68k.org>

[ Upstream commit 2189e928b62e91d8efbc9826ae7c0968f0d55790 ]

When enabling CONFIG_RMW_INSNS in e.g. a Coldfire build:

    {standard input}:3068: Error: invalid instruction for this architecture; needs 68020 or higher (68020 [68k, 68ec020], 68030 [68ec030], 68040 [68ec040], 68060 [68ec060]) -- statement `casl %d4,%d0,(%a6)' ignored

Fix this by (a) adding a new config symbol to track if support for any
CPU that lacks the CAS instruction is enabled, and (b) making
CONFIG_RMW_INSNS depend on the new symbol not being set.

Fixes: 0e152d80507b75c0 ("m68k: reorganize Kconfig options to improve mmu/non-mmu selections")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210725104413.318932-1-geert@linux-m68k.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/Kconfig.cpu | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
index 29e946394fdb..277d61a09463 100644
--- a/arch/m68k/Kconfig.cpu
+++ b/arch/m68k/Kconfig.cpu
@@ -26,6 +26,7 @@ config COLDFIRE
 	bool "Coldfire CPU family support"
 	select ARCH_HAVE_CUSTOM_GPIO_H
 	select CPU_HAS_NO_BITFIELDS
+	select CPU_HAS_NO_CAS
 	select CPU_HAS_NO_MULDIV64
 	select GENERIC_CSUM
 	select GPIOLIB
@@ -39,6 +40,7 @@ config M68000
 	bool
 	depends on !MMU
 	select CPU_HAS_NO_BITFIELDS
+	select CPU_HAS_NO_CAS
 	select CPU_HAS_NO_MULDIV64
 	select CPU_HAS_NO_UNALIGNED
 	select GENERIC_CSUM
@@ -54,6 +56,7 @@ config M68000
 config MCPU32
 	bool
 	select CPU_HAS_NO_BITFIELDS
+	select CPU_HAS_NO_CAS
 	select CPU_HAS_NO_UNALIGNED
 	select CPU_NO_EFFICIENT_FFS
 	help
@@ -383,7 +386,7 @@ config ADVANCED
 
 config RMW_INSNS
 	bool "Use read-modify-write instructions"
-	depends on ADVANCED
+	depends on ADVANCED && !CPU_HAS_NO_CAS
 	help
 	  This allows to use certain instructions that work with indivisible
 	  read-modify-write bus cycles. While this is faster than the
@@ -450,6 +453,9 @@ config M68K_L2_CACHE
 config CPU_HAS_NO_BITFIELDS
 	bool
 
+config CPU_HAS_NO_CAS
+	bool
+
 config CPU_HAS_NO_MULDIV64
 	bool
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 058/334] block: return ELEVATOR_DISCARD_MERGE if possible
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 057/334] m68k: Fix invalid RMW_INSNS on CPUs that lack CAS Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 059/334] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksandr Natalenko, Ming Lei,
	Jens Axboe, Sasha Levin

From: Ming Lei <ming.lei@redhat.com>

[ Upstream commit 866663b7b52d2da267b28e12eed89ee781b8fed1 ]

When merging one bio to request, if they are discard IO and the queue
supports multi-range discard, we need to return ELEVATOR_DISCARD_MERGE
because both block core and related drivers(nvme, virtio-blk) doesn't
handle mixed discard io merge(traditional IO merge together with
discard merge) well.

Fix the issue by returning ELEVATOR_DISCARD_MERGE in this situation,
so both blk-mq and drivers just need to handle multi-range discard.

Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name>
Fixes: 2705dfb20947 ("block: fix discard request merge")
Link: https://lore.kernel.org/r/20210729034226.1591070-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/bfq-iosched.c    |  3 +++
 block/blk-merge.c      | 16 ----------------
 block/elevator.c       |  3 +++
 block/mq-deadline.c    |  2 ++
 include/linux/blkdev.h | 16 ++++++++++++++++
 5 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
index 727955918563..673a634eadd9 100644
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -2361,6 +2361,9 @@ static int bfq_request_merge(struct request_queue *q, struct request **req,
 	__rq = bfq_find_rq_fmerge(bfqd, bio, q);
 	if (__rq && elv_bio_merge_ok(__rq, bio)) {
 		*req = __rq;
+
+		if (blk_discard_mergable(__rq))
+			return ELEVATOR_DISCARD_MERGE;
 		return ELEVATOR_FRONT_MERGE;
 	}
 
diff --git a/block/blk-merge.c b/block/blk-merge.c
index 22eeaad190d7..eeba8422ae82 100644
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -707,22 +707,6 @@ static void blk_account_io_merge_request(struct request *req)
 	}
 }
 
-/*
- * Two cases of handling DISCARD merge:
- * If max_discard_segments > 1, the driver takes every bio
- * as a range and send them to controller together. The ranges
- * needn't to be contiguous.
- * Otherwise, the bios/requests will be handled as same as
- * others which should be contiguous.
- */
-static inline bool blk_discard_mergable(struct request *req)
-{
-	if (req_op(req) == REQ_OP_DISCARD &&
-	    queue_max_discard_segments(req->q) > 1)
-		return true;
-	return false;
-}
-
 static enum elv_merge blk_try_req_merge(struct request *req,
 					struct request *next)
 {
diff --git a/block/elevator.c b/block/elevator.c
index 52ada14cfe45..a5fe2615ec0f 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -336,6 +336,9 @@ enum elv_merge elv_merge(struct request_queue *q, struct request **req,
 	__rq = elv_rqhash_find(q, bio->bi_iter.bi_sector);
 	if (__rq && elv_bio_merge_ok(__rq, bio)) {
 		*req = __rq;
+
+		if (blk_discard_mergable(__rq))
+			return ELEVATOR_DISCARD_MERGE;
 		return ELEVATOR_BACK_MERGE;
 	}
 
diff --git a/block/mq-deadline.c b/block/mq-deadline.c
index 36920670dccc..3c3693c34f06 100644
--- a/block/mq-deadline.c
+++ b/block/mq-deadline.c
@@ -629,6 +629,8 @@ static int dd_request_merge(struct request_queue *q, struct request **rq,
 
 		if (elv_bio_merge_ok(__rq, bio)) {
 			*rq = __rq;
+			if (blk_discard_mergable(__rq))
+				return ELEVATOR_DISCARD_MERGE;
 			return ELEVATOR_FRONT_MERGE;
 		}
 	}
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index d3afea47ade6..4b0f8bb0671d 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1521,6 +1521,22 @@ static inline int queue_limit_discard_alignment(struct queue_limits *lim, sector
 	return offset << SECTOR_SHIFT;
 }
 
+/*
+ * Two cases of handling DISCARD merge:
+ * If max_discard_segments > 1, the driver takes every bio
+ * as a range and send them to controller together. The ranges
+ * needn't to be contiguous.
+ * Otherwise, the bios/requests will be handled as same as
+ * others which should be contiguous.
+ */
+static inline bool blk_discard_mergable(struct request *req)
+{
+	if (req_op(req) == REQ_OP_DISCARD &&
+	    queue_max_discard_segments(req->q) > 1)
+		return true;
+	return false;
+}
+
 static inline int bdev_discard_alignment(struct block_device *bdev)
 {
 	struct request_queue *q = bdev_get_queue(bdev);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 059/334] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 058/334] block: return ELEVATOR_DISCARD_MERGE if possible Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 060/334] spi: spi-pic32: " Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sanchayan Maity, Vladimir Oltean,
	Peter Ujfalusi, Vinod Koul, Tony Lindgren, Mark Brown,
	Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ]

Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.

For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.

For spi-fsl-dspi, this is probably not currently an issue but is still
good to fix though.

Fixes: 90ba37033cb9 ("spi: spi-fsl-dspi: Add DMA support for Vybrid")
Cc: Sanchayan Maity <maitysanchayan@gmail.com>
Cc: Vladimir Oltean <vladimir.oltean@nxp.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Acked-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/20210810081727.19491-1-tony@atomide.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-fsl-dspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index fb45e6af6638..fd004c9db9dc 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -530,6 +530,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr)
 		goto err_rx_dma_buf;
 	}
 
+	memset(&cfg, 0, sizeof(cfg));
 	cfg.src_addr = phy_addr + SPI_POPR;
 	cfg.dst_addr = phy_addr + SPI_PUSHR;
 	cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 060/334] spi: spi-pic32: Fix issue with uninitialized dma_slave_config
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 059/334] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 061/334] genirq/timings: Fix error return code in irq_timings_test_irqs() Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Purna Chandra Mandal, Peter Ujfalusi,
	Vinod Koul, Tony Lindgren, Mark Brown, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ]

Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.

For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.

For spi-pic32, this is probably not currently an issue but is still good to
fix though.

Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210810081727.19491-2-tony@atomide.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-pic32.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/spi/spi-pic32.c b/drivers/spi/spi-pic32.c
index 104bde153efd..5eb7b61bbb4d 100644
--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -361,6 +361,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)
 	struct dma_slave_config cfg;
 	int ret;
 
+	memset(&cfg, 0, sizeof(cfg));
 	cfg.device_fc = true;
 	cfg.src_addr = pic32s->dma_base + buf_offset;
 	cfg.dst_addr = pic32s->dma_base + buf_offset;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 061/334] genirq/timings: Fix error return code in irq_timings_test_irqs()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 060/334] spi: spi-pic32: " Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 062/334] irqchip/loongson-pch-pic: Improve edge triggered interrupt support Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhen Lei,
	Thomas Gleixner, Sasha Levin

From: Zhen Lei <thunder.leizhen@huawei.com>

[ Upstream commit 290fdc4b7ef14e33d0e30058042b0e9bfd02b89b ]

Return a negative error code from the error handling case instead of 0, as
done elsewhere in this function.

Fixes: f52da98d900e ("genirq/timings: Add selftest for irqs circular buffer")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210811093333.2376-1-thunder.leizhen@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/irq/timings.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/irq/timings.c b/kernel/irq/timings.c
index 4d2a702d7aa9..c43e2ac2f8de 100644
--- a/kernel/irq/timings.c
+++ b/kernel/irq/timings.c
@@ -799,12 +799,14 @@ static int __init irq_timings_test_irqs(struct timings_intervals *ti)
 
 		__irq_timings_store(irq, irqs, ti->intervals[i]);
 		if (irqs->circ_timings[i & IRQ_TIMINGS_MASK] != index) {
+			ret = -EBADSLT;
 			pr_err("Failed to store in the circular buffer\n");
 			goto out;
 		}
 	}
 
 	if (irqs->count != ti->count) {
+		ret = -ERANGE;
 		pr_err("Count differs\n");
 		goto out;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 062/334] irqchip/loongson-pch-pic: Improve edge triggered interrupt support
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 061/334] genirq/timings: Fix error return code in irq_timings_test_irqs() Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 063/334] lib/mpi: use kcalloc in mpi_resize Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen Zhu, Huacai Chen, Marc Zyngier,
	Sasha Levin

From: Huacai Chen <chenhuacai@loongson.cn>

[ Upstream commit e5dec38ac5d05d17a7110c8045aa101015281e4d ]

Edge-triggered mode and level-triggered mode need different handlers,
and edge-triggered mode need a specific ack operation. So improve it.

Fixes: ef8c01eb64ca6719da449dab0 ("irqchip: Add Loongson PCH PIC controller")
Signed-off-by: Chen Zhu <zhuchen@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210805132216.3539007-1-chenhuacai@loongson.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-loongson-pch-pic.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-loongson-pch-pic.c b/drivers/irqchip/irq-loongson-pch-pic.c
index f790ca6d78aa..a4eb8a2181c7 100644
--- a/drivers/irqchip/irq-loongson-pch-pic.c
+++ b/drivers/irqchip/irq-loongson-pch-pic.c
@@ -92,18 +92,22 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)
 	case IRQ_TYPE_EDGE_RISING:
 		pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq);
 		pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq);
+		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 	case IRQ_TYPE_EDGE_FALLING:
 		pch_pic_bitset(priv, PCH_PIC_EDGE, d->hwirq);
 		pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq);
+		irq_set_handler_locked(d, handle_edge_irq);
 		break;
 	case IRQ_TYPE_LEVEL_HIGH:
 		pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq);
 		pch_pic_bitclr(priv, PCH_PIC_POL, d->hwirq);
+		irq_set_handler_locked(d, handle_level_irq);
 		break;
 	case IRQ_TYPE_LEVEL_LOW:
 		pch_pic_bitclr(priv, PCH_PIC_EDGE, d->hwirq);
 		pch_pic_bitset(priv, PCH_PIC_POL, d->hwirq);
+		irq_set_handler_locked(d, handle_level_irq);
 		break;
 	default:
 		ret = -EINVAL;
@@ -113,11 +117,24 @@ static int pch_pic_set_type(struct irq_data *d, unsigned int type)
 	return ret;
 }
 
+static void pch_pic_ack_irq(struct irq_data *d)
+{
+	unsigned int reg;
+	struct pch_pic *priv = irq_data_get_irq_chip_data(d);
+
+	reg = readl(priv->base + PCH_PIC_EDGE + PIC_REG_IDX(d->hwirq) * 4);
+	if (reg & BIT(PIC_REG_BIT(d->hwirq))) {
+		writel(BIT(PIC_REG_BIT(d->hwirq)),
+			priv->base + PCH_PIC_CLR + PIC_REG_IDX(d->hwirq) * 4);
+	}
+	irq_chip_ack_parent(d);
+}
+
 static struct irq_chip pch_pic_irq_chip = {
 	.name			= "PCH PIC",
 	.irq_mask		= pch_pic_mask_irq,
 	.irq_unmask		= pch_pic_unmask_irq,
-	.irq_ack		= irq_chip_ack_parent,
+	.irq_ack		= pch_pic_ack_irq,
 	.irq_set_affinity	= irq_chip_set_affinity_parent,
 	.irq_set_type		= pch_pic_set_type,
 };
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 063/334] lib/mpi: use kcalloc in mpi_resize
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 062/334] irqchip/loongson-pch-pic: Improve edge triggered interrupt support Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 064/334] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hongbo Li, Herbert Xu, Sasha Levin

From: Hongbo Li <herberthbli@tencent.com>

[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ]

We should set the additional space to 0 in mpi_resize().
So use kcalloc() instead of kmalloc_array().

In lib/mpi/ec.c:
/****************
 * Resize the array of A to NLIMBS. the additional space is cleared
 * (set to 0) [done by m_realloc()]
 */
int mpi_resize(MPI a, unsigned nlimbs)

Like the comment of kernel's mpi_resize() said, the additional space
need to be set to 0, but when a->d is not NULL, it does not set.

The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt
is _gcry_mpi_resize() which set the additional space to 0.

This bug may cause mpi api which use mpi_resize() get wrong result
under the condition of using the additional space without initiation.
If this condition is not met, the bug would not be triggered.
Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well,
so the bug is not triggered in these cases.

add_points_edwards() use the additional space directly, so it will
get a wrong result.

Fixes: cdec9cb5167a ("crypto: GnuPG based MPI lib - source files (part 1)")
Signed-off-by: Hongbo Li <herberthbli@tencent.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/mpi/mpiutil.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/mpi/mpiutil.c b/lib/mpi/mpiutil.c
index 9a75ca3f7edf..bc81419f400c 100644
--- a/lib/mpi/mpiutil.c
+++ b/lib/mpi/mpiutil.c
@@ -148,7 +148,7 @@ int mpi_resize(MPI a, unsigned nlimbs)
 		return 0;	/* no need to do it */
 
 	if (a->d) {
-		p = kmalloc_array(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
+		p = kcalloc(nlimbs, sizeof(mpi_limb_t), GFP_KERNEL);
 		if (!p)
 			return -ENOMEM;
 		memcpy(p, a->d, a->alloced * sizeof(mpi_limb_t));
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 064/334] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 063/334] lib/mpi: use kcalloc in mpi_resize Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:11 ` [PATCH 5.14 065/334] nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Phong Hoang, Niklas Söderlund,
	Daniel Lezcano, Sasha Levin

From: Phong Hoang <phong.hoang.wz@renesas.com>

[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ]

If CMT instance has at least two channels, one channel will be used
as a clock source and another one used as a clock event device.
In that case, IRQ is not requested for clock source channel so
sh_cmt_clock_event_program_verify() might work incorrectly.
Besides, when a channel is only used for clock source, don't need to
re-set the next match_value since it should be maximum timeout as
it still is.

On the other hand, due to no IRQ, total_cycles is not counted up
when reaches compare match time (timer counter resets to zero),
so sh_cmt_clocksource_read() returns unexpected value.
Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants
will also lead to wrong delta calculation. Hence, this mask should
correspond to timer counter width, and above function just returns
the raw value of timer counter register.

Fixes: bfa76bb12f23 ("clocksource: sh_cmt: Request IRQ for clock event device only")
Fixes: 37e7742c55ba ("clocksource/drivers/sh_cmt: Fix clocksource width for 32-bit machines")
Signed-off-by: Phong Hoang <phong.hoang.wz@renesas.com>
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210422123443.73334-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------
 1 file changed, 18 insertions(+), 12 deletions(-)

diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index d7ed99f0001f..dd0956ad969c 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -579,7 +579,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag)
 	ch->flags |= flag;
 
 	/* setup timeout if no clockevent */
-	if ((flag == FLAG_CLOCKSOURCE) && (!(ch->flags & FLAG_CLOCKEVENT)))
+	if (ch->cmt->num_channels == 1 &&
+	    flag == FLAG_CLOCKSOURCE && (!(ch->flags & FLAG_CLOCKEVENT)))
 		__sh_cmt_set_next(ch, ch->max_match_value);
  out:
 	raw_spin_unlock_irqrestore(&ch->lock, flags);
@@ -621,20 +622,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)
 static u64 sh_cmt_clocksource_read(struct clocksource *cs)
 {
 	struct sh_cmt_channel *ch = cs_to_sh_cmt(cs);
-	unsigned long flags;
 	u32 has_wrapped;
-	u64 value;
-	u32 raw;
 
-	raw_spin_lock_irqsave(&ch->lock, flags);
-	value = ch->total_cycles;
-	raw = sh_cmt_get_counter(ch, &has_wrapped);
+	if (ch->cmt->num_channels == 1) {
+		unsigned long flags;
+		u64 value;
+		u32 raw;
 
-	if (unlikely(has_wrapped))
-		raw += ch->match_value + 1;
-	raw_spin_unlock_irqrestore(&ch->lock, flags);
+		raw_spin_lock_irqsave(&ch->lock, flags);
+		value = ch->total_cycles;
+		raw = sh_cmt_get_counter(ch, &has_wrapped);
+
+		if (unlikely(has_wrapped))
+			raw += ch->match_value + 1;
+		raw_spin_unlock_irqrestore(&ch->lock, flags);
+
+		return value + raw;
+	}
 
-	return value + raw;
+	return sh_cmt_get_counter(ch, &has_wrapped);
 }
 
 static int sh_cmt_clocksource_enable(struct clocksource *cs)
@@ -697,7 +703,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch,
 	cs->disable = sh_cmt_clocksource_disable;
 	cs->suspend = sh_cmt_clocksource_suspend;
 	cs->resume = sh_cmt_clocksource_resume;
-	cs->mask = CLOCKSOURCE_MASK(sizeof(u64) * 8);
+	cs->mask = CLOCKSOURCE_MASK(ch->cmt->info->width);
 	cs->flags = CLOCK_SOURCE_IS_CONTINUOUS;
 
 	dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 065/334] nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 064/334] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel Greg Kroah-Hartman
@ 2021-09-13 13:11 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 066/334] block: nbd: add sanity check for first_minor Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:11 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+0fe7752e52337864d29b, Hou Tao,
	Christoph Hellwig, Josef Bacik, Jens Axboe, Sasha Levin

From: Hou Tao <houtao1@huawei.com>

[ Upstream commit 68c9417b193d0d174b0ada013602272177e61303 ]

Now open_mutex is used to synchronize partition operations (e.g,
blk_drop_partitions() and blkdev_reread_part()), however it makes
nbd driver broken, because nbd may call del_gendisk() in nbd_release()
or nbd_genl_disconnect() if NBD_CFLAG_DESTROY_ON_DISCONNECT is enabled,
and deadlock occurs, as shown below:

// AB-BA dead-lock
nbd_genl_disconnect            blkdev_open
  nbd_disconnect_and_put
                                 lock bd_mutex
  // last ref
  nbd_put
    lock nbd_index_mutex
      del_gendisk
                                   nbd_open
                                     try lock nbd_index_mutex
        try lock bd_mutex

 or

// AA dead-lock
nbd_release
  lock bd_mutex
    nbd_put
      try lock bd_mutex

Instead of fixing block layer (e.g, introduce another lock), fixing
the nbd driver to call del_gendisk() in a kworker when
NBD_DESTROY_ON_DISCONNECT is enabled. When NBD_DESTROY_ON_DISCONNECT
is disabled, nbd device will always be destroy through module removal,
and there is no risky of deadlock.

To ensure the reuse of nbd index succeeds, moving the calling of
idr_remove() after del_gendisk(), so if the reused index is not found
in nbd_index_idr, the old disk must have been deleted. And reusing
the existing destroy_complete mechanism to ensure nbd_genl_connect()
will wait for the completion of del_gendisk().

Also adding a new workqueue for nbd removal, so nbd_cleanup()
can ensure all removals complete before exits.

Reported-by: syzbot+0fe7752e52337864d29b@syzkaller.appspotmail.com
Fixes: c76f48eb5c08 ("block: take bd_mutex around delete_partitions in del_gendisk")
Signed-off-by: Hou Tao <houtao1@huawei.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20210811124428.2368491-2-hch@lst.de
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/nbd.c | 70 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 61 insertions(+), 9 deletions(-)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index acf3f85bf3c7..7ed888e99f09 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -49,6 +49,7 @@
 
 static DEFINE_IDR(nbd_index_idr);
 static DEFINE_MUTEX(nbd_index_mutex);
+static struct workqueue_struct *nbd_del_wq;
 static int nbd_total_devices = 0;
 
 struct nbd_sock {
@@ -113,6 +114,7 @@ struct nbd_device {
 	struct mutex config_lock;
 	struct gendisk *disk;
 	struct workqueue_struct *recv_workq;
+	struct work_struct remove_work;
 
 	struct list_head list;
 	struct task_struct *task_recv;
@@ -233,7 +235,7 @@ static const struct device_attribute backend_attr = {
 	.show = backend_show,
 };
 
-static void nbd_dev_remove(struct nbd_device *nbd)
+static void nbd_del_disk(struct nbd_device *nbd)
 {
 	struct gendisk *disk = nbd->disk;
 
@@ -242,24 +244,60 @@ static void nbd_dev_remove(struct nbd_device *nbd)
 		blk_cleanup_disk(disk);
 		blk_mq_free_tag_set(&nbd->tag_set);
 	}
+}
 
+/*
+ * Place this in the last just before the nbd is freed to
+ * make sure that the disk and the related kobject are also
+ * totally removed to avoid duplicate creation of the same
+ * one.
+ */
+static void nbd_notify_destroy_completion(struct nbd_device *nbd)
+{
+	if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags) &&
+	    nbd->destroy_complete)
+		complete(nbd->destroy_complete);
+}
+
+static void nbd_dev_remove_work(struct work_struct *work)
+{
+	struct nbd_device *nbd =
+		container_of(work, struct nbd_device, remove_work);
+
+	nbd_del_disk(nbd);
+
+	mutex_lock(&nbd_index_mutex);
 	/*
-	 * Place this in the last just before the nbd is freed to
-	 * make sure that the disk and the related kobject are also
-	 * totally removed to avoid duplicate creation of the same
-	 * one.
+	 * Remove from idr after del_gendisk() completes,
+	 * so if the same id is reused, the following
+	 * add_disk() will succeed.
 	 */
-	if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags) && nbd->destroy_complete)
-		complete(nbd->destroy_complete);
+	idr_remove(&nbd_index_idr, nbd->index);
+
+	nbd_notify_destroy_completion(nbd);
+	mutex_unlock(&nbd_index_mutex);
 
 	kfree(nbd);
 }
 
+static void nbd_dev_remove(struct nbd_device *nbd)
+{
+	/* Call del_gendisk() asynchrounously to prevent deadlock */
+	if (test_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags)) {
+		queue_work(nbd_del_wq, &nbd->remove_work);
+		return;
+	}
+
+	nbd_del_disk(nbd);
+	idr_remove(&nbd_index_idr, nbd->index);
+	nbd_notify_destroy_completion(nbd);
+	kfree(nbd);
+}
+
 static void nbd_put(struct nbd_device *nbd)
 {
 	if (refcount_dec_and_mutex_lock(&nbd->refs,
 					&nbd_index_mutex)) {
-		idr_remove(&nbd_index_idr, nbd->index);
 		nbd_dev_remove(nbd);
 		mutex_unlock(&nbd_index_mutex);
 	}
@@ -1685,6 +1723,7 @@ static int nbd_dev_add(int index)
 	nbd->tag_set.flags = BLK_MQ_F_SHOULD_MERGE |
 		BLK_MQ_F_BLOCKING;
 	nbd->tag_set.driver_data = nbd;
+	INIT_WORK(&nbd->remove_work, nbd_dev_remove_work);
 	nbd->destroy_complete = NULL;
 	nbd->backend = NULL;
 
@@ -2426,7 +2465,14 @@ static int __init nbd_init(void)
 	if (register_blkdev(NBD_MAJOR, "nbd"))
 		return -EIO;
 
+	nbd_del_wq = alloc_workqueue("nbd-del", WQ_UNBOUND, 0);
+	if (!nbd_del_wq) {
+		unregister_blkdev(NBD_MAJOR, "nbd");
+		return -ENOMEM;
+	}
+
 	if (genl_register_family(&nbd_genl_family)) {
+		destroy_workqueue(nbd_del_wq);
 		unregister_blkdev(NBD_MAJOR, "nbd");
 		return -EINVAL;
 	}
@@ -2444,7 +2490,10 @@ static int nbd_exit_cb(int id, void *ptr, void *data)
 	struct list_head *list = (struct list_head *)data;
 	struct nbd_device *nbd = ptr;
 
-	list_add_tail(&nbd->list, list);
+	/* Skip nbd that is being removed asynchronously */
+	if (refcount_read(&nbd->refs))
+		list_add_tail(&nbd->list, list);
+
 	return 0;
 }
 
@@ -2467,6 +2516,9 @@ static void __exit nbd_cleanup(void)
 		nbd_put(nbd);
 	}
 
+	/* Also wait for nbd_dev_remove_work() completes */
+	destroy_workqueue(nbd_del_wq);
+
 	idr_destroy(&nbd_index_idr);
 	genl_unregister_family(&nbd_genl_family);
 	unregister_blkdev(NBD_MAJOR, "nbd");
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 066/334] block: nbd: add sanity check for first_minor
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2021-09-13 13:11 ` [PATCH 5.14 065/334] nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 067/334] spi: coldfire-qspi: Use clk_disable_unprepare in the remove function Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+9937dc42271cd87d4b98,
	Christoph Hellwig, Pavel Skripkin, Jens Axboe, Sasha Levin

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit b1a811633f7321cf1ae2bb76a66805b7720e44c9 ]

Syzbot hit WARNING in internal_create_group(). The problem was in
too big disk->first_minor.

disk->first_minor is initialized by value, which comes from userspace
and there wasn't any sanity checks about value correctness. It can cause
duplicate creation of sysfs files/links, because disk->first_minor will
be passed to MKDEV() which causes truncation to byte. Since maximum
minor value is 0xff, let's check if first_minor is correct minor number.

NOTE: the root case of the reported warning was in wrong error handling
in register_disk(), but we can avoid passing knowingly wrong values to
sysfs API, because sysfs error messages can confuse users. For example:
user passed 1048576 as index, but sysfs complains about duplicate
creation of /dev/block/43:0. It's not obvious how 1048576 becomes 0.
Log and reproducer for above example can be found on syzkaller bug
report page.

Link: https://syzkaller.appspot.com/bug?id=03c2ae9146416edf811958d5fd7acfab75b143d1
Fixes: b0d9111a2d53 ("nbd: use an idr to keep track of nbd devices")
Reported-by: syzbot+9937dc42271cd87d4b98@syzkaller.appspotmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/block/nbd.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 7ed888e99f09..93708b1938e8 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1770,7 +1770,17 @@ static int nbd_dev_add(int index)
 	refcount_set(&nbd->refs, 1);
 	INIT_LIST_HEAD(&nbd->list);
 	disk->major = NBD_MAJOR;
+
+	/* Too big first_minor can cause duplicate creation of
+	 * sysfs files/links, since first_minor will be truncated to
+	 * byte in __device_add_disk().
+	 */
 	disk->first_minor = index << part_shift;
+	if (disk->first_minor > 0xff) {
+		err = -EINVAL;
+		goto out_free_idr;
+	}
+
 	disk->minors = 1 << part_shift;
 	disk->fops = &nbd_fops;
 	disk->private_data = nbd;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 067/334] spi: coldfire-qspi: Use clk_disable_unprepare in the remove function
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 066/334] block: nbd: add sanity check for first_minor Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 068/334] irqchip/apple-aic: Fix irq_disable from within irq handlers Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Mark Brown, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d68f4c73d729245a47e70eb216fa24bc174ed2e2 ]

'clk_prepare_enable()' is used in the probe, so 'clk_disable_unprepare()'
should be used in the remove function to be consistent.

Fixes: 499de01c5c0b ("spi: coldfire-qspi: Use clk_prepare_enable and clk_disable_unprepare")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/ee91792ddba61342b0d3284cd4558a2b0016c4e7.1629319838.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-coldfire-qspi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-coldfire-qspi.c b/drivers/spi/spi-coldfire-qspi.c
index 8996115ce736..263ce9047327 100644
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -444,7 +444,7 @@ static int mcfqspi_remove(struct platform_device *pdev)
 	mcfqspi_wr_qmr(mcfqspi, MCFQSPI_QMR_MSTR);
 
 	mcfqspi_cs_teardown(mcfqspi);
-	clk_disable(mcfqspi->clk);
+	clk_disable_unprepare(mcfqspi->clk);
 
 	return 0;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 068/334] irqchip/apple-aic: Fix irq_disable from within irq handlers
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 067/334] spi: coldfire-qspi: Use clk_disable_unprepare in the remove function Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 069/334] irqchip/gic-v3: Fix priority comparison when non-secure priorities are used Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Peter, Hector Martin,
	Marc Zyngier, Sasha Levin

From: Sven Peter <sven@svenpeter.dev>

[ Upstream commit 60a1cd10b222e004f860d14651e80089c77e8e6b ]

When disable_irq_nosync for an interrupt is called from within its
interrupt handler, this interrupt is only marked as disabled with the
intention to mask it when it triggers again.
The AIC hardware however automatically masks the interrupt when it is read.
aic_irq_eoi then unmasks it again if it's not disabled *and* not masked.
This results in a state mismatch between the hardware state and the
state kept in irq_data: The hardware interrupt is masked but
IRQD_IRQ_MASKED is not set. Any further calls to unmask_irq will directly
return and the interrupt can never be enabled again.

Fix this by keeping the hardware and irq_data state in sync by unmasking in
aic_irq_eoi if and only if the irq_data state also assumes the interrupt to
be unmasked.

Fixes: 76cde2639411 ("irqchip/apple-aic: Add support for the Apple Interrupt Controller")
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Acked-by: Hector Martin <marcan@marcan.st>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210812100942.17206-1-sven@svenpeter.dev
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-apple-aic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-apple-aic.c b/drivers/irqchip/irq-apple-aic.c
index b8c06bd8659e..6fc145aacaf0 100644
--- a/drivers/irqchip/irq-apple-aic.c
+++ b/drivers/irqchip/irq-apple-aic.c
@@ -226,7 +226,7 @@ static void aic_irq_eoi(struct irq_data *d)
 	 * Reading the interrupt reason automatically acknowledges and masks
 	 * the IRQ, so we just unmask it here if needed.
 	 */
-	if (!irqd_irq_disabled(d) && !irqd_irq_masked(d))
+	if (!irqd_irq_masked(d))
 		aic_irq_unmask(d);
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 069/334] irqchip/gic-v3: Fix priority comparison when non-secure priorities are used
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 068/334] irqchip/apple-aic: Fix irq_disable from within irq handlers Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 070/334] crypto: qat - use proper type for vf_mask Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexandru Elisei, Chen-Yu Tsai,
	Marc Zyngier, Sasha Levin

From: Chen-Yu Tsai <wenst@chromium.org>

[ Upstream commit 8d474deaba2c4dd33a5e2f5be82e6798ffa6b8a5 ]

When non-secure priorities are used, compared to the raw priority set,
the value read back from RPR is also right-shifted by one and the
highest bit set.

Add a macro to do the modifications to the raw priority when doing the
comparison against the RPR value. This corrects the pseudo-NMI behavior
when non-secure priorities in the GIC are used. Tested on 5.10 with
the "IPI as pseudo-NMI" series [1] applied on MT8195.

[1] https://lore.kernel.org/linux-arm-kernel/1604317487-14543-1-git-send-email-sumit.garg@linaro.org/

Fixes: 336780590990 ("irqchip/gic-v3: Support pseudo-NMIs when SCR_EL3.FIQ == 0")
Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
[maz: Added comment contributed by Alex]
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20210811171505.1502090-1-wenst@chromium.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/irqchip/irq-gic-v3.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
index e0f4debe64e1..3e61210da04b 100644
--- a/drivers/irqchip/irq-gic-v3.c
+++ b/drivers/irqchip/irq-gic-v3.c
@@ -100,6 +100,27 @@ EXPORT_SYMBOL(gic_pmr_sync);
 DEFINE_STATIC_KEY_FALSE(gic_nonsecure_priorities);
 EXPORT_SYMBOL(gic_nonsecure_priorities);
 
+/*
+ * When the Non-secure world has access to group 0 interrupts (as a
+ * consequence of SCR_EL3.FIQ == 0), reading the ICC_RPR_EL1 register will
+ * return the Distributor's view of the interrupt priority.
+ *
+ * When GIC security is enabled (GICD_CTLR.DS == 0), the interrupt priority
+ * written by software is moved to the Non-secure range by the Distributor.
+ *
+ * If both are true (which is when gic_nonsecure_priorities gets enabled),
+ * we need to shift down the priority programmed by software to match it
+ * against the value returned by ICC_RPR_EL1.
+ */
+#define GICD_INT_RPR_PRI(priority)					\
+	({								\
+		u32 __priority = (priority);				\
+		if (static_branch_unlikely(&gic_nonsecure_priorities))	\
+			__priority = 0x80 | (__priority >> 1);		\
+									\
+		__priority;						\
+	})
+
 /* ppi_nmi_refs[n] == number of cpus having ppi[n + 16] set as NMI */
 static refcount_t *ppi_nmi_refs;
 
@@ -687,7 +708,7 @@ static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs
 		return;
 
 	if (gic_supports_nmi() &&
-	    unlikely(gic_read_rpr() == GICD_INT_NMI_PRI)) {
+	    unlikely(gic_read_rpr() == GICD_INT_RPR_PRI(GICD_INT_NMI_PRI))) {
 		gic_handle_nmi(irqnr, regs);
 		return;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 070/334] crypto: qat - use proper type for vf_mask
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 069/334] irqchip/gic-v3: Fix priority comparison when non-secure priorities are used Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 071/334] m68k: Fix asm register constraints for atomic ops Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Giovanni Cabiddu, Marco Chiappero,
	Fiona Trahe, Herbert Xu, Sasha Levin

From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>

[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]

Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.

This is to fix the following warning reported by KASAN the first time
adf_msix_isr_ae() gets called.

    [  692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
    [  692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
    [  692.092076] Call Trace:
    [  692.092089]  <IRQ>
    [  692.092101]  dump_stack+0x9c/0xcf
    [  692.092132]  print_address_description.constprop.0+0x18/0x130
    [  692.092164]  ? find_first_bit+0x28/0x50
    [  692.092185]  kasan_report.cold+0x7f/0x111
    [  692.092213]  ? static_obj+0x10/0x80
    [  692.092234]  ? find_first_bit+0x28/0x50
    [  692.092262]  find_first_bit+0x28/0x50
    [  692.092288]  adf_msix_isr_ae+0x16e/0x230 [intel_qat]

Fixes: ed8ccaef52fa ("crypto: qat - Add support for SRIOV")
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Marco Chiappero <marco.chiappero@intel.com>
Reviewed-by: Fiona Trahe <fiona.trahe@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/crypto/qat/qat_common/adf_isr.c b/drivers/crypto/qat/qat_common/adf_isr.c
index e3ad5587be49..daab02011717 100644
--- a/drivers/crypto/qat/qat_common/adf_isr.c
+++ b/drivers/crypto/qat/qat_common/adf_isr.c
@@ -15,6 +15,8 @@
 #include "adf_transport_access_macros.h"
 #include "adf_transport_internal.h"
 
+#define ADF_MAX_NUM_VFS	32
+
 static int adf_enable_msix(struct adf_accel_dev *accel_dev)
 {
 	struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
@@ -72,7 +74,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
 		struct adf_bar *pmisc =
 			&GET_BARS(accel_dev)[hw_data->get_misc_bar_id(hw_data)];
 		void __iomem *pmisc_bar_addr = pmisc->virt_addr;
-		u32 vf_mask;
+		unsigned long vf_mask;
 
 		/* Get the interrupt sources triggered by VFs */
 		vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
@@ -93,8 +95,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)
 			 * unless the VF is malicious and is attempting to
 			 * flood the host OS with VF2PF interrupts.
 			 */
-			for_each_set_bit(i, (const unsigned long *)&vf_mask,
-					 (sizeof(vf_mask) * BITS_PER_BYTE)) {
+			for_each_set_bit(i, &vf_mask, ADF_MAX_NUM_VFS) {
 				vf_info = accel_dev->pf.vf_info + i;
 
 				if (!__ratelimit(&vf_info->vf2pf_ratelimit)) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 071/334] m68k: Fix asm register constraints for atomic ops
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 070/334] crypto: qat - use proper type for vf_mask Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 072/334] certs: Trigger creation of RSA module signing key if its not an RSA key Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Arnd Bergmann,
	Alexander Viro, Geert Uytterhoeven, Sasha Levin

From: Geert Uytterhoeven <geert@linux-m68k.org>

[ Upstream commit 87d93029fe83e326d5b906e12e95600b157d2c0d ]

Depending on register assignment by the compiler:

    {standard input}:3084: Error: operands mismatch -- statement `andl %a1,%d1' ignored
    {standard input}:3145: Error: operands mismatch -- statement `orl %a1,%d1' ignored
    {standard input}:3195: Error: operands mismatch -- statement `eorl %a1,%d1' ignored

Indeed, the first operand must not be an address register.  However, it
can be an immediate value.  Fix this by adjusting the register
constraint from "g" (general purpose register) to "di" (data register or
immediate).

Fixes: e39d88ea3ce4a471 ("locking/atomic, arch/m68k: Implement atomic_fetch_{add,sub,and,or,xor}()")
Fixes: d839bae4269aea46 ("locking,arch,m68k: Fold atomic_ops")
Fixes: 1da177e4c3f41524 ("Linux-2.6.12-rc2")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20210809112903.3898660-1-geert@linux-m68k.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/include/asm/atomic.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/m68k/include/asm/atomic.h b/arch/m68k/include/asm/atomic.h
index 8637bf8a2f65..cfba83d230fd 100644
--- a/arch/m68k/include/asm/atomic.h
+++ b/arch/m68k/include/asm/atomic.h
@@ -48,7 +48,7 @@ static inline int arch_atomic_##op##_return(int i, atomic_t *v)		\
 			"	casl %2,%1,%0\n"			\
 			"	jne 1b"					\
 			: "+m" (*v), "=&d" (t), "=&d" (tmp)		\
-			: "g" (i), "2" (arch_atomic_read(v)));		\
+			: "di" (i), "2" (arch_atomic_read(v)));		\
 	return t;							\
 }
 
@@ -63,7 +63,7 @@ static inline int arch_atomic_fetch_##op(int i, atomic_t *v)		\
 			"	casl %2,%1,%0\n"			\
 			"	jne 1b"					\
 			: "+m" (*v), "=&d" (t), "=&d" (tmp)		\
-			: "g" (i), "2" (arch_atomic_read(v)));		\
+			: "di" (i), "2" (arch_atomic_read(v)));		\
 	return tmp;							\
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 072/334] certs: Trigger creation of RSA module signing key if its not an RSA key
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 071/334] m68k: Fix asm register constraints for atomic ops Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 073/334] tpm: ibmvtpm: Avoid error message when process gets signal while waiting Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Howells, David Woodhouse,
	Stefan Berger, Jarkko Sakkinen, Sasha Levin

From: Stefan Berger <stefanb@linux.ibm.com>

[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ]

Address a kbuild issue where a developer created an ECDSA key for signing
kernel modules and then builds an older version of the kernel, when bi-
secting the kernel for example, that does not support ECDSA keys.

If openssl is installed, trigger the creation of an RSA module signing
key if it is not an RSA key.

Fixes: cfc411e7fff3 ("Move certificate handling to its own directory")
Cc: David Howells <dhowells@redhat.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 certs/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/certs/Makefile b/certs/Makefile
index 359239a0ee9e..f9344e52ecda 100644
--- a/certs/Makefile
+++ b/certs/Makefile
@@ -57,11 +57,19 @@ endif
 redirect_openssl	= 2>&1
 quiet_redirect_openssl	= 2>&1
 silent_redirect_openssl = 2>/dev/null
+openssl_available       = $(shell openssl help 2>/dev/null && echo yes)
 
 # We do it this way rather than having a boolean option for enabling an
 # external private key, because 'make randconfig' might enable such a
 # boolean option and we unfortunately can't make it depend on !RANDCONFIG.
 ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem")
+
+ifeq ($(openssl_available),yes)
+X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null)
+
+$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem"))
+endif
+
 $(obj)/signing_key.pem: $(obj)/x509.genkey
 	@$(kecho) "###"
 	@$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 073/334] tpm: ibmvtpm: Avoid error message when process gets signal while waiting
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 072/334] certs: Trigger creation of RSA module signing key if its not an RSA key Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 074/334] EDAC/i10nm: Fix NVDIMM detection Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nayna Jain, George Wilson,
	Nageswara R Sastry, Stefan Berger, Jarkko Sakkinen, Sasha Levin

From: Stefan Berger <stefanb@linux.ibm.com>

[ Upstream commit 047d4226b0bca1cda5267dc68bc8291cce5364ac ]

When rngd is run as root then lots of these types of message will appear
in the kernel log if the TPM has been configured to provide random bytes:

[ 7406.275163] tpm tpm0: tpm_transmit: tpm_recv: error -4

The issue is caused by the following call that is interrupted while
waiting for the TPM's response.

sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);

Rather than waiting for the response in the low level driver, have it use
the polling loop in tpm_try_transmit() that uses a command's duration to
poll until a result has been returned by the TPM, thus ending when the
timeout has occurred but not responding to signals and ctrl-c anymore. To
stay in this polling loop extend tpm_ibmvtpm_status() to return
'true' for as long as the vTPM is indicated as being busy in
tpm_processing_cmd. Since the loop requires the TPM's timeouts, get them
now using tpm_get_timeouts() after setting the TPM2 version flag on the
chip.

To recreat the resolved issue start rngd like this:

sudo rngd -r /dev/hwrng -t
sudo rngd -r /dev/tpm0 -t

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1981473
Fixes: 6674ff145eef ("tpm_ibmvtpm: properly handle interrupted packet receptions")
Cc: Nayna Jain <nayna@linux.ibm.com>
Cc: George Wilson <gcwilson@linux.ibm.com>
Reported-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_ibmvtpm.c | 26 +++++++++++++++-----------
 drivers/char/tpm/tpm_ibmvtpm.h |  2 +-
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 903604769de9..3af4c07a9342 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -106,17 +106,12 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 {
 	struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
 	u16 len;
-	int sig;
 
 	if (!ibmvtpm->rtce_buf) {
 		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
 		return 0;
 	}
 
-	sig = wait_event_interruptible(ibmvtpm->wq, !ibmvtpm->tpm_processing_cmd);
-	if (sig)
-		return -EINTR;
-
 	len = ibmvtpm->res_len;
 
 	if (count < len) {
@@ -237,7 +232,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
 	 * set the processing flag before the Hcall, since we may get the
 	 * result (interrupt) before even being able to check rc.
 	 */
-	ibmvtpm->tpm_processing_cmd = true;
+	ibmvtpm->tpm_processing_cmd = 1;
 
 again:
 	rc = ibmvtpm_send_crq(ibmvtpm->vdev,
@@ -255,7 +250,7 @@ again:
 			goto again;
 		}
 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
-		ibmvtpm->tpm_processing_cmd = false;
+		ibmvtpm->tpm_processing_cmd = 0;
 	}
 
 	spin_unlock(&ibmvtpm->rtce_lock);
@@ -269,7 +264,9 @@ static void tpm_ibmvtpm_cancel(struct tpm_chip *chip)
 
 static u8 tpm_ibmvtpm_status(struct tpm_chip *chip)
 {
-	return 0;
+	struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
+
+	return ibmvtpm->tpm_processing_cmd;
 }
 
 /**
@@ -457,7 +454,7 @@ static const struct tpm_class_ops tpm_ibmvtpm = {
 	.send = tpm_ibmvtpm_send,
 	.cancel = tpm_ibmvtpm_cancel,
 	.status = tpm_ibmvtpm_status,
-	.req_complete_mask = 0,
+	.req_complete_mask = 1,
 	.req_complete_val = 0,
 	.req_canceled = tpm_ibmvtpm_req_canceled,
 };
@@ -550,7 +547,7 @@ static void ibmvtpm_crq_process(struct ibmvtpm_crq *crq,
 		case VTPM_TPM_COMMAND_RES:
 			/* len of the data in rtce buffer */
 			ibmvtpm->res_len = be16_to_cpu(crq->len);
-			ibmvtpm->tpm_processing_cmd = false;
+			ibmvtpm->tpm_processing_cmd = 0;
 			wake_up_interruptible(&ibmvtpm->wq);
 			return;
 		default:
@@ -688,8 +685,15 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
 		goto init_irq_cleanup;
 	}
 
-	if (!strcmp(id->compat, "IBM,vtpm20")) {
+
+	if (!strcmp(id->compat, "IBM,vtpm20"))
 		chip->flags |= TPM_CHIP_FLAG_TPM2;
+
+	rc = tpm_get_timeouts(chip);
+	if (rc)
+		goto init_irq_cleanup;
+
+	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
 		rc = tpm2_get_cc_attrs_tbl(chip);
 		if (rc)
 			goto init_irq_cleanup;
diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
index b92aa7d3e93e..51198b137461 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.h
+++ b/drivers/char/tpm/tpm_ibmvtpm.h
@@ -41,7 +41,7 @@ struct ibmvtpm_dev {
 	wait_queue_head_t wq;
 	u16 res_len;
 	u32 vtpm_version;
-	bool tpm_processing_cmd;
+	u8 tpm_processing_cmd;
 };
 
 #define CRQ_RES_BUF_SIZE	PAGE_SIZE
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 074/334] EDAC/i10nm: Fix NVDIMM detection
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 073/334] tpm: ibmvtpm: Avoid error message when process gets signal while waiting Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 075/334] x86/mce: Defer processing of early errors Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fan Du, Wen Jin, Qiuxu Zhuo,
	Tony Luck, Sasha Levin

From: Qiuxu Zhuo <qiuxu.zhuo@intel.com>

[ Upstream commit 2294a7299f5e51667b841f63c6d69474491753fb ]

MCDDRCFG is a per-channel register and uses bit{0,1} to indicate
the NVDIMM presence on DIMM slot{0,1}. Current i10nm_edac driver
wrongly uses MCDDRCFG as per-DIMM register and fails to detect
the NVDIMM.

Fix it by reading MCDDRCFG as per-channel register and using its
bit{0,1} to check whether the NVDIMM is populated on DIMM slot{0,1}.

Fixes: d4dc89d069aa ("EDAC, i10nm: Add a driver for Intel 10nm server processors")
Reported-by: Fan Du <fan.du@intel.com>
Tested-by: Wen Jin <wen.jin@intel.com>
Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/20210818175701.1611513-2-tony.luck@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/edac/i10nm_base.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c
index 6ce0ed2ffaaf..b4a024cb8b97 100644
--- a/drivers/edac/i10nm_base.c
+++ b/drivers/edac/i10nm_base.c
@@ -33,9 +33,9 @@
 #define I10NM_GET_DIMMMTR(m, i, j)	\
 	readl((m)->mbase + ((m)->hbm_mc ? 0x80c : 0x2080c) + \
 	(i) * (m)->chan_mmio_sz + (j) * 4)
-#define I10NM_GET_MCDDRTCFG(m, i, j)	\
+#define I10NM_GET_MCDDRTCFG(m, i)	\
 	readl((m)->mbase + ((m)->hbm_mc ? 0x970 : 0x20970) + \
-	(i) * (m)->chan_mmio_sz + (j) * 4)
+	(i) * (m)->chan_mmio_sz)
 #define I10NM_GET_MCMTR(m, i)		\
 	readl((m)->mbase + ((m)->hbm_mc ? 0xef8 : 0x20ef8) + \
 	(i) * (m)->chan_mmio_sz)
@@ -321,10 +321,10 @@ static int i10nm_get_dimm_config(struct mem_ctl_info *mci,
 
 		ndimms = 0;
 		amap = I10NM_GET_AMAP(imc, i);
+		mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i);
 		for (j = 0; j < imc->num_dimms; j++) {
 			dimm = edac_get_dimm(mci, i, j, 0);
 			mtr = I10NM_GET_DIMMMTR(imc, i, j);
-			mcddrtcfg = I10NM_GET_MCDDRTCFG(imc, i, j);
 			edac_dbg(1, "dimmmtr 0x%x mcddrtcfg 0x%x (mc%d ch%d dimm%d)\n",
 				 mtr, mcddrtcfg, imc->mc, i, j);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 075/334] x86/mce: Defer processing of early errors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 074/334] EDAC/i10nm: Fix NVDIMM detection Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 076/334] spi: davinci: invoke chipselect callback Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sumanth Kamatala, Borislav Petkov,
	Tony Luck, Sasha Levin

From: Borislav Petkov <bp@alien8.de>

[ Upstream commit 3bff147b187d5dfccfca1ee231b0761a89f1eff5 ]

When a fatal machine check results in a system reset, Linux does not
clear the error(s) from machine check bank(s) - hardware preserves the
machine check banks across a warm reset.

During initialization of the kernel after the reboot, Linux reads, logs,
and clears all machine check banks.

But there is a problem. In:

  5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver")

the call to mce_register_decode_chain() moved later in the boot
sequence. This means that /dev/mcelog doesn't see those early error
logs.

This was partially fixed by:

  cd9c57cad3fe ("x86/MCE: Dump MCE to dmesg if no consumers")

which made sure that the logs were not lost completely by printing
to the console. But parsing console logs is error prone. Users of
/dev/mcelog should expect to find any early errors logged to standard
places.

Add a new flag MCP_QUEUE_LOG to machine_check_poll() to be used in early
machine check initialization to indicate that any errors found should
just be queued to genpool. When mcheck_late_init() is called it will
call mce_schedule_work() to actually log and flush any errors queued in
the genpool.

 [ Based on an original patch, commit message by and completely
   productized by Tony Luck. ]

Fixes: 5de97c9f6d85 ("x86/mce: Factor out and deprecate the /dev/mcelog driver")
Reported-by: Sumanth Kamatala <skamatala@juniper.net>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Link: https://lkml.kernel.org/r/20210824003129.GA1642753@agluck-desk2.amr.corp.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/include/asm/mce.h     |  1 +
 arch/x86/kernel/cpu/mce/core.c | 11 ++++++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index 0607ec4f5091..da9321548f6f 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -265,6 +265,7 @@ enum mcp_flags {
 	MCP_TIMESTAMP	= BIT(0),	/* log time stamp */
 	MCP_UC		= BIT(1),	/* log uncorrected errors */
 	MCP_DONTLOG	= BIT(2),	/* only clear, don't log */
+	MCP_QUEUE_LOG	= BIT(3),	/* only queue to genpool */
 };
 bool machine_check_poll(enum mcp_flags flags, mce_banks_t *b);
 
diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c
index 22791aadc085..8cb7816d03b4 100644
--- a/arch/x86/kernel/cpu/mce/core.c
+++ b/arch/x86/kernel/cpu/mce/core.c
@@ -817,7 +817,10 @@ log_it:
 		if (mca_cfg.dont_log_ce && !mce_usable_address(&m))
 			goto clear_it;
 
-		mce_log(&m);
+		if (flags & MCP_QUEUE_LOG)
+			mce_gen_pool_add(&m);
+		else
+			mce_log(&m);
 
 clear_it:
 		/*
@@ -1639,10 +1642,12 @@ static void __mcheck_cpu_init_generic(void)
 		m_fl = MCP_DONTLOG;
 
 	/*
-	 * Log the machine checks left over from the previous reset.
+	 * Log the machine checks left over from the previous reset. Log them
+	 * only, do not start processing them. That will happen in mcheck_late_init()
+	 * when all consumers have been registered on the notifier chain.
 	 */
 	bitmap_fill(all_banks, MAX_NR_BANKS);
-	machine_check_poll(MCP_UC | m_fl, &all_banks);
+	machine_check_poll(MCP_UC | MCP_QUEUE_LOG | m_fl, &all_banks);
 
 	cr4_set_bits(X86_CR4_MCE);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 076/334] spi: davinci: invoke chipselect callback
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 075/334] x86/mce: Defer processing of early errors Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 077/334] blk-crypto: fix check for too-large dun_bytes Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matija Glavinic Pecotic,
	Alexander Sverdlin, Mark Brown, Sasha Levin

From: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>

[ Upstream commit ea4ab99cb58cc9f8d64c0961ff9a059825f304cf ]

Davinci needs to configure chipselect on transfer.

Fixes: 4a07b8bcd503 ("spi: bitbang: Make chipselect callback optional")
Signed-off-by: Matija Glavinic Pecotic <matija.glavinic-pecotic.ext@nokia.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Link: https://lore.kernel.org/r/735fb7b0-82aa-5b9b-85e4-53f0c348cc0e@nokia.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-davinci.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c
index e114e6fe5ea5..d112c2cac042 100644
--- a/drivers/spi/spi-davinci.c
+++ b/drivers/spi/spi-davinci.c
@@ -213,12 +213,6 @@ static void davinci_spi_chipselect(struct spi_device *spi, int value)
 	 * line for the controller
 	 */
 	if (spi->cs_gpiod) {
-		/*
-		 * FIXME: is this code ever executed? This host does not
-		 * set SPI_MASTER_GPIO_SS so this chipselect callback should
-		 * not get called from the SPI core when we are using
-		 * GPIOs for chip select.
-		 */
 		if (value == BITBANG_CS_ACTIVE)
 			gpiod_set_value(spi->cs_gpiod, 1);
 		else
@@ -945,7 +939,7 @@ static int davinci_spi_probe(struct platform_device *pdev)
 	master->bus_num = pdev->id;
 	master->num_chipselect = pdata->num_chipselect;
 	master->bits_per_word_mask = SPI_BPW_RANGE_MASK(2, 16);
-	master->flags = SPI_MASTER_MUST_RX;
+	master->flags = SPI_MASTER_MUST_RX | SPI_MASTER_GPIO_SS;
 	master->setup = davinci_spi_setup;
 	master->cleanup = davinci_spi_cleanup;
 	master->can_dma = davinci_spi_can_dma;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 077/334] blk-crypto: fix check for too-large dun_bytes
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 076/334] spi: davinci: invoke chipselect callback Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 078/334] regulator: vctrl: Use locked regulator_get_voltage in probe path Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Jens Axboe, Sasha Levin

From: Eric Biggers <ebiggers@google.com>

[ Upstream commit cc40b7225151f611ef837f6403cfaeadc7af214a ]

dun_bytes needs to be less than or equal to the IV size of the
encryption mode, not just less than or equal to BLK_CRYPTO_MAX_IV_SIZE.

Currently this doesn't matter since blk_crypto_init_key() is never
actually passed invalid values, but we might as well fix this.

Fixes: a892c8d52c02 ("block: Inline encryption support for blk-mq")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20210825055918.51975-1-ebiggers@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 block/blk-crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-crypto.c b/block/blk-crypto.c
index c5bdaafffa29..103c2e2d50d6 100644
--- a/block/blk-crypto.c
+++ b/block/blk-crypto.c
@@ -332,7 +332,7 @@ int blk_crypto_init_key(struct blk_crypto_key *blk_key, const u8 *raw_key,
 	if (mode->keysize == 0)
 		return -EINVAL;
 
-	if (dun_bytes == 0 || dun_bytes > BLK_CRYPTO_MAX_IV_SIZE)
+	if (dun_bytes == 0 || dun_bytes > mode->ivsize)
 		return -EINVAL;
 
 	if (!is_power_of_2(data_unit_size))
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 078/334] regulator: vctrl: Use locked regulator_get_voltage in probe path
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 077/334] blk-crypto: fix check for too-large dun_bytes Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 079/334] regulator: vctrl: Avoid lockdep warning in enable/disable ops Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Mark Brown, Sasha Levin

From: Chen-Yu Tsai <wenst@chromium.org>

[ Upstream commit 98e47570ba985f2310586c80409238200fa3170f ]

In commit e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting
and setting the voltage"), all calls to get/set the voltage of the
control regulator were switched to unlocked versions to avoid deadlocks.
However, the call in the probe path is done without regulator locks
held. In this case the locked version should be used.

Switch back to the locked regulator_get_voltage() in the probe path to
avoid any mishaps.

Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20210825033704.3307263-2-wenst@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/vctrl-regulator.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
index cbadb1c99679..93d33201ffe0 100644
--- a/drivers/regulator/vctrl-regulator.c
+++ b/drivers/regulator/vctrl-regulator.c
@@ -490,7 +490,8 @@ static int vctrl_probe(struct platform_device *pdev)
 		if (ret)
 			return ret;
 
-		ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+		/* Use locked consumer API when not in regulator framework */
+		ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
 		if (ctrl_uV < 0) {
 			dev_err(&pdev->dev, "failed to get control voltage\n");
 			return ctrl_uV;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 079/334] regulator: vctrl: Avoid lockdep warning in enable/disable ops
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 078/334] regulator: vctrl: Use locked regulator_get_voltage in probe path Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 080/334] spi: sprd: Fix the wrong WDG_LOAD_VAL Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Norris, Chen-Yu Tsai,
	Mark Brown, Sasha Levin

From: Chen-Yu Tsai <wenst@chromium.org>

[ Upstream commit 21e39809fd7c4b8ff3662f23e0168e87594c8ca8 ]

vctrl_enable() and vctrl_disable() call regulator_enable() and
regulator_disable(), respectively. However, vctrl_* are regulator ops
and should not be calling the locked regulator APIs. Doing so results in
a lockdep warning.

Instead of exporting more internal regulator ops, model the ctrl supply
as an actual supply to vctrl-regulator. At probe time this driver still
needs to use the consumer API to fetch its constraints, but otherwise
lets the regulator core handle the upstream supply for it.

The enable/disable/is_enabled ops are not removed, but now only track
state internally. This preserves the original behavior with the ops
being available, but one could argue that the original behavior was
already incorrect: the internal state would not match the upstream
supply if that supply had another consumer that enabled the supply,
while vctrl-regulator was not enabled.

The lockdep warning is as follows:

	WARNING: possible circular locking dependency detected
	5.14.0-rc6 #2 Not tainted
	------------------------------------------------------
	swapper/0/1 is trying to acquire lock:
	ffffffc011306d00 (regulator_list_mutex){+.+.}-{3:3}, at:
		regulator_lock_dependent (arch/arm64/include/asm/current.h:19
					  include/linux/ww_mutex.h:111
					  drivers/regulator/core.c:329)

	but task is already holding lock:
	ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
		regulator_lock_recursive (drivers/regulator/core.c:156
					  drivers/regulator/core.c:263)

	which lock already depends on the new lock.

	the existing dependency chain (in reverse order) is:

	-> #2 (regulator_ww_class_mutex){+.+.}-{3:3}:
	__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
			     include/asm-generic/atomic-long.h:29
			     kernel/locking/mutex.c:103
			     kernel/locking/mutex.c:144
			     kernel/locking/mutex.c:963)
	ww_mutex_lock (kernel/locking/mutex.c:1199)
	regulator_lock_recursive (drivers/regulator/core.c:156
				  drivers/regulator/core.c:263)
	regulator_lock_dependent (drivers/regulator/core.c:343)
	regulator_enable (drivers/regulator/core.c:2808)
	set_machine_constraints (drivers/regulator/core.c:1536)
	regulator_register (drivers/regulator/core.c:5486)
	devm_regulator_register (drivers/regulator/devres.c:196)
	reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
	platform_probe (drivers/base/platform.c:1427)
	[...]

	-> #1 (regulator_ww_class_acquire){+.+.}-{0:0}:
	regulator_lock_dependent (include/linux/ww_mutex.h:129
				  drivers/regulator/core.c:329)
	regulator_enable (drivers/regulator/core.c:2808)
	set_machine_constraints (drivers/regulator/core.c:1536)
	regulator_register (drivers/regulator/core.c:5486)
	devm_regulator_register (drivers/regulator/devres.c:196)
	reg_fixed_voltage_probe (drivers/regulator/fixed.c:289)
	[...]

	-> #0 (regulator_list_mutex){+.+.}-{3:3}:
	__lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
			kernel/locking/lockdep.c:3174 (discriminator 4)
			kernel/locking/lockdep.c:3789 (discriminator 4)
			kernel/locking/lockdep.c:5015 (discriminator 4))
	lock_acquire (arch/arm64/include/asm/percpu.h:39
		      kernel/locking/lockdep.c:438
		      kernel/locking/lockdep.c:5627)
	__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
			     include/asm-generic/atomic-long.h:29
			     kernel/locking/mutex.c:103
			     kernel/locking/mutex.c:144
			     kernel/locking/mutex.c:963)
	mutex_lock_nested (kernel/locking/mutex.c:1125)
	regulator_lock_dependent (arch/arm64/include/asm/current.h:19
				  include/linux/ww_mutex.h:111
				  drivers/regulator/core.c:329)
	regulator_enable (drivers/regulator/core.c:2808)
	vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
	_regulator_do_enable (drivers/regulator/core.c:2617)
	_regulator_enable (drivers/regulator/core.c:2764)
	regulator_enable (drivers/regulator/core.c:308
			  drivers/regulator/core.c:2809)
	_set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
	dev_pm_opp_set_rate (drivers/opp/core.c:1164)
	set_target (drivers/cpufreq/cpufreq-dt.c:62)
	__cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
				 drivers/cpufreq/cpufreq.c:2271)
	cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
	cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
	subsys_interface_register (drivers/base/bus.c:?)
	cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
	dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
	[...]

	other info that might help us debug this:

	Chain exists of:
	  regulator_list_mutex --> regulator_ww_class_acquire --> regulator_ww_class_mutex

	 Possible unsafe locking scenario:

	       CPU0                    CPU1
	       ----                    ----
	  lock(regulator_ww_class_mutex);
				       lock(regulator_ww_class_acquire);
				       lock(regulator_ww_class_mutex);
	  lock(regulator_list_mutex);

	 *** DEADLOCK ***

	6 locks held by swapper/0/1:
	#0: ffffff8002d32188 (&dev->mutex){....}-{3:3}, at:
		__device_driver_lock (drivers/base/dd.c:1030)
	#1: ffffffc0111a0520 (cpu_hotplug_lock){++++}-{0:0}, at:
		cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2792 (discriminator 2))
	#2: ffffff8002a8d918 (subsys mutex#9){+.+.}-{3:3}, at:
		subsys_interface_register (drivers/base/bus.c:1033)
	#3: ffffff800341bb90 (&policy->rwsem){+.+.}-{3:3}, at:
		cpufreq_online (include/linux/bitmap.h:285
				include/linux/cpumask.h:405
				drivers/cpufreq/cpufreq.c:1399)
	#4: ffffffc011f0b7b8 (regulator_ww_class_acquire){+.+.}-{0:0}, at:
		regulator_enable (drivers/regulator/core.c:2808)
	#5: ffffff8004a77160 (regulator_ww_class_mutex){+.+.}-{3:3}, at:
		regulator_lock_recursive (drivers/regulator/core.c:156
		drivers/regulator/core.c:263)

	stack backtrace:
	CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc6 #2 7c8f8996d021ed0f65271e6aeebf7999de74a9fa
	Hardware name: Google Scarlet (DT)
	Call trace:
	dump_backtrace (arch/arm64/kernel/stacktrace.c:161)
	show_stack (arch/arm64/kernel/stacktrace.c:218)
	dump_stack_lvl (lib/dump_stack.c:106 (discriminator 2))
	dump_stack (lib/dump_stack.c:113)
	print_circular_bug (kernel/locking/lockdep.c:?)
	check_noncircular (kernel/locking/lockdep.c:?)
	__lock_acquire (kernel/locking/lockdep.c:3052 (discriminator 4)
			kernel/locking/lockdep.c:3174 (discriminator 4)
			kernel/locking/lockdep.c:3789 (discriminator 4)
			kernel/locking/lockdep.c:5015 (discriminator 4))
	lock_acquire (arch/arm64/include/asm/percpu.h:39
		      kernel/locking/lockdep.c:438
		      kernel/locking/lockdep.c:5627)
	__mutex_lock_common (include/asm-generic/atomic-instrumented.h:606
			     include/asm-generic/atomic-long.h:29
			     kernel/locking/mutex.c:103
			     kernel/locking/mutex.c:144
			     kernel/locking/mutex.c:963)
	mutex_lock_nested (kernel/locking/mutex.c:1125)
	regulator_lock_dependent (arch/arm64/include/asm/current.h:19
				  include/linux/ww_mutex.h:111
				  drivers/regulator/core.c:329)
	regulator_enable (drivers/regulator/core.c:2808)
	vctrl_enable (drivers/regulator/vctrl-regulator.c:400)
	_regulator_do_enable (drivers/regulator/core.c:2617)
	_regulator_enable (drivers/regulator/core.c:2764)
	regulator_enable (drivers/regulator/core.c:308
			  drivers/regulator/core.c:2809)
	_set_opp (drivers/opp/core.c:819 drivers/opp/core.c:1072)
	dev_pm_opp_set_rate (drivers/opp/core.c:1164)
	set_target (drivers/cpufreq/cpufreq-dt.c:62)
	__cpufreq_driver_target (drivers/cpufreq/cpufreq.c:2216
				 drivers/cpufreq/cpufreq.c:2271)
	cpufreq_online (drivers/cpufreq/cpufreq.c:1488 (discriminator 2))
	cpufreq_add_dev (drivers/cpufreq/cpufreq.c:1563)
	subsys_interface_register (drivers/base/bus.c:?)
	cpufreq_register_driver (drivers/cpufreq/cpufreq.c:2819)
	dt_cpufreq_probe (drivers/cpufreq/cpufreq-dt.c:344)
	[...]

Reported-by: Brian Norris <briannorris@chromium.org>
Fixes: f8702f9e4aa7 ("regulator: core: Use ww_mutex for regulators locking")
Fixes: e9153311491d ("regulator: vctrl-regulator: Avoid deadlock getting and setting the voltage")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20210825033704.3307263-3-wenst@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/vctrl-regulator.c | 72 +++++++++++++++++------------
 1 file changed, 42 insertions(+), 30 deletions(-)

diff --git a/drivers/regulator/vctrl-regulator.c b/drivers/regulator/vctrl-regulator.c
index 93d33201ffe0..d2a37978fc3a 100644
--- a/drivers/regulator/vctrl-regulator.c
+++ b/drivers/regulator/vctrl-regulator.c
@@ -37,7 +37,6 @@ struct vctrl_voltage_table {
 struct vctrl_data {
 	struct regulator_dev *rdev;
 	struct regulator_desc desc;
-	struct regulator *ctrl_reg;
 	bool enabled;
 	unsigned int min_slew_down_rate;
 	unsigned int ovp_threshold;
@@ -82,7 +81,12 @@ static int vctrl_calc_output_voltage(struct vctrl_data *vctrl, int ctrl_uV)
 static int vctrl_get_voltage(struct regulator_dev *rdev)
 {
 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
-	int ctrl_uV = regulator_get_voltage_rdev(vctrl->ctrl_reg->rdev);
+	int ctrl_uV;
+
+	if (!rdev->supply)
+		return -EPROBE_DEFER;
+
+	ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev);
 
 	return vctrl_calc_output_voltage(vctrl, ctrl_uV);
 }
@@ -92,14 +96,19 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
 			     unsigned int *selector)
 {
 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
-	struct regulator *ctrl_reg = vctrl->ctrl_reg;
-	int orig_ctrl_uV = regulator_get_voltage_rdev(ctrl_reg->rdev);
-	int uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
+	int orig_ctrl_uV;
+	int uV;
 	int ret;
 
+	if (!rdev->supply)
+		return -EPROBE_DEFER;
+
+	orig_ctrl_uV = regulator_get_voltage_rdev(rdev->supply->rdev);
+	uV = vctrl_calc_output_voltage(vctrl, orig_ctrl_uV);
+
 	if (req_min_uV >= uV || !vctrl->ovp_threshold)
 		/* voltage rising or no OVP */
-		return regulator_set_voltage_rdev(ctrl_reg->rdev,
+		return regulator_set_voltage_rdev(rdev->supply->rdev,
 			vctrl_calc_ctrl_voltage(vctrl, req_min_uV),
 			vctrl_calc_ctrl_voltage(vctrl, req_max_uV),
 			PM_SUSPEND_ON);
@@ -117,7 +126,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
 		next_uV = max_t(int, req_min_uV, uV - max_drop_uV);
 		next_ctrl_uV = vctrl_calc_ctrl_voltage(vctrl, next_uV);
 
-		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
+		ret = regulator_set_voltage_rdev(rdev->supply->rdev,
 					    next_ctrl_uV,
 					    next_ctrl_uV,
 					    PM_SUSPEND_ON);
@@ -134,7 +143,7 @@ static int vctrl_set_voltage(struct regulator_dev *rdev,
 
 err:
 	/* Try to go back to original voltage */
-	regulator_set_voltage_rdev(ctrl_reg->rdev, orig_ctrl_uV, orig_ctrl_uV,
+	regulator_set_voltage_rdev(rdev->supply->rdev, orig_ctrl_uV, orig_ctrl_uV,
 				   PM_SUSPEND_ON);
 
 	return ret;
@@ -151,16 +160,18 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
 				 unsigned int selector)
 {
 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
-	struct regulator *ctrl_reg = vctrl->ctrl_reg;
 	unsigned int orig_sel = vctrl->sel;
 	int ret;
 
+	if (!rdev->supply)
+		return -EPROBE_DEFER;
+
 	if (selector >= rdev->desc->n_voltages)
 		return -EINVAL;
 
 	if (selector >= vctrl->sel || !vctrl->ovp_threshold) {
 		/* voltage rising or no OVP */
-		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
+		ret = regulator_set_voltage_rdev(rdev->supply->rdev,
 					    vctrl->vtable[selector].ctrl,
 					    vctrl->vtable[selector].ctrl,
 					    PM_SUSPEND_ON);
@@ -179,7 +190,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
 		else
 			next_sel = vctrl->vtable[vctrl->sel].ovp_min_sel;
 
-		ret = regulator_set_voltage_rdev(ctrl_reg->rdev,
+		ret = regulator_set_voltage_rdev(rdev->supply->rdev,
 					    vctrl->vtable[next_sel].ctrl,
 					    vctrl->vtable[next_sel].ctrl,
 					    PM_SUSPEND_ON);
@@ -202,7 +213,7 @@ static int vctrl_set_voltage_sel(struct regulator_dev *rdev,
 err:
 	if (vctrl->sel != orig_sel) {
 		/* Try to go back to original voltage */
-		if (!regulator_set_voltage_rdev(ctrl_reg->rdev,
+		if (!regulator_set_voltage_rdev(rdev->supply->rdev,
 					   vctrl->vtable[orig_sel].ctrl,
 					   vctrl->vtable[orig_sel].ctrl,
 					   PM_SUSPEND_ON))
@@ -234,10 +245,6 @@ static int vctrl_parse_dt(struct platform_device *pdev,
 	u32 pval;
 	u32 vrange_ctrl[2];
 
-	vctrl->ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl");
-	if (IS_ERR(vctrl->ctrl_reg))
-		return PTR_ERR(vctrl->ctrl_reg);
-
 	ret = of_property_read_u32(np, "ovp-threshold-percent", &pval);
 	if (!ret) {
 		vctrl->ovp_threshold = pval;
@@ -315,11 +322,11 @@ static int vctrl_cmp_ctrl_uV(const void *a, const void *b)
 	return at->ctrl - bt->ctrl;
 }
 
-static int vctrl_init_vtable(struct platform_device *pdev)
+static int vctrl_init_vtable(struct platform_device *pdev,
+			     struct regulator *ctrl_reg)
 {
 	struct vctrl_data *vctrl = platform_get_drvdata(pdev);
 	struct regulator_desc *rdesc = &vctrl->desc;
-	struct regulator *ctrl_reg = vctrl->ctrl_reg;
 	struct vctrl_voltage_range *vrange_ctrl = &vctrl->vrange.ctrl;
 	int n_voltages;
 	int ctrl_uV;
@@ -395,23 +402,19 @@ static int vctrl_init_vtable(struct platform_device *pdev)
 static int vctrl_enable(struct regulator_dev *rdev)
 {
 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
-	int ret = regulator_enable(vctrl->ctrl_reg);
 
-	if (!ret)
-		vctrl->enabled = true;
+	vctrl->enabled = true;
 
-	return ret;
+	return 0;
 }
 
 static int vctrl_disable(struct regulator_dev *rdev)
 {
 	struct vctrl_data *vctrl = rdev_get_drvdata(rdev);
-	int ret = regulator_disable(vctrl->ctrl_reg);
 
-	if (!ret)
-		vctrl->enabled = false;
+	vctrl->enabled = false;
 
-	return ret;
+	return 0;
 }
 
 static int vctrl_is_enabled(struct regulator_dev *rdev)
@@ -447,6 +450,7 @@ static int vctrl_probe(struct platform_device *pdev)
 	struct regulator_desc *rdesc;
 	struct regulator_config cfg = { };
 	struct vctrl_voltage_range *vrange_ctrl;
+	struct regulator *ctrl_reg;
 	int ctrl_uV;
 	int ret;
 
@@ -461,15 +465,20 @@ static int vctrl_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
+	ctrl_reg = devm_regulator_get(&pdev->dev, "ctrl");
+	if (IS_ERR(ctrl_reg))
+		return PTR_ERR(ctrl_reg);
+
 	vrange_ctrl = &vctrl->vrange.ctrl;
 
 	rdesc = &vctrl->desc;
 	rdesc->name = "vctrl";
 	rdesc->type = REGULATOR_VOLTAGE;
 	rdesc->owner = THIS_MODULE;
+	rdesc->supply_name = "ctrl";
 
-	if ((regulator_get_linear_step(vctrl->ctrl_reg) == 1) ||
-	    (regulator_count_voltages(vctrl->ctrl_reg) == -EINVAL)) {
+	if ((regulator_get_linear_step(ctrl_reg) == 1) ||
+	    (regulator_count_voltages(ctrl_reg) == -EINVAL)) {
 		rdesc->continuous_voltage_range = true;
 		rdesc->ops = &vctrl_ops_cont;
 	} else {
@@ -486,12 +495,12 @@ static int vctrl_probe(struct platform_device *pdev)
 	cfg.init_data = init_data;
 
 	if (!rdesc->continuous_voltage_range) {
-		ret = vctrl_init_vtable(pdev);
+		ret = vctrl_init_vtable(pdev, ctrl_reg);
 		if (ret)
 			return ret;
 
 		/* Use locked consumer API when not in regulator framework */
-		ctrl_uV = regulator_get_voltage(vctrl->ctrl_reg);
+		ctrl_uV = regulator_get_voltage(ctrl_reg);
 		if (ctrl_uV < 0) {
 			dev_err(&pdev->dev, "failed to get control voltage\n");
 			return ctrl_uV;
@@ -514,6 +523,9 @@ static int vctrl_probe(struct platform_device *pdev)
 		}
 	}
 
+	/* Drop ctrl-supply here in favor of regulator core managed supply */
+	devm_regulator_put(ctrl_reg);
+
 	vctrl->rdev = devm_regulator_register(&pdev->dev, rdesc, &cfg);
 	if (IS_ERR(vctrl->rdev)) {
 		ret = PTR_ERR(vctrl->rdev);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 080/334] spi: sprd: Fix the wrong WDG_LOAD_VAL
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 079/334] regulator: vctrl: Avoid lockdep warning in enable/disable ops Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 081/334] spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chunyan Zhang, Mark Brown, Sasha Levin

From: Chunyan Zhang <chunyan.zhang@unisoc.com>

[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ]

Use 50ms as default timeout value and the time clock is 32768HZ.
The original value of WDG_LOAD_VAL is not correct, so this patch
fixes it.

Fixes: ac1775012058 ("spi: sprd: Add the support of restarting the system")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20210826091549.2138125-2-zhang.lyra@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-sprd-adi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/spi/spi-sprd-adi.c b/drivers/spi/spi-sprd-adi.c
index ab19068be867..98ef17389952 100644
--- a/drivers/spi/spi-sprd-adi.c
+++ b/drivers/spi/spi-sprd-adi.c
@@ -103,7 +103,7 @@
 #define HWRST_STATUS_WATCHDOG		0xf0
 
 /* Use default timeout 50 ms that converts to watchdog values */
-#define WDG_LOAD_VAL			((50 * 1000) / 32768)
+#define WDG_LOAD_VAL			((50 * 32768) / 1000)
 #define WDG_LOAD_MASK			GENMASK(15, 0)
 #define WDG_UNLOCK_KEY			0xe551
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 081/334] spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 080/334] spi: sprd: Fix the wrong WDG_LOAD_VAL Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 082/334] drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quanyang Wang, Mark Brown, Sasha Levin

From: Quanyang Wang <quanyang.wang@windriver.com>

[ Upstream commit 26cfc0dbe43aae60dc03af27077775244f26c167 ]

The function wait_for_completion_interruptible_timeout will return
-ERESTARTSYS immediately when receiving SIGKILL signal which is sent
by "jffs2_gcd_mtd" during umounting jffs2. This will break the SPI memory
operation because the data transmitting may begin before the command or
address transmitting completes. Use wait_for_completion_timeout to prevent
the process from being interruptible.

Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com>
Link: https://lore.kernel.org/r/20210826005930.20572-1-quanyang.wang@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/spi/spi-zynq-qspi.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c
index 9262c6418463..cfa222c9bd5e 100644
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -545,7 +545,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 		zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
 		zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
 				ZYNQ_QSPI_IXR_RXTX_MASK);
-		if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
 							       msecs_to_jiffies(1000)))
 			err = -ETIMEDOUT;
 	}
@@ -563,7 +563,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 		zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
 		zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
 				ZYNQ_QSPI_IXR_RXTX_MASK);
-		if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
 							       msecs_to_jiffies(1000)))
 			err = -ETIMEDOUT;
 	}
@@ -579,7 +579,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 		zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
 		zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
 				ZYNQ_QSPI_IXR_RXTX_MASK);
-		if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
 							       msecs_to_jiffies(1000)))
 			err = -ETIMEDOUT;
 
@@ -603,7 +603,7 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem,
 		zynq_qspi_write_op(xqspi, ZYNQ_QSPI_FIFO_DEPTH, true);
 		zynq_qspi_write(xqspi, ZYNQ_QSPI_IEN_OFFSET,
 				ZYNQ_QSPI_IXR_RXTX_MASK);
-		if (!wait_for_completion_interruptible_timeout(&xqspi->data_completion,
+		if (!wait_for_completion_timeout(&xqspi->data_completion,
 							       msecs_to_jiffies(1000)))
 			err = -ETIMEDOUT;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 082/334] drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 081/334] spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 083/334] drm/gma500: Fix end of loop tests for list_for_each_entry Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
	Steven Price, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit f42498705965bd4b026953c1892c686d8b1138e4 ]

Fix the missing clk_disable_unprepare() before return
from panfrost_clk_init() in the error handling case.

Fixes: b681af0bc1cc ("drm: panfrost: add optional bus_clock")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210608143856.4154766-1-weiyongjun1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/panfrost/panfrost_device.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/panfrost/panfrost_device.c b/drivers/gpu/drm/panfrost/panfrost_device.c
index 125ed973feaa..a2a09c51eed7 100644
--- a/drivers/gpu/drm/panfrost/panfrost_device.c
+++ b/drivers/gpu/drm/panfrost/panfrost_device.c
@@ -54,7 +54,8 @@ static int panfrost_clk_init(struct panfrost_device *pfdev)
 	if (IS_ERR(pfdev->bus_clock)) {
 		dev_err(pfdev->dev, "get bus_clock failed %ld\n",
 			PTR_ERR(pfdev->bus_clock));
-		return PTR_ERR(pfdev->bus_clock);
+		err = PTR_ERR(pfdev->bus_clock);
+		goto disable_clock;
 	}
 
 	if (pfdev->bus_clock) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 083/334] drm/gma500: Fix end of loop tests for list_for_each_entry
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 082/334] drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 084/334] ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harshvardhan Jha, Daniel Vetter, Sasha Levin

From: Harshvardhan Jha <harshvardhan.jha@oracle.com>

[ Upstream commit ea9a897b8affa0f7b4c90182b785dded74e434aa ]

The list_for_each_entry() iterator, "connector" in this code, can never be
NULL.  If we exit the loop without finding the correct  connector then
"connector" points invalid memory that is an offset from the list head.
This will eventually lead to memory corruption and presumably a kernel
crash.

Fixes: 9bd81acdb648 ("gma500: Convert Oaktrail to work with new output handling")
Signed-off-by: Harshvardhan Jha <harshvardhan.jha@oracle.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210709073959.11443-1-harshvardhan.jha@oracle.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/gma500/oaktrail_lvds.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/gma500/oaktrail_lvds.c b/drivers/gpu/drm/gma500/oaktrail_lvds.c
index 432bdcc57ac9..a1332878857b 100644
--- a/drivers/gpu/drm/gma500/oaktrail_lvds.c
+++ b/drivers/gpu/drm/gma500/oaktrail_lvds.c
@@ -117,7 +117,7 @@ static void oaktrail_lvds_mode_set(struct drm_encoder *encoder,
 			continue;
 	}
 
-	if (!connector) {
+	if (list_entry_is_head(connector, &mode_config->connector_list, head)) {
 		DRM_ERROR("Couldn't find connector when setting mode");
 		gma_power_end(dev);
 		return;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 084/334] ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 083/334] drm/gma500: Fix end of loop tests for list_for_each_entry Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 085/334] ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 2af2f861edd21c1456ef7dbec52122ce1b581568 ]

Add missing pm_runtime_disable() when probe error out. It could
avoid pm_runtime implementation complains when removing and probing
again the driver.

Fixes:125ab5d588b0b ("ASoC: mediatek: mt8192: add platform driver")

Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20210618141104.105047-2-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/mediatek/mt8192/mt8192-afe-pcm.c | 27 ++++++++++++++--------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
index 7a1724f5ff4c..31c280339c50 100644
--- a/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
+++ b/sound/soc/mediatek/mt8192/mt8192-afe-pcm.c
@@ -2229,12 +2229,13 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->regmap = syscon_node_to_regmap(dev->parent->of_node);
 	if (IS_ERR(afe->regmap)) {
 		dev_err(dev, "could not get regmap from parent\n");
-		return PTR_ERR(afe->regmap);
+		ret = PTR_ERR(afe->regmap);
+		goto err_pm_disable;
 	}
 	ret = regmap_attach_dev(dev, afe->regmap, &mt8192_afe_regmap_config);
 	if (ret) {
 		dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* enable clock for regcache get default value from hw */
@@ -2244,7 +2245,7 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
 	ret = regmap_reinit_cache(afe->regmap, &mt8192_afe_regmap_config);
 	if (ret) {
 		dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	pm_runtime_put_sync(&pdev->dev);
@@ -2257,8 +2258,10 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->memif_size = MT8192_MEMIF_NUM;
 	afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif),
 				  GFP_KERNEL);
-	if (!afe->memif)
-		return -ENOMEM;
+	if (!afe->memif) {
+		ret = -ENOMEM;
+		goto err_pm_disable;
+	}
 
 	for (i = 0; i < afe->memif_size; i++) {
 		afe->memif[i].data = &memif_data[i];
@@ -2272,22 +2275,26 @@ static int mt8192_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->irqs_size = MT8192_IRQ_NUM;
 	afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs),
 				 GFP_KERNEL);
-	if (!afe->irqs)
-		return -ENOMEM;
+	if (!afe->irqs) {
+		ret = -ENOMEM;
+		goto err_pm_disable;
+	}
 
 	for (i = 0; i < afe->irqs_size; i++)
 		afe->irqs[i].irq_data = &irq_data[i];
 
 	/* request irq */
 	irq_id = platform_get_irq(pdev, 0);
-	if (irq_id < 0)
-		return irq_id;
+	if (irq_id < 0) {
+		ret = irq_id;
+		goto err_pm_disable;
+	}
 
 	ret = devm_request_irq(dev, irq_id, mt8192_afe_irq_handler,
 			       IRQF_TRIGGER_NONE, "asys-isr", (void *)afe);
 	if (ret) {
 		dev_err(dev, "could not request_irq for Afe_ISR_Handle\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* init sub_dais */
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 085/334] ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 084/334] ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 086/334] ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Mark Brown, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 19f479c37f76e926a6c0bec974a4d09826e32fc6 ]

Add missing pm_runtime_disable() when probe error out. It could
avoid pm_runtime implementation complains when removing and probing
again the driver.

Fixes:a94aec035a122 ("ASoC: mediatek: mt8183: add platform driver")

Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20210618141104.105047-3-zhangqilong3@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/mediatek/mt8183/mt8183-afe-pcm.c | 43 ++++++++++++++--------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
index c4a598cbbdaa..14e77df06b01 100644
--- a/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
+++ b/sound/soc/mediatek/mt8183/mt8183-afe-pcm.c
@@ -1119,25 +1119,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->regmap = syscon_node_to_regmap(dev->parent->of_node);
 	if (IS_ERR(afe->regmap)) {
 		dev_err(dev, "could not get regmap from parent\n");
-		return PTR_ERR(afe->regmap);
+		ret = PTR_ERR(afe->regmap);
+		goto err_pm_disable;
 	}
 	ret = regmap_attach_dev(dev, afe->regmap, &mt8183_afe_regmap_config);
 	if (ret) {
 		dev_warn(dev, "regmap_attach_dev fail, ret %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	rstc = devm_reset_control_get(dev, "audiosys");
 	if (IS_ERR(rstc)) {
 		ret = PTR_ERR(rstc);
 		dev_err(dev, "could not get audiosys reset:%d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	ret = reset_control_reset(rstc);
 	if (ret) {
 		dev_err(dev, "failed to trigger audio reset:%d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* enable clock for regcache get default value from hw */
@@ -1147,7 +1148,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 	ret = regmap_reinit_cache(afe->regmap, &mt8183_afe_regmap_config);
 	if (ret) {
 		dev_err(dev, "regmap_reinit_cache fail, ret %d\n", ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	pm_runtime_put_sync(&pdev->dev);
@@ -1160,8 +1161,10 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->memif_size = MT8183_MEMIF_NUM;
 	afe->memif = devm_kcalloc(dev, afe->memif_size, sizeof(*afe->memif),
 				  GFP_KERNEL);
-	if (!afe->memif)
-		return -ENOMEM;
+	if (!afe->memif) {
+		ret = -ENOMEM;
+		goto err_pm_disable;
+	}
 
 	for (i = 0; i < afe->memif_size; i++) {
 		afe->memif[i].data = &memif_data[i];
@@ -1178,22 +1181,26 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 	afe->irqs_size = MT8183_IRQ_NUM;
 	afe->irqs = devm_kcalloc(dev, afe->irqs_size, sizeof(*afe->irqs),
 				 GFP_KERNEL);
-	if (!afe->irqs)
-		return -ENOMEM;
+	if (!afe->irqs) {
+		ret = -ENOMEM;
+		goto err_pm_disable;
+	}
 
 	for (i = 0; i < afe->irqs_size; i++)
 		afe->irqs[i].irq_data = &irq_data[i];
 
 	/* request irq */
 	irq_id = platform_get_irq(pdev, 0);
-	if (irq_id < 0)
-		return irq_id;
+	if (irq_id < 0) {
+		ret = irq_id;
+		goto err_pm_disable;
+	}
 
 	ret = devm_request_irq(dev, irq_id, mt8183_afe_irq_handler,
 			       IRQF_TRIGGER_NONE, "asys-isr", (void *)afe);
 	if (ret) {
 		dev_err(dev, "could not request_irq for asys-isr\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	/* init sub_dais */
@@ -1204,7 +1211,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 		if (ret) {
 			dev_warn(afe->dev, "dai register i %d fail, ret %d\n",
 				 i, ret);
-			return ret;
+			goto err_pm_disable;
 		}
 	}
 
@@ -1213,7 +1220,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 	if (ret) {
 		dev_warn(afe->dev, "mtk_afe_combine_sub_dai fail, ret %d\n",
 			 ret);
-		return ret;
+		goto err_pm_disable;
 	}
 
 	afe->mtk_afe_hardware = &mt8183_afe_hardware;
@@ -1229,7 +1236,7 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 					      NULL, 0);
 	if (ret) {
 		dev_warn(dev, "err_platform\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	ret = devm_snd_soc_register_component(afe->dev,
@@ -1238,10 +1245,14 @@ static int mt8183_afe_pcm_dev_probe(struct platform_device *pdev)
 					      afe->num_dai_drivers);
 	if (ret) {
 		dev_warn(dev, "err_dai_component\n");
-		return ret;
+		goto err_pm_disable;
 	}
 
 	return ret;
+
+err_pm_disable:
+	pm_runtime_disable(&pdev->dev);
+	return ret;
 }
 
 static int mt8183_afe_pcm_dev_remove(struct platform_device *pdev)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 086/334] ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 085/334] ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 087/334] media: atmel: atmel-sama5d2-isc: fix YUYV format Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Claudius Heine,
	Mark Brown, Sasha Levin

From: Marek Vasut <marex@denx.de>

[ Upstream commit 3694f996be5cb8374bd224f4e5462c945d359843 ]

The TAS2505/TAS2521 does support up to two channels, LEFT and RIGHT,
which are being alternated on the audio data bus by Word Clock, WCLK.
This is documented in TI slau472 2.7.1 Digital Audio Interface. Note
that both the LEFT and RIGHT channels are only used for audio INPUT,
while only the LEFT channel is used for audio OUTPUT.

Fixes: b4525b6196cd7 ("ASoC: tlv320aic32x4: add support for TAS2505")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Claudius Heine <ch@denx.de>
Cc: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20210708091229.56443-1-marex@denx.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/tlv320aic32x4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c
index 2e9175b37dc9..254a016cb1f3 100644
--- a/sound/soc/codecs/tlv320aic32x4.c
+++ b/sound/soc/codecs/tlv320aic32x4.c
@@ -1131,7 +1131,7 @@ static struct snd_soc_dai_driver aic32x4_tas2505_dai = {
 	.playback = {
 			 .stream_name = "Playback",
 			 .channels_min = 1,
-			 .channels_max = 1,
+			 .channels_max = 2,
 			 .rates = SNDRV_PCM_RATE_8000_96000,
 			 .formats = AIC32X4_FORMATS,},
 	.ops = &aic32x4_ops,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 087/334] media: atmel: atmel-sama5d2-isc: fix YUYV format
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 086/334] ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 088/334] media: TDA1997x: enable EDID support Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eugen Hristev, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Eugen Hristev <eugen.hristev@microchip.com>

[ Upstream commit 123aaf816b952e5b6ee754335596b01ba1f6c830 ]

SAMA5D2 does not have the YCYC field for the RLP (rounding, limiting,
packaging) module.
The YCYC field is supposed to work with interleaved YUV formats like YUYV.
In SAMA5D2, we have to use YYCC field, which is used for both planar
formats like YUV420 and interleaved formats like YUYV.
Fix the according rlp callback to replace the generic YCYC field (which
makes more sense from a logical point of view) with the required YYCC
field.

Fixes: debfa496871c ("media: atmel: atmel-isc-base: add support for more formats and additional pipeline modules")
Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../media/platform/atmel/atmel-sama5d2-isc.c    | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/media/platform/atmel/atmel-sama5d2-isc.c b/drivers/media/platform/atmel/atmel-sama5d2-isc.c
index 925aa80a139b..b66f1d174e9d 100644
--- a/drivers/media/platform/atmel/atmel-sama5d2-isc.c
+++ b/drivers/media/platform/atmel/atmel-sama5d2-isc.c
@@ -255,6 +255,23 @@ static void isc_sama5d2_config_rlp(struct isc_device *isc)
 	struct regmap *regmap = isc->regmap;
 	u32 rlp_mode = isc->config.rlp_cfg_mode;
 
+	/*
+	 * In sama5d2, the YUV planar modes and the YUYV modes are treated
+	 * in the same way in RLP register.
+	 * Normally, YYCC mode should be Luma(n) - Color B(n) - Color R (n)
+	 * and YCYC should be Luma(n + 1) - Color B (n) - Luma (n) - Color R (n)
+	 * but in sama5d2, the YCYC mode does not exist, and YYCC must be
+	 * selected for both planar and interleaved modes, as in fact
+	 * both modes are supported.
+	 *
+	 * Thus, if the YCYC mode is selected, replace it with the
+	 * sama5d2-compliant mode which is YYCC .
+	 */
+	if ((rlp_mode & ISC_RLP_CFG_MODE_YCYC) == ISC_RLP_CFG_MODE_YCYC) {
+		rlp_mode &= ~ISC_RLP_CFG_MODE_MASK;
+		rlp_mode |= ISC_RLP_CFG_MODE_YYCC;
+	}
+
 	regmap_update_bits(regmap, ISC_RLP_CFG + isc->offsets.rlp,
 			   ISC_RLP_CFG_MODE_MASK, rlp_mode);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 088/334] media: TDA1997x: enable EDID support
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 087/334] media: atmel: atmel-sama5d2-isc: fix YUYV format Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 089/334] leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Halasa, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Krzysztof Hałasa <khalasa@piap.pl>

[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ]

Without this patch, the TDA19971 chip's EDID is inactive.
EDID never worked with this driver, it was all tested with HDMI signal
sources which don't need EDID support.

Signed-off-by: Krzysztof Halasa <khalasa@piap.pl>
Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/i2c/tda1997x.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/media/i2c/tda1997x.c b/drivers/media/i2c/tda1997x.c
index 91e6db847bb5..3a191e257fad 100644
--- a/drivers/media/i2c/tda1997x.c
+++ b/drivers/media/i2c/tda1997x.c
@@ -2233,6 +2233,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)
 	/* get initial HDMI status */
 	state->hdmi_status = io_read(sd, REG_HDMI_FLAGS);
 
+	io_write(sd, REG_EDID_ENABLE, EDID_ENABLE_A_EN | EDID_ENABLE_B_EN);
 	return 0;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 089/334] leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 088/334] media: TDA1997x: enable EDID support Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 090/334] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abaci Robot, Jiapeng Chong,
	David Rivshin, Pavel Machek, Sasha Levin

From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>

[ Upstream commit e642197562cd9781453f835e1406cfe0feeb917e ]

The error code is missing in this code scenario, add the error code
'-EINVAL' to the return value 'ret'.

Eliminate the follow smatch warning:

drivers/leds/leds-is31fl32xx.c:388 is31fl32xx_parse_dt() warn: missing
error code 'ret'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Fixes: 9d7cffaf99f5 ("leds: Add driver for the ISSI IS31FL32xx family of LED controllers")
Acked-by: David Rivshin <drivshin@allworx.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-is31fl32xx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/leds/leds-is31fl32xx.c b/drivers/leds/leds-is31fl32xx.c
index 3b55af9a8c58..22c092a4394a 100644
--- a/drivers/leds/leds-is31fl32xx.c
+++ b/drivers/leds/leds-is31fl32xx.c
@@ -386,6 +386,7 @@ static int is31fl32xx_parse_dt(struct device *dev,
 			dev_err(dev,
 				"Node %pOF 'reg' conflicts with another LED\n",
 				child);
+			ret = -EINVAL;
 			goto err;
 		}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 090/334] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 089/334] leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 091/334] media: cxd2880-spi: Fix an error handling path Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Heiko Stuebner,
	Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ]

Merely enabling CONFIG_COMPILE_TEST should not enable additional code.
To fix this, restrict the automatic enabling of ROCKCHIP_GRF to
ARCH_ROCKCHIP, and ask the user in case of compile-testing.

Fixes: 4c58063d4258f6be ("soc: rockchip: add driver handling grf setup")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20210208143855.418374-1-geert+renesas@glider.be
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/rockchip/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/soc/rockchip/Kconfig b/drivers/soc/rockchip/Kconfig
index 2c13bf4dd5db..25eb2c1e31bb 100644
--- a/drivers/soc/rockchip/Kconfig
+++ b/drivers/soc/rockchip/Kconfig
@@ -6,8 +6,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST
 #
 
 config ROCKCHIP_GRF
-	bool
-	default y
+	bool "Rockchip General Register Files support" if COMPILE_TEST
+	default y if ARCH_ROCKCHIP
 	help
 	  The General Register Files are a central component providing
 	  special additional settings registers for a lot of soc-components.
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 091/334] media: cxd2880-spi: Fix an error handling path
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 090/334] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 092/334] drm/of: free the right object Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit dcb0145821017e929a733e2271c85c6f82b9c9f8 ]

If an error occurs after a successful 'regulator_enable()' call,
'regulator_disable()' must be called.

Fix the error handling path of the probe accordingly.

Fixes: cb496cd472af ("media: cxd2880-spi: Add optional vcc regulator")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/spi/cxd2880-spi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c
index e5094fff04c5..b91a1e845b97 100644
--- a/drivers/media/spi/cxd2880-spi.c
+++ b/drivers/media/spi/cxd2880-spi.c
@@ -524,13 +524,13 @@ cxd2880_spi_probe(struct spi_device *spi)
 	if (IS_ERR(dvb_spi->vcc_supply)) {
 		if (PTR_ERR(dvb_spi->vcc_supply) == -EPROBE_DEFER) {
 			ret = -EPROBE_DEFER;
-			goto fail_adapter;
+			goto fail_regulator;
 		}
 		dvb_spi->vcc_supply = NULL;
 	} else {
 		ret = regulator_enable(dvb_spi->vcc_supply);
 		if (ret)
-			goto fail_adapter;
+			goto fail_regulator;
 	}
 
 	dvb_spi->spi = spi;
@@ -618,6 +618,9 @@ fail_frontend:
 fail_attach:
 	dvb_unregister_adapter(&dvb_spi->adapter);
 fail_adapter:
+	if (!dvb_spi->vcc_supply)
+		regulator_disable(dvb_spi->vcc_supply);
+fail_regulator:
 	kfree(dvb_spi);
 	return ret;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 092/334] drm/of: free the right object
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 091/334] media: cxd2880-spi: Fix an error handling path Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 093/334] bpf: Fix a typo of reuseport map in bpf.h Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julia Lawall, Daniel Vetter, Sasha Levin

From: Julia Lawall <Julia.Lawall@inria.fr>

[ Upstream commit b557a5f8da5798d27370ed6b73e673aae33efd55 ]

There is no need to free a NULL value.  Instead, free the object
that is leaking due to the iterator.

The semantic patch that finds this problem is as follows:

// <smpl>
@@
expression x,e;
identifier f;
@@
 x = f(...);
 if (x == NULL) {
	... when any
	    when != x = e
*	of_node_put(x);
	...
 }
// </smpl>

Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210709200717.3676376-1-Julia.Lawall@inria.fr
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_of.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
index ca04c34e8251..197c57477344 100644
--- a/drivers/gpu/drm/drm_of.c
+++ b/drivers/gpu/drm/drm_of.c
@@ -315,7 +315,7 @@ static int drm_of_lvds_get_remote_pixels_type(
 
 		remote_port = of_graph_get_remote_port(endpoint);
 		if (!remote_port) {
-			of_node_put(remote_port);
+			of_node_put(endpoint);
 			return -EPIPE;
 		}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 093/334] bpf: Fix a typo of reuseport map in bpf.h.
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 092/334] drm/of: free the right object Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 094/334] bpf: Fix potential memleak and UAF in the verifier Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuniyuki Iwashima,
	Alexei Starovoitov, Martin KaFai Lau, John Fastabend,
	Sasha Levin

From: Kuniyuki Iwashima <kuniyu@amazon.co.jp>

[ Upstream commit f170acda7ffaf0473d06e1e17c12cd9fd63904f5 ]

Fix s/BPF_MAP_TYPE_REUSEPORT_ARRAY/BPF_MAP_TYPE_REUSEPORT_SOCKARRAY/ typo
in bpf.h.

Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20210714124317.67526-1-kuniyu@amazon.co.jp
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/bpf.h       | 2 +-
 tools/include/uapi/linux/bpf.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index bf9252c7381e..5cdff1631608 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -3249,7 +3249,7 @@ union bpf_attr {
  * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags)
  *	Description
  *		Select a **SO_REUSEPORT** socket from a
- *		**BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*.
+ *		**BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*.
  *		It checks the selected socket is matching the incoming
  *		request in the socket buffer.
  *	Return
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index bf9252c7381e..5cdff1631608 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -3249,7 +3249,7 @@ union bpf_attr {
  * long bpf_sk_select_reuseport(struct sk_reuseport_md *reuse, struct bpf_map *map, void *key, u64 flags)
  *	Description
  *		Select a **SO_REUSEPORT** socket from a
- *		**BPF_MAP_TYPE_REUSEPORT_ARRAY** *map*.
+ *		**BPF_MAP_TYPE_REUSEPORT_SOCKARRAY** *map*.
  *		It checks the selected socket is matching the incoming
  *		request in the socket buffer.
  *	Return
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 094/334] bpf: Fix potential memleak and UAF in the verifier.
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 093/334] bpf: Fix a typo of reuseport map in bpf.h Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 095/334] drm/of: free the iterator object on failure Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, He Fengqing, Alexei Starovoitov,
	Song Liu, Sasha Levin

From: He Fengqing <hefengqing@huawei.com>

[ Upstream commit 75f0fc7b48ad45a2e5736bcf8de26c8872fe8695 ]

In bpf_patch_insn_data(), we first use the bpf_patch_insn_single() to
insert new instructions, then use adjust_insn_aux_data() to adjust
insn_aux_data. If the old env->prog have no enough room for new inserted
instructions, we use bpf_prog_realloc to construct new_prog and free the
old env->prog.

There have two errors here. First, if adjust_insn_aux_data() return
ENOMEM, we should free the new_prog. Second, if adjust_insn_aux_data()
return ENOMEM, bpf_patch_insn_data() will return NULL, and env->prog has
been freed in bpf_prog_realloc, but we will use it in bpf_check().

So in this patch, we make the adjust_insn_aux_data() never fails. In
bpf_patch_insn_data(), we first pre-malloc memory for the new
insn_aux_data, then call bpf_patch_insn_single() to insert new
instructions, at last call adjust_insn_aux_data() to adjust
insn_aux_data.

Fixes: 8041902dae52 ("bpf: adjust insn_aux_data when patching insns")
Signed-off-by: He Fengqing <hefengqing@huawei.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/bpf/20210714101815.164322-1-hefengqing@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 49f07e2bf23b..10084c0600dd 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11414,10 +11414,11 @@ static void convert_pseudo_ld_imm64(struct bpf_verifier_env *env)
  * insni[off, off + cnt).  Adjust corresponding insn_aux_data by copying
  * [0, off) and [off, end) to new locations, so the patched range stays zero
  */
-static int adjust_insn_aux_data(struct bpf_verifier_env *env,
-				struct bpf_prog *new_prog, u32 off, u32 cnt)
+static void adjust_insn_aux_data(struct bpf_verifier_env *env,
+				 struct bpf_insn_aux_data *new_data,
+				 struct bpf_prog *new_prog, u32 off, u32 cnt)
 {
-	struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data;
+	struct bpf_insn_aux_data *old_data = env->insn_aux_data;
 	struct bpf_insn *insn = new_prog->insnsi;
 	u32 old_seen = old_data[off].seen;
 	u32 prog_len;
@@ -11430,12 +11431,9 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env,
 	old_data[off].zext_dst = insn_has_def32(env, insn + off + cnt - 1);
 
 	if (cnt == 1)
-		return 0;
+		return;
 	prog_len = new_prog->len;
-	new_data = vzalloc(array_size(prog_len,
-				      sizeof(struct bpf_insn_aux_data)));
-	if (!new_data)
-		return -ENOMEM;
+
 	memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off);
 	memcpy(new_data + off + cnt - 1, old_data + off,
 	       sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1));
@@ -11446,7 +11444,6 @@ static int adjust_insn_aux_data(struct bpf_verifier_env *env,
 	}
 	env->insn_aux_data = new_data;
 	vfree(old_data);
-	return 0;
 }
 
 static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len)
@@ -11481,6 +11478,14 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
 					    const struct bpf_insn *patch, u32 len)
 {
 	struct bpf_prog *new_prog;
+	struct bpf_insn_aux_data *new_data = NULL;
+
+	if (len > 1) {
+		new_data = vzalloc(array_size(env->prog->len + len - 1,
+					      sizeof(struct bpf_insn_aux_data)));
+		if (!new_data)
+			return NULL;
+	}
 
 	new_prog = bpf_patch_insn_single(env->prog, off, patch, len);
 	if (IS_ERR(new_prog)) {
@@ -11488,10 +11493,10 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of
 			verbose(env,
 				"insn %d cannot be patched due to 16-bit range\n",
 				env->insn_aux_data[off].orig_idx);
+		vfree(new_data);
 		return NULL;
 	}
-	if (adjust_insn_aux_data(env, new_prog, off, len))
-		return NULL;
+	adjust_insn_aux_data(env, new_data, new_prog, off, len);
 	adjust_subprog_starts(env, off, len);
 	adjust_poke_descs(new_prog, off, len);
 	return new_prog;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 095/334] drm/of: free the iterator object on failure
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 094/334] bpf: Fix potential memleak and UAF in the verifier Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 096/334] gve: fix the wrong AdminQ buffer overflow check Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Steven Price, Laurent Pinchart, Sasha Levin

From: Steven Price <steven.price@arm.com>

[ Upstream commit 6f9223a56fabc840836b49de27dc7b27642c6a32 ]

When bailing out due to the sanity check the iterator value needs to be
freed because the early return prevents for_each_child_of_node() from
doing the dereference itself.

Fixes: 6529007522de ("drm: of: Add drm_of_lvds_get_dual_link_pixel_order")
Signed-off-by: Steven Price <steven.price@arm.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210714143300.20632-1-steven.price@arm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/drm_of.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/drm_of.c b/drivers/gpu/drm/drm_of.c
index 197c57477344..997b8827fed2 100644
--- a/drivers/gpu/drm/drm_of.c
+++ b/drivers/gpu/drm/drm_of.c
@@ -331,8 +331,10 @@ static int drm_of_lvds_get_remote_pixels_type(
 		 * configurations by passing the endpoints explicitly to
 		 * drm_of_lvds_get_dual_link_pixel_order().
 		 */
-		if (!current_pt || pixels_type != current_pt)
+		if (!current_pt || pixels_type != current_pt) {
+			of_node_put(endpoint);
 			return -EINVAL;
+		}
 	}
 
 	return pixels_type;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 096/334] gve: fix the wrong AdminQ buffer overflow check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 095/334] drm/of: free the iterator object on failure Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 097/334] libbpf: Fix the possible memory leak on error Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Haiyue Wang, Catherine Sullivan,
	David S. Miller, Sasha Levin

From: Haiyue Wang <haiyue.wang@intel.com>

[ Upstream commit 63a9192b8fa1ea55efeba1f18fad52bb24d9bf12 ]

The 'tail' pointer is also free-running count, so it needs to be masked
as 'adminq_prod_cnt' does, to become an index value of AdminQ buffer.

Fixes: 5cdad90de62c ("gve: Batch AQ commands for creating and destroying queues.")
Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>
Reviewed-by: Catherine Sullivan <csully@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/google/gve/gve_adminq.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/google/gve/gve_adminq.c b/drivers/net/ethernet/google/gve/gve_adminq.c
index 5bb56b454541..f089d33dd48e 100644
--- a/drivers/net/ethernet/google/gve/gve_adminq.c
+++ b/drivers/net/ethernet/google/gve/gve_adminq.c
@@ -322,7 +322,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
 	tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
 
 	// Check if next command will overflow the buffer.
-	if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
+	if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
+	    (tail & priv->adminq_mask)) {
 		int err;
 
 		// Flush existing commands to make room.
@@ -332,7 +333,8 @@ static int gve_adminq_issue_cmd(struct gve_priv *priv,
 
 		// Retry.
 		tail = ioread32be(&priv->reg_bar0->adminq_event_counter);
-		if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) == tail) {
+		if (((priv->adminq_prod_cnt + 1) & priv->adminq_mask) ==
+		    (tail & priv->adminq_mask)) {
 			// This should never happen. We just flushed the
 			// command queue so there should be enough space.
 			return -ENOMEM;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 097/334] libbpf: Fix the possible memory leak on error
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 096/334] gve: fix the wrong AdminQ buffer overflow check Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 098/334] ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shuyi Cheng, Andrii Nakryiko, Sasha Levin

From: Shuyi Cheng <chengshuyi@linux.alibaba.com>

[ Upstream commit 18353c87e0e0440d4c7c746ed740738bbc1b538e ]

If the strdup() fails then we need to call bpf_object__close(obj) to
avoid a resource leak.

Fixes: 166750bc1dd2 ("libbpf: Support libbpf-provided extern variables")
Signed-off-by: Shuyi Cheng <chengshuyi@linux.alibaba.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/1626180159-112996-3-git-send-email-chengshuyi@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 6f5e2757bb3c..1bfd11de9be6 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -7588,8 +7588,10 @@ __bpf_object__open(const char *path, const void *obj_buf, size_t obj_buf_sz,
 	kconfig = OPTS_GET(opts, kconfig, NULL);
 	if (kconfig) {
 		obj->kconfig = strdup(kconfig);
-		if (!obj->kconfig)
-			return ERR_PTR(-ENOMEM);
+		if (!obj->kconfig) {
+			err = -ENOMEM;
+			goto out;
+		}
 	}
 
 	err = bpf_object__elf_init(obj);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 098/334] ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 097/334] libbpf: Fix the possible memory leak on error Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 099/334] ARM: dts: everest: Add phase corrections for eMMC Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dylan Hung, Andrew Jeffery,
	Joel Stanley, Sasha Levin

From: Dylan Hung <dylan_hung@aspeedtech.com>

[ Upstream commit 8c295b7f3d01359ff4336fcb6e406e6ed37957d6 ]

The HVI3C shall be a group of I3C function, not an independent function.
Correct the function name from "HVI3C" to "I3C".

Signed-off-by: Dylan Hung <dylan_hung@aspeedtech.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Fixes: f510f04c8c83 ("ARM: dts: aspeed: Add AST2600 pinmux nodes")
Link: https://lore.kernel.org/r/20201029062723.20798-1-dylan_hung@aspeedtech.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
index 7e90d713f5e5..6dde51c2aed3 100644
--- a/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
+++ b/arch/arm/boot/dts/aspeed-g6-pinctrl.dtsi
@@ -208,12 +208,12 @@
 	};
 
 	pinctrl_hvi3c3_default: hvi3c3_default {
-		function = "HVI3C3";
+		function = "I3C3";
 		groups = "HVI3C3";
 	};
 
 	pinctrl_hvi3c4_default: hvi3c4_default {
-		function = "HVI3C4";
+		function = "I3C4";
 		groups = "HVI3C4";
 	};
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 099/334] ARM: dts: everest: Add phase corrections for eMMC
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 098/334] ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 100/334] arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Jeffery, Joel Stanley, Sasha Levin

From: Andrew Jeffery <andrew@aj.id.au>

[ Upstream commit ded3e2864c735f33ba5abbbe2d7b1c6605242f9b ]

The values were determined via scope measurements.

With the patch we can write and read data without issue where as booting
the system without the patch failed at the point of mounting the rootfs.

Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Link: https://lore.kernel.org/r/20210712233642.3119722-1-andrew@aj.id.au
Fixes: faffd1b2bde3 ("ARM: dts: everest: Add phase corrections for eMMC")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts b/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts
index aa24cac8e5be..44b03a5e2416 100644
--- a/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts
+++ b/arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts
@@ -2832,7 +2832,7 @@
 
 &emmc {
 	status = "okay";
-	clk-phase-mmc-hs200 = <180>, <180>;
+	clk-phase-mmc-hs200 = <210>, <228>;
 };
 
 &fsim0 {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 100/334] arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 099/334] ARM: dts: everest: Add phase corrections for eMMC Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 101/334] i40e: improve locking of mac_filter_hash Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Laurent Pinchart,
	Ulrich Hecht, Sasha Levin

From: Geert Uytterhoeven <geert@linux-m68k.org>

[ Upstream commit 4ec82a7bb3db8c6005e715c63224c32d458917a2 ]

The "max-clock" and "min-vrefresh" properties fail to validate with
commit cfe34bb7a770c5d8 ("dt-bindings: drm: bridge: adi,adv7511.txt:
convert to yaml").  Drop them, as they are parts of an out-of-tree
workaround that is not needed upstream.

Fixes: bcf3003438ea4645 ("arm64: dts: renesas: r8a77995: draak: Enable HDMI display output")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
Link: https://lore.kernel.org/r/975b6686bc423421b147d367fe7fb9a0db99c5af.1625134398.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/r8a77995-draak.dts | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
index 6783c3ad0856..57784341f39d 100644
--- a/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
+++ b/arch/arm64/boot/dts/renesas/r8a77995-draak.dts
@@ -277,10 +277,6 @@
 		interrupt-parent = <&gpio1>;
 		interrupts = <28 IRQ_TYPE_LEVEL_LOW>;
 
-		/* Depends on LVDS */
-		max-clock = <135000000>;
-		min-vrefresh = <50>;
-
 		adi,input-depth = <8>;
 		adi,input-colorspace = "rgb";
 		adi,input-clock = "1x";
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 101/334] i40e: improve locking of mac_filter_hash
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 100/334] arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 102/334] arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Assmann, Konrad Jankowski,
	Tony Nguyen, Sasha Levin, Paolo Abeni

From: Stefan Assmann <sassmann@kpanic.de>

[ Upstream commit 8b4b06919fd66caf49fdf4fe59f9d6312cf7956d ]

i40e_config_vf_promiscuous_mode() calls
i40e_getnum_vf_vsi_vlan_filters() without acquiring the
mac_filter_hash_lock spinlock.

This is unsafe because mac_filter_hash may get altered in another thread
while i40e_getnum_vf_vsi_vlan_filters() traverses the hashes.

Simply adding the spinlock in i40e_getnum_vf_vsi_vlan_filters() is not
possible as it already gets called in i40e_get_vlan_list_sync() with the
spinlock held. Therefore adding a wrapper that acquires the spinlock and
call the correct function where appropriate.

Fixes: 37d318d7805f ("i40e: Remove scheduling while atomic possibility")
Fix-suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Konrad Jankowski <konrad0.jankowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/intel/i40e/i40e_virtchnl_pf.c    | 23 ++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
index eff0a30790dd..472f56b360b8 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1160,12 +1160,12 @@ static int i40e_quiesce_vf_pci(struct i40e_vf *vf)
 }
 
 /**
- * i40e_getnum_vf_vsi_vlan_filters
+ * __i40e_getnum_vf_vsi_vlan_filters
  * @vsi: pointer to the vsi
  *
  * called to get the number of VLANs offloaded on this VF
  **/
-static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
+static int __i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
 {
 	struct i40e_mac_filter *f;
 	u16 num_vlans = 0, bkt;
@@ -1178,6 +1178,23 @@ static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
 	return num_vlans;
 }
 
+/**
+ * i40e_getnum_vf_vsi_vlan_filters
+ * @vsi: pointer to the vsi
+ *
+ * wrapper for __i40e_getnum_vf_vsi_vlan_filters() with spinlock held
+ **/
+static int i40e_getnum_vf_vsi_vlan_filters(struct i40e_vsi *vsi)
+{
+	int num_vlans;
+
+	spin_lock_bh(&vsi->mac_filter_hash_lock);
+	num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi);
+	spin_unlock_bh(&vsi->mac_filter_hash_lock);
+
+	return num_vlans;
+}
+
 /**
  * i40e_get_vlan_list_sync
  * @vsi: pointer to the VSI
@@ -1195,7 +1212,7 @@ static void i40e_get_vlan_list_sync(struct i40e_vsi *vsi, u16 *num_vlans,
 	int bkt;
 
 	spin_lock_bh(&vsi->mac_filter_hash_lock);
-	*num_vlans = i40e_getnum_vf_vsi_vlan_filters(vsi);
+	*num_vlans = __i40e_getnum_vf_vsi_vlan_filters(vsi);
 	*vlan_list = kcalloc(*num_vlans, sizeof(**vlan_list), GFP_ATOMIC);
 	if (!(*vlan_list))
 		goto err;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 102/334] arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 101/334] i40e: improve locking of mac_filter_hash Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 103/334] soc: qcom: rpmhpd: Use corner in power_off Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Judy Hsiao, Stephen Boyd,
	Bjorn Andersson, Sasha Levin

From: Judy Hsiao <judyhsiao@chromium.org>

[ Upstream commit a8c7f3100e708d5f55692f0607ca80c5dcd21ce8 ]

Set audu wakeup delay to 80 ms for fixing pop noise during capture begin.

Fixes: ba5f9b5d7ff3 ("arm64: dts: qcom: sc7180: Add wakeup delay for adau codec")
Signed-off-by: Judy Hsiao <judyhsiao@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20210708090810.174767-1-judyhsiao@chromium.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
index 6f9c07147551..a758e4d22612 100644
--- a/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180-trogdor-coachz.dtsi
@@ -23,7 +23,7 @@ ap_h1_spi: &spi0 {};
 	adau7002: audio-codec-1 {
 		compatible = "adi,adau7002";
 		IOVDD-supply = <&pp1800_l15a>;
-		wakeup-delay-ms = <15>;
+		wakeup-delay-ms = <80>;
 		#sound-dai-cells = <0>;
 	};
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 103/334] soc: qcom: rpmhpd: Use corner in power_off
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 102/334] arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 104/334] libbpf: Fix removal of inner map in bpf_object__create_map Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rajendra Nayak, Stephen Boyd,
	Sibi Sankar, Bjorn Andersson, Sasha Levin

From: Bjorn Andersson <bjorn.andersson@linaro.org>

[ Upstream commit d43b3a989bc8c06fd4bbb69a7500d180db2d68e8 ]

rpmhpd_aggregate_corner() takes a corner as parameter, but in
rpmhpd_power_off() the code requests the level of the first corner
instead.

In all (known) current cases the first corner has level 0, so this
change should be a nop, but in case that there's a power domain with a
non-zero lowest level this makes sure that rpmhpd_power_off() actually
requests the lowest level - which is the closest to "power off" we can
get.

While touching the code, also skip the unnecessary zero-initialization
of "ret".

Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver")
Reviewed-by: Rajendra Nayak <rnayak@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Sibi Sankar <sibis@codeaurora.org>
Tested-by: Sibi Sankar <sibis@codeaurora.org>
Link: https://lore.kernel.org/r/20210703005416.2668319-2-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/rpmhpd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/soc/qcom/rpmhpd.c b/drivers/soc/qcom/rpmhpd.c
index 2daa17ba54a3..fa209b479ab3 100644
--- a/drivers/soc/qcom/rpmhpd.c
+++ b/drivers/soc/qcom/rpmhpd.c
@@ -403,12 +403,11 @@ static int rpmhpd_power_on(struct generic_pm_domain *domain)
 static int rpmhpd_power_off(struct generic_pm_domain *domain)
 {
 	struct rpmhpd *pd = domain_to_rpmhpd(domain);
-	int ret = 0;
+	int ret;
 
 	mutex_lock(&rpmhpd_lock);
 
-	ret = rpmhpd_aggregate_corner(pd, pd->level[0]);
-
+	ret = rpmhpd_aggregate_corner(pd, 0);
 	if (!ret)
 		pd->enabled = false;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 104/334] libbpf: Fix removal of inner map in bpf_object__create_map
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 103/334] soc: qcom: rpmhpd: Use corner in power_off Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 105/334] gfs2: Fix memory leak of object lsi on error return path Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Martynas Pumputis,
	John Fastabend, Sasha Levin

From: Martynas Pumputis <m@lambda.lt>

[ Upstream commit a21ab4c59e09c2a9994a6e393b7484e3b3f78a99 ]

If creating an outer map of a BTF-defined map-in-map fails (via
bpf_object__create_map()), then the previously created its inner map
won't be destroyed.

Fix this by ensuring that the destroy routines are not bypassed in the
case of a failure.

Fixes: 646f02ffdd49c ("libbpf: Add BTF-defined map-in-map support")
Reported-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20210719173838.423148-2-m@lambda.lt
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 1bfd11de9be6..aa5ad6fc5f40 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -4479,6 +4479,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
 {
 	struct bpf_create_map_attr create_attr;
 	struct bpf_map_def *def = &map->def;
+	int err = 0;
 
 	memset(&create_attr, 0, sizeof(create_attr));
 
@@ -4521,8 +4522,6 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
 
 	if (bpf_map_type__is_map_in_map(def->type)) {
 		if (map->inner_map) {
-			int err;
-
 			err = bpf_object__create_map(obj, map->inner_map, true);
 			if (err) {
 				pr_warn("map '%s': failed to create inner map: %d\n",
@@ -4547,8 +4546,8 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
 	if (map->fd < 0 && (create_attr.btf_key_type_id ||
 			    create_attr.btf_value_type_id)) {
 		char *cp, errmsg[STRERR_BUFSIZE];
-		int err = -errno;
 
+		err = -errno;
 		cp = libbpf_strerror_r(err, errmsg, sizeof(errmsg));
 		pr_warn("Error in bpf_create_map_xattr(%s):%s(%d). Retrying without BTF.\n",
 			map->name, cp, err);
@@ -4560,8 +4559,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
 		map->fd = bpf_create_map_xattr(&create_attr);
 	}
 
-	if (map->fd < 0)
-		return -errno;
+	err = map->fd < 0 ? -errno : 0;
 
 	if (bpf_map_type__is_map_in_map(def->type) && map->inner_map) {
 		if (obj->gen_loader)
@@ -4570,7 +4568,7 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map, b
 		zfree(&map->inner_map);
 	}
 
-	return 0;
+	return err;
 }
 
 static int init_map_slots(struct bpf_object *obj, struct bpf_map *map)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 105/334] gfs2: Fix memory leak of object lsi on error return path
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 104/334] libbpf: Fix removal of inner map in bpf_object__create_map Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 106/334] arm64: dts: qcom: sm8250: fix usb2 qmp phy node Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Andreas Gruenbacher,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit a6579cbfd7216b071008db13360c322a6b21400b ]

In the case where IS_ERR(lsi->si_sc_inode) is true the error exit path
to free_local does not kfree the allocated object lsi leading to a memory
leak. Fix this by kfree'ing lst before taking the error exit path.

Addresses-Coverity: ("Resource leak")
Fixes: 97fd734ba17e ("gfs2: lookup local statfs inodes prior to journal recovery")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/ops_fstype.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 5f4504dd0875..bd3b3be1a473 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -677,6 +677,7 @@ static int init_statfs(struct gfs2_sbd *sdp)
 			error = PTR_ERR(lsi->si_sc_inode);
 			fs_err(sdp, "can't find local \"sc\" file#%u: %d\n",
 			       jd->jd_jid, error);
+			kfree(lsi);
 			goto free_local;
 		}
 		lsi->si_jid = jd->jd_jid;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 106/334] arm64: dts: qcom: sm8250: fix usb2 qmp phy node
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 105/334] gfs2: Fix memory leak of object lsi on error return path Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 107/334] bpf, selftests: Fix test_maps now that sockmap supports UDP Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, robh+dt, devicetree,
	Dmitry Baryshkov, Bryan ODonoghue, Bjorn Andersson, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit 63fa4322469648ae1023bb92a8b0d6a2f4bdaf2c ]

Use 'lanes' as SuperSpeed lanes device node instead of just 'lane' to
fix issues with TypeC support.

Fixes: 46a6f297d7dd ("arm64: dts: qcom: sm8250: Add USB and PHY device nodes")
Cc: robh+dt@kernel.org
Cc: devicetree@vger.kernel.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Link: https://lore.kernel.org/r/20210706230702.299047-2-bryan.odonoghue@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 4798368b02ef..9a6eff1813a6 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -2210,7 +2210,7 @@
 				 <&gcc GCC_USB3_PHY_SEC_BCR>;
 			reset-names = "phy", "common";
 
-			usb_2_ssphy: lane@88eb200 {
+			usb_2_ssphy: lanes@88eb200 {
 				reg = <0 0x088eb200 0 0x200>,
 				      <0 0x088eb400 0 0x200>,
 				      <0 0x088eb800 0 0x800>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 107/334] bpf, selftests: Fix test_maps now that sockmap supports UDP
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 106/334] arm64: dts: qcom: sm8250: fix usb2 qmp phy node Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 108/334] firmware: fix theoretical UAF race with firmware cache and resume Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, John Fastabend, Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit c39aa21599748f3845a47645f482d94099b11460 ]

UDP socket support was added recently so testing UDP insert failure is no
longer correct and causes test_maps failure. The fix is easy though, we
simply need to test that UDP is correctly added instead of blocked.

Fixes: 122e6c79efe1c ("sock_map: Update sock type checks for UDP")
Reported-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210720184832.452430-1-john.fastabend@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/test_maps.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c
index 30cbf5d98f7d..abdfc41f7685 100644
--- a/tools/testing/selftests/bpf/test_maps.c
+++ b/tools/testing/selftests/bpf/test_maps.c
@@ -764,8 +764,8 @@ static void test_sockmap(unsigned int tasks, void *data)
 	udp = socket(AF_INET, SOCK_DGRAM, 0);
 	i = 0;
 	err = bpf_map_update_elem(fd, &i, &udp, BPF_ANY);
-	if (!err) {
-		printf("Failed socket SOCK_DGRAM allowed '%i:%i'\n",
+	if (err) {
+		printf("Failed socket update SOCK_DGRAM '%i:%i'\n",
 		       i, udp);
 		goto out_sockmap;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 108/334] firmware: fix theoretical UAF race with firmware cache and resume
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 107/334] bpf, selftests: Fix test_maps now that sockmap supports UDP Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 109/334] driver core: Fix error return code in really_probe() Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Luis Chamberlain, Zhen Lei, Sasha Levin

From: Zhen Lei <thunder.leizhen@huawei.com>

[ Upstream commit 3ecc8cb7c092b2f50e21d2aaaae35b8221ee7214 ]

This race was discovered when I carefully analyzed the code to locate
another firmware-related UAF issue. It can be triggered only when the
firmware load operation is executed during suspend. This possibility is
almost impossible because there are few firmware load and suspend actions
in the actual environment.

		CPU0			CPU1
__device_uncache_fw_images():		assign_fw():
					fw_cache_piggyback_on_request()
					<----- P0
	spin_lock(&fwc->name_lock);
	...
	list_del(&fce->list);
	spin_unlock(&fwc->name_lock);

	uncache_firmware(fce->name);
					<----- P1
					kref_get(&fw_priv->ref);

If CPU1 is interrupted at position P0, the new 'fce' has been added to the
list fwc->fw_names by the fw_cache_piggyback_on_request(). In this case,
CPU0 executes __device_uncache_fw_images() and will be able to see it when
it traverses list fwc->fw_names. Before CPU1 executes kref_get() at P1, if
CPU0 further executes uncache_firmware(), the count of fw_priv->ref may
decrease to 0, causing fw_priv to be released in advance.

Move kref_get() to the lock protection range of fwc->name_lock to fix it.

Fixes: ac39b3ea73aa ("firmware loader: let caching firmware piggyback on loading firmware")
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210719064531.3733-2-thunder.leizhen@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/firmware_loader/main.c | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c
index 68c549d71230..bdbedc6660a8 100644
--- a/drivers/base/firmware_loader/main.c
+++ b/drivers/base/firmware_loader/main.c
@@ -165,7 +165,7 @@ static inline int fw_state_wait(struct fw_priv *fw_priv)
 	return __fw_state_wait_common(fw_priv, MAX_SCHEDULE_TIMEOUT);
 }
 
-static int fw_cache_piggyback_on_request(const char *name);
+static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv);
 
 static struct fw_priv *__allocate_fw_priv(const char *fw_name,
 					  struct firmware_cache *fwc,
@@ -707,10 +707,8 @@ int assign_fw(struct firmware *fw, struct device *device)
 	 * on request firmware.
 	 */
 	if (!(fw_priv->opt_flags & FW_OPT_NOCACHE) &&
-	    fw_priv->fwc->state == FW_LOADER_START_CACHE) {
-		if (fw_cache_piggyback_on_request(fw_priv->fw_name))
-			kref_get(&fw_priv->ref);
-	}
+	    fw_priv->fwc->state == FW_LOADER_START_CACHE)
+		fw_cache_piggyback_on_request(fw_priv);
 
 	/* pass the pages buffer to driver at the last minute */
 	fw_set_page_data(fw_priv, fw);
@@ -1259,11 +1257,11 @@ static int __fw_entry_found(const char *name)
 	return 0;
 }
 
-static int fw_cache_piggyback_on_request(const char *name)
+static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv)
 {
-	struct firmware_cache *fwc = &fw_cache;
+	const char *name = fw_priv->fw_name;
+	struct firmware_cache *fwc = fw_priv->fwc;
 	struct fw_cache_entry *fce;
-	int ret = 0;
 
 	spin_lock(&fwc->name_lock);
 	if (__fw_entry_found(name))
@@ -1271,13 +1269,12 @@ static int fw_cache_piggyback_on_request(const char *name)
 
 	fce = alloc_fw_cache_entry(name);
 	if (fce) {
-		ret = 1;
 		list_add(&fce->list, &fwc->fw_names);
+		kref_get(&fw_priv->ref);
 		pr_debug("%s: fw: %s\n", __func__, name);
 	}
 found:
 	spin_unlock(&fwc->name_lock);
-	return ret;
 }
 
 static void free_fw_cache_entry(struct fw_cache_entry *fce)
@@ -1508,9 +1505,8 @@ static inline void unregister_fw_pm_ops(void)
 	unregister_pm_notifier(&fw_cache.pm_notify);
 }
 #else
-static int fw_cache_piggyback_on_request(const char *name)
+static void fw_cache_piggyback_on_request(struct fw_priv *fw_priv)
 {
-	return 0;
 }
 static inline int register_fw_pm_ops(void)
 {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 109/334] driver core: Fix error return code in really_probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 108/334] firmware: fix theoretical UAF race with firmware cache and resume Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 110/334] ionic: cleanly release devlink instance Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhen Lei, Sasha Levin

From: Zhen Lei <thunder.leizhen@huawei.com>

[ Upstream commit f04948dea236b000da09c466a7ec931ecd8d7867 ]

In the case of error handling, the error code returned by the subfunction
should be propagated instead of 0.

Fixes: 1901fb2604fb ("Driver core: fix "driver" symlink timing")
Fixes: 23b6904442d0 ("driver core: add dev_groups to all drivers")
Fixes: 8fd456ec0cf0 ("driver core: Add state_synced sysfs file for devices that support it")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Link: https://lore.kernel.org/r/20210707074301.2722-1-thunder.leizhen@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/base/dd.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index 437cd61343b2..68ea1f949daa 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -580,7 +580,8 @@ re_probe:
 			goto probe_failed;
 	}
 
-	if (driver_sysfs_add(dev)) {
+	ret = driver_sysfs_add(dev);
+	if (ret) {
 		pr_err("%s: driver_sysfs_add(%s) failed\n",
 		       __func__, dev_name(dev));
 		goto probe_failed;
@@ -602,15 +603,18 @@ re_probe:
 		goto probe_failed;
 	}
 
-	if (device_add_groups(dev, drv->dev_groups)) {
+	ret = device_add_groups(dev, drv->dev_groups);
+	if (ret) {
 		dev_err(dev, "device_add_groups() failed\n");
 		goto dev_groups_failed;
 	}
 
-	if (dev_has_sync_state(dev) &&
-	    device_create_file(dev, &dev_attr_state_synced)) {
-		dev_err(dev, "state_synced sysfs add failed\n");
-		goto dev_sysfs_state_synced_failed;
+	if (dev_has_sync_state(dev)) {
+		ret = device_create_file(dev, &dev_attr_state_synced);
+		if (ret) {
+			dev_err(dev, "state_synced sysfs add failed\n");
+			goto dev_sysfs_state_synced_failed;
+		}
 	}
 
 	if (test_remove) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 110/334] ionic: cleanly release devlink instance
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 109/334] driver core: Fix error return code in really_probe() Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 111/334] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Leon Romanovsky,
	Shannon Nelson, David S. Miller, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit c2255ff47768c94a0ebc3968f007928bb47ea43b ]

The failure to register devlink will leave the system with dangled
devlink resource, which is not cleaned if devlink_port_register() fails.

In order to remove access to ".registered" field of struct devlink_port,
require both devlink_register and devlink_port_register to success and
check it through device pointer.

Fixes: fbfb8031533c ("ionic: Add hardware init and device commands")
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Acked-by: Shannon Nelson <snelson@pensando.io>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/pensando/ionic/ionic_devlink.c    | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
index b41301a5b0df..cd520e4c5522 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_devlink.c
@@ -91,20 +91,20 @@ int ionic_devlink_register(struct ionic *ionic)
 	attrs.flavour = DEVLINK_PORT_FLAVOUR_PHYSICAL;
 	devlink_port_attrs_set(&ionic->dl_port, &attrs);
 	err = devlink_port_register(dl, &ionic->dl_port, 0);
-	if (err)
+	if (err) {
 		dev_err(ionic->dev, "devlink_port_register failed: %d\n", err);
-	else
-		devlink_port_type_eth_set(&ionic->dl_port,
-					  ionic->lif->netdev);
+		devlink_unregister(dl);
+		return err;
+	}
 
-	return err;
+	devlink_port_type_eth_set(&ionic->dl_port, ionic->lif->netdev);
+	return 0;
 }
 
 void ionic_devlink_unregister(struct ionic *ionic)
 {
 	struct devlink *dl = priv_to_devlink(ionic);
 
-	if (ionic->dl_port.registered)
-		devlink_port_unregister(&ionic->dl_port);
+	devlink_port_unregister(&ionic->dl_port);
 	devlink_unregister(dl);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 111/334] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 110/334] ionic: cleanly release devlink instance Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 112/334] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+e27b4fd589762b0b9329,
	Dongliang Mu, Sean Young, Mauro Carvalho Chehab, Sasha Levin

From: Dongliang Mu <mudongliangabcd@gmail.com>

[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]

If dibusb_read_eeprom_byte fails, the mac address is not initialized.
And nova_t_read_mac_address does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.

Fix this by handling the failure of dibusb_read_eeprom_byte.

Reported-by: syzbot+e27b4fd589762b0b9329@syzkaller.appspotmail.com
Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/nova-t-usb2.c b/drivers/media/usb/dvb-usb/nova-t-usb2.c
index e7b290552b66..9c0eb0d40822 100644
--- a/drivers/media/usb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/usb/dvb-usb/nova-t-usb2.c
@@ -130,7 +130,7 @@ ret:
 
 static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
 {
-	int i;
+	int i, ret;
 	u8 b;
 
 	mac[0] = 0x00;
@@ -139,7 +139,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])
 
 	/* this is a complete guess, but works for my box */
 	for (i = 136; i < 139; i++) {
-		dibusb_read_eeprom_byte(d,i, &b);
+		ret = dibusb_read_eeprom_byte(d, i, &b);
+		if (ret)
+			return ret;
 
 		mac[5 - (i - 136)] = b;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 112/334] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 111/334] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 113/334] media: dvb-usb: Fix error handling in dvb_usb_i2c_init Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Dongliang Mu <mudongliangabcd@gmail.com>

[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ]

If vp702x_usb_in_op fails, the mac address is not initialized.
And vp702x_read_mac_addr does not handle this failure, which leads to
the uninit-value in dvb_usb_adapter_dvb_init.

Fix this by handling the failure of vp702x_usb_in_op.

Fixes: 786baecfe78f ("[media] dvb-usb: move it to drivers/media/usb/dvb-usb")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/vp702x.c b/drivers/media/usb/dvb-usb/vp702x.c
index bf54747e2e01..a1d9e4801a2b 100644
--- a/drivers/media/usb/dvb-usb/vp702x.c
+++ b/drivers/media/usb/dvb-usb/vp702x.c
@@ -291,16 +291,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
 static int vp702x_read_mac_addr(struct dvb_usb_device *d,u8 mac[6])
 {
 	u8 i, *buf;
+	int ret;
 	struct vp702x_device_state *st = d->priv;
 
 	mutex_lock(&st->buf_mutex);
 	buf = st->buf;
-	for (i = 6; i < 12; i++)
-		vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1, &buf[i - 6], 1);
+	for (i = 6; i < 12; i++) {
+		ret = vp702x_usb_in_op(d, READ_EEPROM_REQ, i, 1,
+				       &buf[i - 6], 1);
+		if (ret < 0)
+			goto err;
+	}
 
 	memcpy(mac, buf, 6);
+err:
 	mutex_unlock(&st->buf_mutex);
-	return 0;
+	return ret;
 }
 
 static int vp702x_frontend_attach(struct dvb_usb_adapter *adap)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 113/334] media: dvb-usb: Fix error handling in dvb_usb_i2c_init
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 112/334] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 114/334] net: usb: asix: ax88772: add missing stop Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Dongliang Mu <mudongliangabcd@gmail.com>

[ Upstream commit 131ae388b88e3daf4cb0721ed4b4cb8bfc201465 ]

In dvb_usb_i2c_init, if i2c_add_adapter fails, it only prints an error
message, and then continues to set DVB_USB_STATE_I2C. This affects the
logic of dvb_usb_i2c_exit, which leads to that, the deletion of i2c_adap
even if the i2c_add_adapter fails.

Fix this by returning at the failure of i2c_add_adapter and then move
dvb_usb_i2c_exit out of the error handling code of dvb_usb_i2c_init.

Fixes: 13a79f14ab28 ("media: dvb-usb: Fix memory leak at error in dvb_usb_device_init()")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/dvb-usb/dvb-usb-i2c.c  | 9 +++++++--
 drivers/media/usb/dvb-usb/dvb-usb-init.c | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
index 2e07106f4680..bc4b2abdde1a 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-i2c.c
@@ -17,7 +17,8 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)
 
 	if (d->props.i2c_algo == NULL) {
 		err("no i2c algorithm specified");
-		return -EINVAL;
+		ret = -EINVAL;
+		goto err;
 	}
 
 	strscpy(d->i2c_adap.name, d->desc->name, sizeof(d->i2c_adap.name));
@@ -27,11 +28,15 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)
 
 	i2c_set_adapdata(&d->i2c_adap, d);
 
-	if ((ret = i2c_add_adapter(&d->i2c_adap)) < 0)
+	ret = i2c_add_adapter(&d->i2c_adap);
+	if (ret < 0) {
 		err("could not add i2c adapter");
+		goto err;
+	}
 
 	d->state |= DVB_USB_STATE_I2C;
 
+err:
 	return ret;
 }
 
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c
index 28e1fd64dd3c..61439c8f33ca 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-init.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c
@@ -194,8 +194,8 @@ static int dvb_usb_init(struct dvb_usb_device *d, short *adapter_nums)
 
 err_adapter_init:
 	dvb_usb_adapter_exit(d);
-err_i2c_init:
 	dvb_usb_i2c_exit(d);
+err_i2c_init:
 	if (d->priv && d->props.priv_destroy)
 		d->props.priv_destroy(d);
 err_priv_init:
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 114/334] net: usb: asix: ax88772: add missing stop
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 113/334] media: dvb-usb: Fix error handling in dvb_usb_i2c_init Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 115/334] media: go7007: fix memory leak in go7007_usb_probe Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Oleksij Rempel, David S. Miller, Sasha Levin

From: Oleksij Rempel <o.rempel@pengutronix.de>

[ Upstream commit 9c2670951ed03f8fc6c701d66f5c765929cf1f23 ]

Add missing stop and let phylib framework suspend attached PHY.

Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support")
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/asix_devices.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index dc87e8caf954..53c3c680c083 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -1220,6 +1220,7 @@ static const struct driver_info ax88772b_info = {
 	.unbind = ax88772_unbind,
 	.status = asix_status,
 	.reset = ax88772_reset,
+	.stop = ax88772_stop,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
 	         FLAG_MULTI_PACKET,
 	.rx_fixup = asix_rx_fixup_common,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 115/334] media: go7007: fix memory leak in go7007_usb_probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 114/334] net: usb: asix: ax88772: add missing stop Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 116/334] media: go7007: remove redundant initialization Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 47d94dad8e64b2fc1d8f66ce7acf714f9462c60f ]

In commit 137641287eb4 ("go7007: add sanity checking for endpoints")
endpoint sanity check was introduced, but if check fails it simply
returns with leaked pointers.

Cutted log from my local syzbot instance:

BUG: memory leak
unreferenced object 0xffff8880209f0000 (size 8192):
  comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
  hex dump (first 32 bytes):
    30 b0 27 22 80 88 ff ff 75 73 62 2d 64 75 6d 6d  0.'"....usb-dumm
    79 5f 68 63 64 2e 33 2d 31 00 00 00 00 00 00 00  y_hcd.3-1.......
  backtrace:
    [<ffffffff860ca856>] kmalloc include/linux/slab.h:556 [inline]
    [<ffffffff860ca856>] kzalloc include/linux/slab.h:686 [inline]
    [<ffffffff860ca856>] go7007_alloc+0x46/0xb40 drivers/media/usb/go7007/go7007-driver.c:696
    [<ffffffff860de74e>] go7007_usb_probe+0x13e/0x2200 drivers/media/usb/go7007/go7007-usb.c:1114
    [<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
    [<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576

BUG: memory leak
unreferenced object 0xffff88801e2f2800 (size 512):
  comm "kworker/0:4", pid 4916, jiffies 4295263583 (age 29.310s)
  hex dump (first 32 bytes):
    00 87 40 8a ff ff ff ff 00 00 00 00 00 00 00 00  ..@.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff860de794>] kmalloc include/linux/slab.h:556 [inline]
    [<ffffffff860de794>] kzalloc include/linux/slab.h:686 [inline]
    [<ffffffff860de794>] go7007_usb_probe+0x184/0x2200 drivers/media/usb/go7007/go7007-usb.c:1118
    [<ffffffff854a5f74>] usb_probe_interface+0x314/0x7f0 drivers/usb/core/driver.c:396
    [<ffffffff845a7151>] really_probe+0x291/0xf60 drivers/base/dd.c:576

Fixes: 137641287eb4 ("go7007: add sanity checking for endpoints")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-usb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
index dbf0455d5d50..eeb85981e02b 100644
--- a/drivers/media/usb/go7007/go7007-usb.c
+++ b/drivers/media/usb/go7007/go7007-usb.c
@@ -1134,7 +1134,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
 
 	ep = usb->usbdev->ep_in[4];
 	if (!ep)
-		return -ENODEV;
+		goto allocfail;
 
 	/* Allocate the URB and buffer for receiving incoming interrupts */
 	usb->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 116/334] media: go7007: remove redundant initialization
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 115/334] media: go7007: fix memory leak in go7007_usb_probe Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 117/334] media: v4l2-subdev: fix some NULL vs IS_ERR() checks Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Hans Verkuil,
	Mauro Carvalho Chehab, Sasha Levin

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ]

In go7007_alloc() kzalloc() is used for struct go7007
allocation. It means that there is no need in zeroing
any members, because kzalloc will take care of it.

Removing these reduntant initialization steps increases
execution speed a lot:

	Before:
		+ 86.802 us   |    go7007_alloc();
	After:
		+ 29.595 us   |    go7007_alloc();

Fixes: 866b8695d67e8 ("Staging: add the go7007 video driver")
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------
 1 file changed, 26 deletions(-)

diff --git a/drivers/media/usb/go7007/go7007-driver.c b/drivers/media/usb/go7007/go7007-driver.c
index f1767be9d868..6650eab913d8 100644
--- a/drivers/media/usb/go7007/go7007-driver.c
+++ b/drivers/media/usb/go7007/go7007-driver.c
@@ -691,49 +691,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board,
 						struct device *dev)
 {
 	struct go7007 *go;
-	int i;
 
 	go = kzalloc(sizeof(struct go7007), GFP_KERNEL);
 	if (go == NULL)
 		return NULL;
 	go->dev = dev;
 	go->board_info = board;
-	go->board_id = 0;
 	go->tuner_type = -1;
-	go->channel_number = 0;
-	go->name[0] = 0;
 	mutex_init(&go->hw_lock);
 	init_waitqueue_head(&go->frame_waitq);
 	spin_lock_init(&go->spinlock);
 	go->status = STATUS_INIT;
-	memset(&go->i2c_adapter, 0, sizeof(go->i2c_adapter));
-	go->i2c_adapter_online = 0;
-	go->interrupt_available = 0;
 	init_waitqueue_head(&go->interrupt_waitq);
-	go->input = 0;
 	go7007_update_board(go);
-	go->encoder_h_halve = 0;
-	go->encoder_v_halve = 0;
-	go->encoder_subsample = 0;
 	go->format = V4L2_PIX_FMT_MJPEG;
 	go->bitrate = 1500000;
 	go->fps_scale = 1;
-	go->pali = 0;
 	go->aspect_ratio = GO7007_RATIO_1_1;
-	go->gop_size = 0;
-	go->ipb = 0;
-	go->closed_gop = 0;
-	go->repeat_seqhead = 0;
-	go->seq_header_enable = 0;
-	go->gop_header_enable = 0;
-	go->dvd_mode = 0;
-	go->interlace_coding = 0;
-	for (i = 0; i < 4; ++i)
-		go->modet[i].enable = 0;
-	for (i = 0; i < 1624; ++i)
-		go->modet_map[i] = 0;
-	go->audio_deliver = NULL;
-	go->audio_enabled = 0;
 
 	return go;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 117/334] media: v4l2-subdev: fix some NULL vs IS_ERR() checks
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 116/334] media: go7007: remove redundant initialization Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 118/334] media: rockchip/rga: fix error handling in probe Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Laurent Pinchart,
	Sakari Ailus, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit ba7a93e507f88306d7a19a1dcb53b857b790cfb8 ]

The v4l2_subdev_alloc_state() function returns error pointers, it
doesn't return NULL.

Fixes: 0d346d2a6f54 ("media: v4l2-subdev: add subdev-wide state struct")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rcar-vin/rcar-v4l2.c | 4 ++--
 drivers/media/platform/vsp1/vsp1_entity.c   | 4 ++--
 drivers/staging/media/tegra-video/vi.c      | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/rcar-vin/rcar-v4l2.c b/drivers/media/platform/rcar-vin/rcar-v4l2.c
index cca15a10c0b3..0d141155f0e3 100644
--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c
+++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c
@@ -253,8 +253,8 @@ static int rvin_try_format(struct rvin_dev *vin, u32 which,
 	int ret;
 
 	sd_state = v4l2_subdev_alloc_state(sd);
-	if (sd_state == NULL)
-		return -ENOMEM;
+	if (IS_ERR(sd_state))
+		return PTR_ERR(sd_state);
 
 	if (!rvin_format_from_pixel(vin, pix->pixelformat))
 		pix->pixelformat = RVIN_DEFAULT_FORMAT;
diff --git a/drivers/media/platform/vsp1/vsp1_entity.c b/drivers/media/platform/vsp1/vsp1_entity.c
index 6f51e5c75543..823c15facd1b 100644
--- a/drivers/media/platform/vsp1/vsp1_entity.c
+++ b/drivers/media/platform/vsp1/vsp1_entity.c
@@ -676,9 +676,9 @@ int vsp1_entity_init(struct vsp1_device *vsp1, struct vsp1_entity *entity,
 	 * rectangles.
 	 */
 	entity->config = v4l2_subdev_alloc_state(&entity->subdev);
-	if (entity->config == NULL) {
+	if (IS_ERR(entity->config)) {
 		media_entity_cleanup(&entity->subdev.entity);
-		return -ENOMEM;
+		return PTR_ERR(entity->config);
 	}
 
 	return 0;
diff --git a/drivers/staging/media/tegra-video/vi.c b/drivers/staging/media/tegra-video/vi.c
index 89709cd06d4d..d321790b07d9 100644
--- a/drivers/staging/media/tegra-video/vi.c
+++ b/drivers/staging/media/tegra-video/vi.c
@@ -508,8 +508,8 @@ static int __tegra_channel_try_format(struct tegra_vi_channel *chan,
 		return -ENODEV;
 
 	sd_state = v4l2_subdev_alloc_state(subdev);
-	if (!sd_state)
-		return -ENOMEM;
+	if (IS_ERR(sd_state))
+		return PTR_ERR(sd_state);
 	/*
 	 * Retrieve the format information and if requested format isn't
 	 * supported, keep the current format.
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 118/334] media: rockchip/rga: fix error handling in probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 117/334] media: v4l2-subdev: fix some NULL vs IS_ERR() checks Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 119/334] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Dan Carpenter,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit e58430e1d4fd01b74475d2fbe2e25b5817b729a9 ]

There are a few bugs in this code.  1)  No checks for whether
dma_alloc_attrs() or __get_free_pages() failed.  2)  If
video_register_device() fails it doesn't clean up the dma attrs or the
free pages.  3)  The video_device_release() function frees "vfd" which
leads to a use after free on the next line.  The call to
video_unregister_device() is not required so I have just removed that.

Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/rockchip/rga/rga.c | 27 ++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index bf3fd71ec3af..6759091b15e0 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -863,12 +863,12 @@ static int rga_probe(struct platform_device *pdev)
 	if (IS_ERR(rga->m2m_dev)) {
 		v4l2_err(&rga->v4l2_dev, "Failed to init mem2mem device\n");
 		ret = PTR_ERR(rga->m2m_dev);
-		goto unreg_video_dev;
+		goto rel_vdev;
 	}
 
 	ret = pm_runtime_resume_and_get(rga->dev);
 	if (ret < 0)
-		goto unreg_video_dev;
+		goto rel_vdev;
 
 	rga->version.major = (rga_read(rga, RGA_VERSION_INFO) >> 24) & 0xFF;
 	rga->version.minor = (rga_read(rga, RGA_VERSION_INFO) >> 20) & 0x0F;
@@ -882,11 +882,23 @@ static int rga_probe(struct platform_device *pdev)
 	rga->cmdbuf_virt = dma_alloc_attrs(rga->dev, RGA_CMDBUF_SIZE,
 					   &rga->cmdbuf_phy, GFP_KERNEL,
 					   DMA_ATTR_WRITE_COMBINE);
+	if (!rga->cmdbuf_virt) {
+		ret = -ENOMEM;
+		goto rel_vdev;
+	}
 
 	rga->src_mmu_pages =
 		(unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3);
+	if (!rga->src_mmu_pages) {
+		ret = -ENOMEM;
+		goto free_dma;
+	}
 	rga->dst_mmu_pages =
 		(unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3);
+	if (rga->dst_mmu_pages) {
+		ret = -ENOMEM;
+		goto free_src_pages;
+	}
 
 	def_frame.stride = (def_frame.width * def_frame.fmt->depth) >> 3;
 	def_frame.size = def_frame.stride * def_frame.height;
@@ -894,7 +906,7 @@ static int rga_probe(struct platform_device *pdev)
 	ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
 	if (ret) {
 		v4l2_err(&rga->v4l2_dev, "Failed to register video device\n");
-		goto rel_vdev;
+		goto free_dst_pages;
 	}
 
 	v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n",
@@ -902,10 +914,15 @@ static int rga_probe(struct platform_device *pdev)
 
 	return 0;
 
+free_dst_pages:
+	free_pages((unsigned long)rga->dst_mmu_pages, 3);
+free_src_pages:
+	free_pages((unsigned long)rga->src_mmu_pages, 3);
+free_dma:
+	dma_free_attrs(rga->dev, RGA_CMDBUF_SIZE, rga->cmdbuf_virt,
+		       rga->cmdbuf_phy, DMA_ATTR_WRITE_COMBINE);
 rel_vdev:
 	video_device_release(vfd);
-unreg_video_dev:
-	video_unregister_device(rga->vfd);
 unreg_v4l2_dev:
 	v4l2_device_unregister(&rga->v4l2_dev);
 err_put_clk:
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 119/334] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 118/334] media: rockchip/rga: fix error handling in probe Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 120/334] media: atomisp: fix the uninitialized use and rename "retvalue" Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrej Picej, Philipp Zabel,
	Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin

From: Philipp Zabel <p.zabel@pengutronix.de>

[ Upstream commit 44693d74f5653f82cd7ca0fe730eed0f6b83306a ]

The frame memory control register value is currently determined
before userspace selects the final capture format and never corrected.
Update ctx->frame_mem_ctrl in __coda_start_decoding() to fix decoding
into YUV420 or YVU420 capture buffers.

Reported-by: Andrej Picej <andrej.picej@norik.com>
Fixes: 497e6b8559a6 ("media: coda: add sequence initialization work")
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/coda/coda-bit.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c
index 2f42808c43a4..c484c008ab02 100644
--- a/drivers/media/platform/coda/coda-bit.c
+++ b/drivers/media/platform/coda/coda-bit.c
@@ -2053,17 +2053,25 @@ static int __coda_start_decoding(struct coda_ctx *ctx)
 	u32 src_fourcc, dst_fourcc;
 	int ret;
 
+	q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
+	q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
+	src_fourcc = q_data_src->fourcc;
+	dst_fourcc = q_data_dst->fourcc;
+
 	if (!ctx->initialized) {
 		ret = __coda_decoder_seq_init(ctx);
 		if (ret < 0)
 			return ret;
+	} else {
+		ctx->frame_mem_ctrl &= ~(CODA_FRAME_CHROMA_INTERLEAVE | (0x3 << 9) |
+					 CODA9_FRAME_TILED2LINEAR);
+		if (dst_fourcc == V4L2_PIX_FMT_NV12 || dst_fourcc == V4L2_PIX_FMT_YUYV)
+			ctx->frame_mem_ctrl |= CODA_FRAME_CHROMA_INTERLEAVE;
+		if (ctx->tiled_map_type == GDI_TILED_FRAME_MB_RASTER_MAP)
+			ctx->frame_mem_ctrl |= (0x3 << 9) |
+				((ctx->use_vdoa) ? 0 : CODA9_FRAME_TILED2LINEAR);
 	}
 
-	q_data_src = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_OUTPUT);
-	q_data_dst = get_q_data(ctx, V4L2_BUF_TYPE_VIDEO_CAPTURE);
-	src_fourcc = q_data_src->fourcc;
-	dst_fourcc = q_data_dst->fourcc;
-
 	coda_write(dev, ctx->parabuf.paddr, CODA_REG_BIT_PARA_BUF_ADDR);
 
 	ret = coda_alloc_framebuffers(ctx, q_data_dst, src_fourcc);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 120/334] media: atomisp: fix the uninitialized use and rename "retvalue"
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 119/334] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 121/334] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yizhuo, Mauro Carvalho Chehab, Sasha Levin

From: Yizhuo <yzhai003@ucr.edu>

[ Upstream commit c275e5d349b0d2b1143607d28b9c7c14a8a0a9b4 ]

Inside function mt9m114_detect(), variable "retvalue" could
be uninitialized if mt9m114_read_reg() returns error, however, it
is used in the later if statement, which is potentially unsafe.

The local variable "retvalue" is renamed to "model" to avoid
confusion.

Link: https://lore.kernel.org/linux-media/20210625053858.3862-1-yzhai003@ucr.edu
Fixes: ad85094 (media / atomisp: fix the uninitialized use of model ID)
Signed-off-by: Yizhuo <yzhai003@ucr.edu>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
index 11196180a206..34bf92de2f29 100644
--- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
+++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
@@ -1545,16 +1545,19 @@ static struct v4l2_ctrl_config mt9m114_controls[] = {
 static int mt9m114_detect(struct mt9m114_device *dev, struct i2c_client *client)
 {
 	struct i2c_adapter *adapter = client->adapter;
-	u32 retvalue;
+	u32 model;
+	int ret;
 
 	if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
 		dev_err(&client->dev, "%s: i2c error", __func__);
 		return -ENODEV;
 	}
-	mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue);
-	dev->real_model_id = retvalue;
+	ret = mt9m114_read_reg(client, MISENSOR_16BIT, MT9M114_PID, &model);
+	if (ret)
+		return ret;
+	dev->real_model_id = model;
 
-	if (retvalue != MT9M114_MOD_ID) {
+	if (model != MT9M114_MOD_ID) {
 		dev_err(&client->dev, "%s: failed: client->addr = %x\n",
 			__func__, client->addr);
 		return -ENODEV;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 121/334] Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 120/334] media: atomisp: fix the uninitialized use and rename "retvalue" Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 122/334] Bluetooth: btusb: Fix a unspported condition to set available debug features Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Marcel Holtmann, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ]

Smatch complains that some of these struct members are not initialized
leading to a stack information disclosure:

    net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
    check that 'cp.retrans_effort' doesn't leak information

This seems like a valid warning.  I've added a default case to fix
this issue.

Fixes: 2f69a82acf6f ("Bluetooth: Use voice setting in deferred SCO connection request")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d9a4e88dacbb..ffa2a77a3e4c 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -773,6 +773,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting)
 			cp.max_latency = cpu_to_le16(0xffff);
 			cp.retrans_effort = 0xff;
 			break;
+		default:
+			/* use CVSD settings as fallback */
+			cp.max_latency = cpu_to_le16(0xffff);
+			cp.retrans_effort = 0xff;
+			break;
 		}
 
 		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 122/334] Bluetooth: btusb: Fix a unspported condition to set available debug features
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 121/334] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 123/334] 6lowpan: iphc: Fix an off-by-one check of array index Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jun Miao, Marcel Holtmann, Sasha Levin

From: Jun Miao <jun.miao@windriver.com>

[ Upstream commit 20a831f04f1526f2c3442efd3dece8630216b5d2 ]

When reading the support debug features failed, there are not available
features init. Continue to set the debug features is illogical, we should
skip btintel_set_debug_features(), even if check it by "if (!features)".

Fixes: c453b10c2b28 ("Bluetooth: btusb: Configure Intel debug feature based on available support")
Signed-off-by: Jun Miao <jun.miao@windriver.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 0255bf243ce5..bd37d6fb88c2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -2921,10 +2921,11 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
 	/* Read the Intel supported features and if new exception formats
 	 * supported, need to load the additional DDC config to enable.
 	 */
-	btintel_read_debug_features(hdev, &features);
-
-	/* Set DDC mask for available debug features */
-	btintel_set_debug_features(hdev, &features);
+	err = btintel_read_debug_features(hdev, &features);
+	if (!err) {
+		/* Set DDC mask for available debug features */
+		btintel_set_debug_features(hdev, &features);
+	}
 
 	/* Read the Intel version information after loading the FW  */
 	err = btintel_read_version(hdev, &ver);
@@ -3017,10 +3018,11 @@ static int btusb_setup_intel_newgen(struct hci_dev *hdev)
 	/* Read the Intel supported features and if new exception formats
 	 * supported, need to load the additional DDC config to enable.
 	 */
-	btintel_read_debug_features(hdev, &features);
-
-	/* Set DDC mask for available debug features */
-	btintel_set_debug_features(hdev, &features);
+	err = btintel_read_debug_features(hdev, &features);
+	if (!err) {
+		/* Set DDC mask for available debug features */
+		btintel_set_debug_features(hdev, &features);
+	}
 
 	/* Read the Intel version information after loading the FW  */
 	err = btintel_read_version_tlv(hdev, &version);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 123/334] 6lowpan: iphc: Fix an off-by-one check of array index
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 122/334] Bluetooth: btusb: Fix a unspported condition to set available debug features Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 124/334] drm/amdgpu/acp: Make PM domain really work Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Marcel Holtmann, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 9af417610b6142e826fd1ee8ba7ff3e9a2133a5a ]

The bounds check of id is off-by-one and the comparison should
be >= rather >. Currently the WARN_ON_ONCE check does not stop
the out of range indexing of &ldev->ctx.table[id] so also add
a return path if the bounds are out of range.

Addresses-Coverity: ("Illegal address computation").
Fixes: 5609c185f24d ("6lowpan: iphc: add support for stateful compression")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/6lowpan/debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/6lowpan/debugfs.c b/net/6lowpan/debugfs.c
index 1c140af06d52..600b9563bfc5 100644
--- a/net/6lowpan/debugfs.c
+++ b/net/6lowpan/debugfs.c
@@ -170,7 +170,8 @@ static void lowpan_dev_debugfs_ctx_init(struct net_device *dev,
 	struct dentry *root;
 	char buf[32];
 
-	WARN_ON_ONCE(id > LOWPAN_IPHC_CTX_TABLE_SIZE);
+	if (WARN_ON_ONCE(id >= LOWPAN_IPHC_CTX_TABLE_SIZE))
+		return;
 
 	sprintf(buf, "%d", id);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 124/334] drm/amdgpu/acp: Make PM domain really work
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 123/334] 6lowpan: iphc: Fix an off-by-one check of array index Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:12 ` [PATCH 5.14 125/334] drm/amd/pm: Fix a bug communicating with the SMU (v5) Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Alex Deucher, Sasha Levin

From: Kai-Heng Feng <kai.heng.feng@canonical.com>

[ Upstream commit aff890288de2d818e4f83ec40c9315e2d735df07 ]

Devices created by mfd_add_hotplug_devices() don't really increase the
index of its name, so get_mfd_cell_dev() cannot find any device, hence a
NULL dev is passed to pm_genpd_add_device():
[   56.974926] (NULL device *): amdgpu: device acp_audio_dma.0.auto added to pm domain
[   56.974933] (NULL device *): amdgpu: Failed to add dev to genpd
[   56.974941] [drm:amdgpu_device_ip_init [amdgpu]] *ERROR* hw_init of IP block <acp_ip> failed -22
[   56.975810] amdgpu 0000:00:01.0: amdgpu: amdgpu_device_ip_init failed
[   56.975839] amdgpu 0000:00:01.0: amdgpu: Fatal error during GPU init
[   56.977136] ------------[ cut here ]------------
[   56.977143] kernel BUG at mm/slub.c:4206!
[   56.977158] invalid opcode: 0000 [#1] SMP NOPTI
[   56.977167] CPU: 1 PID: 1648 Comm: modprobe Not tainted 5.12.0-051200rc8-generic #202104182230
[   56.977175] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./FM2A68M-HD+, BIOS P5.20 02/13/2019
[   56.977180] RIP: 0010:kfree+0x3bf/0x410
[   56.977195] Code: 89 e7 48 d3 e2 f7 da e8 5f 0d 02 00 80 e7 02 75 3e 44 89 ee 4c 89 e7 e8 ef 5f fd ff e9 fa fe ff ff 49 8b 44 24 08 a8 01 75 b7 <0f> 0b 4c 8b 4d b0 48 8b 4d a8 48 89 da 4c 89 e6 41 b8 01 00 00 00
[   56.977202] RSP: 0018:ffffa48640ff79f0 EFLAGS: 00010246
[   56.977210] RAX: 0000000000000000 RBX: ffff9286127d5608 RCX: 0000000000000000
[   56.977215] RDX: 0000000000000000 RSI: ffffffffc099d0fb RDI: ffff9286127d5608
[   56.977220] RBP: ffffa48640ff7a48 R08: 0000000000000001 R09: 0000000000000001
[   56.977224] R10: 0000000000000000 R11: ffff9286087d8458 R12: fffff3ae0449f540
[   56.977229] R13: 0000000000000000 R14: dead000000000122 R15: dead000000000100
[   56.977234] FS:  00007f9de5929540(0000) GS:ffff928612e80000(0000) knlGS:0000000000000000
[   56.977240] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   56.977245] CR2: 00007f697dd97160 CR3: 00000001110f0000 CR4: 00000000001506e0
[   56.977251] Call Trace:
[   56.977261]  amdgpu_dm_encoder_destroy+0x1b/0x30 [amdgpu]
[   56.978056]  drm_mode_config_cleanup+0x4f/0x2e0 [drm]
[   56.978147]  ? kfree+0x3dd/0x410
[   56.978157]  ? drm_managed_release+0xc8/0x100 [drm]
[   56.978232]  drm_mode_config_init_release+0xe/0x10 [drm]
[   56.978311]  drm_managed_release+0x9d/0x100 [drm]
[   56.978388]  devm_drm_dev_init_release+0x4d/0x70 [drm]
[   56.978450]  devm_action_release+0x15/0x20
[   56.978459]  release_nodes+0x77/0xc0
[   56.978469]  devres_release_all+0x3f/0x50
[   56.978477]  really_probe+0x245/0x460
[   56.978485]  driver_probe_device+0xe9/0x160
[   56.978492]  device_driver_attach+0xab/0xb0
[   56.978499]  __driver_attach+0x8f/0x150
[   56.978506]  ? device_driver_attach+0xb0/0xb0
[   56.978513]  bus_for_each_dev+0x7e/0xc0
[   56.978521]  driver_attach+0x1e/0x20
[   56.978528]  bus_add_driver+0x135/0x1f0
[   56.978534]  driver_register+0x91/0xf0
[   56.978540]  __pci_register_driver+0x54/0x60
[   56.978549]  amdgpu_init+0x77/0x1000 [amdgpu]
[   56.979246]  ? 0xffffffffc0dbc000
[   56.979254]  do_one_initcall+0x48/0x1d0
[   56.979265]  ? kmem_cache_alloc_trace+0x120/0x230
[   56.979274]  ? do_init_module+0x28/0x280
[   56.979282]  do_init_module+0x62/0x280
[   56.979288]  load_module+0x71c/0x7a0
[   56.979296]  __do_sys_finit_module+0xc2/0x120
[   56.979305]  __x64_sys_finit_module+0x1a/0x20
[   56.979311]  do_syscall_64+0x38/0x90
[   56.979319]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[   56.979328] RIP: 0033:0x7f9de54f989d
[   56.979335] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 f5 0c 00 f7 d8 64 89 01 48
[   56.979342] RSP: 002b:00007ffe3c395a28 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   56.979350] RAX: ffffffffffffffda RBX: 0000560df3ef4330 RCX: 00007f9de54f989d
[   56.979355] RDX: 0000000000000000 RSI: 0000560df3a07358 RDI: 000000000000000f
[   56.979360] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000
[   56.979365] R10: 000000000000000f R11: 0000000000000246 R12: 0000560df3a07358
[   56.979369] R13: 0000000000000000 R14: 0000560df3ef4460 R15: 0000560df3ef4330
[   56.979377] Modules linked in: amdgpu(+) iommu_v2 gpu_sched drm_ttm_helper ttm drm_kms_helper cec rc_core i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt nft_counter xt_tcpudp ipt_REJECT nf_reject_ipv4 xt_conntrack iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nf_tables libcrc32c nfnetlink ip6_tables iptable_filter bpfilter input_leds binfmt_misc edac_mce_amd kvm_amd ccp kvm snd_hda_codec_realtek snd_hda_codec_generic crct10dif_pclmul snd_hda_codec_hdmi ledtrig_audio ghash_clmulni_intel aesni_intel snd_hda_intel snd_intel_dspcfg snd_seq_midi crypto_simd snd_intel_sdw_acpi cryptd snd_hda_codec snd_seq_midi_event snd_rawmidi snd_hda_core snd_hwdep snd_seq fam15h_power k10temp snd_pcm snd_seq_device snd_timer snd mac_hid soundcore sch_fq_codel nct6775 hwmon_vid drm ip_tables x_tables autofs4 dm_mirror dm_region_hash dm_log hid_generic usbhid hid uas usb_storage r8169 crc32_pclmul realtek ahci xhci_pci i2c_piix4
[   56.979521]  xhci_pci_renesas libahci video
[   56.979541] ---[ end trace cb8f6a346f18da7b ]---

Instead of finding MFD hotplugged device by its name, simply iterate
over the child devices to avoid the issue.

Squash in unused variable removal (Alex)

BugLink: https://bugs.launchpad.net/bugs/1920674
Fixes: 25030321ba28 ("drm/amd: add pm domain for ACP IP sub blocks")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 54 ++++++++++++-------------
 1 file changed, 26 insertions(+), 28 deletions(-)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
index b8655ff73a65..cc9c9f8b23b2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c
@@ -160,17 +160,28 @@ static int acp_poweron(struct generic_pm_domain *genpd)
 	return 0;
 }
 
-static struct device *get_mfd_cell_dev(const char *device_name, int r)
+static int acp_genpd_add_device(struct device *dev, void *data)
 {
-	char auto_dev_name[25];
-	struct device *dev;
+	struct generic_pm_domain *gpd = data;
+	int ret;
 
-	snprintf(auto_dev_name, sizeof(auto_dev_name),
-		 "%s.%d.auto", device_name, r);
-	dev = bus_find_device_by_name(&platform_bus_type, NULL, auto_dev_name);
-	dev_info(dev, "device %s added to pm domain\n", auto_dev_name);
+	ret = pm_genpd_add_device(gpd, dev);
+	if (ret)
+		dev_err(dev, "Failed to add dev to genpd %d\n", ret);
 
-	return dev;
+	return ret;
+}
+
+static int acp_genpd_remove_device(struct device *dev, void *data)
+{
+	int ret;
+
+	ret = pm_genpd_remove_device(dev);
+	if (ret)
+		dev_err(dev, "Failed to remove dev from genpd %d\n", ret);
+
+	/* Continue to remove */
+	return 0;
 }
 
 /**
@@ -181,11 +192,10 @@ static struct device *get_mfd_cell_dev(const char *device_name, int r)
  */
 static int acp_hw_init(void *handle)
 {
-	int r, i;
+	int r;
 	uint64_t acp_base;
 	u32 val = 0;
 	u32 count = 0;
-	struct device *dev;
 	struct i2s_platform_data *i2s_pdata = NULL;
 
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -341,15 +351,10 @@ static int acp_hw_init(void *handle)
 	if (r)
 		goto failure;
 
-	for (i = 0; i < ACP_DEVS ; i++) {
-		dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
-		r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev);
-		if (r) {
-			dev_err(dev, "Failed to add dev to genpd\n");
-			goto failure;
-		}
-	}
-
+	r = device_for_each_child(adev->acp.parent, &adev->acp.acp_genpd->gpd,
+				  acp_genpd_add_device);
+	if (r)
+		goto failure;
 
 	/* Assert Soft reset of ACP */
 	val = cgs_read_register(adev->acp.cgs_device, mmACP_SOFT_RESET);
@@ -410,10 +415,8 @@ failure:
  */
 static int acp_hw_fini(void *handle)
 {
-	int i, ret;
 	u32 val = 0;
 	u32 count = 0;
-	struct device *dev;
 	struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
 	/* return early if no ACP */
@@ -458,13 +461,8 @@ static int acp_hw_fini(void *handle)
 		udelay(100);
 	}
 
-	for (i = 0; i < ACP_DEVS ; i++) {
-		dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i);
-		ret = pm_genpd_remove_device(dev);
-		/* If removal fails, dont giveup and try rest */
-		if (ret)
-			dev_err(dev, "remove dev from genpd failed\n");
-	}
+	device_for_each_child(adev->acp.parent, NULL,
+			      acp_genpd_remove_device);
 
 	mfd_remove_devices(adev->acp.parent);
 	kfree(adev->acp.acp_res);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 125/334] drm/amd/pm: Fix a bug communicating with the SMU (v5)
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 124/334] drm/amdgpu/acp: Make PM domain really work Greg Kroah-Hartman
@ 2021-09-13 13:12 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 126/334] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Deucher, Evan Quan, Lijo Lazar,
	Luben Tuikov, Alex Deucher, Sasha Levin

From: Luben Tuikov <luben.tuikov@amd.com>

[ Upstream commit 5810323ba692895b045e3f1b3e107605c3717dab ]

This fixes a bug which if we probe a non-existing
I2C device, and the SMU returns 0xFF, from then on
we can never communicate with the SMU, because the
code before this patch reads and interprets 0xFF
as a terminal error, and thus we never write 0
into register 90 to clear the status (and
subsequently send a new command to the SMU.)

It is not an error that the SMU returns status
0xFF. This means that the SMU executed the last
command successfully (execution status), but the
command result is an error of some sort (execution
result), depending on what the command was.

When doing a status check of the SMU, before we
send a new command, the only status which
precludes us from sending a new command is 0--the
SMU hasn't finished executing a previous command,
and 0xFC--the SMU is busy.

This bug was seen as the following line in the
kernel log,

amdgpu: Msg issuing pre-check failed(0xff) and SMU may be not in the right state!

when subsequent SMU commands, not necessarily
related to I2C, were sent to the SMU.

This patch fixes this bug.

v2: Add a comment to the description of
__smu_cmn_poll_stat() to explain why we're NOT
defining the SMU FW return codes as macros, but
are instead hard-coding them. Such a change, can
be followed up by a subsequent patch.

v3: The changes are,
a) Add comments to break labels in
   __smu_cmn_reg2errno().

b) When an unknown/unspecified/undefined result is
   returned back from the SMU, map that to
   -EREMOTEIO, to distinguish failure at the SMU
   FW.

c) Add kernel-doc to
   smu_cmn_send_msg_without_waiting(),
   smu_cmn_wait_for_response(),
   smu_cmn_send_smc_msg_with_param().

d) In smu_cmn_send_smc_msg_with_param(), since we
   wait for completion of the command, if the
   result of the completion is
   undefined/unknown/unspecified, we print that to
   the kernel log.

v4: a) Add macros as requested, though redundant, to
    be removed when SMU consolidates for all
    ASICs--see comment in code.
    b) Get out if the SMU code is unknown.

v5: Rename the macro names.

Cc: Alex Deucher <Alexander.Deucher@amd.com>
Cc: Evan Quan <evan.quan@amd.com>
Cc: Lijo Lazar <Lijo.Lazar@amd.com>
Fixes: fcb1fe9c9e0031 ("drm/amd/powerplay: pre-check the SMU state before issuing message")
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
Reviewed-by: Alex Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 288 +++++++++++++++++++++----
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h |   3 +-
 2 files changed, 244 insertions(+), 47 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
index e802f9a95f08..a0e2111eb783 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
@@ -55,7 +55,7 @@
 
 #undef __SMU_DUMMY_MAP
 #define __SMU_DUMMY_MAP(type)	#type
-static const char* __smu_message_names[] = {
+static const char * const __smu_message_names[] = {
 	SMU_MESSAGE_TYPES
 };
 
@@ -76,55 +76,258 @@ static void smu_cmn_read_arg(struct smu_context *smu,
 	*arg = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_82);
 }
 
-int smu_cmn_wait_for_response(struct smu_context *smu)
+/* Redefine the SMU error codes here.
+ *
+ * Note that these definitions are redundant and should be removed
+ * when the SMU has exported a unified header file containing these
+ * macros, which header file we can just include and use the SMU's
+ * macros. At the moment, these error codes are defined by the SMU
+ * per-ASIC unfortunately, yet we're a one driver for all ASICs.
+ */
+#define SMU_RESP_NONE           0
+#define SMU_RESP_OK             1
+#define SMU_RESP_CMD_FAIL       0xFF
+#define SMU_RESP_CMD_UNKNOWN    0xFE
+#define SMU_RESP_CMD_BAD_PREREQ 0xFD
+#define SMU_RESP_BUSY_OTHER     0xFC
+#define SMU_RESP_DEBUG_END      0xFB
+
+/**
+ * __smu_cmn_poll_stat -- poll for a status from the SMU
+ * smu: a pointer to SMU context
+ *
+ * Returns the status of the SMU, which could be,
+ *    0, the SMU is busy with your previous command;
+ *    1, execution status: success, execution result: success;
+ * 0xFF, execution status: success, execution result: failure;
+ * 0xFE, unknown command;
+ * 0xFD, valid command, but bad (command) prerequisites;
+ * 0xFC, the command was rejected as the SMU is busy;
+ * 0xFB, "SMC_Result_DebugDataDumpEnd".
+ *
+ * The values here are not defined by macros, because I'd rather we
+ * include a single header file which defines them, which is
+ * maintained by the SMU FW team, so that we're impervious to firmware
+ * changes. At the moment those values are defined in various header
+ * files, one for each ASIC, yet here we're a single ASIC-agnostic
+ * interface. Such a change can be followed-up by a subsequent patch.
+ */
+static u32 __smu_cmn_poll_stat(struct smu_context *smu)
 {
 	struct amdgpu_device *adev = smu->adev;
-	uint32_t cur_value, i, timeout = adev->usec_timeout * 20;
+	int timeout = adev->usec_timeout * 20;
+	u32 reg;
 
-	for (i = 0; i < timeout; i++) {
-		cur_value = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90);
-		if ((cur_value & MP1_C2PMSG_90__CONTENT_MASK) != 0)
-			return cur_value;
+	for ( ; timeout > 0; timeout--) {
+		reg = RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90);
+		if ((reg & MP1_C2PMSG_90__CONTENT_MASK) != 0)
+			break;
 
 		udelay(1);
 	}
 
-	/* timeout means wrong logic */
-	if (i == timeout)
-		return -ETIME;
-
-	return RREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90);
+	return reg;
 }
 
-int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
-				     uint16_t msg, uint32_t param)
+static void __smu_cmn_reg_print_error(struct smu_context *smu,
+				      u32 reg_c2pmsg_90,
+				      int msg_index,
+				      u32 param,
+				      enum smu_message_type msg)
 {
 	struct amdgpu_device *adev = smu->adev;
-	int ret;
+	const char *message = smu_get_message_name(smu, msg);
 
-	ret = smu_cmn_wait_for_response(smu);
-	if (ret != 0x1) {
-		dev_err(adev->dev, "Msg issuing pre-check failed(0x%x) and "
-		       "SMU may be not in the right state!\n", ret);
-		if (ret != -ETIME)
-			ret = -EIO;
-		return ret;
+	switch (reg_c2pmsg_90) {
+	case SMU_RESP_NONE:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: I'm not done with your previous command!");
+		break;
+	case SMU_RESP_OK:
+		/* The SMU executed the command. It completed with a
+		 * successful result.
+		 */
+		break;
+	case SMU_RESP_CMD_FAIL:
+		/* The SMU executed the command. It completed with an
+		 * unsuccessful result.
+		 */
+		break;
+	case SMU_RESP_CMD_UNKNOWN:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: unknown command: index:%d param:0x%08X message:%s",
+				    msg_index, param, message);
+		break;
+	case SMU_RESP_CMD_BAD_PREREQ:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: valid command, bad prerequisites: index:%d param:0x%08X message:%s",
+				    msg_index, param, message);
+		break;
+	case SMU_RESP_BUSY_OTHER:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: I'm very busy for your command: index:%d param:0x%08X message:%s",
+				    msg_index, param, message);
+		break;
+	case SMU_RESP_DEBUG_END:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: I'm debugging!");
+		break;
+	default:
+		dev_err_ratelimited(adev->dev,
+				    "SMU: response:0x%08X for index:%d param:0x%08X message:%s?",
+				    reg_c2pmsg_90, msg_index, param, message);
+		break;
+	}
+}
+
+static int __smu_cmn_reg2errno(struct smu_context *smu, u32 reg_c2pmsg_90)
+{
+	int res;
+
+	switch (reg_c2pmsg_90) {
+	case SMU_RESP_NONE:
+		/* The SMU is busy--still executing your command.
+		 */
+		res = -ETIME;
+		break;
+	case SMU_RESP_OK:
+		res = 0;
+		break;
+	case SMU_RESP_CMD_FAIL:
+		/* Command completed successfully, but the command
+		 * status was failure.
+		 */
+		res = -EIO;
+		break;
+	case SMU_RESP_CMD_UNKNOWN:
+		/* Unknown command--ignored by the SMU.
+		 */
+		res = -EOPNOTSUPP;
+		break;
+	case SMU_RESP_CMD_BAD_PREREQ:
+		/* Valid command--bad prerequisites.
+		 */
+		res = -EINVAL;
+		break;
+	case SMU_RESP_BUSY_OTHER:
+		/* The SMU is busy with other commands. The client
+		 * should retry in 10 us.
+		 */
+		res = -EBUSY;
+		break;
+	default:
+		/* Unknown or debug response from the SMU.
+		 */
+		res = -EREMOTEIO;
+		break;
 	}
 
+	return res;
+}
+
+static void __smu_cmn_send_msg(struct smu_context *smu,
+			       u16 msg,
+			       u32 param)
+{
+	struct amdgpu_device *adev = smu->adev;
+
 	WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_90, 0);
 	WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_82, param);
 	WREG32_SOC15(MP1, 0, mmMP1_SMN_C2PMSG_66, msg);
+}
 
-	return 0;
+/**
+ * smu_cmn_send_msg_without_waiting -- send the message; don't wait for status
+ * @smu: pointer to an SMU context
+ * @msg_index: message index
+ * @param: message parameter to send to the SMU
+ *
+ * Send a message to the SMU with the parameter passed. Do not wait
+ * for status/result of the message, thus the "without_waiting".
+ *
+ * Return 0 on success, -errno on error if we weren't able to _send_
+ * the message for some reason. See __smu_cmn_reg2errno() for details
+ * of the -errno.
+ */
+int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
+				     uint16_t msg_index,
+				     uint32_t param)
+{
+	u32 reg;
+	int res;
+
+	if (smu->adev->no_hw_access)
+		return 0;
+
+	mutex_lock(&smu->message_lock);
+	reg = __smu_cmn_poll_stat(smu);
+	res = __smu_cmn_reg2errno(smu, reg);
+	if (reg == SMU_RESP_NONE ||
+	    reg == SMU_RESP_BUSY_OTHER ||
+	    res == -EREMOTEIO)
+		goto Out;
+	__smu_cmn_send_msg(smu, msg_index, param);
+	res = 0;
+Out:
+	mutex_unlock(&smu->message_lock);
+	return res;
 }
 
+/**
+ * smu_cmn_wait_for_response -- wait for response from the SMU
+ * @smu: pointer to an SMU context
+ *
+ * Wait for status from the SMU.
+ *
+ * Return 0 on success, -errno on error, indicating the execution
+ * status and result of the message being waited for. See
+ * __smu_cmn_reg2errno() for details of the -errno.
+ */
+int smu_cmn_wait_for_response(struct smu_context *smu)
+{
+	u32 reg;
+
+	reg = __smu_cmn_poll_stat(smu);
+	return __smu_cmn_reg2errno(smu, reg);
+}
+
+/**
+ * smu_cmn_send_smc_msg_with_param -- send a message with parameter
+ * @smu: pointer to an SMU context
+ * @msg: message to send
+ * @param: parameter to send to the SMU
+ * @read_arg: pointer to u32 to return a value from the SMU back
+ *            to the caller
+ *
+ * Send the message @msg with parameter @param to the SMU, wait for
+ * completion of the command, and return back a value from the SMU in
+ * @read_arg pointer.
+ *
+ * Return 0 on success, -errno on error, if we weren't able to send
+ * the message or if the message completed with some kind of
+ * error. See __smu_cmn_reg2errno() for details of the -errno.
+ *
+ * If we weren't able to send the message to the SMU, we also print
+ * the error to the standard log.
+ *
+ * Command completion status is printed only if the -errno is
+ * -EREMOTEIO, indicating that the SMU returned back an
+ * undefined/unknown/unspecified result. All other cases are
+ * well-defined, not printed, but instead given back to the client to
+ * decide what further to do.
+ *
+ * The return value, @read_arg is read back regardless, to give back
+ * more information to the client, which on error would most likely be
+ * @param, but we can't assume that. This also eliminates more
+ * conditionals.
+ */
 int smu_cmn_send_smc_msg_with_param(struct smu_context *smu,
 				    enum smu_message_type msg,
 				    uint32_t param,
 				    uint32_t *read_arg)
 {
-	struct amdgpu_device *adev = smu->adev;
-	int ret = 0, index = 0;
+	int res, index;
+	u32 reg;
 
 	if (smu->adev->no_hw_access)
 		return 0;
@@ -136,31 +339,24 @@ int smu_cmn_send_smc_msg_with_param(struct smu_context *smu,
 		return index == -EACCES ? 0 : index;
 
 	mutex_lock(&smu->message_lock);
-	ret = smu_cmn_send_msg_without_waiting(smu, (uint16_t)index, param);
-	if (ret)
-		goto out;
-
-	ret = smu_cmn_wait_for_response(smu);
-	if (ret != 0x1) {
-		if (ret == -ETIME) {
-			dev_err(adev->dev, "message: %15s (%d) \tparam: 0x%08x is timeout (no response)\n",
-				smu_get_message_name(smu, msg), index, param);
-		} else {
-			dev_err(adev->dev, "failed send message: %15s (%d) \tparam: 0x%08x response %#x\n",
-				smu_get_message_name(smu, msg), index, param,
-				ret);
-			ret = -EIO;
-		}
-		goto out;
+	reg = __smu_cmn_poll_stat(smu);
+	res = __smu_cmn_reg2errno(smu, reg);
+	if (reg == SMU_RESP_NONE ||
+	    reg == SMU_RESP_BUSY_OTHER ||
+	    res == -EREMOTEIO) {
+		__smu_cmn_reg_print_error(smu, reg, index, param, msg);
+		goto Out;
 	}
-
+	__smu_cmn_send_msg(smu, (uint16_t) index, param);
+	reg = __smu_cmn_poll_stat(smu);
+	res = __smu_cmn_reg2errno(smu, reg);
+	if (res == -EREMOTEIO)
+		__smu_cmn_reg_print_error(smu, reg, index, param, msg);
 	if (read_arg)
 		smu_cmn_read_arg(smu, read_arg);
-
-	ret = 0; /* 0 as driver return value */
-out:
+Out:
 	mutex_unlock(&smu->message_lock);
-	return ret;
+	return res;
 }
 
 int smu_cmn_send_smc_msg(struct smu_context *smu,
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h
index 9add5f16ff56..16993daa2ae0 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.h
@@ -27,7 +27,8 @@
 
 #if defined(SWSMU_CODE_LAYER_L2) || defined(SWSMU_CODE_LAYER_L3) || defined(SWSMU_CODE_LAYER_L4)
 int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
-				     uint16_t msg, uint32_t param);
+				     uint16_t msg_index,
+				     uint32_t param);
 int smu_cmn_send_smc_msg_with_param(struct smu_context *smu,
 				    enum smu_message_type msg,
 				    uint32_t param,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 126/334] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2021-09-13 13:12 ` [PATCH 5.14 125/334] drm/amd/pm: Fix a bug communicating with the SMU (v5) Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 127/334] ARM: dts: meson8: Use a higher default GPU clock frequency Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin KaFai Lau, Andrii Nakryiko,
	Eric Dumazet, Kuniyuki Iwashima, Yonghong Song, Sasha Levin

From: Martin KaFai Lau <kafai@fb.com>

[ Upstream commit 525e2f9fd0229eb10cb460a9e6d978257f24804e ]

st->bucket stores the current bucket number.
st->offset stores the offset within this bucket that is the sk to be
seq_show().  Thus, st->offset only makes sense within the same
st->bucket.

These two variables are an optimization for the common no-lseek case.
When resuming the seq_file iteration (i.e. seq_start()),
tcp_seek_last_pos() tries to continue from the st->offset
at bucket st->bucket.

However, it is possible that the bucket pointed by st->bucket
has changed and st->offset may end up skipping the whole st->bucket
without finding a sk.  In this case, tcp_seek_last_pos() currently
continues to satisfy the offset condition in the next (and incorrect)
bucket.  Instead, regardless of the offset value, the first sk of the
next bucket should be returned.  Thus, "bucket == st->bucket" check is
added to tcp_seek_last_pos().

The chance of hitting this is small and the issue is a decade old,
so targeting for the next tree.

Fixes: a8b690f98baf ("tcp: Fix slowness in read /proc/net/tcp")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210701200541.1033917-1-kafai@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_ipv4.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a692626c19e4..db07c05736b2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2451,6 +2451,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)
 static void *tcp_seek_last_pos(struct seq_file *seq)
 {
 	struct tcp_iter_state *st = seq->private;
+	int bucket = st->bucket;
 	int offset = st->offset;
 	int orig_num = st->num;
 	void *rc = NULL;
@@ -2461,7 +2462,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
 			break;
 		st->state = TCP_SEQ_STATE_LISTENING;
 		rc = listening_get_next(seq, NULL);
-		while (offset-- && rc)
+		while (offset-- && rc && bucket == st->bucket)
 			rc = listening_get_next(seq, rc);
 		if (rc)
 			break;
@@ -2472,7 +2473,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)
 		if (st->bucket > tcp_hashinfo.ehash_mask)
 			break;
 		rc = established_get_first(seq);
-		while (offset-- && rc)
+		while (offset-- && rc && bucket == st->bucket)
 			rc = established_get_next(seq, rc);
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 127/334] ARM: dts: meson8: Use a higher default GPU clock frequency
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 126/334] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 128/334] ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Demetris Ierokipides,
	Martin Blumenstingl, Neil Armstrong, Sasha Levin

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 44cf630bcb8c5ec78125805c9447dd5766792224 ]

We are seeing "imprecise external abort (0x1406)" errors during boot
(which then cause the whole board to hang) on Meson8 (but not Meson8m2).
These are observed while trying to access the GPU's registers when the
MALI clock is running at it's default setting of 24MHz. The 3.10 vendor
kernel uses 318.75MHz as "default" GPU frequency. Using that makes the
"imprecise external aborts" go away.
Add the assigned-clocks and assigned-clock-rates properties to also bump
the MALI clock to 318.75MHz before accessing any of it's registers.

Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU")
Reported-by: Demetris Ierokipides <ierokipides.dem@gmail.com>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Reviewed-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210711214023.2163565-1-martin.blumenstingl@googlemail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8.dtsi | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi
index 157a950a55d3..686c7b7c79d5 100644
--- a/arch/arm/boot/dts/meson8.dtsi
+++ b/arch/arm/boot/dts/meson8.dtsi
@@ -304,8 +304,13 @@
 					  "pp2", "ppmmu2", "pp4", "ppmmu4",
 					  "pp5", "ppmmu5", "pp6", "ppmmu6";
 			resets = <&reset RESET_MALI>;
+
 			clocks = <&clkc CLKID_CLK81>, <&clkc CLKID_MALI>;
 			clock-names = "bus", "core";
+
+			assigned-clocks = <&clkc CLKID_MALI>;
+			assigned-clock-rates = <318750000>;
+
 			operating-points-v2 = <&gpu_opp_table>;
 			#cooling-cells = <2>; /* min followed by max */
 		};
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 128/334] ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 127/334] ARM: dts: meson8: Use a higher default GPU clock frequency Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 129/334] ARM: dts: meson8b: mxq: " Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Anand Moon,
	Neil Armstrong, Sasha Levin

From: Anand Moon <linux.amoon@gmail.com>

[ Upstream commit 876228e9f935f19c7afc7ba394d17e2ec9143b65 ]

After enabling CONFIG_REGULATOR_DEBUG=y we observe below debug logs.
Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
instead of dummy regulator.

[    7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
[    7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
[    7.117184] VCCK: supplied by regulator-dummy
[    7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
[    7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
[    7.118498] VDDEE: will resolve supply early: pwm
[    7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
[    7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
[    7.118553] VDDEE: supplied by regulator-dummy
[    7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT

Fixes: 524d96083b66 ("ARM: dts: meson8b: odroidc1: add the CPU voltage regulator")
Fixes: 8bdf38be712d ("ARM: dts: meson8b: odroidc1: add the VDDEE regulator")

Tested-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[narmstrong: fixed typo in commit s/observer/observe/]
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210705112358.3554-2-linux.amoon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8b-odroidc1.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts
index c440ef94e082..04356bc639fa 100644
--- a/arch/arm/boot/dts/meson8b-odroidc1.dts
+++ b/arch/arm/boot/dts/meson8b-odroidc1.dts
@@ -131,7 +131,7 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
-		vin-supply = <&p5v0>;
+		pwm-supply = <&p5v0>;
 
 		pwms = <&pwm_cd 0 12218 0>;
 		pwm-dutycycle-range = <91 0>;
@@ -163,7 +163,7 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
-		vin-supply = <&p5v0>;
+		pwm-supply = <&p5v0>;
 
 		pwms = <&pwm_cd 1 12218 0>;
 		pwm-dutycycle-range = <91 0>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 129/334] ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 128/334] ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 130/334] ARM: dts: meson8b: ec100: " Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Anand Moon,
	Neil Armstrong, Sasha Levin

From: Anand Moon <linux.amoon@gmail.com>

[ Upstream commit 632062e540becbbcb067523ec8bcadb1239d9578 ]

After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs.
Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
instead of dummy regulator.
Add missing pwm-supply for regulator-vcck regulator node.

[    7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
[    7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
[    7.117184] VCCK: supplied by regulator-dummy
[    7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
[    7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
[    7.118498] VDDEE: will resolve supply early: pwm
[    7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
[    7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
[    7.118553] VDDEE: supplied by regulator-dummy
[    7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT

Fixes: dee51cd0d2e8 ("ARM: dts: meson8b: mxq: add the VDDEE regulator")
Fixes: d94f60e3dfa0 ("ARM: dts: meson8b: mxq: improve support for the TRONFY MXQ S805")

Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210705112358.3554-3-linux.amoon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8b-mxq.dts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/meson8b-mxq.dts b/arch/arm/boot/dts/meson8b-mxq.dts
index f3937d55472d..7adedd3258c3 100644
--- a/arch/arm/boot/dts/meson8b-mxq.dts
+++ b/arch/arm/boot/dts/meson8b-mxq.dts
@@ -34,6 +34,8 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
+		pwm-supply = <&vcc_5v>;
+
 		pwms = <&pwm_cd 0 1148 0>;
 		pwm-dutycycle-range = <100 0>;
 
@@ -79,7 +81,7 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
-		vin-supply = <&vcc_5v>;
+		pwm-supply = <&vcc_5v>;
 
 		pwms = <&pwm_cd 1 1148 0>;
 		pwm-dutycycle-range = <100 0>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 130/334] ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 129/334] ARM: dts: meson8b: mxq: " Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 131/334] net/mlx5e: Prohibit inner indir TIRs in IPoIB Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Anand Moon,
	Neil Armstrong, Sasha Levin

From: Anand Moon <linux.amoon@gmail.com>

[ Upstream commit 72ccc373b064ae3ac0c5b5f2306069b60ca118df ]

After enabling CONFIG_REGULATOR_DEBUG=y we observer below debug logs.
Changes help link VCCK and VDDEE pwm regulator to 5V regulator supply
instead of dummy regulator.

[    7.117140] pwm-regulator regulator-vcck: Looking up pwm-supply from device tree
[    7.117153] pwm-regulator regulator-vcck: Looking up pwm-supply property in node /regulator-vcck failed
[    7.117184] VCCK: supplied by regulator-dummy
[    7.117194] regulator-dummy: could not add device link regulator.8: -ENOENT
[    7.117266] VCCK: 860 <--> 1140 mV at 986 mV, enabled
[    7.118498] VDDEE: will resolve supply early: pwm
[    7.118515] pwm-regulator regulator-vddee: Looking up pwm-supply from device tree
[    7.118526] pwm-regulator regulator-vddee: Looking up pwm-supply property in node /regulator-vddee failed
[    7.118553] VDDEE: supplied by regulator-dummy
[    7.118563] regulator-dummy: could not add device link regulator.9: -ENOENT

Fixes: 087a1d8b4e4c ("ARM: dts: meson8b: ec100: add the VDDEE regulator")
Fixes: 3e7db1c1b7a3 ("ARM: dts: meson8b: ec100: improve the description of the regulators")

Cc: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Anand Moon <linux.amoon@gmail.com>
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Link: https://lore.kernel.org/r/20210705112358.3554-4-linux.amoon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/meson8b-ec100.dts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/meson8b-ec100.dts b/arch/arm/boot/dts/meson8b-ec100.dts
index 8e48ccc6b634..7e8ddc6f1252 100644
--- a/arch/arm/boot/dts/meson8b-ec100.dts
+++ b/arch/arm/boot/dts/meson8b-ec100.dts
@@ -148,7 +148,7 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
-		vin-supply = <&vcc_5v>;
+		pwm-supply = <&vcc_5v>;
 
 		pwms = <&pwm_cd 0 1148 0>;
 		pwm-dutycycle-range = <100 0>;
@@ -232,7 +232,7 @@
 		regulator-min-microvolt = <860000>;
 		regulator-max-microvolt = <1140000>;
 
-		vin-supply = <&vcc_5v>;
+		pwm-supply = <&vcc_5v>;
 
 		pwms = <&pwm_cd 1 1148 0>;
 		pwm-dutycycle-range = <100 0>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 131/334] net/mlx5e: Prohibit inner indir TIRs in IPoIB
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 130/334] ARM: dts: meson8b: ec100: " Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 132/334] net/mlx5e: Block LRO if firmware asks for tunneled LRO Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Saeed Mahameed,
	Sasha Levin

From: Maxim Mikityanskiy <maximmi@nvidia.com>

[ Upstream commit 9c43f3865c2a03be104f1c1d5e9129c2a2bdba88 ]

TIR's rx_hash_field_selector_inner can be enabled only when
tunneled_offload_en = 1. tunneled_offload_en is filled according to the
tunneled_offload_en field in struct mlx5e_params, which is false in the
IPoIB profile. On the other hand, the IPoIB profile passes inner_ttc =
true to mlx5e_create_indirect_tirs, which potentially allows the latter
function to attempt to create inner indirect TIRs without having
tunneled_offload_en set.

This commit prohibits this behavior by passing inner_ttc = false to
mlx5e_create_indirect_tirs. The latter function won't attempt to create
inner indirect TIRs.

As inner indirect TIRs are not created in the IPoIB profile (this commit
blocks it explicitly, and even before they would have failed to be
created), the call to mlx5e_create_inner_ttc_table in
mlx5i_create_flow_steering is a no-op and can be removed.

Fixes: 46dc933cee82 ("net/mlx5e: Provide explicit directive if to create inner indirect tirs")
Fixes: 458821c72bd0 ("net/mlx5e: IPoIB, Add inner TTC table to IPoIB flow steering")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlx5/core/en/fs.h    |  6 ------
 .../net/ethernet/mellanox/mlx5/core/en_fs.c    | 10 +++++-----
 .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c  | 18 ++----------------
 3 files changed, 7 insertions(+), 27 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
index 1d5ce07b83f4..43b092f5565a 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h
@@ -248,18 +248,12 @@ struct ttc_params {
 
 void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv, struct ttc_params *ttc_params);
 void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params);
-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params);
 
 int mlx5e_create_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
 			   struct mlx5e_ttc_table *ttc);
 void mlx5e_destroy_ttc_table(struct mlx5e_priv *priv,
 			     struct mlx5e_ttc_table *ttc);
 
-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
-				 struct mlx5e_ttc_table *ttc);
-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
-				   struct mlx5e_ttc_table *ttc);
-
 void mlx5e_destroy_flow_table(struct mlx5e_flow_table *ft);
 int mlx5e_ttc_fwd_dest(struct mlx5e_priv *priv, enum mlx5e_traffic_types type,
 		       struct mlx5_flow_destination *new_dest);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
index 0b75fab41ae8..6464ac3f294e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
@@ -1324,7 +1324,7 @@ void mlx5e_set_ttc_basic_params(struct mlx5e_priv *priv,
 	ttc_params->inner_ttc = &priv->fs.inner_ttc;
 }
 
-void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params)
+static void mlx5e_set_inner_ttc_ft_params(struct ttc_params *ttc_params)
 {
 	struct mlx5_flow_table_attr *ft_attr = &ttc_params->ft_attr;
 
@@ -1343,8 +1343,8 @@ void mlx5e_set_ttc_ft_params(struct ttc_params *ttc_params)
 	ft_attr->prio = MLX5E_NIC_PRIO;
 }
 
-int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
-				 struct mlx5e_ttc_table *ttc)
+static int mlx5e_create_inner_ttc_table(struct mlx5e_priv *priv, struct ttc_params *params,
+					struct mlx5e_ttc_table *ttc)
 {
 	struct mlx5e_flow_table *ft = &ttc->ft;
 	int err;
@@ -1374,8 +1374,8 @@ err:
 	return err;
 }
 
-void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
-				   struct mlx5e_ttc_table *ttc)
+static void mlx5e_destroy_inner_ttc_table(struct mlx5e_priv *priv,
+					  struct mlx5e_ttc_table *ttc)
 {
 	if (!mlx5e_tunnel_inner_ft_supported(priv->mdev))
 		return;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
index 7d7ed025db0d..620d638e1e8f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
@@ -331,17 +331,6 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
 	}
 
 	mlx5e_set_ttc_basic_params(priv, &ttc_params);
-	mlx5e_set_inner_ttc_ft_params(&ttc_params);
-	for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++)
-		ttc_params.indir_tirn[tt] = priv->inner_indir_tir[tt].tirn;
-
-	err = mlx5e_create_inner_ttc_table(priv, &ttc_params, &priv->fs.inner_ttc);
-	if (err) {
-		netdev_err(priv->netdev, "Failed to create inner ttc table, err=%d\n",
-			   err);
-		goto err_destroy_arfs_tables;
-	}
-
 	mlx5e_set_ttc_ft_params(&ttc_params);
 	for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++)
 		ttc_params.indir_tirn[tt] = priv->indir_tir[tt].tirn;
@@ -350,13 +339,11 @@ static int mlx5i_create_flow_steering(struct mlx5e_priv *priv)
 	if (err) {
 		netdev_err(priv->netdev, "Failed to create ttc table, err=%d\n",
 			   err);
-		goto err_destroy_inner_ttc_table;
+		goto err_destroy_arfs_tables;
 	}
 
 	return 0;
 
-err_destroy_inner_ttc_table:
-	mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc);
 err_destroy_arfs_tables:
 	mlx5e_arfs_destroy_tables(priv);
 
@@ -366,7 +353,6 @@ err_destroy_arfs_tables:
 static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv)
 {
 	mlx5e_destroy_ttc_table(priv, &priv->fs.ttc);
-	mlx5e_destroy_inner_ttc_table(priv, &priv->fs.inner_ttc);
 	mlx5e_arfs_destroy_tables(priv);
 }
 
@@ -392,7 +378,7 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv)
 	if (err)
 		goto err_destroy_indirect_rqts;
 
-	err = mlx5e_create_indirect_tirs(priv, true);
+	err = mlx5e_create_indirect_tirs(priv, false);
 	if (err)
 		goto err_destroy_direct_rqts;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 132/334] net/mlx5e: Block LRO if firmware asks for tunneled LRO
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 131/334] net/mlx5e: Prohibit inner indir TIRs in IPoIB Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 133/334] cgroup/cpuset: Fix a partition bug with hotplug Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Saeed Mahameed,
	Sasha Levin

From: Maxim Mikityanskiy <maximmi@nvidia.com>

[ Upstream commit 26ab7b384525ccfa678c518577f7f0d841209c8b ]

This commit does a cleanup in LRO configuration.

LRO is a parameter of an RQ, but its state is changed by modifying a TIR
related to the RQ.

The current status: LRO for tunneled packets is not supported in the
driver, inner TIRs may enable LRO on creation, but LRO status of inner
TIRs isn't changed in mlx5e_modify_tirs_lro(). This is inconsistent, but
as long as the firmware doesn't declare support for tunneled LRO, it
works, because the same RQs are shared between the inner and outer TIRs.

This commit does two fixes:

1. If the firmware has the tunneled LRO capability, LRO is blocked
altogether, because it's not possible to block it for inner TIRs only,
when the same RQs are shared between inner and outer TIRs, and the
driver won't be able to handle tunneled LRO traffic.

2. mlx5e_modify_tirs_lro() is patched to modify LRO state for all TIRs,
including inner ones, because all TIRs related to an RQ should agree on
their LRO state.

Fixes: 7b3722fa9ef6 ("net/mlx5e: Support RSS for GRE tunneled packets")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 15 +++++++++++++++
 include/linux/mlx5/mlx5_ifc.h                     |  3 ++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 24f919ef9b8e..b7be1ef4cbb2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -2567,6 +2567,14 @@ static int mlx5e_modify_tirs_lro(struct mlx5e_priv *priv)
 		err = mlx5_core_modify_tir(mdev, priv->indir_tir[tt].tirn, in);
 		if (err)
 			goto free_in;
+
+		/* Verify inner tirs resources allocated */
+		if (!priv->inner_indir_tir[0].tirn)
+			continue;
+
+		err = mlx5_core_modify_tir(mdev, priv->inner_indir_tir[tt].tirn, in);
+		if (err)
+			goto free_in;
 	}
 
 	for (ix = 0; ix < priv->max_nch; ix++) {
@@ -4812,7 +4820,14 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev)
 	netdev->hw_enc_features  |= NETIF_F_HW_VLAN_CTAG_TX;
 	netdev->hw_enc_features  |= NETIF_F_HW_VLAN_CTAG_RX;
 
+	/* Tunneled LRO is not supported in the driver, and the same RQs are
+	 * shared between inner and outer TIRs, so the driver can't disable LRO
+	 * for inner TIRs while having it enabled for outer TIRs. Due to this,
+	 * block LRO altogether if the firmware declares tunneled LRO support.
+	 */
 	if (!!MLX5_CAP_ETH(mdev, lro_cap) &&
+	    !MLX5_CAP_ETH(mdev, tunnel_lro_vxlan) &&
+	    !MLX5_CAP_ETH(mdev, tunnel_lro_gre) &&
 	    mlx5e_check_fragmented_striding_rq_cap(mdev))
 		netdev->vlan_features    |= NETIF_F_LRO;
 
diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
index b0009aa3647f..6bbae0c3bc0b 100644
--- a/include/linux/mlx5/mlx5_ifc.h
+++ b/include/linux/mlx5/mlx5_ifc.h
@@ -921,7 +921,8 @@ struct mlx5_ifc_per_protocol_networking_offload_caps_bits {
 	u8         scatter_fcs[0x1];
 	u8         enhanced_multi_pkt_send_wqe[0x1];
 	u8         tunnel_lso_const_out_ip_id[0x1];
-	u8         reserved_at_1c[0x2];
+	u8         tunnel_lro_gre[0x1];
+	u8         tunnel_lro_vxlan[0x1];
 	u8         tunnel_stateless_gre[0x1];
 	u8         tunnel_stateless_vxlan[0x1];
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 133/334] cgroup/cpuset: Fix a partition bug with hotplug
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 132/334] net/mlx5e: Block LRO if firmware asks for tunneled LRO Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 134/334] drm: mxsfb: Enable recovery on underflow Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Waiman Long, Tejun Heo, Sasha Levin

From: Waiman Long <longman@redhat.com>

[ Upstream commit 15d428e6fe77fffc3f4fff923336036f5496ef17 ]

In cpuset_hotplug_workfn(), the detection of whether the cpu list
has been changed is done by comparing the effective cpus of the top
cpuset with the cpu_active_mask. However, in the rare case that just
all the CPUs in the subparts_cpus are offlined, the detection fails
and the partition states are not updated correctly. Fix it by forcing
the cpus_updated flag to true in this particular case.

Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cpuset.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index adb5190c4429..592e9e37542f 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -3168,6 +3168,13 @@ static void cpuset_hotplug_workfn(struct work_struct *work)
 	cpus_updated = !cpumask_equal(top_cpuset.effective_cpus, &new_cpus);
 	mems_updated = !nodes_equal(top_cpuset.effective_mems, new_mems);
 
+	/*
+	 * In the rare case that hotplug removes all the cpus in subparts_cpus,
+	 * we assumed that cpus are updated.
+	 */
+	if (!cpus_updated && top_cpuset.nr_subparts_cpus)
+		cpus_updated = true;
+
 	/* synchronize cpus_allowed to cpu_active_mask */
 	if (cpus_updated) {
 		spin_lock_irq(&callback_lock);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 134/334] drm: mxsfb: Enable recovery on underflow
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 133/334] cgroup/cpuset: Fix a partition bug with hotplug Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 135/334] drm: mxsfb: Increase number of outstanding requests on V4 and newer HW Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Daniel Abrecht,
	Emil Velikov, Laurent Pinchart, Lucas Stach, Stefan Agner,
	Jagan Teki, Sam Ravnborg, Sasha Levin

From: Marek Vasut <marex@denx.de>

[ Upstream commit 0c9856e4edcdcac22d65618e8ceff9eb41447880 ]

There is some sort of corner case behavior of the controller,
which could rarely be triggered at least on i.MX6SX connected
to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS
bridged 1920x1080 panel (and likely on other setups too), where
the image on the panel shifts to the right and wraps around.
This happens either when the controller is enabled on boot or
even later during run time. The condition does not correct
itself automatically, i.e. the display image remains shifted.

It seems this problem is known and is due to sporadic underflows
of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow
IRQs, neither of the IRQs trigger and neither IRQ status bit is
asserted when this condition occurs.

All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW
bit, which is described in the reference manual since i.MX23 as
"
  Set this bit to enable the LCDIF block to recover in the next
  field/frame if there was an underflow in the current field/frame.
"
Enable this bit to mitigate the sporadic underflows.

Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Daniel Abrecht <public@danielabrecht.ch>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Stefan Agner <stefan@agner.ch>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210620224701.189289-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mxsfb/mxsfb_kms.c  | 29 +++++++++++++++++++++++++++++
 drivers/gpu/drm/mxsfb/mxsfb_regs.h |  1 +
 2 files changed, 30 insertions(+)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
index 300e7bab0f43..01e0f525360f 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
@@ -115,6 +115,35 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
 	reg |= VDCTRL4_SYNC_SIGNALS_ON;
 	writel(reg, mxsfb->base + LCDC_VDCTRL4);
 
+	/*
+	 * Enable recovery on underflow.
+	 *
+	 * There is some sort of corner case behavior of the controller,
+	 * which could rarely be triggered at least on i.MX6SX connected
+	 * to 800x480 DPI panel and i.MX8MM connected to DPI->DSI->LVDS
+	 * bridged 1920x1080 panel (and likely on other setups too), where
+	 * the image on the panel shifts to the right and wraps around.
+	 * This happens either when the controller is enabled on boot or
+	 * even later during run time. The condition does not correct
+	 * itself automatically, i.e. the display image remains shifted.
+	 *
+	 * It seems this problem is known and is due to sporadic underflows
+	 * of the LCDIF FIFO. While the LCDIF IP does have underflow/overflow
+	 * IRQs, neither of the IRQs trigger and neither IRQ status bit is
+	 * asserted when this condition occurs.
+	 *
+	 * All known revisions of the LCDIF IP have CTRL1 RECOVER_ON_UNDERFLOW
+	 * bit, which is described in the reference manual since i.MX23 as
+	 * "
+	 *   Set this bit to enable the LCDIF block to recover in the next
+	 *   field/frame if there was an underflow in the current field/frame.
+	 * "
+	 * Enable this bit to mitigate the sporadic underflows.
+	 */
+	reg = readl(mxsfb->base + LCDC_CTRL1);
+	reg |= CTRL1_RECOVER_ON_UNDERFLOW;
+	writel(reg, mxsfb->base + LCDC_CTRL1);
+
 	writel(CTRL_RUN, mxsfb->base + LCDC_CTRL + REG_SET);
 }
 
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
index 55d28a27f912..df90e960f495 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
@@ -54,6 +54,7 @@
 #define CTRL_DF24			BIT(1)
 #define CTRL_RUN			BIT(0)
 
+#define CTRL1_RECOVER_ON_UNDERFLOW	BIT(24)
 #define CTRL1_FIFO_CLEAR		BIT(21)
 #define CTRL1_SET_BYTE_PACKAGING(x)	(((x) & 0xf) << 16)
 #define CTRL1_GET_BYTE_PACKAGING(x)	(((x) >> 16) & 0xf)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 135/334] drm: mxsfb: Increase number of outstanding requests on V4 and newer HW
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 134/334] drm: mxsfb: Enable recovery on underflow Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 136/334] drm: mxsfb: Clear FIFO_CLEAR bit Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Daniel Abrecht,
	Emil Velikov, Laurent Pinchart, Lucas Stach, Stefan Agner,
	Sam Ravnborg, Sasha Levin

From: Marek Vasut <marex@denx.de>

[ Upstream commit 9891cb54445bc65bf156bda416b6215048c7f617 ]

In case the DRAM is under high load, the MXSFB FIFO might underflow
and that causes visible artifacts. This could be triggered on i.MX8MM
using e.g. "$ memtester 128M" on a device with 1920x1080 panel. The
first "Stuck Address" test of the memtester will completely corrupt
the image on the panel and leave the MXSFB FIFO in odd state.

To avoid this underflow, increase number of outstanding requests to
DRAM from 2 to 16, which is the maximum. This mitigates the issue
and it can no longer be triggered.

Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Daniel Abrecht <public@danielabrecht.ch>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Stefan Agner <stefan@agner.ch>
Reviewed-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210620224759.189351-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mxsfb/mxsfb_drv.c  | 3 +++
 drivers/gpu/drm/mxsfb/mxsfb_drv.h  | 1 +
 drivers/gpu/drm/mxsfb/mxsfb_kms.c  | 8 ++++++++
 drivers/gpu/drm/mxsfb/mxsfb_regs.h | 8 ++++++++
 4 files changed, 20 insertions(+)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
index 6da93551e2e5..c277d3f61a5e 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c
@@ -51,6 +51,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
 		.hs_wdth_mask	= 0xff,
 		.hs_wdth_shift	= 24,
 		.has_overlay	= false,
+		.has_ctrl2	= false,
 	},
 	[MXSFB_V4] = {
 		.transfer_count	= LCDC_V4_TRANSFER_COUNT,
@@ -59,6 +60,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
 		.hs_wdth_mask	= 0x3fff,
 		.hs_wdth_shift	= 18,
 		.has_overlay	= false,
+		.has_ctrl2	= true,
 	},
 	[MXSFB_V6] = {
 		.transfer_count	= LCDC_V4_TRANSFER_COUNT,
@@ -67,6 +69,7 @@ static const struct mxsfb_devdata mxsfb_devdata[] = {
 		.hs_wdth_mask	= 0x3fff,
 		.hs_wdth_shift	= 18,
 		.has_overlay	= true,
+		.has_ctrl2	= true,
 	},
 };
 
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.h b/drivers/gpu/drm/mxsfb/mxsfb_drv.h
index 399d23e91ed1..7c720e226fdf 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.h
@@ -22,6 +22,7 @@ struct mxsfb_devdata {
 	unsigned int	hs_wdth_mask;
 	unsigned int	hs_wdth_shift;
 	bool		has_overlay;
+	bool		has_ctrl2;
 };
 
 struct mxsfb_drm_private {
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
index 01e0f525360f..5bcc06c1ac0b 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
@@ -107,6 +107,14 @@ static void mxsfb_enable_controller(struct mxsfb_drm_private *mxsfb)
 		clk_prepare_enable(mxsfb->clk_disp_axi);
 	clk_prepare_enable(mxsfb->clk);
 
+	/* Increase number of outstanding requests on all supported IPs */
+	if (mxsfb->devdata->has_ctrl2) {
+		reg = readl(mxsfb->base + LCDC_V4_CTRL2);
+		reg &= ~CTRL2_SET_OUTSTANDING_REQS_MASK;
+		reg |= CTRL2_SET_OUTSTANDING_REQS_16;
+		writel(reg, mxsfb->base + LCDC_V4_CTRL2);
+	}
+
 	/* If it was disabled, re-enable the mode again */
 	writel(CTRL_DOTCLK_MODE, mxsfb->base + LCDC_CTRL + REG_SET);
 
diff --git a/drivers/gpu/drm/mxsfb/mxsfb_regs.h b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
index df90e960f495..694fea13e893 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_regs.h
+++ b/drivers/gpu/drm/mxsfb/mxsfb_regs.h
@@ -15,6 +15,7 @@
 #define LCDC_CTRL			0x00
 #define LCDC_CTRL1			0x10
 #define LCDC_V3_TRANSFER_COUNT		0x20
+#define LCDC_V4_CTRL2			0x20
 #define LCDC_V4_TRANSFER_COUNT		0x30
 #define LCDC_V4_CUR_BUF			0x40
 #define LCDC_V4_NEXT_BUF		0x50
@@ -61,6 +62,13 @@
 #define CTRL1_CUR_FRAME_DONE_IRQ_EN	BIT(13)
 #define CTRL1_CUR_FRAME_DONE_IRQ	BIT(9)
 
+#define CTRL2_SET_OUTSTANDING_REQS_1	0
+#define CTRL2_SET_OUTSTANDING_REQS_2	(0x1 << 21)
+#define CTRL2_SET_OUTSTANDING_REQS_4	(0x2 << 21)
+#define CTRL2_SET_OUTSTANDING_REQS_8	(0x3 << 21)
+#define CTRL2_SET_OUTSTANDING_REQS_16	(0x4 << 21)
+#define CTRL2_SET_OUTSTANDING_REQS_MASK	(0x7 << 21)
+
 #define TRANSFER_COUNT_SET_VCOUNT(x)	(((x) & 0xffff) << 16)
 #define TRANSFER_COUNT_GET_VCOUNT(x)	(((x) >> 16) & 0xffff)
 #define TRANSFER_COUNT_SET_HCOUNT(x)	((x) & 0xffff)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 136/334] drm: mxsfb: Clear FIFO_CLEAR bit
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 135/334] drm: mxsfb: Increase number of outstanding requests on V4 and newer HW Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 137/334] net: cipso: fix warnings in netlbl_cipsov4_add_std Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Daniel Abrecht,
	Emil Velikov, Laurent Pinchart, Lucas Stach, Stefan Agner,
	Jagan Teki, Sam Ravnborg, Sasha Levin

From: Marek Vasut <marex@denx.de>

[ Upstream commit 5e23c98178eb1a2cdb7c4fee9a39baf8cabf282d ]

Make sure the FIFO_CLEAR bit is latched in when configuring the
controller, so that the FIFO is really cleared. And then clear
the FIFO_CLEAR bit, since it is not self-clearing.

Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller")
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Daniel Abrecht <public@danielabrecht.ch>
Cc: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Lucas Stach <l.stach@pengutronix.de>
Cc: Stefan Agner <stefan@agner.ch>
Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
Tested-by: Jagan Teki <jagan@amarulasolutions.com> # i.Core MX8MM
Acked-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210620224946.189524-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/mxsfb/mxsfb_kms.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/mxsfb/mxsfb_kms.c b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
index 5bcc06c1ac0b..54f905ac75c0 100644
--- a/drivers/gpu/drm/mxsfb/mxsfb_kms.c
+++ b/drivers/gpu/drm/mxsfb/mxsfb_kms.c
@@ -243,6 +243,9 @@ static void mxsfb_crtc_mode_set_nofb(struct mxsfb_drm_private *mxsfb)
 
 	/* Clear the FIFOs */
 	writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_SET);
+	readl(mxsfb->base + LCDC_CTRL1);
+	writel(CTRL1_FIFO_CLEAR, mxsfb->base + LCDC_CTRL1 + REG_CLR);
+	readl(mxsfb->base + LCDC_CTRL1);
 
 	if (mxsfb->devdata->has_overlay)
 		writel(0, mxsfb->base + LCDC_AS_CTRL);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 137/334] net: cipso: fix warnings in netlbl_cipsov4_add_std
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 136/334] drm: mxsfb: Clear FIFO_CLEAR bit Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 138/334] net: ti: am65-cpsw-nuss: fix wrong devlink release order Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Moore, Pavel Skripkin,
	David S. Miller, Sasha Levin, syzbot+cdd51ee2e6b0b2e18c0d

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 ]

Syzbot reported warning in netlbl_cipsov4_add(). The
problem was in too big doi_def->map.std->lvl.local_size
passed to kcalloc(). Since this value comes from userpace there is
no need to warn if value is not correct.

The same problem may occur with other kcalloc() calls in
this function, so, I've added __GFP_NOWARN flag to all
kcalloc() calls there.

Reported-and-tested-by: syzbot+cdd51ee2e6b0b2e18c0d@syzkaller.appspotmail.com
Fixes: 96cb8e3313c7 ("[NetLabel]: CIPSOv4 and Unlabeled packet integration")
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/netlabel/netlabel_cipso_v4.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index baf235721c43..000bb3da4f77 100644
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -187,14 +187,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		}
 	doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 	if (doi_def->map.std->lvl.local == NULL) {
 		ret_val = -ENOMEM;
 		goto add_std_failure;
 	}
 	doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 	if (doi_def->map.std->lvl.cipso == NULL) {
 		ret_val = -ENOMEM;
 		goto add_std_failure;
@@ -263,7 +263,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		doi_def->map.std->cat.local = kcalloc(
 					      doi_def->map.std->cat.local_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 		if (doi_def->map.std->cat.local == NULL) {
 			ret_val = -ENOMEM;
 			goto add_std_failure;
@@ -271,7 +271,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info,
 		doi_def->map.std->cat.cipso = kcalloc(
 					      doi_def->map.std->cat.cipso_size,
 					      sizeof(u32),
-					      GFP_KERNEL);
+					      GFP_KERNEL | __GFP_NOWARN);
 		if (doi_def->map.std->cat.cipso == NULL) {
 			ret_val = -ENOMEM;
 			goto add_std_failure;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 138/334] net: ti: am65-cpsw-nuss: fix wrong devlink release order
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 137/334] net: cipso: fix warnings in netlbl_cipsov4_add_std Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 139/334] drm: rcar-du: Dont put reference to drm_device in rcar_du_remove() Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, David S. Miller,
	Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit acf34954efd17d4f65c7bb3e614381e6afc33222 ]

The commit that introduced devlink support released devlink resources in
wrong order, that made an unwind flow to be asymmetrical. In addition,
the am65-cpsw-nuss used internal to devlink core field - registered.

In order to fix the unwind flow and remove such access to the
registered field, rewrite the code to call devlink_port_unregister only
on registered ports.

Fixes: 58356eb31d60 ("net: ti: am65-cpsw-nuss: Add devlink support")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ti/am65-cpsw-nuss.c | 34 ++++++++++++------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index 67a08cbba859..fb58fc470773 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -2388,21 +2388,6 @@ static const struct devlink_param am65_cpsw_devlink_params[] = {
 			     am65_cpsw_dl_switch_mode_set, NULL),
 };
 
-static void am65_cpsw_unregister_devlink_ports(struct am65_cpsw_common *common)
-{
-	struct devlink_port *dl_port;
-	struct am65_cpsw_port *port;
-	int i;
-
-	for (i = 1; i <= common->port_num; i++) {
-		port = am65_common_get_port(common, i);
-		dl_port = &port->devlink_port;
-
-		if (dl_port->registered)
-			devlink_port_unregister(dl_port);
-	}
-}
-
 static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common)
 {
 	struct devlink_port_attrs attrs = {};
@@ -2464,7 +2449,12 @@ static int am65_cpsw_nuss_register_devlink(struct am65_cpsw_common *common)
 	return ret;
 
 dl_port_unreg:
-	am65_cpsw_unregister_devlink_ports(common);
+	for (i = i - 1; i >= 1; i--) {
+		port = am65_common_get_port(common, i);
+		dl_port = &port->devlink_port;
+
+		devlink_port_unregister(dl_port);
+	}
 dl_unreg:
 	devlink_unregister(common->devlink);
 dl_free:
@@ -2475,6 +2465,17 @@ dl_free:
 
 static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common)
 {
+	struct devlink_port *dl_port;
+	struct am65_cpsw_port *port;
+	int i;
+
+	for (i = 1; i <= common->port_num; i++) {
+		port = am65_common_get_port(common, i);
+		dl_port = &port->devlink_port;
+
+		devlink_port_unregister(dl_port);
+	}
+
 	if (!AM65_CPSW_IS_CPSW2G(common) &&
 	    IS_ENABLED(CONFIG_TI_K3_AM65_CPSW_SWITCHDEV)) {
 		devlink_params_unpublish(common->devlink);
@@ -2482,7 +2483,6 @@ static void am65_cpsw_unregister_devlink(struct am65_cpsw_common *common)
 					  ARRAY_SIZE(am65_cpsw_devlink_params));
 	}
 
-	am65_cpsw_unregister_devlink_ports(common);
 	devlink_unregister(common->devlink);
 	devlink_free(common->devlink);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 139/334] drm: rcar-du: Dont put reference to drm_device in rcar_du_remove()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 138/334] net: ti: am65-cpsw-nuss: fix wrong devlink release order Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 140/334] Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Kieran Bingham,
	Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit c29b6b0b126e9ee69a5d6339475e831a149295bd ]

The reference to the drm_device that was acquired by
devm_drm_dev_alloc() is released automatically by the devres
infrastructure. It must not be released manually, as that causes a
reference underflow..

Fixes: ea6aae151887 ("drm: rcar-du: Embed drm_device in rcar_du_device")
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/rcar-du/rcar_du_drv.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
index bfbff90588cb..c22551c2facb 100644
--- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c
+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c
@@ -556,8 +556,6 @@ static int rcar_du_remove(struct platform_device *pdev)
 
 	drm_kms_helper_poll_fini(ddev);
 
-	drm_dev_put(ddev);
-
 	return 0;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 140/334] Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 139/334] drm: rcar-du: Dont put reference to drm_device in rcar_du_remove() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 141/334] drm/amd/pm: Fix a bug in semaphore double-lock Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tedd Ho-Jeong An,
	Luiz Augusto von Dentz, Sasha Levin

From: Tedd Ho-Jeong An <tedd.an@intel.com>

[ Upstream commit a25fca4d3c18766b6f7a3c95fa8faec23ef464c5 ]

This patch fixes the MGMT add_advertising command repsones with the
wrong opcode when it is trying to return the not supported error.

Fixes: cbbdfa6f33198 ("Bluetooth: Enable controller RPA resolution using Experimental feature")
Signed-off-by: Tedd Ho-Jeong An <tedd.an@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/mgmt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 3663f880df11..1e21e014efd2 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -7725,7 +7725,7 @@ static int add_advertising(struct sock *sk, struct hci_dev *hdev,
 	 * advertising.
 	 */
 	if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
-		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING,
+		return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING,
 				       MGMT_STATUS_NOT_SUPPORTED);
 
 	if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 141/334] drm/amd/pm: Fix a bug in semaphore double-lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 140/334] Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 142/334] lib/test_scanf: Handle n_bits == 0 in random tests Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Deucher, Changfeng Zhu,
	Huang Rui, Luben Tuikov, Alex Deucher, Sasha Levin

From: Luben Tuikov <luben.tuikov@amd.com>

[ Upstream commit 544dcd74b7093ad4befac99b11d90331aa73348e ]

Fix a bug in smu_cmn_send_msg_without_waiting() in
that this function does not need to take the
smu->message_lock mutex in order to send a message
down to the SMU. The mutex is acquired by the
caller of this function instead.

Cc: Alex Deucher <Alexander.Deucher@amd.com>
Cc: Changfeng Zhu <Changfeng.Zhu@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Fixes: 5810323ba69289 ("drm/amd/pm: Fix a bug communicating with the SMU (v5)")
Signed-off-by: Luben Tuikov <luben.tuikov@amd.com>
Reviewed-by: Alex Deucher <Alexander.Deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
index a0e2111eb783..415be74df28c 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
@@ -259,7 +259,6 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
 	if (smu->adev->no_hw_access)
 		return 0;
 
-	mutex_lock(&smu->message_lock);
 	reg = __smu_cmn_poll_stat(smu);
 	res = __smu_cmn_reg2errno(smu, reg);
 	if (reg == SMU_RESP_NONE ||
@@ -269,7 +268,6 @@ int smu_cmn_send_msg_without_waiting(struct smu_context *smu,
 	__smu_cmn_send_msg(smu, msg_index, param);
 	res = 0;
 Out:
-	mutex_unlock(&smu->message_lock);
 	return res;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 142/334] lib/test_scanf: Handle n_bits == 0 in random tests
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 141/334] drm/amd/pm: Fix a bug in semaphore double-lock Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 143/334] libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Andy Shevchenko,
	Richard Fitzgerald, Petr Mladek, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit fe8e3ee0d588566c1f44f28a555042ef50eba491 ]

UBSAN reported (via LKP)

[   11.021349][    T1] UBSAN: shift-out-of-bounds in lib/test_scanf.c:275:51
[   11.022782][    T1] shift exponent 32 is too large for 32-bit type 'unsigned int'

When n_bits == 0, the shift is out of range. Switch code to use GENMASK
to handle this case.

Fixes: 50f530e176ea ("lib: test_scanf: Add tests for sscanf number conversion")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210727150132.28920-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/test_scanf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/test_scanf.c b/lib/test_scanf.c
index 84fe09eaf55e..abae88848972 100644
--- a/lib/test_scanf.c
+++ b/lib/test_scanf.c
@@ -271,7 +271,7 @@ static u32 __init next_test_random(u32 max_bits)
 {
 	u32 n_bits = hweight32(prandom_u32_state(&rnd_state)) % (max_bits + 1);
 
-	return prandom_u32_state(&rnd_state) & (UINT_MAX >> (32 - n_bits));
+	return prandom_u32_state(&rnd_state) & GENMASK(n_bits, 0);
 }
 
 static unsigned long long __init next_test_random_ull(void)
@@ -280,7 +280,7 @@ static unsigned long long __init next_test_random_ull(void)
 	u32 n_bits = (hweight32(rand1) * 3) % 64;
 	u64 val = (u64)prandom_u32_state(&rnd_state) * rand1;
 
-	return val & (ULLONG_MAX >> (64 - n_bits));
+	return val & GENMASK_ULL(n_bits, 0);
 }
 
 #define random_for_type(T)				\
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 143/334] libbpf: Return non-null error on failures in libbpf_find_prog_btf_id()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 142/334] lib/test_scanf: Handle n_bits == 0 in random tests Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 144/334] tools: Free BTF objects at various locations Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Andrii Nakryiko, Sasha Levin

From: Quentin Monnet <quentin@isovalent.com>

[ Upstream commit 6d2d73cdd673d493f9f3751188757129b1d23fb7 ]

Variable "err" is initialised to -EINVAL so that this error code is
returned when something goes wrong in libbpf_find_prog_btf_id().
However, a recent change in the function made use of the variable in
such a way that it is set to 0 if retrieving linear information on the
program is successful, and this 0 value remains if we error out on
failures at later stages.

Let's fix this by setting err to -EINVAL later in the function.

Fixes: e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level APIs")
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210729162028.29512-2-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/libbpf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index aa5ad6fc5f40..2234d5c33177 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -9515,7 +9515,7 @@ static int libbpf_find_prog_btf_id(const char *name, __u32 attach_prog_fd)
 	struct bpf_prog_info_linear *info_linear;
 	struct bpf_prog_info *info;
 	struct btf *btf = NULL;
-	int err = -EINVAL;
+	int err;
 
 	info_linear = bpf_program__get_prog_info_linear(attach_prog_fd, 0);
 	err = libbpf_get_error(info_linear);
@@ -9524,6 +9524,8 @@ static int libbpf_find_prog_btf_id(const char *name, __u32 attach_prog_fd)
 			attach_prog_fd);
 		return err;
 	}
+
+	err = -EINVAL;
 	info = &info_linear->info;
 	if (!info->btf_id) {
 		pr_warn("The target program doesn't have BTF\n");
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 144/334] tools: Free BTF objects at various locations
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 143/334] libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 145/334] arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Monnet, Andrii Nakryiko, Sasha Levin

From: Quentin Monnet <quentin@isovalent.com>

[ Upstream commit 369e955b3d1c12f6ec2e51a95911bb80ada55d79 ]

Make sure to call btf__free() (and not simply free(), which does not
free all pointers stored in the struct) on pointers to struct btf
objects retrieved at various locations.

These were found while updating the calls to btf__get_from_id().

Fixes: 999d82cbc044 ("tools/bpf: enhance test_btf file testing to test func info")
Fixes: 254471e57a86 ("tools/bpf: bpftool: add support for func types")
Fixes: 7b612e291a5a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Fixes: d56354dc4909 ("perf tools: Save bpf_prog_info and BTF of new BPF programs")
Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
Fixes: fa853c4b839e ("perf stat: Enable counting events for BPF programs")
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210729162028.29512-5-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/prog.c                     | 5 ++++-
 tools/perf/util/bpf-event.c                  | 4 ++--
 tools/perf/util/bpf_counter.c                | 3 ++-
 tools/testing/selftests/bpf/prog_tests/btf.c | 1 +
 4 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
index cc48726740ad..9d709b427665 100644
--- a/tools/bpf/bpftool/prog.c
+++ b/tools/bpf/bpftool/prog.c
@@ -781,6 +781,8 @@ prog_dump(struct bpf_prog_info *info, enum dump_mode mode,
 		kernel_syms_destroy(&dd);
 	}
 
+	btf__free(btf);
+
 	return 0;
 }
 
@@ -2002,8 +2004,8 @@ static char *profile_target_name(int tgt_fd)
 	struct bpf_prog_info_linear *info_linear;
 	struct bpf_func_info *func_info;
 	const struct btf_type *t;
+	struct btf *btf = NULL;
 	char *name = NULL;
-	struct btf *btf;
 
 	info_linear = bpf_program__get_prog_info_linear(
 		tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO);
@@ -2027,6 +2029,7 @@ static char *profile_target_name(int tgt_fd)
 	}
 	name = strdup(btf__name_by_offset(btf, t->name_off));
 out:
+	btf__free(btf);
 	free(info_linear);
 	return name;
 }
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index cdecda1ddd36..17a9844e4fbf 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -296,7 +296,7 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
 
 out:
 	free(info_linear);
-	free(btf);
+	btf__free(btf);
 	return err ? -1 : 0;
 }
 
@@ -486,7 +486,7 @@ static void perf_env__add_bpf_info(struct perf_env *env, u32 id)
 	perf_env__fetch_btf(env, btf_id, btf);
 
 out:
-	free(btf);
+	btf__free(btf);
 	close(fd);
 }
 
diff --git a/tools/perf/util/bpf_counter.c b/tools/perf/util/bpf_counter.c
index 8150e03367bb..beca55129b0b 100644
--- a/tools/perf/util/bpf_counter.c
+++ b/tools/perf/util/bpf_counter.c
@@ -64,8 +64,8 @@ static char *bpf_target_prog_name(int tgt_fd)
 	struct bpf_prog_info_linear *info_linear;
 	struct bpf_func_info *func_info;
 	const struct btf_type *t;
+	struct btf *btf = NULL;
 	char *name = NULL;
-	struct btf *btf;
 
 	info_linear = bpf_program__get_prog_info_linear(
 		tgt_fd, 1UL << BPF_PROG_INFO_FUNC_INFO);
@@ -89,6 +89,7 @@ static char *bpf_target_prog_name(int tgt_fd)
 	}
 	name = strdup(btf__name_by_offset(btf, t->name_off));
 out:
+	btf__free(btf);
 	free(info_linear);
 	return name;
 }
diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
index 857e3f26086f..68e415f4d33c 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -4386,6 +4386,7 @@ skip:
 	fprintf(stderr, "OK");
 
 done:
+	btf__free(btf);
 	free(func_info);
 	bpf_object__close(obj);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 145/334] arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 144/334] tools: Free BTF objects at various locations Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 146/334] devlink: Break parameter notification sequence to be before/after unload/load driver Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Biju Das, Geert Uytterhoeven, Sasha Levin

From: Biju Das <biju.das.jz@bp.renesas.com>

[ Upstream commit c96ca5604a889a142d6b60889cc6da48498806e9 ]

Hihope boards use Realtek PHY. From the very beginning it use only
tx delays. However the phy driver commit bbc4d71d63549bcd003
("net: phy: realtek: fix rtl8211e rx/tx delay config") introduced
NFS mount failure. Now it needs rx delay inaddition to tx delay
for NFS mount to work. This patch fixes NFS mount failure issue
by adding MAC internal rx delay.

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Fixes: bbc4d71d63549bcd ("net: phy: realtek: fix rtl8211e rx/tx delay config")
Link: https://lore.kernel.org/r/20210721180632.15080-1-biju.das.jz@bp.renesas.com
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
index 202c4fc88bd5..dde3a07bc417 100644
--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
+++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi
@@ -20,6 +20,7 @@
 	pinctrl-names = "default";
 	phy-handle = <&phy0>;
 	tx-internal-delay-ps = <2000>;
+	rx-internal-delay-ps = <1800>;
 	status = "okay";
 
 	phy0: ethernet-phy@0 {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 146/334] devlink: Break parameter notification sequence to be before/after unload/load driver
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 145/334] arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Parav Pandit, Leon Romanovsky,
	Jakub Kicinski, Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 05a7f4a8dff19999ca8a83a35ff4782689de7bfc ]

The change of namespaces during devlink reload calls to driver unload
before it accesses devlink parameters. The commands below causes to
use-after-free bug when trying to get flow steering mode.

 * ip netns add n1
 * devlink dev reload pci/0000:00:09.0 netns n1

 ==================================================================
 BUG: KASAN: use-after-free in mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
 Read of size 4 at addr ffff888009d04308 by task devlink/275

 CPU: 6 PID: 275 Comm: devlink Not tainted 5.12.0-rc2+ #2853
 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
 Call Trace:
  dump_stack+0x93/0xc2
  print_address_description.constprop.0+0x18/0x140
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  kasan_report.cold+0x7c/0xd8
  ? mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  mlx5_devlink_fs_mode_get+0x96/0xa0 [mlx5_core]
  devlink_nl_param_fill+0x1c8/0xe80
  ? __free_pages_ok+0x37a/0x8a0
  ? devlink_flash_update_timeout_notify+0xd0/0xd0
  ? lock_acquire+0x1a9/0x6d0
  ? fs_reclaim_acquire+0xb7/0x160
  ? lock_is_held_type+0x98/0x110
  ? 0xffffffff81000000
  ? lock_release+0x1f9/0x6c0
  ? fs_reclaim_release+0xa1/0xf0
  ? lock_downgrade+0x6d0/0x6d0
  ? lock_is_held_type+0x98/0x110
  ? lock_is_held_type+0x98/0x110
  ? memset+0x20/0x40
  ? __build_skb_around+0x1f8/0x2b0
  devlink_param_notify+0x6d/0x180
  devlink_reload+0x1c3/0x520
  ? devlink_remote_reload_actions_performed+0x30/0x30
  ? mutex_trylock+0x24b/0x2d0
  ? devlink_nl_cmd_reload+0x62b/0x1070
  devlink_nl_cmd_reload+0x66d/0x1070
  ? devlink_reload+0x520/0x520
  ? devlink_get_from_attrs+0x1bc/0x260
  ? devlink_nl_pre_doit+0x64/0x4d0
  genl_family_rcv_msg_doit+0x1e9/0x2f0
  ? mutex_lock_io_nested+0x1130/0x1130
  ? genl_family_rcv_msg_attrs_parse.constprop.0+0x240/0x240
  ? security_capable+0x51/0x90
  genl_rcv_msg+0x27f/0x4a0
  ? genl_get_cmd+0x3c0/0x3c0
  ? lock_acquire+0x1a9/0x6d0
  ? devlink_reload+0x520/0x520
  ? lock_release+0x6c0/0x6c0
  netlink_rcv_skb+0x11d/0x340
  ? genl_get_cmd+0x3c0/0x3c0
  ? netlink_ack+0x9f0/0x9f0
  ? lock_release+0x1f9/0x6c0
  genl_rcv+0x24/0x40
  netlink_unicast+0x433/0x700
  ? netlink_attachskb+0x730/0x730
  ? _copy_from_iter_full+0x178/0x650
  ? __alloc_skb+0x113/0x2b0
  netlink_sendmsg+0x6f1/0xbd0
  ? netlink_unicast+0x700/0x700
  ? lock_is_held_type+0x98/0x110
  ? netlink_unicast+0x700/0x700
  sock_sendmsg+0xb0/0xe0
  __sys_sendto+0x193/0x240
  ? __x64_sys_getpeername+0xb0/0xb0
  ? do_sys_openat2+0x10b/0x370
  ? __up_read+0x1a1/0x7b0
  ? do_user_addr_fault+0x219/0xdc0
  ? __x64_sys_openat+0x120/0x1d0
  ? __x64_sys_open+0x1a0/0x1a0
  __x64_sys_sendto+0xdd/0x1b0
  ? syscall_enter_from_user_mode+0x1d/0x50
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
 RIP: 0033:0x7fc69d0af14a
 Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 c3 0f 1f 44 00 00 55 48 83 ec 30 44 89 4c
 RSP: 002b:00007ffc1d8292f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fc69d0af14a
 RDX: 0000000000000038 RSI: 0000555f57c56440 RDI: 0000000000000003
 RBP: 0000555f57c56410 R08: 00007fc69d17b200 R09: 000000000000000c
 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

 Allocated by task 146:
  kasan_save_stack+0x1b/0x40
  __kasan_kmalloc+0x99/0xc0
  mlx5_init_fs+0xf0/0x1c50 [mlx5_core]
  mlx5_load+0xd2/0x180 [mlx5_core]
  mlx5_init_one+0x2f6/0x450 [mlx5_core]
  probe_one+0x47d/0x6e0 [mlx5_core]
  pci_device_probe+0x2a0/0x4a0
  really_probe+0x20a/0xc90
  driver_probe_device+0xd8/0x380
  device_driver_attach+0x1df/0x250
  __driver_attach+0xff/0x240
  bus_for_each_dev+0x11e/0x1a0
  bus_add_driver+0x309/0x570
  driver_register+0x1ee/0x380
  0xffffffffa06b8062
  do_one_initcall+0xd5/0x410
  do_init_module+0x1c8/0x760
  load_module+0x6d8b/0x9650
  __do_sys_finit_module+0x118/0x1b0
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 Freed by task 275:
  kasan_save_stack+0x1b/0x40
  kasan_set_track+0x1c/0x30
  kasan_set_free_info+0x20/0x30
  __kasan_slab_free+0x102/0x140
  slab_free_freelist_hook+0x74/0x1b0
  kfree+0xd7/0x2a0
  mlx5_unload+0x16/0xb0 [mlx5_core]
  mlx5_unload_one+0xae/0x120 [mlx5_core]
  mlx5_devlink_reload_down+0x1bc/0x380 [mlx5_core]
  devlink_reload+0x141/0x520
  devlink_nl_cmd_reload+0x66d/0x1070
  genl_family_rcv_msg_doit+0x1e9/0x2f0
  genl_rcv_msg+0x27f/0x4a0
  netlink_rcv_skb+0x11d/0x340
  genl_rcv+0x24/0x40
  netlink_unicast+0x433/0x700
  netlink_sendmsg+0x6f1/0xbd0
  sock_sendmsg+0xb0/0xe0
  __sys_sendto+0x193/0x240
  __x64_sys_sendto+0xdd/0x1b0
  do_syscall_64+0x2d/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae

 The buggy address belongs to the object at ffff888009d04300
  which belongs to the cache kmalloc-128 of size 128
 The buggy address is located 8 bytes inside of
  128-byte region [ffff888009d04300, ffff888009d04380)
 The buggy address belongs to the page:
 page:0000000086a64ecc refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888009d04000 pfn:0x9d04
 head:0000000086a64ecc order:1 compound_mapcount:0
 flags: 0x4000000000010200(slab|head)
 raw: 4000000000010200 ffffea0000203980 0000000200000002 ffff8880050428c0
 raw: ffff888009d04000 000000008020001d 00000001ffffffff 0000000000000000
 page dumped because: kasan: bad access detected

 Memory state around the buggy address:
  ffff888009d04200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff888009d04280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 >ffff888009d04300: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                       ^
  ffff888009d04380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff888009d04400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ==================================================================

The right solution to devlink reload is to notify about deletion of
parameters, unload driver, change net namespaces, load driver and notify
about addition of parameters.

Fixes: 070c63f20f6c ("net: devlink: allow to change namespaces during reload")
Reviewed-by: Parav Pandit <parav@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/devlink.c | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 85032626de24..3963b1bc1e59 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -3801,10 +3801,12 @@ static void devlink_param_notify(struct devlink *devlink,
 				 struct devlink_param_item *param_item,
 				 enum devlink_command cmd);
 
-static void devlink_reload_netns_change(struct devlink *devlink,
-					struct net *dest_net)
+static void devlink_ns_change_notify(struct devlink *devlink,
+				     struct net *dest_net, struct net *curr_net,
+				     bool new)
 {
 	struct devlink_param_item *param_item;
+	enum devlink_command cmd;
 
 	/* Userspace needs to be notified about devlink objects
 	 * removed from original and entering new network namespace.
@@ -3812,17 +3814,18 @@ static void devlink_reload_netns_change(struct devlink *devlink,
 	 * reload process so the notifications are generated separatelly.
 	 */
 
-	list_for_each_entry(param_item, &devlink->param_list, list)
-		devlink_param_notify(devlink, 0, param_item,
-				     DEVLINK_CMD_PARAM_DEL);
-	devlink_notify(devlink, DEVLINK_CMD_DEL);
+	if (!dest_net || net_eq(dest_net, curr_net))
+		return;
 
-	__devlink_net_set(devlink, dest_net);
+	if (new)
+		devlink_notify(devlink, DEVLINK_CMD_NEW);
 
-	devlink_notify(devlink, DEVLINK_CMD_NEW);
+	cmd = new ? DEVLINK_CMD_PARAM_NEW : DEVLINK_CMD_PARAM_DEL;
 	list_for_each_entry(param_item, &devlink->param_list, list)
-		devlink_param_notify(devlink, 0, param_item,
-				     DEVLINK_CMD_PARAM_NEW);
+		devlink_param_notify(devlink, 0, param_item, cmd);
+
+	if (!new)
+		devlink_notify(devlink, DEVLINK_CMD_DEL);
 }
 
 static bool devlink_reload_supported(const struct devlink_ops *ops)
@@ -3902,6 +3905,7 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net,
 			  u32 *actions_performed, struct netlink_ext_ack *extack)
 {
 	u32 remote_reload_stats[DEVLINK_RELOAD_STATS_ARRAY_SIZE];
+	struct net *curr_net;
 	int err;
 
 	if (!devlink->reload_enabled)
@@ -3909,18 +3913,22 @@ static int devlink_reload(struct devlink *devlink, struct net *dest_net,
 
 	memcpy(remote_reload_stats, devlink->stats.remote_reload_stats,
 	       sizeof(remote_reload_stats));
+
+	curr_net = devlink_net(devlink);
+	devlink_ns_change_notify(devlink, dest_net, curr_net, false);
 	err = devlink->ops->reload_down(devlink, !!dest_net, action, limit, extack);
 	if (err)
 		return err;
 
-	if (dest_net && !net_eq(dest_net, devlink_net(devlink)))
-		devlink_reload_netns_change(devlink, dest_net);
+	if (dest_net && !net_eq(dest_net, curr_net))
+		__devlink_net_set(devlink, dest_net);
 
 	err = devlink->ops->reload_up(devlink, action, limit, actions_performed, extack);
 	devlink_reload_failed_set(devlink, !!err);
 	if (err)
 		return err;
 
+	devlink_ns_change_notify(devlink, dest_net, curr_net, true);
 	WARN_ON(!(*actions_performed & BIT(action)));
 	/* Catch driver on updating the remote action within devlink reload */
 	WARN_ON(memcmp(remote_reload_stats, devlink->stats.remote_reload_stats,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 146/334] devlink: Break parameter notification sequence to be before/after unload/load driver Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:57   ` Doug Anderson
  2021-09-13 13:13 ` [PATCH 5.14 148/334] drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe() Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  339 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrzej Hajda, Douglas Anderson,
	Bjorn Andersson, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]

This is really just a revert of commit 58074b08c04a ("drm/bridge:
ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.

The old code failed to read the EDID properly in a very important
case: before the bridge's pre_enable() was called. The way things need
to work:
1. Read the EDID.
2. Based on the EDID, decide on video settings and pixel clock.
3. Enable the bridge w/ the desired settings.

The way things were working:
1. Try to read the EDID but fail; fall back to hardcoded values.
2. Based on hardcoded values, decide on video settings and pixel clock.
3. Enable the bridge w/ the desired settings.
4. Try again to read the EDID, it works now!
5. Realize that the hardcoded settings weren't quite right.
6. Disable / reenable the bridge w/ the right settings.

The reasons for the failures were twofold:
a) Since we never ran the bridge chip's pre-enable then we never set
   the bit to ignore HPD. This meant the bridge chip didn't even _try_
   to go out on the bus and communicate with the panel.
b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
   if the panel wasn't on.

Instead of reverting the code, we could fix it to set the HPD bit and
also power on the panel. However, it also works nicely to just let the
panel code read the EDID. Now that we've split the driver up we can
expose the DDC AUX channel bus to the panel node. The panel can take
charge of reading the EDID.

NOTE: in order for things to work, anyone that needs to read the EDID
will need to instantiate their panel using the new DP AUX bus (AKA by
listing their panel under the "aux-bus" node of the bridge chip in the
device tree).

In the future if we want to use the bridge chip to provide a full
external DP port (which won't have a panel) then we will have to
conditinally add EDID reading back in.

Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 45a2969afb2b..aef850296756 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -124,7 +124,6 @@
  * @connector:    Our connector.
  * @host_node:    Remote DSI node.
  * @dsi:          Our MIPI DSI source.
- * @edid:         Detected EDID of eDP panel.
  * @refclk:       Our reference clock.
  * @panel:        Our panel.
  * @enable_gpio:  The GPIO we toggle to enable the bridge.
@@ -154,7 +153,6 @@ struct ti_sn65dsi86 {
 	struct drm_dp_aux		aux;
 	struct drm_bridge		bridge;
 	struct drm_connector		connector;
-	struct edid			*edid;
 	struct device_node		*host_node;
 	struct mipi_dsi_device		*dsi;
 	struct clk			*refclk;
@@ -403,24 +401,6 @@ connector_to_ti_sn65dsi86(struct drm_connector *connector)
 static int ti_sn_bridge_connector_get_modes(struct drm_connector *connector)
 {
 	struct ti_sn65dsi86 *pdata = connector_to_ti_sn65dsi86(connector);
-	struct edid *edid = pdata->edid;
-	int num, ret;
-
-	if (!edid) {
-		pm_runtime_get_sync(pdata->dev);
-		edid = pdata->edid = drm_get_edid(connector, &pdata->aux.ddc);
-		pm_runtime_put_autosuspend(pdata->dev);
-	}
-
-	if (edid && drm_edid_is_valid(edid)) {
-		ret = drm_connector_update_edid_property(connector, edid);
-		if (!ret) {
-			num = drm_add_edid_modes(connector, edid);
-			if (num)
-				return num;
-		}
-	}
-
 	return drm_panel_get_modes(pdata->panel, connector);
 }
 
@@ -1358,8 +1338,6 @@ static void ti_sn_bridge_remove(struct auxiliary_device *adev)
 		mipi_dsi_device_unregister(pdata->dsi);
 	}
 
-	kfree(pdata->edid);
-
 	drm_bridge_remove(&pdata->bridge);
 
 	of_node_put(pdata->host_node);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 148/334] drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 149/334] drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Linus Walleij, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 4c1b3d94bf632c1420a5d4108199f55a5655831d ]

As I was testing to make sure that the DEFER path worked well with my
patch series, I got tired of seeing this scary message in my logs just
because the panel needed to defer:
  [drm:ti_sn_bridge_probe] *ERROR* could not find any panel node

Let's use dev_err_probe() which nicely quiets this error and also
simplifies the code a tiny bit. We'll also update other places in the
file which can use dev_err_probe().

Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.10.I24bba069e63b1eea84443eef0c8535fd032a6311@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 31 +++++++++++----------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index aef850296756..4d1483cf7b58 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -1302,10 +1302,9 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev,
 	int ret;
 
 	ret = drm_of_find_panel_or_bridge(np, 1, 0, &pdata->panel, NULL);
-	if (ret) {
-		DRM_ERROR("could not find any panel node\n");
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(&adev->dev, ret,
+				     "could not find any panel node\n");
 
 	ti_sn_bridge_parse_lanes(pdata, np);
 
@@ -1432,27 +1431,23 @@ static int ti_sn65dsi86_probe(struct i2c_client *client,
 
 	pdata->regmap = devm_regmap_init_i2c(client,
 					     &ti_sn65dsi86_regmap_config);
-	if (IS_ERR(pdata->regmap)) {
-		DRM_ERROR("regmap i2c init failed\n");
-		return PTR_ERR(pdata->regmap);
-	}
+	if (IS_ERR(pdata->regmap))
+		return dev_err_probe(dev, PTR_ERR(pdata->regmap),
+				     "regmap i2c init failed\n");
 
 	pdata->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
-	if (IS_ERR(pdata->enable_gpio)) {
-		DRM_ERROR("failed to get enable gpio from DT\n");
-		ret = PTR_ERR(pdata->enable_gpio);
-		return ret;
-	}
+	if (IS_ERR(pdata->enable_gpio))
+		return dev_err_probe(dev, PTR_ERR(pdata->enable_gpio),
+				     "failed to get enable gpio from DT\n");
 
 	ret = ti_sn65dsi86_parse_regulators(pdata);
-	if (ret) {
-		DRM_ERROR("failed to parse regulators\n");
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to parse regulators\n");
 
 	pdata->refclk = devm_clk_get_optional(dev, "refclk");
 	if (IS_ERR(pdata->refclk))
-		return PTR_ERR(pdata->refclk);
+		return dev_err_probe(dev, PTR_ERR(pdata->refclk),
+				     "failed to get reference clock\n");
 
 	pm_runtime_enable(dev);
 	ret = devm_add_action_or_reset(dev, ti_sn65dsi86_runtime_disable, dev);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 149/334] drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 148/334] drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 150/334] drm/bridge: ti-sn65dsi86: Fix power off sequence Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Jagan Teki,
	Robert Foss, Sasha Levin

From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>

[ Upstream commit 4e5763f03e105fedfcd7a83bec1dccae96e334dd ]

To simplify interfacing with the panel, wrap it in a panel-bridge and
let the DRM bridge helpers handle chaining of operations.

This also prepares for support of DRM_BRIDGE_ATTACH_NO_CONNECTOR, which
requires all components in the display pipeline to be represented by
bridges.

Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210624000304.16281-5-laurent.pinchart+renesas@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 32 +++++++++++++++++----------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 4d1483cf7b58..970a4859eea3 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -125,7 +125,7 @@
  * @host_node:    Remote DSI node.
  * @dsi:          Our MIPI DSI source.
  * @refclk:       Our reference clock.
- * @panel:        Our panel.
+ * @next_bridge:  The bridge on the eDP side.
  * @enable_gpio:  The GPIO we toggle to enable the bridge.
  * @supplies:     Data for bulk enabling/disabling our regulators.
  * @dp_lanes:     Count of dp_lanes we're using.
@@ -156,7 +156,7 @@ struct ti_sn65dsi86 {
 	struct device_node		*host_node;
 	struct mipi_dsi_device		*dsi;
 	struct clk			*refclk;
-	struct drm_panel		*panel;
+	struct drm_bridge		*next_bridge;
 	struct gpio_desc		*enable_gpio;
 	struct regulator_bulk_data	supplies[SN_REGULATOR_SUPPLY_NUM];
 	int				dp_lanes;
@@ -401,7 +401,8 @@ connector_to_ti_sn65dsi86(struct drm_connector *connector)
 static int ti_sn_bridge_connector_get_modes(struct drm_connector *connector)
 {
 	struct ti_sn65dsi86 *pdata = connector_to_ti_sn65dsi86(connector);
-	return drm_panel_get_modes(pdata->panel, connector);
+
+	return drm_bridge_get_modes(pdata->next_bridge, connector);
 }
 
 static enum drm_mode_status
@@ -527,8 +528,16 @@ static int ti_sn_bridge_attach(struct drm_bridge *bridge,
 	}
 	pdata->dsi = dsi;
 
+	/* Attach the next bridge */
+	ret = drm_bridge_attach(bridge->encoder, pdata->next_bridge,
+				&pdata->bridge, flags);
+	if (ret < 0)
+		goto err_dsi_detach;
+
 	return 0;
 
+err_dsi_detach:
+	mipi_dsi_detach(dsi);
 err_dsi_attach:
 	mipi_dsi_device_unregister(dsi);
 err_dsi_host:
@@ -547,8 +556,6 @@ static void ti_sn_bridge_disable(struct drm_bridge *bridge)
 {
 	struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge);
 
-	drm_panel_disable(pdata->panel);
-
 	/* disable video stream */
 	regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE, 0);
 	/* semi auto link training mode OFF */
@@ -873,8 +880,6 @@ static void ti_sn_bridge_enable(struct drm_bridge *bridge)
 	/* enable video stream */
 	regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE,
 			   VSTREAM_ENABLE);
-
-	drm_panel_enable(pdata->panel);
 }
 
 static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge)
@@ -885,16 +890,12 @@ static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge)
 
 	if (!pdata->refclk)
 		ti_sn65dsi86_enable_comms(pdata);
-
-	drm_panel_prepare(pdata->panel);
 }
 
 static void ti_sn_bridge_post_disable(struct drm_bridge *bridge)
 {
 	struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge);
 
-	drm_panel_unprepare(pdata->panel);
-
 	if (!pdata->refclk)
 		ti_sn65dsi86_disable_comms(pdata);
 
@@ -1299,13 +1300,20 @@ static int ti_sn_bridge_probe(struct auxiliary_device *adev,
 {
 	struct ti_sn65dsi86 *pdata = dev_get_drvdata(adev->dev.parent);
 	struct device_node *np = pdata->dev->of_node;
+	struct drm_panel *panel;
 	int ret;
 
-	ret = drm_of_find_panel_or_bridge(np, 1, 0, &pdata->panel, NULL);
+	ret = drm_of_find_panel_or_bridge(np, 1, 0, &panel, NULL);
 	if (ret)
 		return dev_err_probe(&adev->dev, ret,
 				     "could not find any panel node\n");
 
+	pdata->next_bridge = devm_drm_panel_bridge_add(pdata->dev, panel);
+	if (IS_ERR(pdata->next_bridge)) {
+		DRM_ERROR("failed to create panel bridge\n");
+		return PTR_ERR(pdata->next_bridge);
+	}
+
 	ti_sn_bridge_parse_lanes(pdata, np);
 
 	ret = ti_sn_bridge_parse_dsi_host(pdata);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 150/334] drm/bridge: ti-sn65dsi86: Fix power off sequence
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 149/334] drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 151/334] drm/bridge: ti-sn65dsi86: Add some 100 us delays Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Robert Foss,
	Sean Paul, Sam Ravnborg, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit acb06210b096830e28e9ffd2c6501fe99bdb10fd ]

When testing with a panel that's apparently a little more persnickety
about the correct power sequence (specifically Samsung ATNA33XC20), we
found that the ti-sn65dsi86 was doing things just slightly wrong.

Looking closely at the ti-sn65dsi86's datasheet, the power off
sequence is supposed to be:
1. Clear VSTREAM_ENABLE bit
2. Stop DSI stream from GPU. DSI lanes must be placed in LP11 state.
3. Program the ML_TX_MODE to 0x0 (OFF)
4. Program the DP_NUM_LANES register to 0x0
5. Clear the DP_PLL_EN bit.
6. Deassert the EN pin.
7. Remove power from supply pins

Since we were doing the whole sequence in the "disable", I believe
that step #2 (stopping the DSI stream from the GPU) wasn't
happening. We also weren't setting DP_NUM_LANES to 0.

Let's fix this.

NOTE: things are a little asymmetric now. For instance, we turn the
PLL on in "enable" but now we're not turning it off until
"post_disable". It would seem to make sense to move the PLL turning on
to "pre_enable" to match. Unfortunately, I don't believe that's
allowed. It looks as if (in the non-refclk mode which probably nobody
is using) we have to wait until the MIPI clock is there before we can
enable the PLL. In any case, the way it is here won't really
hurt--it'll just leave the PLL on a little longer.

Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Robert Foss <robert.foss@linaro.org>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210730084534.v2.2.If8a8ec3bf1855cf0dbb62c005a71d6698c99c125@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index 970a4859eea3..ecd4fa3a9a1d 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -558,10 +558,6 @@ static void ti_sn_bridge_disable(struct drm_bridge *bridge)
 
 	/* disable video stream */
 	regmap_update_bits(pdata->regmap, SN_ENH_FRAME_REG, VSTREAM_ENABLE, 0);
-	/* semi auto link training mode OFF */
-	regmap_write(pdata->regmap, SN_ML_TX_MODE_REG, 0);
-	/* disable DP PLL */
-	regmap_write(pdata->regmap, SN_PLL_ENABLE_REG, 0);
 }
 
 static void ti_sn_bridge_set_dsi_rate(struct ti_sn65dsi86 *pdata)
@@ -896,6 +892,13 @@ static void ti_sn_bridge_post_disable(struct drm_bridge *bridge)
 {
 	struct ti_sn65dsi86 *pdata = bridge_to_ti_sn65dsi86(bridge);
 
+	/* semi auto link training mode OFF */
+	regmap_write(pdata->regmap, SN_ML_TX_MODE_REG, 0);
+	/* Num lanes to 0 as per power sequencing in data sheet */
+	regmap_update_bits(pdata->regmap, SN_SSC_CONFIG_REG, DP_NUM_LANES_MASK, 0);
+	/* disable DP PLL */
+	regmap_write(pdata->regmap, SN_PLL_ENABLE_REG, 0);
+
 	if (!pdata->refclk)
 		ti_sn65dsi86_disable_comms(pdata);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 151/334] drm/bridge: ti-sn65dsi86: Add some 100 us delays
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 150/334] drm/bridge: ti-sn65dsi86: Fix power off sequence Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 152/334] net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Robert Foss,
	Sean Paul, Sam Ravnborg, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit e183bf31cf0d3a05162e633e428350ed176ce926 ]

The manual has always said that we need 100 us delays in a few
places. Though it hasn't seemed to be a big deal to skip these, let's
add them in case it makes something happier.

NOTE: this fixes no known issues but it seems good to make it right.

Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Acked-by: Robert Foss <robert.foss@linaro.org>
Reviewed-by: Sean Paul <seanpaul@chromium.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210730084534.v2.3.I842d483139531aa4651da8338512fdf0171ff23c@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index ecd4fa3a9a1d..c9cddf317c72 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -304,6 +304,9 @@ static int __maybe_unused ti_sn65dsi86_resume(struct device *dev)
 		return ret;
 	}
 
+	/* td2: min 100 us after regulators before enabling the GPIO */
+	usleep_range(100, 110);
+
 	gpiod_set_value(pdata->enable_gpio, 1);
 
 	/*
@@ -886,6 +889,9 @@ static void ti_sn_bridge_pre_enable(struct drm_bridge *bridge)
 
 	if (!pdata->refclk)
 		ti_sn65dsi86_enable_comms(pdata);
+
+	/* td7: min 100 us after enable before DSI data */
+	usleep_range(100, 110);
 }
 
 static void ti_sn_bridge_post_disable(struct drm_bridge *bridge)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 152/334] net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 151/334] drm/bridge: ti-sn65dsi86: Add some 100 us delays Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 153/334] i2c: highlander: add IRQ check Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abaci Robot, Jiapeng Chong,
	Leon Romanovsky, Saeed Mahameed, Sasha Levin

From: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>

[ Upstream commit bcd68c04c7692416206414dc8971730aa140eba7 ]

The return value is missing in this code scenario, add the return value
'0' to the return value 'err'.

Eliminate the follow smatch warning:

drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c:3083
mlx5_devlink_eswitch_inline_mode_set() warn: missing error code 'err'.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Fixes: 8e0aa4bc959c ("net/mlx5: E-switch, Protect eswitch mode changes")
Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 3bb71a186004..fc945945ae33 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -3091,8 +3091,11 @@ int mlx5_devlink_eswitch_inline_mode_set(struct devlink *devlink, u8 mode,
 
 	switch (MLX5_CAP_ETH(dev, wqe_inline_mode)) {
 	case MLX5_CAP_INLINE_MODE_NOT_REQUIRED:
-		if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE)
+		if (mode == DEVLINK_ESWITCH_INLINE_MODE_NONE) {
+			err = 0;
 			goto out;
+		}
+
 		fallthrough;
 	case MLX5_CAP_INLINE_MODE_L2:
 		NL_SET_ERR_MSG_MOD(extack, "Inline mode can't be set");
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 153/334] i2c: highlander: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 152/334] net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 154/334] leds: lgm-sso: Put fwnode in any case during ->probe() Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit f16a3bb69aa6baabf8f0aca982c8cf21e2a4f6bc ]

The driver is written as if platform_get_irq() returns 0 on errors (while
actually it returns a negative error code), blithely passing these error
codes to request_irq() (which takes *unsigned* IRQ #) -- which fails with
-EINVAL. Add the necessary error check to the pre-existing *if* statement
forcing the driver into the polling mode...

Fixes: 4ad48e6ab18c ("i2c: Renesas Highlander FPGA SMBus support")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-highlander.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-highlander.c b/drivers/i2c/busses/i2c-highlander.c
index 803dad70e2a7..a2add128d084 100644
--- a/drivers/i2c/busses/i2c-highlander.c
+++ b/drivers/i2c/busses/i2c-highlander.c
@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, dev);
 
 	dev->irq = platform_get_irq(pdev, 0);
-	if (iic_force_poll)
+	if (dev->irq < 0 || iic_force_poll)
 		dev->irq = 0;
 
 	if (dev->irq) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 154/334] leds: lgm-sso: Put fwnode in any case during ->probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 153/334] i2c: highlander: add IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 155/334] leds: lgm-sso: Dont spam logs when probe is deferred Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amireddy Mallikarjuna reddy,
	Andy Shevchenko, Pavel Machek, Sasha Levin

From: Andy Shevchenko <andy.shevchenko@gmail.com>

[ Upstream commit 9999908ca1abee7aa518a4f6a3739517c137acbf ]

fwnode_get_next_child_node() bumps a reference counting of a returned variable.
We have to balance it whenever we return to the caller.

All the same in fwnode_for_each_child_node() case.

Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
Cc: Amireddy Mallikarjuna reddy <mallikarjunax.reddy@linux.intel.com>
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/blink/leds-lgm-sso.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
index 7eb2f44f16be..62ce83cea553 100644
--- a/drivers/leds/blink/leds-lgm-sso.c
+++ b/drivers/leds/blink/leds-lgm-sso.c
@@ -631,8 +631,10 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 
 	fwnode_for_each_child_node(fw_ssoled, fwnode_child) {
 		led = devm_kzalloc(dev, sizeof(*led), GFP_KERNEL);
-		if (!led)
-			return -ENOMEM;
+		if (!led) {
+			ret = -ENOMEM;
+			goto __dt_err;
+		}
 
 		INIT_LIST_HEAD(&led->list);
 		led->priv = priv;
@@ -702,11 +704,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 		if (sso_create_led(priv, led, fwnode_child))
 			goto __dt_err;
 	}
-	fwnode_handle_put(fw_ssoled);
 
 	return 0;
+
 __dt_err:
-	fwnode_handle_put(fw_ssoled);
+	fwnode_handle_put(fwnode_child);
 	/* unregister leds */
 	list_for_each(p, &priv->led_list) {
 		led = list_entry(p, struct sso_led, list);
@@ -731,6 +733,7 @@ static int sso_led_dt_parse(struct sso_led_priv *priv)
 	fw_ssoled = fwnode_get_named_child_node(fwnode, "ssoled");
 	if (fw_ssoled) {
 		ret = __sso_led_dt_parse(priv, fw_ssoled);
+		fwnode_handle_put(fw_ssoled);
 		if (ret)
 			return ret;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 155/334] leds: lgm-sso: Dont spam logs when probe is deferred
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 154/334] leds: lgm-sso: Put fwnode in any case during ->probe() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 156/334] leds: lt3593: Put fwnode in any case during ->probe() Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amireddy Mallikarjuna reddy,
	Andy Shevchenko, Pavel Machek, Sasha Levin

From: Andy Shevchenko <andy.shevchenko@gmail.com>

[ Upstream commit 1ed4d05e0a0b23ba15e0affcff4008dd537ae3ee ]

When requesting GPIO line the probe can be deferred.
In such case don't spam logs with an error message.
This can be achieved by switching to dev_err_probe().

Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
Cc: Amireddy Mallikarjuna reddy <mallikarjunax.reddy@linux.intel.com>
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/blink/leds-lgm-sso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
index 62ce83cea553..ca9f88996819 100644
--- a/drivers/leds/blink/leds-lgm-sso.c
+++ b/drivers/leds/blink/leds-lgm-sso.c
@@ -644,7 +644,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 							      fwnode_child,
 							      GPIOD_ASIS, NULL);
 		if (IS_ERR(led->gpiod)) {
-			dev_err(dev, "led: get gpio fail!\n");
+			dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
 			goto __dt_err;
 		}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 156/334] leds: lt3593: Put fwnode in any case during ->probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 155/334] leds: lgm-sso: Dont spam logs when probe is deferred Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 157/334] leds: rt8515: " Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Mack, Andy Shevchenko,
	Pavel Machek, Sasha Levin

From: Andy Shevchenko <andy.shevchenko@gmail.com>

[ Upstream commit 7e1baaaa2407a642ea19b58e214fab9a69cda1d7 ]

device_get_next_child_node() bumps a reference counting of a returned variable.
We have to balance it whenever we return to the caller.

Fixes: 8cd7d6daba93 ("leds: lt3593: Add device tree probing glue")
Cc: Daniel Mack <daniel@zonque.org>
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/leds-lt3593.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/leds/leds-lt3593.c b/drivers/leds/leds-lt3593.c
index 3bb52d3165d9..d0160fde0f94 100644
--- a/drivers/leds/leds-lt3593.c
+++ b/drivers/leds/leds-lt3593.c
@@ -97,10 +97,9 @@ static int lt3593_led_probe(struct platform_device *pdev)
 	init_data.default_label = ":";
 
 	ret = devm_led_classdev_register_ext(dev, &led_data->cdev, &init_data);
-	if (ret < 0) {
-		fwnode_handle_put(child);
+	fwnode_handle_put(child);
+	if (ret < 0)
 		return ret;
-	}
 
 	platform_set_drvdata(pdev, led_data);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 157/334] leds: rt8515: Put fwnode in any case during ->probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 156/334] leds: lt3593: Put fwnode in any case during ->probe() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 158/334] leds: trigger: audio: Add an activate callback to ensure the initial brightness is set Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Pavel Machek,
	Linus Walleij, Sasha Levin

From: Andy Shevchenko <andy.shevchenko@gmail.com>

[ Upstream commit 8aa41952ef245449df79100e1942b5e6288b098a ]

fwnode_get_next_available_child_node() bumps a reference counting of
a returned variable. We have to balance it whenever we return to
the caller.

Fixes: e1c6edcbea13 ("leds: rt8515: Add Richtek RT8515 LED driver")
Signed-off-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/flash/leds-rt8515.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/leds/flash/leds-rt8515.c b/drivers/leds/flash/leds-rt8515.c
index 590bfa180d10..44904fdee3cc 100644
--- a/drivers/leds/flash/leds-rt8515.c
+++ b/drivers/leds/flash/leds-rt8515.c
@@ -343,8 +343,9 @@ static int rt8515_probe(struct platform_device *pdev)
 
 	ret = devm_led_classdev_flash_register_ext(dev, fled, &init_data);
 	if (ret) {
-		dev_err(dev, "can't register LED %s\n", led->name);
+		fwnode_handle_put(child);
 		mutex_destroy(&rt->lock);
+		dev_err(dev, "can't register LED %s\n", led->name);
 		return ret;
 	}
 
@@ -362,6 +363,7 @@ static int rt8515_probe(struct platform_device *pdev)
 		 */
 	}
 
+	fwnode_handle_put(child);
 	return 0;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 158/334] leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 157/334] leds: rt8515: " Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 159/334] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Marek Behún,
	Hans de Goede, Pavel Machek, Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 64f67b5240db79eceb0bd57dae8e591fd3103ba0 ]

Some 2-in-1s with a detachable (USB) keyboard(dock) have mute-LEDs in
the speaker- and/or mic-mute keys on the keyboard.

Examples of this are the Lenovo Thinkpad10 tablet (with its USB kbd-dock)
and the HP x2 10 series.

The detachable nature of these keyboards means that the keyboard and
thus the mute LEDs may show up after the user (or userspace restoring
old mixer settings) has muted the speaker and/or mic.

Current LED-class devices with a default_trigger of "audio-mute" or
"audio-micmute" initialize the brightness member of led_classdev with
ledtrig_audio_get() before registering the LED.

This makes the software state after attaching the keyboard match the
actual audio mute state, e.g. cat /sys/class/leds/foo/brightness will
show the right value.

But before this commit nothing was actually calling the led_classdev's
brightness_set[_blocking] callback so the value returned by
ledtrig_audio_get() was never actually being sent to the hw, leading
to the mute LEDs staying in their default power-on state, after
attaching the keyboard, even if ledtrig_audio_get() returned a different
state.

This could be fixed by having the individual LED drivers call
brightness_set[_blocking] themselves after registering the LED,
but this really is something which should be done by a led-trigger
activate callback.

Add an activate callback for this, fixing the issue of the
mute LEDs being out of sync after (re)attaching the keyboard.

Cc: Takashi Iwai <tiwai@suse.de>
Fixes: faa2541f5b1a ("leds: trigger: Introduce audio mute LED trigger")
Reviewed-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/trigger/ledtrig-audio.c | 37 ++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/drivers/leds/trigger/ledtrig-audio.c b/drivers/leds/trigger/ledtrig-audio.c
index f76621e88482..c6b437e6369b 100644
--- a/drivers/leds/trigger/ledtrig-audio.c
+++ b/drivers/leds/trigger/ledtrig-audio.c
@@ -6,10 +6,33 @@
 #include <linux/kernel.h>
 #include <linux/leds.h>
 #include <linux/module.h>
+#include "../leds.h"
 
-static struct led_trigger *ledtrig_audio[NUM_AUDIO_LEDS];
 static enum led_brightness audio_state[NUM_AUDIO_LEDS];
 
+static int ledtrig_audio_mute_activate(struct led_classdev *led_cdev)
+{
+	led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MUTE]);
+	return 0;
+}
+
+static int ledtrig_audio_micmute_activate(struct led_classdev *led_cdev)
+{
+	led_set_brightness_nosleep(led_cdev, audio_state[LED_AUDIO_MICMUTE]);
+	return 0;
+}
+
+static struct led_trigger ledtrig_audio[NUM_AUDIO_LEDS] = {
+	[LED_AUDIO_MUTE] = {
+		.name     = "audio-mute",
+		.activate = ledtrig_audio_mute_activate,
+	},
+	[LED_AUDIO_MICMUTE] = {
+		.name     = "audio-micmute",
+		.activate = ledtrig_audio_micmute_activate,
+	},
+};
+
 enum led_brightness ledtrig_audio_get(enum led_audio type)
 {
 	return audio_state[type];
@@ -19,24 +42,22 @@ EXPORT_SYMBOL_GPL(ledtrig_audio_get);
 void ledtrig_audio_set(enum led_audio type, enum led_brightness state)
 {
 	audio_state[type] = state;
-	led_trigger_event(ledtrig_audio[type], state);
+	led_trigger_event(&ledtrig_audio[type], state);
 }
 EXPORT_SYMBOL_GPL(ledtrig_audio_set);
 
 static int __init ledtrig_audio_init(void)
 {
-	led_trigger_register_simple("audio-mute",
-				    &ledtrig_audio[LED_AUDIO_MUTE]);
-	led_trigger_register_simple("audio-micmute",
-				    &ledtrig_audio[LED_AUDIO_MICMUTE]);
+	led_trigger_register(&ledtrig_audio[LED_AUDIO_MUTE]);
+	led_trigger_register(&ledtrig_audio[LED_AUDIO_MICMUTE]);
 	return 0;
 }
 module_init(ledtrig_audio_init);
 
 static void __exit ledtrig_audio_exit(void)
 {
-	led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MUTE]);
-	led_trigger_unregister_simple(ledtrig_audio[LED_AUDIO_MICMUTE]);
+	led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MUTE]);
+	led_trigger_unregister(&ledtrig_audio[LED_AUDIO_MICMUTE]);
 }
 module_exit(ledtrig_audio_exit);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 159/334] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 158/334] leds: trigger: audio: Add an activate callback to ensure the initial brightness is set Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 160/334] media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete() Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dongliang Mu, Sean Young,
	Mauro Carvalho Chehab, Sasha Levin

From: Dongliang Mu <mudongliangabcd@gmail.com>

[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ]

If em28xx_ir_init fails, it would decrease the refcount of dev. However,
in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease
the refcount of dev. This will lead to a refcount bug.

Fix this bug by removing the kref_put in the error handling code
of em28xx_ir_init.

refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3
Workqueue: usb_hub_wq hub_event
RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28
Call Trace:
  kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69
  em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150
  usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458
  __device_release_driver drivers/base/dd.c:1201 [inline]
  device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232
  bus_remove_device+0x108/0x160 drivers/base/bus.c:529
  device_del+0x1fe/0x510 drivers/base/core.c:3540
  usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419
  usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221
  hub_port_connect drivers/usb/core/hub.c:5151 [inline]
  hub_port_connect_change drivers/usb/core/hub.c:5440 [inline]
  port_event drivers/usb/core/hub.c:5586 [inline]
  hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668
  process_one_work+0x2c9/0x610 kernel/workqueue.c:2276
  process_scheduled_works kernel/workqueue.c:2338 [inline]
  worker_thread+0x333/0x5b0 kernel/workqueue.c:2424
  kthread+0x188/0x1d0 kernel/kthread.c:319
  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Reported-by: Dongliang Mu <mudongliangabcd@gmail.com>
Fixes: ac5688637144 ("media: em28xx: Fix possible memory leak of em28xx struct")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/usb/em28xx/em28xx-input.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 59529cbf9cd0..0b6d77c3bec8 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -842,7 +842,6 @@ error:
 	kfree(ir);
 ref_put:
 	em28xx_shutdown_buttons(dev);
-	kref_put(&dev->ref, em28xx_free_device);
 	return err;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 160/334] media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 159/334] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 161/334] media: venus: hfi: fix return value check in sys_get_prop_image_version() Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun,
	Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit 0368e7d2cd84a90d0518753fac33795e13df553f ]

Add the missing unlock before return from function
isp_subdev_notifier_complete() in the init error
handling case.

Fixes: ba689d933361 ("media: omap3isp: Acquire graph mutex for graph traversal")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/omap3isp/isp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
index 53025c8c7531..20f59c59ff8a 100644
--- a/drivers/media/platform/omap3isp/isp.c
+++ b/drivers/media/platform/omap3isp/isp.c
@@ -2037,8 +2037,10 @@ static int isp_subdev_notifier_complete(struct v4l2_async_notifier *async)
 	mutex_lock(&isp->media_dev.graph_mutex);
 
 	ret = media_entity_enum_init(&isp->crashed, &isp->media_dev);
-	if (ret)
+	if (ret) {
+		mutex_unlock(&isp->media_dev.graph_mutex);
 		return ret;
+	}
 
 	list_for_each_entry(sd, &v4l2_dev->subdevs, list) {
 		if (sd->notifier != &isp->notifier)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 161/334] media: venus: hfi: fix return value check in sys_get_prop_image_version()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 160/334] media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 162/334] media: venus: venc: Fix potential null pointer dereference on pointer fmt Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhen Lei,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Zhen Lei <thunder.leizhen@huawei.com>

[ Upstream commit 331e06bbde5856059b7a6bb183f12878ed4decb1 ]

In case of error, the function qcom_smem_get() returns ERR_PTR()
and never returns NULL. The NULL test in the return value check
should be replaced with IS_ERR().

Fixes: d566e78dd6af ("media: venus : hfi: add venus image info into smem")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c
index d9fde66f6fa8..9a2bdb002edc 100644
--- a/drivers/media/platform/qcom/venus/hfi_msgs.c
+++ b/drivers/media/platform/qcom/venus/hfi_msgs.c
@@ -261,7 +261,7 @@ sys_get_prop_image_version(struct device *dev,
 
 	smem_tbl_ptr = qcom_smem_get(QCOM_SMEM_HOST_ANY,
 		SMEM_IMG_VER_TBL, &smem_blk_sz);
-	if (smem_tbl_ptr && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ)
+	if (!IS_ERR(smem_tbl_ptr) && smem_blk_sz >= SMEM_IMG_OFFSET_VENUS + VER_STR_SZ)
 		memcpy(smem_tbl_ptr + SMEM_IMG_OFFSET_VENUS,
 		       img_ver, VER_STR_SZ);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 162/334] media: venus: venc: Fix potential null pointer dereference on pointer fmt
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 161/334] media: venus: hfi: fix return value check in sys_get_prop_image_version() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 163/334] media: venus: helper: do not set constrained parameters for UBWC Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Stanimir Varbanov,
	Mauro Carvalho Chehab, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 09ea9719a423fc675d40dd05407165e161ea0c48 ]

Currently the call to find_format can potentially return a NULL to
fmt and the nullpointer is later dereferenced on the assignment of
pixmp->num_planes = fmt->num_planes.  Fix this by adding a NULL pointer
check and returning NULL for the failure case.

Addresses-Coverity: ("Dereference null return")

Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/venc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/venc.c b/drivers/media/platform/qcom/venus/venc.c
index 8dd49d4f124c..1d62e38065d6 100644
--- a/drivers/media/platform/qcom/venus/venc.c
+++ b/drivers/media/platform/qcom/venus/venc.c
@@ -183,6 +183,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)
 		else
 			return NULL;
 		fmt = find_format(inst, pixmp->pixelformat, f->type);
+		if (!fmt)
+			return NULL;
 	}
 
 	pixmp->width = clamp(pixmp->width, frame_width_min(inst),
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 163/334] media: venus: helper: do not set constrained parameters for UBWC
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 162/334] media: venus: venc: Fix potential null pointer dereference on pointer fmt Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 164/334] soc: mmsys: mediatek: add mask to mmsys routes Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mansur Alisha Shaik, Bryan ODonoghue,
	Stanimir Varbanov, Mauro Carvalho Chehab, Sasha Levin

From: Mansur Alisha Shaik <mansur@codeaurora.org>

[ Upstream commit 1ac61faf6ebbce59fccbb53d7faf25576e9897ab ]

Plane constraints firmware interface is to override the default
alignment for a given color format. By default venus hardware has
alignments as 128x32, but NV12 was defined differently to meet
various usecases. Compressed NV12 has always been aligned as 128x32,
hence not needed to override the default alignment.

Fixes: bc28936bbba9 ("media: venus: helpers, hfi, vdec: Set actual plane constraints to FW")
Signed-off-by: Mansur Alisha Shaik <mansur@codeaurora.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Stanimir Varbanov <stanimir.varbanov@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/media/platform/qcom/venus/helpers.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/helpers.c b/drivers/media/platform/qcom/venus/helpers.c
index 1fe6d463dc99..8012f5c7bf34 100644
--- a/drivers/media/platform/qcom/venus/helpers.c
+++ b/drivers/media/platform/qcom/venus/helpers.c
@@ -1137,6 +1137,9 @@ int venus_helper_set_format_constraints(struct venus_inst *inst)
 	if (!IS_V6(inst->core))
 		return 0;
 
+	if (inst->opb_fmt == HFI_COLOR_FORMAT_NV12_UBWC)
+		return 0;
+
 	pconstraint.buffer_type = HFI_BUFFER_OUTPUT2;
 	pconstraint.num_planes = 2;
 	pconstraint.plane_format[0].stride_multiples = 128;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 164/334] soc: mmsys: mediatek: add mask to mmsys routes
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 163/334] media: venus: helper: do not set constrained parameters for UBWC Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 165/334] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Frank Wunderlich, CK Hu,
	Chun-Kuang Hu, Hsin-Yi Wang, Matthias Brugger, Sasha Levin

From: CK Hu <ck.hu@mediatek.com>

[ Upstream commit 7bdcead7a75e3eab5e711c2da78c2a0360e7f2a4 ]

SOUT has many bits and need to be cleared before set new value.
Write only could do the clear, but for MOUT, it clears bits that
should not be cleared. So use a mask to reset only the needed bits.

this fixes HDMI issues on MT7623/BPI-R2 since 5.13

Fixes: 440147639ac7 ("soc: mediatek: mmsys: Use an array for setting the routing registers")
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: CK Hu <ck.hu@mediatek.com>
Reviewed-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
Link: https://lore.kernel.org/r/20210729070549.5514-1-linux@fw-web.de
Signed-off-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/mediatek/mt8183-mmsys.h |  21 +++--
 drivers/soc/mediatek/mtk-mmsys.c    |   7 +-
 drivers/soc/mediatek/mtk-mmsys.h    | 133 +++++++++++++++++++---------
 3 files changed, 112 insertions(+), 49 deletions(-)

diff --git a/drivers/soc/mediatek/mt8183-mmsys.h b/drivers/soc/mediatek/mt8183-mmsys.h
index 579dfc8dc8fc..9dee485807c9 100644
--- a/drivers/soc/mediatek/mt8183-mmsys.h
+++ b/drivers/soc/mediatek/mt8183-mmsys.h
@@ -28,25 +28,32 @@
 static const struct mtk_mmsys_routes mmsys_mt8183_routing_table[] = {
 	{
 		DDP_COMPONENT_OVL0, DDP_COMPONENT_OVL_2L0,
-		MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L
+		MT8183_DISP_OVL0_MOUT_EN, MT8183_OVL0_MOUT_EN_OVL0_2L,
+		MT8183_OVL0_MOUT_EN_OVL0_2L
 	}, {
 		DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0,
-		MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0
+		MT8183_DISP_OVL0_2L_MOUT_EN, MT8183_OVL0_2L_MOUT_EN_DISP_PATH0,
+		MT8183_OVL0_2L_MOUT_EN_DISP_PATH0
 	}, {
 		DDP_COMPONENT_OVL_2L1, DDP_COMPONENT_RDMA1,
-		MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1
+		MT8183_DISP_OVL1_2L_MOUT_EN, MT8183_OVL1_2L_MOUT_EN_RDMA1,
+		MT8183_OVL1_2L_MOUT_EN_RDMA1
 	}, {
 		DDP_COMPONENT_DITHER, DDP_COMPONENT_DSI0,
-		MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0
+		MT8183_DISP_DITHER0_MOUT_EN, MT8183_DITHER0_MOUT_IN_DSI0,
+		MT8183_DITHER0_MOUT_IN_DSI0
 	}, {
 		DDP_COMPONENT_OVL_2L0, DDP_COMPONENT_RDMA0,
-		MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L
+		MT8183_DISP_PATH0_SEL_IN, MT8183_DISP_PATH0_SEL_IN_OVL0_2L,
+		MT8183_DISP_PATH0_SEL_IN_OVL0_2L
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
-		MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1
+		MT8183_DISP_DPI0_SEL_IN, MT8183_DPI0_SEL_IN_RDMA1,
+		MT8183_DPI0_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_COLOR0,
-		MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0
+		MT8183_DISP_RDMA0_SOUT_SEL_IN, MT8183_RDMA0_SOUT_COLOR0,
+		MT8183_RDMA0_SOUT_COLOR0
 	}
 };
 
diff --git a/drivers/soc/mediatek/mtk-mmsys.c b/drivers/soc/mediatek/mtk-mmsys.c
index 080660ef11bf..0f949896fd06 100644
--- a/drivers/soc/mediatek/mtk-mmsys.c
+++ b/drivers/soc/mediatek/mtk-mmsys.c
@@ -68,7 +68,9 @@ void mtk_mmsys_ddp_connect(struct device *dev,
 
 	for (i = 0; i < mmsys->data->num_routes; i++)
 		if (cur == routes[i].from_comp && next == routes[i].to_comp) {
-			reg = readl_relaxed(mmsys->regs + routes[i].addr) | routes[i].val;
+			reg = readl_relaxed(mmsys->regs + routes[i].addr);
+			reg &= ~routes[i].mask;
+			reg |= routes[i].val;
 			writel_relaxed(reg, mmsys->regs + routes[i].addr);
 		}
 }
@@ -85,7 +87,8 @@ void mtk_mmsys_ddp_disconnect(struct device *dev,
 
 	for (i = 0; i < mmsys->data->num_routes; i++)
 		if (cur == routes[i].from_comp && next == routes[i].to_comp) {
-			reg = readl_relaxed(mmsys->regs + routes[i].addr) & ~routes[i].val;
+			reg = readl_relaxed(mmsys->regs + routes[i].addr);
+			reg &= ~routes[i].mask;
 			writel_relaxed(reg, mmsys->regs + routes[i].addr);
 		}
 }
diff --git a/drivers/soc/mediatek/mtk-mmsys.h b/drivers/soc/mediatek/mtk-mmsys.h
index a760a34e6eca..5f3e2bf0c40b 100644
--- a/drivers/soc/mediatek/mtk-mmsys.h
+++ b/drivers/soc/mediatek/mtk-mmsys.h
@@ -35,41 +35,54 @@
 #define RDMA0_SOUT_DSI1				0x1
 #define RDMA0_SOUT_DSI2				0x4
 #define RDMA0_SOUT_DSI3				0x5
+#define RDMA0_SOUT_MASK				0x7
 #define RDMA1_SOUT_DPI0				0x2
 #define RDMA1_SOUT_DPI1				0x3
 #define RDMA1_SOUT_DSI1				0x1
 #define RDMA1_SOUT_DSI2				0x4
 #define RDMA1_SOUT_DSI3				0x5
+#define RDMA1_SOUT_MASK				0x7
 #define RDMA2_SOUT_DPI0				0x2
 #define RDMA2_SOUT_DPI1				0x3
 #define RDMA2_SOUT_DSI1				0x1
 #define RDMA2_SOUT_DSI2				0x4
 #define RDMA2_SOUT_DSI3				0x5
+#define RDMA2_SOUT_MASK				0x7
 #define DPI0_SEL_IN_RDMA1			0x1
 #define DPI0_SEL_IN_RDMA2			0x3
+#define DPI0_SEL_IN_MASK			0x3
 #define DPI1_SEL_IN_RDMA1			(0x1 << 8)
 #define DPI1_SEL_IN_RDMA2			(0x3 << 8)
+#define DPI1_SEL_IN_MASK			(0x3 << 8)
 #define DSI0_SEL_IN_RDMA1			0x1
 #define DSI0_SEL_IN_RDMA2			0x4
+#define DSI0_SEL_IN_MASK			0x7
 #define DSI1_SEL_IN_RDMA1			0x1
 #define DSI1_SEL_IN_RDMA2			0x4
+#define DSI1_SEL_IN_MASK			0x7
 #define DSI2_SEL_IN_RDMA1			(0x1 << 16)
 #define DSI2_SEL_IN_RDMA2			(0x4 << 16)
+#define DSI2_SEL_IN_MASK			(0x7 << 16)
 #define DSI3_SEL_IN_RDMA1			(0x1 << 16)
 #define DSI3_SEL_IN_RDMA2			(0x4 << 16)
+#define DSI3_SEL_IN_MASK			(0x7 << 16)
 #define COLOR1_SEL_IN_OVL1			0x1
 
 #define OVL_MOUT_EN_RDMA			0x1
 #define BLS_TO_DSI_RDMA1_TO_DPI1		0x8
 #define BLS_TO_DPI_RDMA1_TO_DSI			0x2
+#define BLS_RDMA1_DSI_DPI_MASK			0xf
 #define DSI_SEL_IN_BLS				0x0
 #define DPI_SEL_IN_BLS				0x0
+#define DPI_SEL_IN_MASK				0x1
 #define DSI_SEL_IN_RDMA				0x1
+#define DSI_SEL_IN_MASK				0x1
 
 struct mtk_mmsys_routes {
 	u32 from_comp;
 	u32 to_comp;
 	u32 addr;
+	u32 mask;
 	u32 val;
 };
 
@@ -91,124 +104,164 @@ struct mtk_mmsys_driver_data {
 static const struct mtk_mmsys_routes mmsys_default_routing_table[] = {
 	{
 		DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0,
-		DISP_REG_CONFIG_OUT_SEL, BLS_TO_DSI_RDMA1_TO_DPI1
+		DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK,
+		BLS_TO_DSI_RDMA1_TO_DPI1
 	}, {
 		DDP_COMPONENT_BLS, DDP_COMPONENT_DSI0,
-		DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_BLS
+		DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK,
+		DSI_SEL_IN_BLS
 	}, {
 		DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_OUT_SEL, BLS_TO_DPI_RDMA1_TO_DSI
+		DISP_REG_CONFIG_OUT_SEL, BLS_RDMA1_DSI_DPI_MASK,
+		BLS_TO_DPI_RDMA1_TO_DSI
 	}, {
 		DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_RDMA
+		DISP_REG_CONFIG_DSI_SEL, DSI_SEL_IN_MASK,
+		DSI_SEL_IN_RDMA
 	}, {
 		DDP_COMPONENT_BLS, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_BLS
+		DISP_REG_CONFIG_DPI_SEL, DPI_SEL_IN_MASK,
+		DPI_SEL_IN_BLS
 	}, {
 		DDP_COMPONENT_GAMMA, DDP_COMPONENT_RDMA1,
-		DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1
+		DISP_REG_CONFIG_DISP_GAMMA_MOUT_EN, GAMMA_MOUT_EN_RDMA1,
+		GAMMA_MOUT_EN_RDMA1
 	}, {
 		DDP_COMPONENT_OD0, DDP_COMPONENT_RDMA0,
-		DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0
+		DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD_MOUT_EN_RDMA0,
+		OD_MOUT_EN_RDMA0
 	}, {
 		DDP_COMPONENT_OD1, DDP_COMPONENT_RDMA1,
-		DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1
+		DISP_REG_CONFIG_DISP_OD_MOUT_EN, OD1_MOUT_EN_RDMA1,
+		OD1_MOUT_EN_RDMA1
 	}, {
 		DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0,
-		DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0
+		DISP_REG_CONFIG_DISP_OVL0_MOUT_EN, OVL0_MOUT_EN_COLOR0,
+		OVL0_MOUT_EN_COLOR0
 	}, {
 		DDP_COMPONENT_OVL0, DDP_COMPONENT_COLOR0,
-		DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0
+		DISP_REG_CONFIG_DISP_COLOR0_SEL_IN, COLOR0_SEL_IN_OVL0,
+		COLOR0_SEL_IN_OVL0
 	}, {
 		DDP_COMPONENT_OVL0, DDP_COMPONENT_RDMA0,
-		DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA
+		DISP_REG_CONFIG_DISP_OVL_MOUT_EN, OVL_MOUT_EN_RDMA,
+		OVL_MOUT_EN_RDMA
 	}, {
 		DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1,
-		DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1
+		DISP_REG_CONFIG_DISP_OVL1_MOUT_EN, OVL1_MOUT_EN_COLOR1,
+		OVL1_MOUT_EN_COLOR1
 	}, {
 		DDP_COMPONENT_OVL1, DDP_COMPONENT_COLOR1,
-		DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1
+		DISP_REG_CONFIG_DISP_COLOR1_SEL_IN, COLOR1_SEL_IN_OVL1,
+		COLOR1_SEL_IN_OVL1
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI0
+		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
+		RDMA0_SOUT_DPI0
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_DPI1,
-		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DPI1
+		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
+		RDMA0_SOUT_DPI1
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI1,
-		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI1
+		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
+		RDMA0_SOUT_DSI1
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI2,
-		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI2
+		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
+		RDMA0_SOUT_DSI2
 	}, {
 		DDP_COMPONENT_RDMA0, DDP_COMPONENT_DSI3,
-		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_DSI3
+		DISP_REG_CONFIG_DISP_RDMA0_SOUT_EN, RDMA0_SOUT_MASK,
+		RDMA0_SOUT_DSI3
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI0
+		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
+		RDMA1_SOUT_DPI0
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK,
+		DPI0_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1,
-		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DPI1
+		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
+		RDMA1_SOUT_DPI1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DPI1,
-		DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK,
+		DPI1_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI0,
-		DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK,
+		DSI0_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1,
-		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI1
+		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
+		RDMA1_SOUT_DSI1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI1,
-		DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK,
+		DSI1_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2,
-		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI2
+		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
+		RDMA1_SOUT_DSI2
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI2,
-		DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK,
+		DSI2_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3,
-		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_DSI3
+		DISP_REG_CONFIG_DISP_RDMA1_SOUT_EN, RDMA1_SOUT_MASK,
+		RDMA1_SOUT_DSI3
 	}, {
 		DDP_COMPONENT_RDMA1, DDP_COMPONENT_DSI3,
-		DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA1
+		DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK,
+		DSI3_SEL_IN_RDMA1
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI0
+		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
+		RDMA2_SOUT_DPI0
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI0,
-		DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DPI_SEL_IN, DPI0_SEL_IN_MASK,
+		DPI0_SEL_IN_RDMA2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1,
-		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DPI1
+		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
+		RDMA2_SOUT_DPI1
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DPI1,
-		DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DPI_SEL_IN, DPI1_SEL_IN_MASK,
+		DPI1_SEL_IN_RDMA2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI0,
-		DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DSIE_SEL_IN, DSI0_SEL_IN_MASK,
+		DSI0_SEL_IN_RDMA2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1,
-		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI1
+		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
+		RDMA2_SOUT_DSI1
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI1,
-		DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DSIO_SEL_IN, DSI1_SEL_IN_MASK,
+		DSI1_SEL_IN_RDMA2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2,
-		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI2
+		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
+		RDMA2_SOUT_DSI2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI2,
-		DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DSIE_SEL_IN, DSI2_SEL_IN_MASK,
+		DSI2_SEL_IN_RDMA2
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3,
-		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_DSI3
+		DISP_REG_CONFIG_DISP_RDMA2_SOUT, RDMA2_SOUT_MASK,
+		RDMA2_SOUT_DSI3
 	}, {
 		DDP_COMPONENT_RDMA2, DDP_COMPONENT_DSI3,
-		DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_RDMA2
+		DISP_REG_CONFIG_DSIO_SEL_IN, DSI3_SEL_IN_MASK,
+		DSI3_SEL_IN_RDMA2
 	}
 };
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 165/334] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 164/334] soc: mmsys: mediatek: add mask to mmsys routes Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 166/334] PCI: PM: Enable PME if it can be signaled from D3cold Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Utkarsh H Patel,
	Koba Ko, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ]

It is inconsistent to return PCI_D0 from pci_target_state() instead
of the original target state if 'wakeup' is true and the device
cannot signal PME from D0.

This only happens when the device cannot signal PME from the original
target state and any shallower power states (including D0) and that
case is effectively equivalent to the one in which PME singaling is
not supported at all.  Since the original target state is returned in
the latter case, make the function do that in the former one too.

Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
Fixes: 666ff6f83e1d ("PCI/PM: Avoid using device_may_wakeup() for runtime PM")
Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Reported-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index aacf575c15cf..28bac63525b2 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2599,16 +2599,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)
 	if (dev->current_state == PCI_D3cold)
 		target_state = PCI_D3cold;
 
-	if (wakeup) {
+	if (wakeup && dev->pme_support) {
+		pci_power_t state = target_state;
+
 		/*
 		 * Find the deepest state from which the device can generate
 		 * PME#.
 		 */
-		if (dev->pme_support) {
-			while (target_state
-			      && !(dev->pme_support & (1 << target_state)))
-				target_state--;
-		}
+		while (state && !(dev->pme_support & (1 << state)))
+			state--;
+
+		if (state)
+			return state;
+		else if (dev->pme_support & 1)
+			return PCI_D0;
 	}
 
 	return target_state;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 166/334] PCI: PM: Enable PME if it can be signaled from D3cold
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 165/334] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 167/334] bpf, samples: Add missing mprog-disable to xdp_redirect_cpus optstring Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Utkarsh H Patel,
	Koba Ko, Rafael J. Wysocki, Sasha Levin

From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>

[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ]

PME signaling is only enabled by __pci_enable_wake() if the target
device can signal PME from the given target power state (to avoid
pointless reconfiguration of the device), but if the hierarchy above
the device goes into D3cold, the device itself will end up in D3cold
too, so if it can signal PME from D3cold, it should be enabled to
do so in __pci_enable_wake().

[Note that if the device does not end up in D3cold and it cannot
 signal PME from the original target power state, it will not signal
 PME, so in that case the behavior does not change.]

Link: https://lore.kernel.org/linux-pm/3149540.aeNJFYEL58@kreacher/
Fixes: 5bcc2fb4e815 ("PCI PM: Simplify PCI wake-up code")
Reported-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Reported-by: Koba Ko <koba.ko@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pci/pci.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 28bac63525b2..3f353572588d 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -2495,7 +2495,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable
 	if (enable) {
 		int error;
 
-		if (pci_pme_capable(dev, state))
+		/*
+		 * Enable PME signaling if the device can signal PME from
+		 * D3cold regardless of whether or not it can signal PME from
+		 * the current target state, because that will allow it to
+		 * signal PME when the hierarchy above it goes into D3cold and
+		 * the device itself ends up in D3cold as a result of that.
+		 */
+		if (pci_pme_capable(dev, state) || pci_pme_capable(dev, PCI_D3cold))
 			pci_pme_active(dev, true);
 		else
 			ret = 1;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 167/334] bpf, samples: Add missing mprog-disable to xdp_redirect_cpus optstring
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 166/334] PCI: PM: Enable PME if it can be signaled from D3cold Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 168/334] soc: qcom: smsm: Fix missed interrupts if state changes while masked Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Cover, Daniel Borkmann, Sasha Levin

From: Matthew Cover <werekraken@gmail.com>

[ Upstream commit 34ad6d9d8c27293e1895b448af7d6cf5d351ad8d ]

Commit ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program
on cpumap") added the following option, but missed adding it to optstring:

  - mprog-disable: disable loading XDP program on cpumap entries

Fix it and add the missing option character.

Fixes: ce4dade7f12a ("samples/bpf: xdp_redirect_cpu: Load a eBPF program on cpumap")
Signed-off-by: Matthew Cover <matthew.cover@stackpath.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210731005632.13228-1-matthew.cover@stackpath.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/bpf/xdp_redirect_cpu_user.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/samples/bpf/xdp_redirect_cpu_user.c b/samples/bpf/xdp_redirect_cpu_user.c
index 576411612523..c7d7d3586730 100644
--- a/samples/bpf/xdp_redirect_cpu_user.c
+++ b/samples/bpf/xdp_redirect_cpu_user.c
@@ -831,7 +831,7 @@ int main(int argc, char **argv)
 	memset(cpu, 0, n_cpus * sizeof(int));
 
 	/* Parse commands line args */
-	while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:",
+	while ((opt = getopt_long(argc, argv, "hSd:s:p:q:c:xzFf:e:r:m:n",
 				  long_options, &longindex)) != -1) {
 		switch (opt) {
 		case 'd':
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 168/334] soc: qcom: smsm: Fix missed interrupts if state changes while masked
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 167/334] bpf, samples: Add missing mprog-disable to xdp_redirect_cpus optstring Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 169/334] net: dsa: build tag_8021q.c as part of DSA core Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephan Gerhold, Bjorn Andersson,
	Sasha Levin

From: Stephan Gerhold <stephan@gerhold.net>

[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ]

The SMSM driver detects interrupt edges by tracking the last state
it has seen (and has triggered the interrupt handler for). This works
fine, but only if the interrupt does not change state while masked.

For example, if an interrupt is unmasked while the state is HIGH,
the stored last_value for that interrupt might still be LOW. Then,
when the remote processor triggers smsm_intr() we assume that nothing
has changed, even though the state might have changed from HIGH to LOW.

Attempt to fix this by checking the current remote state before
unmasking an IRQ. Use atomic operations to avoid the interrupt handler
from interfering with the unmask function.

This fixes modem crashes in some edge cases with the BAM-DMUX driver.
Specifically, the BAM-DMUX interrupt handler is not called for the
HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded
(and therefore unmasks the interrupt) after the modem was already started:

qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188:
  Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK

Fixes: c97c4090ff72 ("soc: qcom: smsm: Add driver for Qualcomm SMSM")
Signed-off-by: Stephan Gerhold <stephan@gerhold.net>
Link: https://lore.kernel.org/r/20210712135703.324748-2-stephan@gerhold.net
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/soc/qcom/smsm.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c
index 1d3d5e3ec2b0..6e9a9cd28b17 100644
--- a/drivers/soc/qcom/smsm.c
+++ b/drivers/soc/qcom/smsm.c
@@ -109,7 +109,7 @@ struct smsm_entry {
 	DECLARE_BITMAP(irq_enabled, 32);
 	DECLARE_BITMAP(irq_rising, 32);
 	DECLARE_BITMAP(irq_falling, 32);
-	u32 last_value;
+	unsigned long last_value;
 
 	u32 *remote_state;
 	u32 *subscription;
@@ -204,8 +204,7 @@ static irqreturn_t smsm_intr(int irq, void *data)
 	u32 val;
 
 	val = readl(entry->remote_state);
-	changed = val ^ entry->last_value;
-	entry->last_value = val;
+	changed = val ^ xchg(&entry->last_value, val);
 
 	for_each_set_bit(i, entry->irq_enabled, 32) {
 		if (!(changed & BIT(i)))
@@ -264,6 +263,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)
 	struct qcom_smsm *smsm = entry->smsm;
 	u32 val;
 
+	/* Make sure our last cached state is up-to-date */
+	if (readl(entry->remote_state) & BIT(irq))
+		set_bit(irq, &entry->last_value);
+	else
+		clear_bit(irq, &entry->last_value);
+
 	set_bit(irq, entry->irq_enabled);
 
 	if (entry->subscription) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 169/334] net: dsa: build tag_8021q.c as part of DSA core
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 168/334] soc: qcom: smsm: Fix missed interrupts if state changes while masked Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 170/334] net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit 8b6e638b4be2ad77f61fb93b4e1776c6ccc2edab ]

Upcoming patches will add tag_8021q related logic to switch.c and
port.c, in order to allow it to make use of cross-chip notifiers.
In addition, a struct dsa_8021q_context *ctx pointer will be added to
struct dsa_switch.

It seems fairly low-reward to #ifdef the *ctx from struct dsa_switch and
to provide shim implementations of the entire tag_8021q.c calling
surface (not even clear what to do about the tag_8021q cross-chip
notifiers to avoid compiling them). The runtime overhead for switches
which don't use tag_8021q is fairly small because all helpers will check
for ds->tag_8021q_ctx being a NULL pointer and stop there.

So let's make it part of dsa_core.o.

Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/Kconfig     | 12 ------------
 net/dsa/Makefile    |  3 +--
 net/dsa/tag_8021q.c |  2 --
 3 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index 00bb89b2d86f..bca1b5d66df2 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -18,16 +18,6 @@ if NET_DSA
 
 # Drivers must select the appropriate tagging format(s)
 
-config NET_DSA_TAG_8021Q
-	tristate
-	select VLAN_8021Q
-	help
-	  Unlike the other tagging protocols, the 802.1Q config option simply
-	  provides helpers for other tagging implementations that might rely on
-	  VLAN in one way or another. It is not a complete solution.
-
-	  Drivers which use these helpers should select this as dependency.
-
 config NET_DSA_TAG_AR9331
 	tristate "Tag driver for Atheros AR9331 SoC with built-in switch"
 	help
@@ -126,7 +116,6 @@ config NET_DSA_TAG_OCELOT_8021Q
 	tristate "Tag driver for Ocelot family of switches, using VLAN"
 	depends on MSCC_OCELOT_SWITCH_LIB || \
 	          (MSCC_OCELOT_SWITCH_LIB=n && COMPILE_TEST)
-	select NET_DSA_TAG_8021Q
 	help
 	  Say Y or M if you want to enable support for tagging frames with a
 	  custom VLAN-based header. Frames that require timestamping, such as
@@ -149,7 +138,6 @@ config NET_DSA_TAG_LAN9303
 
 config NET_DSA_TAG_SJA1105
 	tristate "Tag driver for NXP SJA1105 switches"
-	select NET_DSA_TAG_8021Q
 	select PACKING
 	help
 	  Say Y or M if you want to enable support for tagging frames with the
diff --git a/net/dsa/Makefile b/net/dsa/Makefile
index 44bc79952b8b..67ea009f242c 100644
--- a/net/dsa/Makefile
+++ b/net/dsa/Makefile
@@ -1,10 +1,9 @@
 # SPDX-License-Identifier: GPL-2.0
 # the core
 obj-$(CONFIG_NET_DSA) += dsa_core.o
-dsa_core-y += dsa.o dsa2.o master.o port.o slave.o switch.o
+dsa_core-y += dsa.o dsa2.o master.o port.o slave.o switch.o tag_8021q.o
 
 # tagging formats
-obj-$(CONFIG_NET_DSA_TAG_8021Q) += tag_8021q.o
 obj-$(CONFIG_NET_DSA_TAG_AR9331) += tag_ar9331.o
 obj-$(CONFIG_NET_DSA_TAG_BRCM_COMMON) += tag_brcm.o
 obj-$(CONFIG_NET_DSA_TAG_DSA_COMMON) += tag_dsa.o
diff --git a/net/dsa/tag_8021q.c b/net/dsa/tag_8021q.c
index 4aa29f90ecea..0d1db3e37668 100644
--- a/net/dsa/tag_8021q.c
+++ b/net/dsa/tag_8021q.c
@@ -493,5 +493,3 @@ void dsa_8021q_rcv(struct sk_buff *skb, int *source_port, int *switch_id,
 	skb->priority = (tci & VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT;
 }
 EXPORT_SYMBOL_GPL(dsa_8021q_rcv);
-
-MODULE_LICENSE("GPL v2");
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 170/334] net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 169/334] net: dsa: build tag_8021q.c as part of DSA core Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 171/334] debugfs: Return error during {full/open}_proxy_open() on rmmod Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Vladimir Oltean,
	David S. Miller, Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit f8b17a0bd96065e4511858689916bb729dbb881b ]

TX timestamps are sent by SJA1110 as Ethernet packets containing
metadata, so they are received by the tagging driver but must be
processed by the switch driver - the one that is stateful since it
keeps the TX timestamp queue.

This means that there is an sja1110_process_meta_tstamp() symbol
exported by the switch driver which is called by the tagging driver.

There is a shim definition for that function when the switch driver is
not compiled, which does nothing, but that shim is not effective when
the tagging protocol driver is built-in and the switch driver is a
module, because built-in code cannot call symbols exported by modules.

So add an optional dependency between the tagger and the switch driver,
if PTP support is enabled in the switch driver. If PTP is not enabled,
sja1110_process_meta_tstamp() will translate into the shim "do nothing
with these meta frames" function.

Fixes: 566b18c8b752 ("net: dsa: sja1105: implement TX timestamping for SJA1110")
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig
index bca1b5d66df2..970906eb5b2c 100644
--- a/net/dsa/Kconfig
+++ b/net/dsa/Kconfig
@@ -138,6 +138,7 @@ config NET_DSA_TAG_LAN9303
 
 config NET_DSA_TAG_SJA1105
 	tristate "Tag driver for NXP SJA1105 switches"
+	depends on (NET_DSA_SJA1105 && NET_DSA_SJA1105_PTP) || !NET_DSA_SJA1105 || !NET_DSA_SJA1105_PTP
 	select PACKING
 	help
 	  Say Y or M if you want to enable support for tagging frames with the
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 171/334] debugfs: Return error during {full/open}_proxy_open() on rmmod
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 170/334] net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 172/334] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Taehee Yoo, Mário Lopes,
	Sven Eckelmann, Sasha Levin

From: Sven Eckelmann <sven@narfation.org>

[ Upstream commit 112cedc8e600b668688eb809bf11817adec58ddc ]

If a kernel module gets unloaded then it printed report about a leak before
commit 275678e7a9be ("debugfs: Check module state before warning in
{full/open}_proxy_open()"). An additional check was added in this commit to
avoid this printing. But it was forgotten that the function must return an
error in this case because it was not actually opened.

As result, the systems started to crash or to hang when a module was
unloaded while something was trying to open a file.

Fixes: 275678e7a9be ("debugfs: Check module state before warning in {full/open}_proxy_open()")
Cc: Taehee Yoo <ap420073@gmail.com>
Reported-by: Mário Lopes <ml@simonwunderlich.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://lore.kernel.org/r/20210802162444.7848-1-sven@narfation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/debugfs/file.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index df00231d3ecc..7d162b0efbf0 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -179,8 +179,10 @@ static int open_proxy_open(struct inode *inode, struct file *filp)
 	if (!fops_get(real_fops)) {
 #ifdef CONFIG_MODULES
 		if (real_fops->owner &&
-		    real_fops->owner->state == MODULE_STATE_GOING)
+		    real_fops->owner->state == MODULE_STATE_GOING) {
+			r = -ENXIO;
 			goto out;
+		}
 #endif
 
 		/* Huh? Module did not clean up after itself at exit? */
@@ -314,8 +316,10 @@ static int full_proxy_open(struct inode *inode, struct file *filp)
 	if (!fops_get(real_fops)) {
 #ifdef CONFIG_MODULES
 		if (real_fops->owner &&
-		    real_fops->owner->state == MODULE_STATE_GOING)
+		    real_fops->owner->state == MODULE_STATE_GOING) {
+			r = -ENXIO;
 			goto out;
+		}
 #endif
 
 		/* Huh? Module did not cleanup after itself at exit? */
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 172/334] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 171/334] debugfs: Return error during {full/open}_proxy_open() on rmmod Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 173/334] arm64: dts: qcom: sc7280: Fixup the cpufreq node Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Marcel Holtmann, Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]

An earlier commit replaced using batostr to using %pMR sprintf for the
construction of session->name. Static analysis detected that this new
method can use a total of 21 characters (including the trailing '\0')
so we need to increase the BTNAMSIZ from 18 to 21 to fix potential
buffer overflows.

Addresses-Coverity: ("Out-of-bounds write")
Fixes: fcb73338ed53 ("Bluetooth: Use %pMR in sprintf/seq_printf instead of batostr")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/cmtp/cmtp.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index c32638dddbf9..f6b9dc4e408f 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -26,7 +26,7 @@
 #include <linux/types.h>
 #include <net/bluetooth/bluetooth.h>
 
-#define BTNAMSIZ 18
+#define BTNAMSIZ 21
 
 /* CMTP ioctl defines */
 #define CMTPCONNADD	_IOW('C', 200, int)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 173/334] arm64: dts: qcom: sc7280: Fixup the cpufreq node
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 172/334] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 174/334] arm64: dts: qcom: sm8350: fix IPA interconnects Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sibi Sankar, Stephen Boyd,
	Bjorn Andersson, Sasha Levin

From: Sibi Sankar <sibis@codeaurora.org>

[ Upstream commit 11e03d692101e484df9322f892a8b6e111a82bfd ]

Fixup the register regions used by the cpufreq node on SC7280 SoC to
support per core L3 DCVS.

Fixes: 7dbd121a2c58 ("arm64: dts: qcom: sc7280: Add cpufreq hw node")
Signed-off-by: Sibi Sankar <sibis@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1627581885-32165-4-git-send-email-sibis@codeaurora.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index 188c5768a55a..c08f07410699 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -1437,9 +1437,9 @@
 
 		cpufreq_hw: cpufreq@18591000 {
 			compatible = "qcom,cpufreq-epss";
-			reg = <0 0x18591000 0 0x1000>,
-			      <0 0x18592000 0 0x1000>,
-			      <0 0x18593000 0 0x1000>;
+			reg = <0 0x18591100 0 0x900>,
+			      <0 0x18592100 0 0x900>,
+			      <0 0x18593100 0 0x900>;
 			clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>;
 			clock-names = "xo", "alternate";
 			#freq-domain-cells = <1>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 174/334] arm64: dts: qcom: sm8350: fix IPA interconnects
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 173/334] arm64: dts: qcom: sc7280: Fixup the cpufreq node Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 175/334] drm: bridge: it66121: Check drm_bridge_attach retval Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Elder, Bjorn Andersson, Sasha Levin

From: Alex Elder <elder@linaro.org>

[ Upstream commit 84173ca359787abd720d150d3d0d7edabf9db46c ]

There should only be two interconnects defined for IPA on the
QUalcomm SM8350 SoC.  The names should also match those specified by
the IPA Device Tree binding.

Fixes: f11d3e7da32e ("arm64: dts: qcom: sm8350: add IPA information")
Signed-off-by: Alex Elder <elder@linaro.org>
Link: https://lore.kernel.org/r/20210804210214.1891755-5-elder@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/qcom/sm8350.dtsi | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/arch/arm64/boot/dts/qcom/sm8350.dtsi b/arch/arm64/boot/dts/qcom/sm8350.dtsi
index 0d16392bb976..dbc174d424e2 100644
--- a/arch/arm64/boot/dts/qcom/sm8350.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8350.dtsi
@@ -666,12 +666,10 @@
 			clocks = <&rpmhcc RPMH_IPA_CLK>;
 			clock-names = "core";
 
-			interconnects = <&aggre2_noc MASTER_IPA &gem_noc SLAVE_LLCC>,
-					<&mc_virt MASTER_LLCC &mc_virt SLAVE_EBI1>,
+			interconnects = <&aggre2_noc MASTER_IPA &mc_virt SLAVE_EBI1>,
 					<&gem_noc MASTER_APPSS_PROC &config_noc SLAVE_IPA_CFG>;
-			interconnect-names = "ipa_to_llcc",
-					     "llcc_to_ebi1",
-					     "appss_to_ipa";
+			interconnect-names = "memory",
+					     "config";
 
 			qcom,smem-states = <&ipa_smp2p_out 0>,
 					   <&ipa_smp2p_out 1>;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 175/334] drm: bridge: it66121: Check drm_bridge_attach retval
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 174/334] arm64: dts: qcom: sm8350: fix IPA interconnects Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 176/334] net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop() Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Foss, Jernej Skrabec, Sasha Levin

From: Robert Foss <robert.foss@linaro.org>

[ Upstream commit bd03d440e2589b9c328f40ce60203adf2b19d2e2 ]

The return value of drm_bridge_attach() is ignored during
the it66121_bridge_attach() call, which is incorrect.

Fixes: 988156dc2fc9 ("drm: bridge: add it66121 driver")
Signed-off-by: Robert Foss <robert.foss@linaro.org>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210805185039.402178-1-robert.foss@linaro.org
Link: https://patchwork.freedesktop.org/patch/msgid/20210805185039.402178-1-robert.foss@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ite-it66121.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/bridge/ite-it66121.c b/drivers/gpu/drm/bridge/ite-it66121.c
index 7149ed40af83..2f2a09adb4bc 100644
--- a/drivers/gpu/drm/bridge/ite-it66121.c
+++ b/drivers/gpu/drm/bridge/ite-it66121.c
@@ -536,6 +536,8 @@ static int it66121_bridge_attach(struct drm_bridge *bridge,
 		return -EINVAL;
 
 	ret = drm_bridge_attach(bridge->encoder, ctx->next_bridge, bridge, flags);
+	if (ret)
+		return ret;
 
 	ret = regmap_write_bits(ctx->regmap, IT66121_CLK_BANK_REG,
 				IT66121_CLK_BANK_PWROFF_RCLK, 0);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 176/334] net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 175/334] drm: bridge: it66121: Check drm_bridge_attach retval Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 177/334] net: dsa: stop syncing the bridge mcast_router attribute at join time Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vignesh Raghavendra,
	Grygorii Strashko, David S. Miller, Sasha Levin

From: Vignesh Raghavendra <vigneshr@ti.com>

[ Upstream commit 47bfc4d128dedd9e828e33b70b87b591a6d59edf ]

On TI K3 am64x platform the issue with RX IRQ is observed - it's become
disabled forever after .ndo_stop(). The K3 CPSW driver manipulates RX IRQ
by using standard Linux enable_irq()/disable_irq_nosync() API as there is
no IRQ enable/disable options in CPSW HW itself, as result during
.ndo_stop() following sequence happens

  phy_stop()
  teardown TX/RX channels
  wait for TX tdown complete
  napi_disable(TX)
  clean up TX channels

  (a)

  napi_disable(RX)

At point (a) it's not possible to predict if RX IRQ was triggered or not.
if RX IRQ was triggered then it also not possible to definitely say if RX
NAPI was run or only scheduled and immediately canceled by
napi_disable(RX). Actually the last case causes RX IRQ to be permanently
disabled.

Another observed issue is that RX IRQ enable counter become unbalanced if
(gro_flush_timeout =! 0) while (napi_defer_hard_irqs == 0):

Unbalanced enable for IRQ 44
WARNING: CPU: 0 PID: 10 at ../kernel/irq/manage.c:776 __enable_irq+0x38/0x80
__enable_irq+0x38/0x80
enable_irq+0x54/0xb0
am65_cpsw_nuss_rx_poll+0x2f4/0x368
__napi_poll+0x34/0x1b8
net_rx_action+0xe4/0x220
_stext+0x11c/0x284
run_ksoftirqd+0x4c/0x60

To avoid above issues introduce flag indicating if RX was actually disabled
before enabling it in am65_cpsw_nuss_rx_poll() and restore RX IRQ state in
.ndo_open()

Fixes: 4f7cce272403 ("net: ethernet: ti: am65-cpsw: add support for am64x cpsw3g")
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/ti/am65-cpsw-nuss.c | 13 +++++++++++--
 drivers/net/ethernet/ti/am65-cpsw-nuss.h |  2 ++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index fb58fc470773..e967cd1ade36 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -518,6 +518,10 @@ static int am65_cpsw_nuss_common_open(struct am65_cpsw_common *common,
 	}
 
 	napi_enable(&common->napi_rx);
+	if (common->rx_irq_disabled) {
+		common->rx_irq_disabled = false;
+		enable_irq(common->rx_chns.irq);
+	}
 
 	dev_dbg(common->dev, "cpsw_nuss started\n");
 	return 0;
@@ -871,8 +875,12 @@ static int am65_cpsw_nuss_rx_poll(struct napi_struct *napi_rx, int budget)
 
 	dev_dbg(common->dev, "%s num_rx:%d %d\n", __func__, num_rx, budget);
 
-	if (num_rx < budget && napi_complete_done(napi_rx, num_rx))
-		enable_irq(common->rx_chns.irq);
+	if (num_rx < budget && napi_complete_done(napi_rx, num_rx)) {
+		if (common->rx_irq_disabled) {
+			common->rx_irq_disabled = false;
+			enable_irq(common->rx_chns.irq);
+		}
+	}
 
 	return num_rx;
 }
@@ -1090,6 +1098,7 @@ static irqreturn_t am65_cpsw_nuss_rx_irq(int irq, void *dev_id)
 {
 	struct am65_cpsw_common *common = dev_id;
 
+	common->rx_irq_disabled = true;
 	disable_irq_nosync(irq);
 	napi_schedule(&common->napi_rx);
 
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.h b/drivers/net/ethernet/ti/am65-cpsw-nuss.h
index 5d93e346f05e..048ed10143c1 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.h
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.h
@@ -126,6 +126,8 @@ struct am65_cpsw_common {
 	struct am65_cpsw_rx_chn	rx_chns;
 	struct napi_struct	napi_rx;
 
+	bool			rx_irq_disabled;
+
 	u32			nuss_ver;
 	u32			cpsw_ver;
 	unsigned long		bus_freq;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 177/334] net: dsa: stop syncing the bridge mcast_router attribute at join time
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 176/334] net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 178/334] net: dsa: mt7530: remove the .port_set_mrouter implementation Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, DENG Qingfang, Vladimir Oltean,
	David S. Miller, Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit 7df4e7449489d82cee6813dccbb4ae4f3f26ef7b ]

Qingfang points out that when a bridge with the default settings is
created and a port joins it:

ip link add br0 type bridge
ip link set swp0 master br0

DSA calls br_multicast_router() on the bridge to see if the br0 device
is a multicast router port, and if it is, it enables multicast flooding
to the CPU port, otherwise it disables it.

If we look through the multicast_router_show() sysfs or at the
IFLA_BR_MCAST_ROUTER netlink attribute, we see that the default mrouter
attribute for the bridge device is "1" (MDB_RTR_TYPE_TEMP_QUERY).

However, br_multicast_router() will return "0" (MDB_RTR_TYPE_DISABLED),
because an mrouter port in the MDB_RTR_TYPE_TEMP_QUERY state may not be
actually _active_ until it receives an actual IGMP query. So, the
br_multicast_router() function should really have been called
br_multicast_router_active() perhaps.

When/if an IGMP query is received, the bridge device will transition via
br_multicast_mark_router() into the active state until the
ip4_mc_router_timer expires after an multicast_querier_interval.

Of course, this does not happen if the bridge is created with an
mcast_router attribute of "2" (MDB_RTR_TYPE_PERM).

The point is that in lack of any IGMP query messages, and in the default
bridge configuration, unregistered multicast packets will not be able to
reach the CPU port through flooding, and this breaks many use cases
(most obviously, IPv6 ND, with its ICMP6 neighbor solicitation multicast
messages).

Leave the multicast flooding setting towards the CPU port down to a driver
level decision.

Fixes: 010e269f91be ("net: dsa: sync up switchdev objects and port attributes when joining the bridge")
Reported-by: DENG Qingfang <dqfext@gmail.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/dsa/port.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/net/dsa/port.c b/net/dsa/port.c
index 28b45b7e66df..d9ef2c2fbf88 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -186,10 +186,6 @@ static int dsa_port_switchdev_sync(struct dsa_port *dp,
 	if (err && err != -EOPNOTSUPP)
 		return err;
 
-	err = dsa_port_mrouter(dp->cpu_dp, br_multicast_router(br), extack);
-	if (err && err != -EOPNOTSUPP)
-		return err;
-
 	err = dsa_port_ageing_time(dp, br_get_ageing_time(br));
 	if (err && err != -EOPNOTSUPP)
 		return err;
@@ -272,12 +268,6 @@ static void dsa_port_switchdev_unsync_attrs(struct dsa_port *dp)
 
 	/* VLAN filtering is handled by dsa_switch_bridge_leave */
 
-	/* Some drivers treat the notification for having a local multicast
-	 * router by allowing multicast to be flooded to the CPU, so we should
-	 * allow this in standalone mode too.
-	 */
-	dsa_port_mrouter(dp->cpu_dp, true, NULL);
-
 	/* Ageing time may be global to the switch chip, so don't change it
 	 * here because we have no good reason (or value) to change it to.
 	 */
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 178/334] net: dsa: mt7530: remove the .port_set_mrouter implementation
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 177/334] net: dsa: stop syncing the bridge mcast_router attribute at join time Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 179/334] net: dsa: dont disable multicast flooding to the CPU even without an IGMP querier Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit cbbf09b5771e6e9da268bc0d2fb6e428afa787bc ]

DSA's idea of optimizing out multicast flooding to the CPU port leaves
quite a few holes open, so it should be reverted.

The mt7530 driver is the only new driver which added a .port_set_mrouter
implementation after the reorg from commit a8b659e7ff75 ("net: dsa: act
as passthrough for bridge port flags"), so it needs to be reverted
separately so that the other revert commit can go a bit further down the
git history.

Fixes: 5a30833b9a16 ("net: dsa: mt7530: support MDB and bridge flag operations")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/mt7530.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c
index 05bc46634b36..0cea1572f826 100644
--- a/drivers/net/dsa/mt7530.c
+++ b/drivers/net/dsa/mt7530.c
@@ -1185,18 +1185,6 @@ mt7530_port_bridge_flags(struct dsa_switch *ds, int port,
 	return 0;
 }
 
-static int
-mt7530_port_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
-			struct netlink_ext_ack *extack)
-{
-	struct mt7530_priv *priv = ds->priv;
-
-	mt7530_rmw(priv, MT7530_MFC, UNM_FFP(BIT(port)),
-		   mrouter ? UNM_FFP(BIT(port)) : 0);
-
-	return 0;
-}
-
 static int
 mt7530_port_bridge_join(struct dsa_switch *ds, int port,
 			struct net_device *bridge)
@@ -3058,7 +3046,6 @@ static const struct dsa_switch_ops mt7530_switch_ops = {
 	.port_stp_state_set	= mt7530_stp_state_set,
 	.port_pre_bridge_flags	= mt7530_port_pre_bridge_flags,
 	.port_bridge_flags	= mt7530_port_bridge_flags,
-	.port_set_mrouter	= mt7530_port_set_mrouter,
 	.port_bridge_join	= mt7530_port_bridge_join,
 	.port_bridge_leave	= mt7530_port_bridge_leave,
 	.port_fdb_add		= mt7530_port_fdb_add,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 179/334] net: dsa: dont disable multicast flooding to the CPU even without an IGMP querier
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 178/334] net: dsa: mt7530: remove the .port_set_mrouter implementation Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 180/334] PM: EM: Increase energy calculation precision Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, David S. Miller,
	Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit c73c57081b3d59aa99093fbedced32ea02620cd3 ]

Commit 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER
attribute") added an option for users to turn off multicast flooding
towards the CPU if they turn off the IGMP querier on a bridge which
already has enslaved ports (echo 0 > /sys/class/net/br0/bridge/multicast_router).

And commit a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags")
simply papered over that issue, because it moved the decision to flood
the CPU with multicast (or not) from the DSA core down to individual drivers,
instead of taking a more radical position then.

The truth is that disabling multicast flooding to the CPU is simply
something we are not prepared to do now, if at all. Some reasons:

- ICMP6 neighbor solicitation messages are unregistered multicast
  packets as far as the bridge is concerned. So if we stop flooding
  multicast, the outside world cannot ping the bridge device's IPv6
  link-local address.

- There might be foreign interfaces bridged with our DSA switch ports
  (sending a packet towards the host does not necessarily equal
  termination, but maybe software forwarding). So if there is no one
  interested in that multicast traffic in the local network stack, that
  doesn't mean nobody is.

- PTP over L4 (IPv4, IPv6) is multicast, but is unregistered as far as
  the bridge is concerned. This should reach the CPU port.

- The switch driver might not do FDB partitioning. And since we don't
  even bother to do more fine-grained flood disabling (such as "disable
  flooding _from_port_N_ towards the CPU port" as opposed to "disable
  flooding _from_any_port_ towards the CPU port"), this breaks standalone
  ports, or even multiple bridges where one has an IGMP querier and one
  doesn't.

Reverting the logic makes all of the above work.

Fixes: a8b659e7ff75 ("net: dsa: act as passthrough for bridge port flags")
Fixes: 08cc83cc7fd8 ("net: dsa: add support for BRIDGE_MROUTER attribute")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/dsa/b53/b53_common.c | 10 ----------
 drivers/net/dsa/b53/b53_priv.h   |  2 --
 drivers/net/dsa/bcm_sf2.c        |  1 -
 drivers/net/dsa/mv88e6xxx/chip.c | 18 ------------------
 include/net/dsa.h                |  2 --
 net/dsa/dsa_priv.h               |  2 --
 net/dsa/port.c                   | 11 -----------
 net/dsa/slave.c                  |  6 ------
 8 files changed, 52 deletions(-)

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index b23e3488695b..bd1417a66cbf 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -2016,15 +2016,6 @@ int b53_br_flags(struct dsa_switch *ds, int port,
 }
 EXPORT_SYMBOL(b53_br_flags);
 
-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
-		    struct netlink_ext_ack *extack)
-{
-	b53_port_set_mcast_flood(ds->priv, port, mrouter);
-
-	return 0;
-}
-EXPORT_SYMBOL(b53_set_mrouter);
-
 static bool b53_possible_cpu_port(struct dsa_switch *ds, int port)
 {
 	/* Broadcom switches will accept enabling Broadcom tags on the
@@ -2268,7 +2259,6 @@ static const struct dsa_switch_ops b53_switch_ops = {
 	.port_bridge_leave	= b53_br_leave,
 	.port_pre_bridge_flags	= b53_br_flags_pre,
 	.port_bridge_flags	= b53_br_flags,
-	.port_set_mrouter	= b53_set_mrouter,
 	.port_stp_state_set	= b53_br_set_stp_state,
 	.port_fast_age		= b53_br_fast_age,
 	.port_vlan_filtering	= b53_vlan_filtering,
diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 82700a5714c1..9bf8319342b0 100644
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -328,8 +328,6 @@ int b53_br_flags_pre(struct dsa_switch *ds, int port,
 int b53_br_flags(struct dsa_switch *ds, int port,
 		 struct switchdev_brport_flags flags,
 		 struct netlink_ext_ack *extack);
-int b53_set_mrouter(struct dsa_switch *ds, int port, bool mrouter,
-		    struct netlink_ext_ack *extack);
 int b53_setup_devlink_resources(struct dsa_switch *ds);
 void b53_port_event(struct dsa_switch *ds, int port);
 void b53_phylink_validate(struct dsa_switch *ds, int port,
diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c
index 3b018fcf4412..6ce9ec1283e0 100644
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -1199,7 +1199,6 @@ static const struct dsa_switch_ops bcm_sf2_ops = {
 	.port_pre_bridge_flags	= b53_br_flags_pre,
 	.port_bridge_flags	= b53_br_flags,
 	.port_stp_state_set	= b53_br_set_stp_state,
-	.port_set_mrouter	= b53_set_mrouter,
 	.port_fast_age		= b53_br_fast_age,
 	.port_vlan_filtering	= b53_vlan_filtering,
 	.port_vlan_add		= b53_vlan_add,
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 272b0535d946..111a6d5985da 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -5781,23 +5781,6 @@ out:
 	return err;
 }
 
-static int mv88e6xxx_port_set_mrouter(struct dsa_switch *ds, int port,
-				      bool mrouter,
-				      struct netlink_ext_ack *extack)
-{
-	struct mv88e6xxx_chip *chip = ds->priv;
-	int err;
-
-	if (!chip->info->ops->port_set_mcast_flood)
-		return -EOPNOTSUPP;
-
-	mv88e6xxx_reg_lock(chip);
-	err = chip->info->ops->port_set_mcast_flood(chip, port, mrouter);
-	mv88e6xxx_reg_unlock(chip);
-
-	return err;
-}
-
 static bool mv88e6xxx_lag_can_offload(struct dsa_switch *ds,
 				      struct net_device *lag,
 				      struct netdev_lag_upper_info *info)
@@ -6099,7 +6082,6 @@ static const struct dsa_switch_ops mv88e6xxx_switch_ops = {
 	.port_bridge_leave	= mv88e6xxx_port_bridge_leave,
 	.port_pre_bridge_flags	= mv88e6xxx_port_pre_bridge_flags,
 	.port_bridge_flags	= mv88e6xxx_port_bridge_flags,
-	.port_set_mrouter	= mv88e6xxx_port_set_mrouter,
 	.port_stp_state_set	= mv88e6xxx_port_stp_state_set,
 	.port_fast_age		= mv88e6xxx_port_fast_age,
 	.port_vlan_filtering	= mv88e6xxx_port_vlan_filtering,
diff --git a/include/net/dsa.h b/include/net/dsa.h
index 33f40c1ec379..048d297623c9 100644
--- a/include/net/dsa.h
+++ b/include/net/dsa.h
@@ -699,8 +699,6 @@ struct dsa_switch_ops {
 	int	(*port_bridge_flags)(struct dsa_switch *ds, int port,
 				     struct switchdev_brport_flags flags,
 				     struct netlink_ext_ack *extack);
-	int	(*port_set_mrouter)(struct dsa_switch *ds, int port, bool mrouter,
-				    struct netlink_ext_ack *extack);
 
 	/*
 	 * VLAN support
diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
index f201c33980bf..cddf7cb0f398 100644
--- a/net/dsa/dsa_priv.h
+++ b/net/dsa/dsa_priv.h
@@ -234,8 +234,6 @@ int dsa_port_pre_bridge_flags(const struct dsa_port *dp,
 int dsa_port_bridge_flags(const struct dsa_port *dp,
 			  struct switchdev_brport_flags flags,
 			  struct netlink_ext_ack *extack);
-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter,
-		     struct netlink_ext_ack *extack);
 int dsa_port_vlan_add(struct dsa_port *dp,
 		      const struct switchdev_obj_port_vlan *vlan,
 		      struct netlink_ext_ack *extack);
diff --git a/net/dsa/port.c b/net/dsa/port.c
index d9ef2c2fbf88..23e30198a90e 100644
--- a/net/dsa/port.c
+++ b/net/dsa/port.c
@@ -597,17 +597,6 @@ int dsa_port_bridge_flags(const struct dsa_port *dp,
 	return ds->ops->port_bridge_flags(ds, dp->index, flags, extack);
 }
 
-int dsa_port_mrouter(struct dsa_port *dp, bool mrouter,
-		     struct netlink_ext_ack *extack)
-{
-	struct dsa_switch *ds = dp->ds;
-
-	if (!ds->ops->port_set_mrouter)
-		return -EOPNOTSUPP;
-
-	return ds->ops->port_set_mrouter(ds, dp->index, mrouter, extack);
-}
-
 int dsa_port_mtu_change(struct dsa_port *dp, int new_mtu,
 			bool targeted_match)
 {
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 23be8e01026b..b34116b15d43 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -314,12 +314,6 @@ static int dsa_slave_port_attr_set(struct net_device *dev, const void *ctx,
 
 		ret = dsa_port_bridge_flags(dp, attr->u.brport_flags, extack);
 		break;
-	case SWITCHDEV_ATTR_ID_BRIDGE_MROUTER:
-		if (!dsa_port_offloads_bridge(dp, attr->orig_dev))
-			return -EOPNOTSUPP;
-
-		ret = dsa_port_mrouter(dp->cpu_dp, attr->u.mrouter, extack);
-		break;
 	default:
 		ret = -EOPNOTSUPP;
 		break;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 180/334] PM: EM: Increase energy calculation precision
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 179/334] net: dsa: dont disable multicast flooding to the CPU even without an IGMP querier Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 181/334] selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, CCJ Yeh, Dietmar Eggemann,
	Lukasz Luba, Rafael J. Wysocki, Sasha Levin

From: Lukasz Luba <lukasz.luba@arm.com>

[ Upstream commit 7fcc17d0cb12938d2b3507973a6f93fc9ed2c7a1 ]

The Energy Model (EM) provides useful information about device power in
each performance state to other subsystems like: Energy Aware Scheduler
(EAS). The energy calculation in EAS does arithmetic operation based on
the EM em_cpu_energy(). Current implementation of that function uses
em_perf_state::cost as a pre-computed cost coefficient equal to:
cost = power * max_frequency / frequency.
The 'power' is expressed in milli-Watts (or in abstract scale).

There are corner cases when the EAS energy calculation for two Performance
Domains (PDs) return the same value. The EAS compares these values to
choose smaller one. It might happen that this values are equal due to
rounding error. In such scenario, we need better resolution, e.g. 1000
times better. To provide this possibility increase the resolution in the
em_perf_state::cost for 64-bit architectures. The cost of increasing
resolution on 32-bit is pretty high (64-bit division) and is not justified
since there are no new 32bit big.LITTLE EAS systems expected which would
benefit from this higher resolution.

This patch allows to avoid the rounding to milli-Watt errors, which might
occur in EAS energy estimation for each PD. The rounding error is common
for small tasks which have small utilization value.

There are two places in the code where it makes a difference:
1. In the find_energy_efficient_cpu() where we are searching for
best_delta. We might suffer there when two PDs return the same result,
like in the example below.

Scenario:
Low utilized system e.g. ~200 sum_util for PD0 and ~220 for PD1. There
are quite a few small tasks ~10-15 util. These tasks would suffer for
the rounding error. These utilization values are typical when running games
on Android. One of our partners has reported 5..10mA less battery drain
when running with increased resolution.

Some details:
We have two PDs: PD0 (big) and PD1 (little)
Let's compare w/o patch set ('old') and w/ patch set ('new')
We are comparing energy w/ task and w/o task placed in the PDs

a) 'old' w/o patch set, PD0
task_util = 13
cost = 480
sum_util_w/o_task = 215
sum_util_w_task = 228
scale_cpu = 1024
energy_w/o_task = 480 * 215 / 1024 = 100.78 => 100
energy_w_task = 480 * 228 / 1024 = 106.87 => 106
energy_diff = 106 - 100 = 6
(this is equal to 'old' PD1's energy_diff in 'c)')

b) 'new' w/ patch set, PD0
task_util = 13
cost = 480 * 1000 = 480000
sum_util_w/o_task = 215
sum_util_w_task = 228
energy_w/o_task = 480000 * 215 / 1024 = 100781
energy_w_task = 480000 * 228 / 1024  = 106875
energy_diff = 106875 - 100781 = 6094
(this is not equal to 'new' PD1's energy_diff in 'd)')

c) 'old' w/o patch set, PD1
task_util = 13
cost = 160
sum_util_w/o_task = 283
sum_util_w_task = 293
scale_cpu = 355
energy_w/o_task = 160 * 283 / 355 = 127.55 => 127
energy_w_task = 160 * 296 / 355 = 133.41 => 133
energy_diff = 133 - 127 = 6
(this is equal to 'old' PD0's energy_diff in 'a)')

d) 'new' w/ patch set, PD1
task_util = 13
cost = 160 * 1000 = 160000
sum_util_w/o_task = 283
sum_util_w_task = 293
scale_cpu = 355
energy_w/o_task = 160000 * 283 / 355 = 127549
energy_w_task = 160000 * 296 / 355 =   133408
energy_diff = 133408 - 127549 = 5859
(this is not equal to 'new' PD0's energy_diff in 'b)')

2. Difference in the 6% energy margin filter at the end of
find_energy_efficient_cpu(). With this patch the margin comparison also
has better resolution, so it's possible to have better task placement
thanks to that.

Fixes: 27871f7a8a341ef ("PM: Introduce an Energy Model management framework")
Reported-by: CCJ Yeh <CCj.Yeh@mediatek.com>
Reviewed-by: Dietmar Eggemann <dietmar.eggemann@arm.com>
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/energy_model.h | 16 ++++++++++++++++
 kernel/power/energy_model.c  |  4 +++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/include/linux/energy_model.h b/include/linux/energy_model.h
index 3f221dbf5f95..1834752c5617 100644
--- a/include/linux/energy_model.h
+++ b/include/linux/energy_model.h
@@ -53,6 +53,22 @@ struct em_perf_domain {
 #ifdef CONFIG_ENERGY_MODEL
 #define EM_MAX_POWER 0xFFFF
 
+/*
+ * Increase resolution of energy estimation calculations for 64-bit
+ * architectures. The extra resolution improves decision made by EAS for the
+ * task placement when two Performance Domains might provide similar energy
+ * estimation values (w/o better resolution the values could be equal).
+ *
+ * We increase resolution only if we have enough bits to allow this increased
+ * resolution (i.e. 64-bit). The costs for increasing resolution when 32-bit
+ * are pretty high and the returns do not justify the increased costs.
+ */
+#ifdef CONFIG_64BIT
+#define em_scale_power(p) ((p) * 1000)
+#else
+#define em_scale_power(p) (p)
+#endif
+
 struct em_data_callback {
 	/**
 	 * active_power() - Provide power at the next performance state of
diff --git a/kernel/power/energy_model.c b/kernel/power/energy_model.c
index 0f4530b3a8cd..a332ccd829e2 100644
--- a/kernel/power/energy_model.c
+++ b/kernel/power/energy_model.c
@@ -170,7 +170,9 @@ static int em_create_perf_table(struct device *dev, struct em_perf_domain *pd,
 	/* Compute the cost of each performance state. */
 	fmax = (u64) table[nr_states - 1].frequency;
 	for (i = 0; i < nr_states; i++) {
-		table[i].cost = div64_u64(fmax * table[i].power,
+		unsigned long power_res = em_scale_power(table[i].power);
+
+		table[i].cost = div64_u64(fmax * power_res,
 					  table[i].frequency);
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 181/334] selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 180/334] PM: EM: Increase energy calculation precision Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 182/334] leds: lgm-sso: Propagate error codes from callee to caller Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jose Blanquicet, Daniel Borkmann,
	Yonghong Song, Sasha Levin

From: Jose Blanquicet <josebl@microsoft.com>

[ Upstream commit 277b134057036df8c657079ca92c3e5e7d10aeaf ]

Currently, this test is incorrectly printing the destination port in
place of the destination IP.

Fixes: 2767c97765cb ("selftests/bpf: Implement sample tcp/tcp6 bpf_iter programs")
Signed-off-by: Jose Blanquicet <josebl@microsoft.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210805164044.527903-1-josebl@microsoft.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
index 2e4775c35414..92267abb462f 100644
--- a/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
+++ b/tools/testing/selftests/bpf/progs/bpf_iter_tcp4.c
@@ -121,7 +121,7 @@ static int dump_tcp_sock(struct seq_file *seq, struct tcp_sock *tp,
 	}
 
 	BPF_SEQ_PRINTF(seq, "%4d: %08X:%04X %08X:%04X ",
-		       seq_num, src, srcp, destp, destp);
+		       seq_num, src, srcp, dest, destp);
 	BPF_SEQ_PRINTF(seq, "%02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d ",
 		       state,
 		       tp->write_seq - tp->snd_una, rx_queue,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 182/334] leds: lgm-sso: Propagate error codes from callee to caller
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 181/334] selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 183/334] drm/msm: Fix error return code in msm_drm_init() Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Andy Shevchenko,
	Pavel Machek, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit 9cbc861095375793a69858f91f3ac4e817f320f0 ]

The one of the latest change to the driver reveals the problem that
the error codes from callee aren't propagated to the caller of
__sso_led_dt_parse(). Fix this accordingly.

Fixes: 9999908ca1ab ("leds: lgm-sso: Put fwnode in any case during ->probe()")
Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/leds/blink/leds-lgm-sso.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c
index ca9f88996819..aa14f0ebe7a0 100644
--- a/drivers/leds/blink/leds-lgm-sso.c
+++ b/drivers/leds/blink/leds-lgm-sso.c
@@ -644,7 +644,7 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 							      fwnode_child,
 							      GPIOD_ASIS, NULL);
 		if (IS_ERR(led->gpiod)) {
-			dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
+			ret = dev_err_probe(dev, PTR_ERR(led->gpiod), "led: get gpio fail!\n");
 			goto __dt_err;
 		}
 
@@ -664,8 +664,11 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 			desc->panic_indicator = 1;
 
 		ret = fwnode_property_read_u32(fwnode_child, "reg", &prop);
-		if (ret != 0 || prop >= SSO_LED_MAX_NUM) {
+		if (ret)
+			goto __dt_err;
+		if (prop >= SSO_LED_MAX_NUM) {
 			dev_err(dev, "invalid LED pin:%u\n", prop);
+			ret = -EINVAL;
 			goto __dt_err;
 		}
 		desc->pin = prop;
@@ -701,7 +704,8 @@ __sso_led_dt_parse(struct sso_led_priv *priv, struct fwnode_handle *fw_ssoled)
 				desc->brightness = LED_FULL;
 		}
 
-		if (sso_create_led(priv, led, fwnode_child))
+		ret = sso_create_led(priv, led, fwnode_child);
+		if (ret)
 			goto __dt_err;
 	}
 
@@ -715,7 +719,7 @@ __dt_err:
 		sso_led_shutdown(led);
 	}
 
-	return -EINVAL;
+	return ret;
 }
 
 static int sso_led_dt_parse(struct sso_led_priv *priv)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 183/334] drm/msm: Fix error return code in msm_drm_init()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 182/334] leds: lgm-sso: Propagate error codes from callee to caller Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 184/334] drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Li, Abhinav Kumar,
	Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Wei Li <liwei391@huawei.com>

[ Upstream commit bfddcfe155a2fe448fee0169c5cbc82c7fa73491 ]

When it fail to create crtc_event kthread, it just jump to err_msm_uninit,
while the 'ret' is not updated. So assign the return code before that.

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Li <liwei391@huawei.com>
Reviewed-by: Abhinav Kumar <abhinavk@codeaurora.org>
Link: https://lore.kernel.org/r/20210705134302.315813-1-liwei391@huawei.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/msm_drv.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c
index 9b8fa2ad0d84..729ab68d0203 100644
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -539,6 +539,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv)
 		if (IS_ERR(priv->event_thread[i].worker)) {
 			ret = PTR_ERR(priv->event_thread[i].worker);
 			DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n");
+			ret = PTR_ERR(priv->event_thread[i].worker);
 			goto err_msm_uninit;
 		}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 184/334] drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 183/334] drm/msm: Fix error return code in msm_drm_init() Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:13 ` [PATCH 5.14 185/334] drm/msm/mdp4: move HW revision detection to earlier phase Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Heidelberg, Dmitry Baryshkov,
	Rob Clark, Sasha Levin

From: David Heidelberg <david@ixit.cz>

[ Upstream commit 4d319afe666b0fc9a9855ba9bdf9ae3710ecf431 ]

Inspired by MDP5 code.
Also use DRM_DEV_INFO for MDP version as MDP5 does.

Cosmetic change: uint32_t -> u32 - checkpatch suggestion.

Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210705231641.315804-1-david@ixit.cz
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 27 ++++++++++++++++--------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 4a5b518288b0..3a7a01d801aa 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -19,20 +19,13 @@ static int mdp4_hw_init(struct msm_kms *kms)
 {
 	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
 	struct drm_device *dev = mdp4_kms->dev;
-	uint32_t version, major, minor, dmap_cfg, vg_cfg;
+	u32 major, minor, dmap_cfg, vg_cfg;
 	unsigned long clk;
 	int ret = 0;
 
 	pm_runtime_get_sync(dev->dev);
 
-	mdp4_enable(mdp4_kms);
-	version = mdp4_read(mdp4_kms, REG_MDP4_VERSION);
-	mdp4_disable(mdp4_kms);
-
-	major = FIELD(version, MDP4_VERSION_MAJOR);
-	minor = FIELD(version, MDP4_VERSION_MINOR);
-
-	DBG("found MDP4 version v%d.%d", major, minor);
+	read_mdp_hw_revision(mdp4_kms, &major, &minor);
 
 	if (major != 4) {
 		DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
@@ -411,6 +404,22 @@ fail:
 	return ret;
 }
 
+static void read_mdp_hw_revision(struct mdp4_kms *mdp4_kms,
+				 u32 *major, u32 *minor)
+{
+	struct drm_device *dev = mdp4_kms->dev;
+	u32 version;
+
+	mdp4_enable(mdp4_kms);
+	version = mdp4_read(mdp4_kms, REG_MDP4_VERSION);
+	mdp4_disable(mdp4_kms);
+
+	*major = FIELD(version, MDP4_VERSION_MAJOR);
+	*minor = FIELD(version, MDP4_VERSION_MINOR);
+
+	DRM_DEV_INFO(dev->dev, "MDP4 version v%d.%d", *major, *minor);
+}
+
 struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev->dev);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 185/334] drm/msm/mdp4: move HW revision detection to earlier phase
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 184/334] drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision Greg Kroah-Hartman
@ 2021-09-13 13:13 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 186/334] drm/msm/dp: update is_connected status base on sink count at dp_pm_resume() Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:13 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Heidelberg, Dmitry Baryshkov,
	Rob Clark, Sasha Levin

From: David Heidelberg <david@ixit.cz>

[ Upstream commit 4af4fc92939dc811ef291c0673946555aa4fb71f ]

Fixes if condition, which never worked inside mdp4_kms_init, since
HW detection has been done later in mdp4_hw_init.

Fixes: eb2b47bb9a03 ("drm/msm/mdp4: only use lut_clk on mdp4.2+")

Signed-off-by: David Heidelberg <david@ixit.cz>
Link: https://lore.kernel.org/r/20210705231641.315804-2-david@ixit.cz
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c | 45 ++++++++++++------------
 1 file changed, 22 insertions(+), 23 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
index 3a7a01d801aa..0712752742f4 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_kms.c
@@ -19,23 +19,12 @@ static int mdp4_hw_init(struct msm_kms *kms)
 {
 	struct mdp4_kms *mdp4_kms = to_mdp4_kms(to_mdp_kms(kms));
 	struct drm_device *dev = mdp4_kms->dev;
-	u32 major, minor, dmap_cfg, vg_cfg;
+	u32 dmap_cfg, vg_cfg;
 	unsigned long clk;
 	int ret = 0;
 
 	pm_runtime_get_sync(dev->dev);
 
-	read_mdp_hw_revision(mdp4_kms, &major, &minor);
-
-	if (major != 4) {
-		DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
-				major, minor);
-		ret = -ENXIO;
-		goto out;
-	}
-
-	mdp4_kms->rev = minor;
-
 	if (mdp4_kms->rev > 1) {
 		mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER0, 0x0707ffff);
 		mdp4_write(mdp4_kms, REG_MDP4_CS_CONTROLLER1, 0x03073f3f);
@@ -81,7 +70,6 @@ static int mdp4_hw_init(struct msm_kms *kms)
 	if (mdp4_kms->rev > 1)
 		mdp4_write(mdp4_kms, REG_MDP4_RESET_STATUS, 1);
 
-out:
 	pm_runtime_put_sync(dev->dev);
 
 	return ret;
@@ -428,6 +416,7 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 	struct msm_kms *kms = NULL;
 	struct msm_gem_address_space *aspace;
 	int irq, ret;
+	u32 major, minor;
 
 	mdp4_kms = kzalloc(sizeof(*mdp4_kms), GFP_KERNEL);
 	if (!mdp4_kms) {
@@ -488,15 +477,6 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 	if (IS_ERR(mdp4_kms->pclk))
 		mdp4_kms->pclk = NULL;
 
-	if (mdp4_kms->rev >= 2) {
-		mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk");
-		if (IS_ERR(mdp4_kms->lut_clk)) {
-			DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n");
-			ret = PTR_ERR(mdp4_kms->lut_clk);
-			goto fail;
-		}
-	}
-
 	mdp4_kms->axi_clk = devm_clk_get(&pdev->dev, "bus_clk");
 	if (IS_ERR(mdp4_kms->axi_clk)) {
 		DRM_DEV_ERROR(dev->dev, "failed to get axi_clk\n");
@@ -505,8 +485,27 @@ struct msm_kms *mdp4_kms_init(struct drm_device *dev)
 	}
 
 	clk_set_rate(mdp4_kms->clk, config->max_clk);
-	if (mdp4_kms->lut_clk)
+
+	read_mdp_hw_revision(mdp4_kms, &major, &minor);
+
+	if (major != 4) {
+		DRM_DEV_ERROR(dev->dev, "unexpected MDP version: v%d.%d\n",
+			      major, minor);
+		ret = -ENXIO;
+		goto fail;
+	}
+
+	mdp4_kms->rev = minor;
+
+	if (mdp4_kms->rev >= 2) {
+		mdp4_kms->lut_clk = devm_clk_get(&pdev->dev, "lut_clk");
+		if (IS_ERR(mdp4_kms->lut_clk)) {
+			DRM_DEV_ERROR(dev->dev, "failed to get lut_clk\n");
+			ret = PTR_ERR(mdp4_kms->lut_clk);
+			goto fail;
+		}
 		clk_set_rate(mdp4_kms->lut_clk, config->max_clk);
+	}
 
 	pm_runtime_enable(dev->dev);
 	mdp4_kms->rpm_enabled = true;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 186/334] drm/msm/dp: update is_connected status base on sink count at dp_pm_resume()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2021-09-13 13:13 ` [PATCH 5.14 185/334] drm/msm/mdp4: move HW revision detection to earlier phase Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 187/334] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuogee Hsieh, Stephen Boyd,
	Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Kuogee Hsieh <khsieh@codeaurora.org>

[ Upstream commit e8a767e04dbc7b201cb17ab99dca723a3488b6d4 ]

Currently at dp_pm_resume() is_connected state is decided base on hpd connection
status only. This will put is_connected in wrongly "true" state at the scenario
that dongle attached to DUT but without hmdi cable connecting to it. Fix this
problem by adding read sink count from dongle and decided is_connected state base
on both sink count and hpd connection status.

Changes in v2:
-- remove dp_get_sink_count() cand call drm_dp_read_sink_count()

Changes in v3:
-- delete status local variable from dp_pm_resume()

Changes in v4:
-- delete un necessary comment at dp_pm_resume()

Fixes: d9aa6571b28ba ("drm/msm/dp: check sink_count before update is_connected status")
Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Link: https://lore.kernel.org/r/1628092261-32346-1-git-send-email-khsieh@codeaurora.org
Tested-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_display.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 867388a399ad..8aca93309c1c 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -1286,7 +1286,7 @@ static int dp_pm_resume(struct device *dev)
 	struct platform_device *pdev = to_platform_device(dev);
 	struct msm_dp *dp_display = platform_get_drvdata(pdev);
 	struct dp_display_private *dp;
-	u32 status;
+	int sink_count = 0;
 
 	dp = container_of(dp_display, struct dp_display_private, dp_display);
 
@@ -1300,14 +1300,25 @@ static int dp_pm_resume(struct device *dev)
 
 	dp_catalog_ctrl_hpd_config(dp->catalog);
 
-	status = dp_catalog_link_is_connected(dp->catalog);
+	/*
+	 * set sink to normal operation mode -- D0
+	 * before dpcd read
+	 */
+	dp_link_psm_config(dp->link, &dp->panel->link_info, false);
+
+	if (dp_catalog_link_is_connected(dp->catalog)) {
+		sink_count = drm_dp_read_sink_count(dp->aux);
+		if (sink_count < 0)
+			sink_count = 0;
+	}
 
+	dp->link->sink_count = sink_count;
 	/*
 	 * can not declared display is connected unless
 	 * HDMI cable is plugged in and sink_count of
 	 * dongle become 1
 	 */
-	if (status && dp->link->sink_count)
+	if (dp->link->sink_count)
 		dp->dp_display.is_connected = true;
 	else
 		dp->dp_display.is_connected = false;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 187/334] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 186/334] drm/msm/dp: update is_connected status base on sink count at dp_pm_resume() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 188/334] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmitry Baryshkov, Rob Clark, Sasha Levin

From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>

[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ]

dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs
instead of mixers actually used for the CTL. Change it to clear
necessary data, using provided mixer ids.

Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210704230519.4081467-1-dmitry.baryshkov@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
index f8a74f6cdc4c..64740ddb983e 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c
@@ -345,10 +345,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)
 	int i;
 
 	for (i = 0; i < ctx->mixer_count; i++) {
-		DPU_REG_WRITE(c, CTL_LAYER(LM_0 + i), 0);
-		DPU_REG_WRITE(c, CTL_LAYER_EXT(LM_0 + i), 0);
-		DPU_REG_WRITE(c, CTL_LAYER_EXT2(LM_0 + i), 0);
-		DPU_REG_WRITE(c, CTL_LAYER_EXT3(LM_0 + i), 0);
+		enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id;
+
+		DPU_REG_WRITE(c, CTL_LAYER(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT2(mixer_id), 0);
+		DPU_REG_WRITE(c, CTL_LAYER_EXT3(mixer_id), 0);
 	}
 
 	DPU_REG_WRITE(c, CTL_FETCH_PIPE_ACTIVE, 0);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 188/334] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 187/334] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 189/334] counter: 104-quad-8: Return error when invalid mode during ceiling_write Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sam Protsenko, Marc Zyngier,
	Krzysztof Kozlowski, Alim Akhtar, Sasha Levin

From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>

[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ]

The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by
ARM).

Reported-by: Sam Protsenko <semen.protsenko@linaro.org>
Reported-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7")
Link: https://lore.kernel.org/r/20210805072110.4730-1-krzysztof.kozlowski@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi
index 10244e59d56d..56a0bb7eb0e6 100644
--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi
@@ -102,7 +102,7 @@
 			#address-cells = <0>;
 			interrupt-controller;
 			reg =	<0x11001000 0x1000>,
-				<0x11002000 0x1000>,
+				<0x11002000 0x2000>,
 				<0x11004000 0x2000>,
 				<0x11006000 0x2000>;
 		};
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 189/334] counter: 104-quad-8: Return error when invalid mode during ceiling_write
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 188/334] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 190/334] cgroup/cpuset: Miscellaneous code cleanup Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Syed Nayyar Waris,
	William Breathitt Gray, Jonathan Cameron, Sasha Levin

From: William Breathitt Gray <vilhelm.gray@gmail.com>

[ Upstream commit 728246e8f7269ecd35a2c6e6795323e6d8f48db7 ]

The 104-QUAD-8 only has two count modes where a ceiling value makes
sense: Range Limit and Modulo-N. Outside of these two modes, setting a
ceiling value is an invalid operation -- so let's report it as such by
returning -EINVAL.

Fixes: fc069262261c ("counter: 104-quad-8: Add lock guards - generic interface")
Acked-by: Syed Nayyar Waris <syednwaris@gmail.com>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Link: https://lore.kernel.org/r/a2147f022829b66839a1db5530a7fada47856847.1627990337.git.vilhelm.gray@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/counter/104-quad-8.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/counter/104-quad-8.c b/drivers/counter/104-quad-8.c
index 09a9a77cce06..81f9642777fb 100644
--- a/drivers/counter/104-quad-8.c
+++ b/drivers/counter/104-quad-8.c
@@ -715,12 +715,13 @@ static ssize_t quad8_count_ceiling_write(struct counter_device *counter,
 	case 1:
 	case 3:
 		quad8_preset_register_set(priv, count->id, ceiling);
-		break;
+		mutex_unlock(&priv->lock);
+		return len;
 	}
 
 	mutex_unlock(&priv->lock);
 
-	return len;
+	return -EINVAL;
 }
 
 static ssize_t quad8_count_preset_enable_read(struct counter_device *counter,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 190/334] cgroup/cpuset: Miscellaneous code cleanup
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 189/334] counter: 104-quad-8: Return error when invalid mode during ceiling_write Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 191/334] cgroup/cpuset: Fix violation of cpuset locking rule Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Waiman Long, Tejun Heo, Sasha Levin

From: Waiman Long <longman@redhat.com>

[ Upstream commit 0f3adb8a1e5f36e792598c1d77a2cfac9c90a4f9 ]

Use more descriptive variable names for update_prstate(), remove
unnecessary code and fix some typos. There is no functional change.

Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cpuset.c | 40 +++++++++++++++++++---------------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 592e9e37542f..28a784bf64b1 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1114,7 +1114,7 @@ enum subparts_cmd {
  * cpus_allowed can be granted or an error code will be returned.
  *
  * For partcmd_disable, the cpuset is being transofrmed from a partition
- * root back to a non-partition root. any CPUs in cpus_allowed that are in
+ * root back to a non-partition root. Any CPUs in cpus_allowed that are in
  * parent's subparts_cpus will be taken away from that cpumask and put back
  * into parent's effective_cpus. 0 should always be returned.
  *
@@ -1225,7 +1225,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 		/*
 		 * partcmd_update w/o newmask:
 		 *
-		 * addmask = cpus_allowed & parent->effectiveb_cpus
+		 * addmask = cpus_allowed & parent->effective_cpus
 		 *
 		 * Note that parent's subparts_cpus may have been
 		 * pre-shrunk in case there is a change in the cpu list.
@@ -1365,12 +1365,12 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 			case PRS_DISABLED:
 				/*
 				 * If parent is not a partition root or an
-				 * invalid partition root, clear the state
-				 * state and the CS_CPU_EXCLUSIVE flag.
+				 * invalid partition root, clear its state
+				 * and its CS_CPU_EXCLUSIVE flag.
 				 */
 				WARN_ON_ONCE(cp->partition_root_state
 					     != PRS_ERROR);
-				cp->partition_root_state = 0;
+				cp->partition_root_state = PRS_DISABLED;
 
 				/*
 				 * clear_bit() is an atomic operation and
@@ -1937,30 +1937,28 @@ out:
 
 /*
  * update_prstate - update partititon_root_state
- * cs:	the cpuset to update
- * val: 0 - disabled, 1 - enabled
+ * cs: the cpuset to update
+ * new_prs: new partition root state
  *
  * Call with cpuset_mutex held.
  */
-static int update_prstate(struct cpuset *cs, int val)
+static int update_prstate(struct cpuset *cs, int new_prs)
 {
 	int err;
 	struct cpuset *parent = parent_cs(cs);
-	struct tmpmasks tmp;
+	struct tmpmasks tmpmask;
 
-	if ((val != 0) && (val != 1))
-		return -EINVAL;
-	if (val == cs->partition_root_state)
+	if (new_prs == cs->partition_root_state)
 		return 0;
 
 	/*
 	 * Cannot force a partial or invalid partition root to a full
 	 * partition root.
 	 */
-	if (val && cs->partition_root_state)
+	if (new_prs && (cs->partition_root_state < 0))
 		return -EINVAL;
 
-	if (alloc_cpumasks(NULL, &tmp))
+	if (alloc_cpumasks(NULL, &tmpmask))
 		return -ENOMEM;
 
 	err = -EINVAL;
@@ -1978,7 +1976,7 @@ static int update_prstate(struct cpuset *cs, int val)
 			goto out;
 
 		err = update_parent_subparts_cpumask(cs, partcmd_enable,
-						     NULL, &tmp);
+						     NULL, &tmpmask);
 		if (err) {
 			update_flag(CS_CPU_EXCLUSIVE, cs, 0);
 			goto out;
@@ -1990,18 +1988,18 @@ static int update_prstate(struct cpuset *cs, int val)
 		 * CS_CPU_EXCLUSIVE bit.
 		 */
 		if (cs->partition_root_state == PRS_ERROR) {
-			cs->partition_root_state = 0;
+			cs->partition_root_state = PRS_DISABLED;
 			update_flag(CS_CPU_EXCLUSIVE, cs, 0);
 			err = 0;
 			goto out;
 		}
 
 		err = update_parent_subparts_cpumask(cs, partcmd_disable,
-						     NULL, &tmp);
+						     NULL, &tmpmask);
 		if (err)
 			goto out;
 
-		cs->partition_root_state = 0;
+		cs->partition_root_state = PRS_DISABLED;
 
 		/* Turning off CS_CPU_EXCLUSIVE will not return error */
 		update_flag(CS_CPU_EXCLUSIVE, cs, 0);
@@ -2015,11 +2013,11 @@ static int update_prstate(struct cpuset *cs, int val)
 		update_tasks_cpumask(parent);
 
 	if (parent->child_ecpus_count)
-		update_sibling_cpumasks(parent, cs, &tmp);
+		update_sibling_cpumasks(parent, cs, &tmpmask);
 
 	rebuild_sched_domains_locked();
 out:
-	free_cpumasks(NULL, &tmp);
+	free_cpumasks(NULL, &tmpmask);
 	return err;
 }
 
@@ -3060,7 +3058,7 @@ retry:
 		goto retry;
 	}
 
-	parent =  parent_cs(cs);
+	parent = parent_cs(cs);
 	compute_effective_cpumask(&new_cpus, cs, parent);
 	nodes_and(new_mems, cs->mems_allowed, parent->effective_mems);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 191/334] cgroup/cpuset: Fix violation of cpuset locking rule
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 190/334] cgroup/cpuset: Miscellaneous code cleanup Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 192/334] ASoC: Intel: Fix platform ID matching Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Waiman Long, Tejun Heo, Sasha Levin

From: Waiman Long <longman@redhat.com>

[ Upstream commit 6ba34d3c73674e46d9e126e4f0cee79e5ef2481c ]

The cpuset fields that manage partition root state do not strictly
follow the cpuset locking rule that update to cpuset has to be done
with both the callback_lock and cpuset_mutex held. This is now fixed
by making sure that the locking rule is upheld.

Fixes: 3881b86128d0 ("cpuset: Add an error state to cpuset.sched.partition")
Fixes: 4b842da276a8 ("cpuset: Make CPU hotplug work with partition")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cgroup/cpuset.c | 58 +++++++++++++++++++++++++-----------------
 1 file changed, 35 insertions(+), 23 deletions(-)

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index 28a784bf64b1..13b5be6df4da 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c
@@ -1148,6 +1148,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 	struct cpuset *parent = parent_cs(cpuset);
 	int adding;	/* Moving cpus from effective_cpus to subparts_cpus */
 	int deleting;	/* Moving cpus from subparts_cpus to effective_cpus */
+	int new_prs;
 	bool part_error = false;	/* Partition error? */
 
 	percpu_rwsem_assert_held(&cpuset_rwsem);
@@ -1183,6 +1184,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 	 * A cpumask update cannot make parent's effective_cpus become empty.
 	 */
 	adding = deleting = false;
+	new_prs = cpuset->partition_root_state;
 	if (cmd == partcmd_enable) {
 		cpumask_copy(tmp->addmask, cpuset->cpus_allowed);
 		adding = true;
@@ -1247,11 +1249,11 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 		switch (cpuset->partition_root_state) {
 		case PRS_ENABLED:
 			if (part_error)
-				cpuset->partition_root_state = PRS_ERROR;
+				new_prs = PRS_ERROR;
 			break;
 		case PRS_ERROR:
 			if (!part_error)
-				cpuset->partition_root_state = PRS_ENABLED;
+				new_prs = PRS_ENABLED;
 			break;
 		}
 		/*
@@ -1260,10 +1262,10 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 		part_error = (prev_prs == PRS_ERROR);
 	}
 
-	if (!part_error && (cpuset->partition_root_state == PRS_ERROR))
+	if (!part_error && (new_prs == PRS_ERROR))
 		return 0;	/* Nothing need to be done */
 
-	if (cpuset->partition_root_state == PRS_ERROR) {
+	if (new_prs == PRS_ERROR) {
 		/*
 		 * Remove all its cpus from parent's subparts_cpus.
 		 */
@@ -1272,7 +1274,7 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 				       parent->subparts_cpus);
 	}
 
-	if (!adding && !deleting)
+	if (!adding && !deleting && (new_prs == cpuset->partition_root_state))
 		return 0;
 
 	/*
@@ -1299,6 +1301,9 @@ static int update_parent_subparts_cpumask(struct cpuset *cpuset, int cmd,
 	}
 
 	parent->nr_subparts_cpus = cpumask_weight(parent->subparts_cpus);
+
+	if (cpuset->partition_root_state != new_prs)
+		cpuset->partition_root_state = new_prs;
 	spin_unlock_irq(&callback_lock);
 
 	return cmd == partcmd_update;
@@ -1321,6 +1326,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 	struct cpuset *cp;
 	struct cgroup_subsys_state *pos_css;
 	bool need_rebuild_sched_domains = false;
+	int new_prs;
 
 	rcu_read_lock();
 	cpuset_for_each_descendant_pre(cp, pos_css, cs) {
@@ -1360,7 +1366,8 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 		 * update_tasks_cpumask() again for tasks in the parent
 		 * cpuset if the parent's subparts_cpus changes.
 		 */
-		if ((cp != cs) && cp->partition_root_state) {
+		new_prs = cp->partition_root_state;
+		if ((cp != cs) && new_prs) {
 			switch (parent->partition_root_state) {
 			case PRS_DISABLED:
 				/*
@@ -1370,7 +1377,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 				 */
 				WARN_ON_ONCE(cp->partition_root_state
 					     != PRS_ERROR);
-				cp->partition_root_state = PRS_DISABLED;
+				new_prs = PRS_DISABLED;
 
 				/*
 				 * clear_bit() is an atomic operation and
@@ -1391,11 +1398,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 				/*
 				 * When parent is invalid, it has to be too.
 				 */
-				cp->partition_root_state = PRS_ERROR;
-				if (cp->nr_subparts_cpus) {
-					cp->nr_subparts_cpus = 0;
-					cpumask_clear(cp->subparts_cpus);
-				}
+				new_prs = PRS_ERROR;
 				break;
 			}
 		}
@@ -1407,8 +1410,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 		spin_lock_irq(&callback_lock);
 
 		cpumask_copy(cp->effective_cpus, tmp->new_cpus);
-		if (cp->nr_subparts_cpus &&
-		   (cp->partition_root_state != PRS_ENABLED)) {
+		if (cp->nr_subparts_cpus && (new_prs != PRS_ENABLED)) {
 			cp->nr_subparts_cpus = 0;
 			cpumask_clear(cp->subparts_cpus);
 		} else if (cp->nr_subparts_cpus) {
@@ -1435,6 +1437,10 @@ static void update_cpumasks_hier(struct cpuset *cs, struct tmpmasks *tmp)
 					= cpumask_weight(cp->subparts_cpus);
 			}
 		}
+
+		if (new_prs != cp->partition_root_state)
+			cp->partition_root_state = new_prs;
+
 		spin_unlock_irq(&callback_lock);
 
 		WARN_ON(!is_in_v2_mode() &&
@@ -1944,25 +1950,25 @@ out:
  */
 static int update_prstate(struct cpuset *cs, int new_prs)
 {
-	int err;
+	int err, old_prs = cs->partition_root_state;
 	struct cpuset *parent = parent_cs(cs);
 	struct tmpmasks tmpmask;
 
-	if (new_prs == cs->partition_root_state)
+	if (old_prs == new_prs)
 		return 0;
 
 	/*
 	 * Cannot force a partial or invalid partition root to a full
 	 * partition root.
 	 */
-	if (new_prs && (cs->partition_root_state < 0))
+	if (new_prs && (old_prs == PRS_ERROR))
 		return -EINVAL;
 
 	if (alloc_cpumasks(NULL, &tmpmask))
 		return -ENOMEM;
 
 	err = -EINVAL;
-	if (!cs->partition_root_state) {
+	if (!old_prs) {
 		/*
 		 * Turning on partition root requires setting the
 		 * CS_CPU_EXCLUSIVE bit implicitly as well and cpus_allowed
@@ -1981,14 +1987,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)
 			update_flag(CS_CPU_EXCLUSIVE, cs, 0);
 			goto out;
 		}
-		cs->partition_root_state = PRS_ENABLED;
 	} else {
 		/*
 		 * Turning off partition root will clear the
 		 * CS_CPU_EXCLUSIVE bit.
 		 */
-		if (cs->partition_root_state == PRS_ERROR) {
-			cs->partition_root_state = PRS_DISABLED;
+		if (old_prs == PRS_ERROR) {
 			update_flag(CS_CPU_EXCLUSIVE, cs, 0);
 			err = 0;
 			goto out;
@@ -1999,8 +2003,6 @@ static int update_prstate(struct cpuset *cs, int new_prs)
 		if (err)
 			goto out;
 
-		cs->partition_root_state = PRS_DISABLED;
-
 		/* Turning off CS_CPU_EXCLUSIVE will not return error */
 		update_flag(CS_CPU_EXCLUSIVE, cs, 0);
 	}
@@ -2017,6 +2019,12 @@ static int update_prstate(struct cpuset *cs, int new_prs)
 
 	rebuild_sched_domains_locked();
 out:
+	if (!err) {
+		spin_lock_irq(&callback_lock);
+		cs->partition_root_state = new_prs;
+		spin_unlock_irq(&callback_lock);
+	}
+
 	free_cpumasks(NULL, &tmpmask);
 	return err;
 }
@@ -3080,8 +3088,10 @@ retry:
 	if (is_partition_root(cs) && (cpumask_empty(&new_cpus) ||
 	   (parent->partition_root_state == PRS_ERROR))) {
 		if (cs->nr_subparts_cpus) {
+			spin_lock_irq(&callback_lock);
 			cs->nr_subparts_cpus = 0;
 			cpumask_clear(cs->subparts_cpus);
+			spin_unlock_irq(&callback_lock);
 			compute_effective_cpumask(&new_cpus, cs, parent);
 		}
 
@@ -3095,7 +3105,9 @@ retry:
 		     cpumask_empty(&new_cpus)) {
 			update_parent_subparts_cpumask(cs, partcmd_disable,
 						       NULL, tmp);
+			spin_lock_irq(&callback_lock);
 			cs->partition_root_state = PRS_ERROR;
+			spin_unlock_irq(&callback_lock);
 		}
 		cpuset_force_rebuild();
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 192/334] ASoC: Intel: Fix platform ID matching
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 191/334] cgroup/cpuset: Fix violation of cpuset locking rule Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 193/334] Bluetooth: fix repeated calls to sco_sock_kill Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Curtis Malainey, Matt Davis,
	Cezary Rojewski, Pierre-Louis Bossart, Mark Brown, Sasha Levin

From: Curtis Malainey <cujomalainey@chromium.org>

[ Upstream commit f4eeaed04e861b95f1f2c911263f2fcaa959c078 ]

Sparse warnings triggered truncating the IDs of some platform device
tables. Unfortunately some of the IDs in the match tables were missed
which breaks audio. The KBL change has been verified to fix audio, the
CML change was not tested as it was found through grepping the broken
changes and found to match the same situation in anticipation that it
should also be fixed.

Fixes: 94efd726b947 ("ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 characters")
Fixes: 24e46fb811e9 ("ASoC: Intel: bxt_da7219_max98357a: shrink platform_id below 20 characters")
Signed-off-by: Curtis Malainey <cujomalainey@chromium.org>
Tested-by: Matt Davis <mattedavis@google.com>
Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210809213544.1682444-1-cujomalainey@chromium.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/common/soc-acpi-intel-cml-match.c | 2 +-
 sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/intel/common/soc-acpi-intel-cml-match.c b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
index 42ef51c3fb4f..b591c6fd13fd 100644
--- a/sound/soc/intel/common/soc-acpi-intel-cml-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-cml-match.c
@@ -75,7 +75,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cml_machines[] = {
 	},
 	{
 		.id = "DLGS7219",
-		.drv_name = "cml_da7219_max98357a",
+		.drv_name = "cml_da7219_mx98357a",
 		.machine_quirk = snd_soc_acpi_codec_list,
 		.quirk_data = &max98390_spk_codecs,
 		.sof_fw_filename = "sof-cml.ri",
diff --git a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
index ba5ff468c265..741bf2f9e081 100644
--- a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c
@@ -87,7 +87,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_kbl_machines[] = {
 	},
 	{
 		.id = "DLGS7219",
-		.drv_name = "kbl_da7219_max98357a",
+		.drv_name = "kbl_da7219_mx98357a",
 		.fw_filename = "intel/dsp_fw_kbl.bin",
 		.machine_quirk = snd_soc_acpi_codec_list,
 		.quirk_data = &kbl_7219_98357_codecs,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 193/334] Bluetooth: fix repeated calls to sco_sock_kill
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 192/334] ASoC: Intel: Fix platform ID matching Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 194/334] drm/msm/dsi: Fix some reference counted resource leaks Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Desmond Cheong Zhi Xi,
	Luiz Augusto von Dentz, Sasha Levin

From: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ]

In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed
socket"), a check was added to sco_sock_kill to skip killing a socket
if the SOCK_DEAD flag was set.

This was done after a trace for a use-after-free bug showed that the
same sock pointer was being killed twice.

Unfortunately, this check prevents sco_sock_kill from running on any
socket. sco_sock_kill kills a socket only if it's zapped and orphaned,
however sock_orphan announces that the socket is dead before detaching
it. i.e., orphaned sockets have the SOCK_DEAD flag set.

To fix this, we remove the check for SOCK_DEAD, and avoid repeated
calls to sco_sock_kill by removing incorrect calls in:

1. sco_sock_timeout. The socket should not be killed on timeout as
further processing is expected to be done. For example,
sco_sock_connect sets the timer then waits for the socket to be
connected or for an error to be returned.

2. sco_conn_del. This function should clean up resources for the
connection, but the socket itself should be cleaned up in
sco_sock_release.

3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen
and sco_sock_release are followed by sco_sock_kill. Hence the
duplicated call should be removed.

Fixes: 4e1a720d0312 ("Bluetooth: avoid killing an already killed socket")
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/sco.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index ffa2a77a3e4c..b5ab842c7c4a 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -85,7 +85,6 @@ static void sco_sock_timeout(struct timer_list *t)
 	sk->sk_state_change(sk);
 	bh_unlock_sock(sk);
 
-	sco_sock_kill(sk);
 	sock_put(sk);
 }
 
@@ -177,7 +176,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err)
 		sco_sock_clear_timer(sk);
 		sco_chan_del(sk, err);
 		bh_unlock_sock(sk);
-		sco_sock_kill(sk);
 		sock_put(sk);
 	}
 
@@ -394,8 +392,7 @@ static void sco_sock_cleanup_listen(struct sock *parent)
  */
 static void sco_sock_kill(struct sock *sk)
 {
-	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket ||
-	    sock_flag(sk, SOCK_DEAD))
+	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 		return;
 
 	BT_DBG("sk %p state %d", sk, sk->sk_state);
@@ -447,7 +444,6 @@ static void sco_sock_close(struct sock *sk)
 	lock_sock(sk);
 	__sco_sock_close(sk);
 	release_sock(sk);
-	sco_sock_kill(sk);
 }
 
 static void sco_skb_put_cmsg(struct sk_buff *skb, struct msghdr *msg,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 194/334] drm/msm/dsi: Fix some reference counted resource leaks
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 193/334] Bluetooth: fix repeated calls to sco_sock_kill Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 195/334] drm/msm/dp: replug event is converted into an unplug followed by an plug events Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Rob Clark, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6977cc89c87506ff17e6c05f0e37f46752256e82 ]

'of_find_device_by_node()' takes a reference that must be released when
not needed anymore.
This is expected to be done in 'dsi_destroy()'.

However, there are 2 issues in 'dsi_get_phy()'.

First, if 'of_find_device_by_node()' succeeds but 'platform_get_drvdata()'
returns NULL, 'msm_dsi->phy_dev' will still be NULL, and the reference
won't be released in 'dsi_destroy()'.

Secondly, as 'of_find_device_by_node()' already takes a reference, there is
no need for an additional 'get_device()'.

Move the assignment to 'msm_dsi->phy_dev' a few lines above and remove the
unneeded 'get_device()' to solve both issues.

Fixes: ec31abf6684e ("drm/msm/dsi: Separate PHY to another platform device")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/f15bc57648a00e7c99f943903468a04639d50596.1628241097.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dsi/dsi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/dsi/dsi.c b/drivers/gpu/drm/msm/dsi/dsi.c
index 75afc12a7b25..29d11f1cb79b 100644
--- a/drivers/gpu/drm/msm/dsi/dsi.c
+++ b/drivers/gpu/drm/msm/dsi/dsi.c
@@ -26,8 +26,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
 	}
 
 	phy_pdev = of_find_device_by_node(phy_node);
-	if (phy_pdev)
+	if (phy_pdev) {
 		msm_dsi->phy = platform_get_drvdata(phy_pdev);
+		msm_dsi->phy_dev = &phy_pdev->dev;
+	}
 
 	of_node_put(phy_node);
 
@@ -36,8 +38,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)
 		return -EPROBE_DEFER;
 	}
 
-	msm_dsi->phy_dev = get_device(&phy_pdev->dev);
-
 	return 0;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 195/334] drm/msm/dp: replug event is converted into an unplug followed by an plug events
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 194/334] drm/msm/dsi: Fix some reference counted resource leaks Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 196/334] net/mlx5: Fix unpublish devlink parameters Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kuogee Hsieh, Stephen Boyd,
	Rob Clark, Sasha Levin

From: Kuogee Hsieh <khsieh@codeaurora.org>

[ Upstream commit 7e10bf427850f2d7133fd091999abd5fc1755cdb ]

Remove special handling of replug interrupt and instead treat replug event
as a sequential unplug followed by a plugin event. This is needed to meet
the requirements of DP Link Layer CTS test case 4.2.1.3.

Changes in V2:
-- add fixes statement

Changes in V3:
-- delete EV_HPD_REPLUG_INT

Fixes: f21c8a276c2d ("drm/msm/dp: handle irq_hpd with sink_count = 0 correctly")

Signed-off-by: Kuogee Hsieh <khsieh@codeaurora.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/1628196295-7382-5-git-send-email-khsieh@codeaurora.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/dp/dp_display.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c
index 8aca93309c1c..997fd67f7379 100644
--- a/drivers/gpu/drm/msm/dp/dp_display.c
+++ b/drivers/gpu/drm/msm/dp/dp_display.c
@@ -55,7 +55,6 @@ enum {
 	EV_HPD_INIT_SETUP,
 	EV_HPD_PLUG_INT,
 	EV_IRQ_HPD_INT,
-	EV_HPD_REPLUG_INT,
 	EV_HPD_UNPLUG_INT,
 	EV_USER_NOTIFICATION,
 	EV_CONNECT_PENDING_TIMEOUT,
@@ -1119,9 +1118,6 @@ static int hpd_event_thread(void *data)
 		case EV_IRQ_HPD_INT:
 			dp_irq_hpd_handle(dp_priv, todo->data);
 			break;
-		case EV_HPD_REPLUG_INT:
-			/* do nothing */
-			break;
 		case EV_USER_NOTIFICATION:
 			dp_display_send_hpd_notification(dp_priv,
 						todo->data);
@@ -1165,10 +1161,8 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)
 
 	if (hpd_isr_status & 0x0F) {
 		/* hpd related interrupts */
-		if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK ||
-			hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
+		if (hpd_isr_status & DP_DP_HPD_PLUG_INT_MASK)
 			dp_add_event(dp, EV_HPD_PLUG_INT, 0, 0);
-		}
 
 		if (hpd_isr_status & DP_DP_IRQ_HPD_INT_MASK) {
 			/* stop sentinel connect pending checking */
@@ -1176,8 +1170,10 @@ static irqreturn_t dp_display_irq_handler(int irq, void *dev_id)
 			dp_add_event(dp, EV_IRQ_HPD_INT, 0, 0);
 		}
 
-		if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK)
-			dp_add_event(dp, EV_HPD_REPLUG_INT, 0, 0);
+		if (hpd_isr_status & DP_DP_HPD_REPLUG_INT_MASK) {
+			dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
+			dp_add_event(dp, EV_HPD_PLUG_INT, 0, 3);
+		}
 
 		if (hpd_isr_status & DP_DP_HPD_UNPLUG_INT_MASK)
 			dp_add_event(dp, EV_HPD_UNPLUG_INT, 0, 0);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 196/334] net/mlx5: Fix unpublish devlink parameters
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 195/334] drm/msm/dp: replug event is converted into an unplug followed by an plug events Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 197/334] ASoC: rt5682: Properly turn off regulators if wrong device ID Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Parav Pandit, Jiri Pirko,
	Leon Romanovsky, David S. Miller, Sasha Levin

From: Parav Pandit <parav@nvidia.com>

[ Upstream commit 6f35723864b42ec9e9bb95a503449633395c4975 ]

Cleanup routine missed to unpublish the parameters. Add it.

Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/devlink.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
index d791d351b489..be6b75bd10f1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c
@@ -670,6 +670,7 @@ params_reg_err:
 void mlx5_devlink_unregister(struct devlink *devlink)
 {
 	mlx5_devlink_traps_unregister(devlink);
+	devlink_params_unpublish(devlink);
 	devlink_params_unregister(devlink, mlx5_devlink_params,
 				  ARRAY_SIZE(mlx5_devlink_params));
 	devlink_unregister(devlink);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 197/334] ASoC: rt5682: Properly turn off regulators if wrong device ID
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 196/334] net/mlx5: Fix unpublish devlink parameters Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 198/334] drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Stephen Boyd,
	Mark Brown, Sasha Levin

From: Douglas Anderson <dianders@chromium.org>

[ Upstream commit 772d44526e203c062171786e514373f129616278 ]

When I booted up on a board that had a slightly different codec
stuffed on it, I got this message at bootup:

  rt5682 9-001a: Device with ID register 6749 is not rt5682

That's normal/expected, but what wasn't normal was the splat that I
got after:

  WARNING: CPU: 7 PID: 176 at drivers/regulator/core.c:2151 _regulator_put+0x150/0x158
  pc : _regulator_put+0x150/0x158
  ...
  Call trace:
   _regulator_put+0x150/0x158
   regulator_bulk_free+0x48/0x70
   devm_regulator_bulk_release+0x20/0x2c
   release_nodes+0x1cc/0x244
   devres_release_all+0x44/0x60
   really_probe+0x17c/0x378
   ...

This is because the error paths don't turn off the regulator. Let's
fix that.

Fixes: 0ddce71c21f0 ("ASoC: rt5682: add rt5682 codec driver")
Fixes: 87b42abae99d ("ASoC: rt5682: Implement remove callback")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20210811081751.v2.1.I4a1d9aa5d99e05aeee15c2768db600158d76cab8@changeid
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/rt5682-i2c.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c
index 4a56a52adab5..e559b965a0a6 100644
--- a/sound/soc/codecs/rt5682-i2c.c
+++ b/sound/soc/codecs/rt5682-i2c.c
@@ -117,6 +117,13 @@ static struct snd_soc_dai_driver rt5682_dai[] = {
 	},
 };
 
+static void rt5682_i2c_disable_regulators(void *data)
+{
+	struct rt5682_priv *rt5682 = data;
+
+	regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies);
+}
+
 static int rt5682_i2c_probe(struct i2c_client *i2c,
 		const struct i2c_device_id *id)
 {
@@ -157,6 +164,11 @@ static int rt5682_i2c_probe(struct i2c_client *i2c,
 		return ret;
 	}
 
+	ret = devm_add_action_or_reset(&i2c->dev, rt5682_i2c_disable_regulators,
+				       rt5682);
+	if (ret)
+		return ret;
+
 	ret = regulator_bulk_enable(ARRAY_SIZE(rt5682->supplies),
 				    rt5682->supplies);
 	if (ret) {
@@ -285,7 +297,6 @@ static int rt5682_i2c_remove(struct i2c_client *client)
 	struct rt5682_priv *rt5682 = i2c_get_clientdata(client);
 
 	rt5682_i2c_shutdown(client);
-	regulator_bulk_disable(ARRAY_SIZE(rt5682->supplies), rt5682->supplies);
 
 	return 0;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 198/334] drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 197/334] ASoC: rt5682: Properly turn off regulators if wrong device ID Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 199/334] usb: dwc3: meson-g12a: add IRQ check Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Boyd, Rob Clark,
	Laurent Pinchart, Douglas Anderson, Sasha Levin

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit c7782443a88926a4f938f0193041616328cf2db2 ]

If we created our own connector because the driver does not support the
NO_CONNECTOR flag, we don't want the downstream bridge to *also* create
a connector.  And if this driver did pass the NO_CONNECTOR flag (and we
supported that mode) this would change nothing.

Fixes: 4e5763f03e10 ("drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge")
Reported-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Tested-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Tested-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20210811235253.924867-2-robdclark@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/bridge/ti-sn65dsi86.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
index c9cddf317c72..3aeed2731945 100644
--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c
+++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c
@@ -531,6 +531,9 @@ static int ti_sn_bridge_attach(struct drm_bridge *bridge,
 	}
 	pdata->dsi = dsi;
 
+	/* We never want the next bridge to *also* create a connector: */
+	flags |= DRM_BRIDGE_ATTACH_NO_CONNECTOR;
+
 	/* Attach the next bridge */
 	ret = drm_bridge_attach(bridge->encoder, pdata->next_bridge,
 				&pdata->bridge, flags);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 199/334] usb: dwc3: meson-g12a: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 198/334] drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 200/334] usb: dwc3: qcom: " Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Blumenstingl, Felipe Balbi,
	Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit baa2986bda3f7b2386607587a4185e3dff8f98df ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_threaded_irq()
(which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding
an original error code. Stop calling devm_request_threaded_irq() with the
invalid IRQ #s.

Fixes: f90db10779ad ("usb: dwc3: meson-g12a: Add support for IRQ based OTG switching")
Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/96106462-5538-0b2f-f2ab-ee56e4853912@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/dwc3-meson-g12a.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/dwc3/dwc3-meson-g12a.c b/drivers/usb/dwc3/dwc3-meson-g12a.c
index ffe301d6ea35..d0f9b7c296b0 100644
--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
@@ -598,6 +598,8 @@ static int dwc3_meson_g12a_otg_init(struct platform_device *pdev,
 				   USB_R5_ID_DIG_IRQ, 0);
 
 		irq = platform_get_irq(pdev, 0);
+		if (irq < 0)
+			return irq;
 		ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
 						dwc3_meson_g12a_irq_thread,
 						IRQF_ONESHOT, pdev->name, priv);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 200/334] usb: dwc3: qcom: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 199/334] usb: dwc3: meson-g12a: add IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 201/334] usb: gadget: udc: at91: " Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 175006956740f70ca23394c58f8d7804776741bd ]

In dwc3_qcom_acpi_register_core(), the driver neglects to check the result
of platform_get_irq()'s call and blithely assigns the negative error codes
to the allocated child device's IRQ resource and then passing this resource
to platform_device_add_resources() and later causing dwc3_otg_get_irq() to
fail anyway.  Stop calling platform_device_add_resources() with the invalid
IRQ #s, so that there's less complexity in the IRQ error checking.

Fixes: 2bc02355f8ba ("usb: dwc3: qcom: Add support for booting with ACPI")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/45fec3da-1679-5bfe-5d74-219ca3fb28e7@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/dwc3/dwc3-qcom.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 49e6ca94486d..cfbb96f6627e 100644
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -614,6 +614,10 @@ static int dwc3_qcom_acpi_register_core(struct platform_device *pdev)
 		qcom->acpi_pdata->dwc3_core_base_size;
 
 	irq = platform_get_irq(pdev_irq, 0);
+	if (irq < 0) {
+		ret = irq;
+		goto out;
+	}
 	child_res[1].flags = IORESOURCE_IRQ;
 	child_res[1].start = child_res[1].end = irq;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 201/334] usb: gadget: udc: at91: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 200/334] usb: dwc3: qcom: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 202/334] usb: gadget: udc: s3c2410: " Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Felipe Balbi, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 50855c31573b02963f0aa2aacfd4ea41c31ae0e0 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code. Stop calling devm_request_irq() with the invalid IRQ #s.

Fixes: 8b2e76687b39 ("USB: AT91 UDC updates, mostly power management")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Acked-by: Felipe Balbi <balbi@kernel.org>
Link: https://lore.kernel.org/r/6654a224-739a-1a80-12f0-76d920f87b6c@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/at91_udc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/at91_udc.c b/drivers/usb/gadget/udc/at91_udc.c
index eede5cedacb4..d9ad9adf7348 100644
--- a/drivers/usb/gadget/udc/at91_udc.c
+++ b/drivers/usb/gadget/udc/at91_udc.c
@@ -1876,7 +1876,9 @@ static int at91udc_probe(struct platform_device *pdev)
 	clk_disable(udc->iclk);
 
 	/* request UDC and maybe VBUS irqs */
-	udc->udp_irq = platform_get_irq(pdev, 0);
+	udc->udp_irq = retval = platform_get_irq(pdev, 0);
+	if (retval < 0)
+		goto err_unprepare_iclk;
 	retval = devm_request_irq(dev, udc->udp_irq, at91_udc_irq, 0,
 				  driver_name, udc);
 	if (retval) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 202/334] usb: gadget: udc: s3c2410: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 201/334] usb: gadget: udc: at91: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 203/334] mac80211: remove unnecessary NULL check in ieee80211_register_hw() Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Felipe Balbi,
	Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit ecff88e819e31081d41cd05bb199b9bd10e13e90 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code. Stop calling request_irq() with the invalid IRQ #s.

Fixes: 188db4435ac6 ("usb: gadget: s3c: use platform resources")
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/bd69b22c-b484-5a1f-c798-78d4b78405f2@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/s3c2410_udc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/usb/gadget/udc/s3c2410_udc.c b/drivers/usb/gadget/udc/s3c2410_udc.c
index 179777cb699f..e3931da24277 100644
--- a/drivers/usb/gadget/udc/s3c2410_udc.c
+++ b/drivers/usb/gadget/udc/s3c2410_udc.c
@@ -1784,6 +1784,10 @@ static int s3c2410_udc_probe(struct platform_device *pdev)
 	s3c2410_udc_reinit(udc);
 
 	irq_usbd = platform_get_irq(pdev, 0);
+	if (irq_usbd < 0) {
+		retval = irq_usbd;
+		goto err_udc_clk;
+	}
 
 	/* irq setup after old hardware state is cleaned up */
 	retval = request_irq(irq_usbd, s3c2410_udc_irq,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 203/334] mac80211: remove unnecessary NULL check in ieee80211_register_hw()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 202/334] usb: gadget: udc: s3c2410: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 204/334] usb: misc: brcmstb-usb-pinmap: add IRQ check Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Johannes Berg, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 4a11174d6dbd0bde6d5a1d6efb0d70f58811db55 ]

The address "&sband->iftype_data[i]" points to an array at the end of
struct.  It can't be NULL and so the check can be removed.

Fixes: bac2fd3d7534 ("mac80211: remove use of ieee80211_get_he_sta_cap()")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/YNmgHi7Rh3SISdog@mwanda
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index fcae76ddd586..45fb517591ee 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -1020,7 +1020,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
 			iftd = &sband->iftype_data[i];
 
-			supp_he = supp_he || (iftd && iftd->he_cap.has_he);
+			supp_he = supp_he || iftd->he_cap.has_he;
 		}
 
 		/* HT, VHT, HE require QoS, thus >= 4 queues */
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 204/334] usb: misc: brcmstb-usb-pinmap: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 203/334] mac80211: remove unnecessary NULL check in ieee80211_register_hw() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 205/334] usb: phy: fsl-usb: " Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sergey Shtylyov,
	Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 711087f342914e831269438ff42cf59bb0142c71 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to devm_request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code.  Stop calling devm_request_irq() with the invalid IRQ #s.

Fixes: 517c4c44b323 ("usb: Add driver to allow any GPIO to be used for 7211 USB signals")
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/806d0b1a-365b-93d9-3fc1-922105ca5e61@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/misc/brcmstb-usb-pinmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/misc/brcmstb-usb-pinmap.c b/drivers/usb/misc/brcmstb-usb-pinmap.c
index 336653091e3b..2b2019c19cde 100644
--- a/drivers/usb/misc/brcmstb-usb-pinmap.c
+++ b/drivers/usb/misc/brcmstb-usb-pinmap.c
@@ -293,6 +293,8 @@ static int __init brcmstb_usb_pinmap_probe(struct platform_device *pdev)
 
 		/* Enable interrupt for out pins */
 		irq = platform_get_irq(pdev, 0);
+		if (irq < 0)
+			return irq;
 		err = devm_request_irq(&pdev->dev, irq,
 				       brcmstb_usb_pinmap_ovr_isr,
 				       IRQF_TRIGGER_RISING,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 205/334] usb: phy: fsl-usb: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 204/334] usb: misc: brcmstb-usb-pinmap: add IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 206/334] usb: phy: twl6030: add IRQ checks Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit ecc2f30dbb25969908115c81ec23650ed982b004 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_irq() (which takes
*unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original
error code. Stop calling request_irq() with the invalid IRQ #s.

Fixes: 0807c500a1a6 ("USB: add Freescale USB OTG Transceiver driver")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/b0a86089-8b8b-122e-fd6d-73e8c2304964@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-fsl-usb.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/phy/phy-fsl-usb.c b/drivers/usb/phy/phy-fsl-usb.c
index f34c9437a182..972704262b02 100644
--- a/drivers/usb/phy/phy-fsl-usb.c
+++ b/drivers/usb/phy/phy-fsl-usb.c
@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev)
 
 	/* request irq */
 	p_otg->irq = platform_get_irq(pdev, 0);
+	if (p_otg->irq < 0)
+		return p_otg->irq;
 	status = request_irq(p_otg->irq, fsl_otg_isr,
 				IRQF_SHARED, driver_name, p_otg);
 	if (status) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 206/334] usb: phy: twl6030: add IRQ checks
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 205/334] usb: phy: fsl-usb: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 207/334] usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 0881e22c06e66af0b64773c91c8868ead3d01aa1 ]

The driver neglects to check the result of platform_get_irq()'s calls and
blithely passes the negative error codes to request_threaded_irq() (which
takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding
an original error code.  Stop calling request_threaded_irq() with the
invalid IRQ #s.

Fixes: c33fad0c3748 ("usb: otg: Adding twl6030-usb transceiver driver for OMAP4430")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/9507f50b-50f1-6dc4-f57c-3ed4e53a1c25@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-twl6030-usb.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c
index 8ba6c5a91557..ab3c38a7d8ac 100644
--- a/drivers/usb/phy/phy-twl6030-usb.c
+++ b/drivers/usb/phy/phy-twl6030-usb.c
@@ -348,6 +348,11 @@ static int twl6030_usb_probe(struct platform_device *pdev)
 	twl->irq2		= platform_get_irq(pdev, 1);
 	twl->linkstat		= MUSB_UNKNOWN;
 
+	if (twl->irq1 < 0)
+		return twl->irq1;
+	if (twl->irq2 < 0)
+		return twl->irq2;
+
 	twl->comparator.set_vbus	= twl6030_set_vbus;
 	twl->comparator.start_srp	= twl6030_start_srp;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 207/334] usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 206/334] usb: phy: twl6030: add IRQ checks Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 208/334] selftests/bpf: Fix test_core_autosize on big-endian machines Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Niklas Söderlund,
	Geert Uytterhoeven, Sasha Levin

From: Geert Uytterhoeven <geert+renesas@glider.be>

[ Upstream commit cea45a3bd2dd4d9c35581328f571afd32b3c9f48 ]

soc_device_match() is intended as a last resort, to handle e.g. quirks
that cannot be handled by matching based on a compatible value.

As the device nodes for the Renesas USB 3.0 Peripheral Controller on
R-Car E3 and RZ/G2E do have SoC-specific compatible values, the latter
can and should be used to match against these devices.

This also fixes support for the USB 3.0 Peripheral Controller on the
R-Car E3e (R8A779M6) SoC, which is a different grading of the R-Car E3
(R8A77990) SoC, using the same SoC-specific compatible value.

Fixes: 30025efa8b5e75f5 ("usb: gadget: udc: renesas_usb3: add support for r8a77990")
Fixes: 546970fdab1da5fe ("usb: gadget: udc: renesas_usb3: add support for r8a774c0")
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/760981fb4cd110d7cbfc9dcffa365e7c8b25c6e5.1628696960.git.geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/renesas_usb3.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index f1b35a39d1ba..57d417a7c3e0 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2707,10 +2707,15 @@ static const struct renesas_usb3_priv renesas_usb3_priv_r8a77990 = {
 
 static const struct of_device_id usb3_of_match[] = {
 	{
+		.compatible = "renesas,r8a774c0-usb3-peri",
+		.data = &renesas_usb3_priv_r8a77990,
+	}, {
 		.compatible = "renesas,r8a7795-usb3-peri",
 		.data = &renesas_usb3_priv_gen3,
-	},
-	{
+	}, {
+		.compatible = "renesas,r8a77990-usb3-peri",
+		.data = &renesas_usb3_priv_r8a77990,
+	}, {
 		.compatible = "renesas,rcar-gen3-usb3-peri",
 		.data = &renesas_usb3_priv_gen3,
 	},
@@ -2719,18 +2724,10 @@ static const struct of_device_id usb3_of_match[] = {
 MODULE_DEVICE_TABLE(of, usb3_of_match);
 
 static const struct soc_device_attribute renesas_usb3_quirks_match[] = {
-	{
-		.soc_id = "r8a774c0",
-		.data = &renesas_usb3_priv_r8a77990,
-	},
 	{
 		.soc_id = "r8a7795", .revision = "ES1.*",
 		.data = &renesas_usb3_priv_r8a7795_es1,
 	},
-	{
-		.soc_id = "r8a77990",
-		.data = &renesas_usb3_priv_r8a77990,
-	},
 	{ /* sentinel */ },
 };
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 208/334] selftests/bpf: Fix test_core_autosize on big-endian machines
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 207/334] usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 209/334] devlink: Clear whole devlink_flash_notify struct Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilya Leoshkevich, Andrii Nakryiko,
	Sasha Levin

From: Ilya Leoshkevich <iii@linux.ibm.com>

[ Upstream commit d164dd9a5c08c16a883b3de97d13948c7be7fa4d ]

The "probed" part of test_core_autosize copies an integer using
bpf_core_read() into an integer of a potentially different size.
On big-endian machines a destination offset is required for this to
produce a sensible result.

Fixes: 888d83b961f6 ("selftests/bpf: Validate libbpf's auto-sizing of LD/ST/STX instructions")
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210812224814.187460-1-iii@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../selftests/bpf/progs/test_core_autosize.c  | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/tools/testing/selftests/bpf/progs/test_core_autosize.c b/tools/testing/selftests/bpf/progs/test_core_autosize.c
index 44f5aa2e8956..9a7829c5e4a7 100644
--- a/tools/testing/selftests/bpf/progs/test_core_autosize.c
+++ b/tools/testing/selftests/bpf/progs/test_core_autosize.c
@@ -125,6 +125,16 @@ int handle_downsize(void *ctx)
 	return 0;
 }
 
+#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
+#define bpf_core_read_int bpf_core_read
+#else
+#define bpf_core_read_int(dst, sz, src) ({ \
+	/* Prevent "subtraction from stack pointer prohibited" */ \
+	volatile long __off = sizeof(*dst) - (sz); \
+	bpf_core_read((char *)(dst) + __off, sz, src); \
+})
+#endif
+
 SEC("raw_tp/sys_enter")
 int handle_probed(void *ctx)
 {
@@ -132,23 +142,23 @@ int handle_probed(void *ctx)
 	__u64 tmp;
 
 	tmp = 0;
-	bpf_core_read(&tmp, bpf_core_field_size(in->ptr), &in->ptr);
+	bpf_core_read_int(&tmp, bpf_core_field_size(in->ptr), &in->ptr);
 	ptr_probed = tmp;
 
 	tmp = 0;
-	bpf_core_read(&tmp, bpf_core_field_size(in->val1), &in->val1);
+	bpf_core_read_int(&tmp, bpf_core_field_size(in->val1), &in->val1);
 	val1_probed = tmp;
 
 	tmp = 0;
-	bpf_core_read(&tmp, bpf_core_field_size(in->val2), &in->val2);
+	bpf_core_read_int(&tmp, bpf_core_field_size(in->val2), &in->val2);
 	val2_probed = tmp;
 
 	tmp = 0;
-	bpf_core_read(&tmp, bpf_core_field_size(in->val3), &in->val3);
+	bpf_core_read_int(&tmp, bpf_core_field_size(in->val3), &in->val3);
 	val3_probed = tmp;
 
 	tmp = 0;
-	bpf_core_read(&tmp, bpf_core_field_size(in->val4), &in->val4);
+	bpf_core_read_int(&tmp, bpf_core_field_size(in->val4), &in->val4);
 	val4_probed = tmp;
 
 	return 0;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 209/334] devlink: Clear whole devlink_flash_notify struct
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 208/334] selftests/bpf: Fix test_core_autosize on big-endian machines Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 210/334] samples: pktgen: add missing IPv6 option to pktgen scripts Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, David S. Miller,
	Sasha Levin

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit ed43fbac717882165a2a4bd64f7b1f56f7467bb7 ]

The { 0 } doesn't clear all fields in the struct, but tells to the
compiler to set all fields to zero and doesn't touch any sub-fields
if they exists.

The {} is an empty initialiser that instructs to fully initialize whole
struct including sub-fields, which is error-prone for future
devlink_flash_notify extensions.

Fixes: 6700acc5f1fe ("devlink: collect flash notify params into a struct")
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/devlink.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 3963b1bc1e59..5a85a7b0feb2 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -4125,7 +4125,7 @@ out_free_msg:
 
 static void devlink_flash_update_begin_notify(struct devlink *devlink)
 {
-	struct devlink_flash_notify params = { 0 };
+	struct devlink_flash_notify params = {};
 
 	__devlink_flash_update_notify(devlink,
 				      DEVLINK_CMD_FLASH_UPDATE,
@@ -4134,7 +4134,7 @@ static void devlink_flash_update_begin_notify(struct devlink *devlink)
 
 static void devlink_flash_update_end_notify(struct devlink *devlink)
 {
-	struct devlink_flash_notify params = { 0 };
+	struct devlink_flash_notify params = {};
 
 	__devlink_flash_update_notify(devlink,
 				      DEVLINK_CMD_FLASH_UPDATE_END,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 210/334] samples: pktgen: add missing IPv6 option to pktgen scripts
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 209/334] devlink: Clear whole devlink_flash_notify struct Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 211/334] net: stmmac: fix INTR TBU status affecting irq count statistic Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Juhee Kang, David S. Miller, Sasha Levin

From: Juhee Kang <claudiajkang@gmail.com>

[ Upstream commit 0f0c4f1b72e090b23131700bb155944cc28b2a7b ]

Currently, "sample04" and "sample05" are not working properly when
running with an IPv6 option("-6"). The commit 0f06a6787e05 ("samples:
Add an IPv6 "-6" option to the pktgen scripts") has omitted the addition
of this option at "sample04" and "sample05".

In order to support IPv6 option, this commit adds logic related to IPv6
option.

Fixes: 0f06a6787e05 ("samples: Add an IPv6 "-6" option to the pktgen scripts")

Signed-off-by: Juhee Kang <claudiajkang@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 samples/pktgen/pktgen_sample04_many_flows.sh      | 12 +++++++-----
 samples/pktgen/pktgen_sample05_flow_per_thread.sh | 12 +++++++-----
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/samples/pktgen/pktgen_sample04_many_flows.sh b/samples/pktgen/pktgen_sample04_many_flows.sh
index 56c5f5af350f..cff51f861506 100755
--- a/samples/pktgen/pktgen_sample04_many_flows.sh
+++ b/samples/pktgen/pktgen_sample04_many_flows.sh
@@ -13,13 +13,15 @@ root_check_run_with_sudo "$@"
 # Parameter parsing via include
 source ${basedir}/parameters.sh
 # Set some default params, if they didn't get set
-[ -z "$DEST_IP" ]   && DEST_IP="198.18.0.42"
+if [ -z "$DEST_IP" ]; then
+    [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1"
+fi
 [ -z "$DST_MAC" ]   && DST_MAC="90:e2:ba:ff:ff:ff"
 [ -z "$CLONE_SKB" ] && CLONE_SKB="0"
 [ -z "$COUNT" ]     && COUNT="0" # Zero means indefinitely
 if [ -n "$DEST_IP" ]; then
-    validate_addr $DEST_IP
-    read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP)
+    validate_addr${IP6} $DEST_IP
+    read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP)
 fi
 if [ -n "$DST_PORT" ]; then
     read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
@@ -62,8 +64,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
 
     # Single destination
     pg_set $dev "dst_mac $DST_MAC"
-    pg_set $dev "dst_min $DST_MIN"
-    pg_set $dev "dst_max $DST_MAX"
+    pg_set $dev "dst${IP6}_min $DST_MIN"
+    pg_set $dev "dst${IP6}_max $DST_MAX"
 
     if [ -n "$DST_PORT" ]; then
 	# Single destination port or random port range
diff --git a/samples/pktgen/pktgen_sample05_flow_per_thread.sh b/samples/pktgen/pktgen_sample05_flow_per_thread.sh
index 6e0effabca59..3578d0aa4ac5 100755
--- a/samples/pktgen/pktgen_sample05_flow_per_thread.sh
+++ b/samples/pktgen/pktgen_sample05_flow_per_thread.sh
@@ -17,14 +17,16 @@ root_check_run_with_sudo "$@"
 # Parameter parsing via include
 source ${basedir}/parameters.sh
 # Set some default params, if they didn't get set
-[ -z "$DEST_IP" ]   && DEST_IP="198.18.0.42"
+if [ -z "$DEST_IP" ]; then
+    [ -z "$IP6" ] && DEST_IP="198.18.0.42" || DEST_IP="FD00::1"
+fi
 [ -z "$DST_MAC" ]   && DST_MAC="90:e2:ba:ff:ff:ff"
 [ -z "$CLONE_SKB" ] && CLONE_SKB="0"
 [ -z "$BURST" ]     && BURST=32
 [ -z "$COUNT" ]     && COUNT="0" # Zero means indefinitely
 if [ -n "$DEST_IP" ]; then
-    validate_addr $DEST_IP
-    read -r DST_MIN DST_MAX <<< $(parse_addr $DEST_IP)
+    validate_addr${IP6} $DEST_IP
+    read -r DST_MIN DST_MAX <<< $(parse_addr${IP6} $DEST_IP)
 fi
 if [ -n "$DST_PORT" ]; then
     read -r UDP_DST_MIN UDP_DST_MAX <<< $(parse_ports $DST_PORT)
@@ -52,8 +54,8 @@ for ((thread = $F_THREAD; thread <= $L_THREAD; thread++)); do
 
     # Single destination
     pg_set $dev "dst_mac $DST_MAC"
-    pg_set $dev "dst_min $DST_MIN"
-    pg_set $dev "dst_max $DST_MAX"
+    pg_set $dev "dst${IP6}_min $DST_MIN"
+    pg_set $dev "dst${IP6}_max $DST_MAX"
 
     if [ -n "$DST_PORT" ]; then
 	# Single destination port or random port range
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 211/334] net: stmmac: fix INTR TBU status affecting irq count statistic
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 210/334] samples: pktgen: add missing IPv6 option to pktgen scripts Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 212/334] Bluetooth: Move shutdown callback before flushing tx and rx queue Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Voon Weifeng,
	Vijayakannan Ayyathurai, David S. Miller, Sasha Levin

From: Voon Weifeng <weifeng.voon@intel.com>

[ Upstream commit 1975df880b959e30f28d66148a12d77b458abd76 ]

DMA channel status "Transmit buffer unavailable(TBU)" bit is not
considered as a successful dma tx. Hence, it should not affect
all the irq count statistic.

Fixes: 1103d3a5531c ("net: stmmac: dwmac4: Also use TBU interrupt to clean TX path")
Signed-off-by: Voon Weifeng <weifeng.voon@intel.com>
Signed-off-by: Vijayakannan Ayyathurai <vijayakannan.ayyathurai@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
index e63270267578..f83db62938dd 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c
@@ -172,11 +172,12 @@ int dwmac4_dma_interrupt(void __iomem *ioaddr,
 		x->rx_normal_irq_n++;
 		ret |= handle_rx;
 	}
-	if (likely(intr_status & (DMA_CHAN_STATUS_TI |
-		DMA_CHAN_STATUS_TBU))) {
+	if (likely(intr_status & DMA_CHAN_STATUS_TI)) {
 		x->tx_normal_irq_n++;
 		ret |= handle_tx;
 	}
+	if (unlikely(intr_status & DMA_CHAN_STATUS_TBU))
+		ret |= handle_tx;
 	if (unlikely(intr_status & DMA_CHAN_STATUS_ERI))
 		x->rx_early_irq++;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 212/334] Bluetooth: Move shutdown callback before flushing tx and rx queue
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 211/334] net: stmmac: fix INTR TBU status affecting irq count statistic Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 213/334] PM: cpu: Make notifier chain use a raw_spinlock_t Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hsin-Yi Wang, Guenter Roeck,
	Kai-Heng Feng, Marcel Holtmann, Sasha Levin, Mattijs Korpershoek

From: Kai-Heng Feng <kai.heng.feng@canonical.com>

[ Upstream commit 0ea53674d07fb6db2dd7a7ec2fdc85a12eb246c2 ]

Commit 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues
are flushed or cancelled") introduced a regression that makes mtkbtsdio
driver stops working:
[   36.593956] Bluetooth: hci0: Firmware already downloaded
[   46.814613] Bluetooth: hci0: Execution of wmt command timed out
[   46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110)

The shutdown callback depends on the result of hdev->rx_work, so we
should call it before flushing rx_work:
-> btmtksdio_shutdown()
 -> mtk_hci_wmt_sync()
  -> __hci_cmd_send()
   -> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared

-> btmtksdio_recv_event()
 -> hci_recv_frame()
  -> queue_work(hdev->workqueue, &hdev->rx_work)
   -> clears BTMTKSDIO_TX_WAIT_VND_EVT

So move the shutdown callback before flushing TX/RX queue to resolve the
issue.

Reported-and-tested-by: Mattijs Korpershoek <mkorpershoek@baylibre.com>
Tested-by: Hsin-Yi Wang <hsinyi@chromium.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Fixes: 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled")
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e1a545c8a69f..2331612839d7 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1727,6 +1727,14 @@ int hci_dev_do_close(struct hci_dev *hdev)
 	hci_request_cancel_all(hdev);
 	hci_req_sync_lock(hdev);
 
+	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
+	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
+	    test_bit(HCI_UP, &hdev->flags)) {
+		/* Execute vendor specific shutdown routine */
+		if (hdev->shutdown)
+			hdev->shutdown(hdev);
+	}
+
 	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 		cancel_delayed_work_sync(&hdev->cmd_timer);
 		hci_req_sync_unlock(hdev);
@@ -1798,14 +1806,6 @@ int hci_dev_do_close(struct hci_dev *hdev)
 		clear_bit(HCI_INIT, &hdev->flags);
 	}
 
-	if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
-	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
-	    test_bit(HCI_UP, &hdev->flags)) {
-		/* Execute vendor specific shutdown routine */
-		if (hdev->shutdown)
-			hdev->shutdown(hdev);
-	}
-
 	/* flush cmd  work */
 	flush_work(&hdev->cmd_work);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 213/334] PM: cpu: Make notifier chain use a raw_spinlock_t
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 212/334] Bluetooth: Move shutdown callback before flushing tx and rx queue Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 214/334] usb: host: ohci-tmio: add IRQ check Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Valentin Schneider,
	Sebastian Andrzej Siewior, Rafael J. Wysocki, Sasha Levin

From: Valentin Schneider <valentin.schneider@arm.com>

[ Upstream commit b2f6662ac08d0e7c25574ce53623c71bdae9dd78 ]

Invoking atomic_notifier_chain_notify() requires acquiring a spinlock_t,
which can block under CONFIG_PREEMPT_RT. Notifications for members of the
cpu_pm notification chain will be issued by the idle task, which can never
block.

Making *all* atomic_notifiers use a raw_spinlock is too big of a hammer, as
only notifications issued by the idle task are problematic.

Special-case cpu_pm_notifier_chain by kludging a raw_notifier and
raw_spinlock_t together, matching the atomic_notifier behavior with a
raw_spinlock_t.

Fixes: 70d932985757 ("notifier: Fix broken error handling pattern")
Signed-off-by: Valentin Schneider <valentin.schneider@arm.com>
Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/cpu_pm.c | 50 +++++++++++++++++++++++++++++++++++++------------
 1 file changed, 38 insertions(+), 12 deletions(-)

diff --git a/kernel/cpu_pm.c b/kernel/cpu_pm.c
index f7e1d0eccdbc..246efc74e3f3 100644
--- a/kernel/cpu_pm.c
+++ b/kernel/cpu_pm.c
@@ -13,19 +13,32 @@
 #include <linux/spinlock.h>
 #include <linux/syscore_ops.h>
 
-static ATOMIC_NOTIFIER_HEAD(cpu_pm_notifier_chain);
+/*
+ * atomic_notifiers use a spinlock_t, which can block under PREEMPT_RT.
+ * Notifications for cpu_pm will be issued by the idle task itself, which can
+ * never block, IOW it requires using a raw_spinlock_t.
+ */
+static struct {
+	struct raw_notifier_head chain;
+	raw_spinlock_t lock;
+} cpu_pm_notifier = {
+	.chain = RAW_NOTIFIER_INIT(cpu_pm_notifier.chain),
+	.lock  = __RAW_SPIN_LOCK_UNLOCKED(cpu_pm_notifier.lock),
+};
 
 static int cpu_pm_notify(enum cpu_pm_event event)
 {
 	int ret;
 
 	/*
-	 * atomic_notifier_call_chain has a RCU read critical section, which
-	 * could be disfunctional in cpu idle. Copy RCU_NONIDLE code to let
-	 * RCU know this.
+	 * This introduces a RCU read critical section, which could be
+	 * disfunctional in cpu idle. Copy RCU_NONIDLE code to let RCU know
+	 * this.
 	 */
 	rcu_irq_enter_irqson();
-	ret = atomic_notifier_call_chain(&cpu_pm_notifier_chain, event, NULL);
+	rcu_read_lock();
+	ret = raw_notifier_call_chain(&cpu_pm_notifier.chain, event, NULL);
+	rcu_read_unlock();
 	rcu_irq_exit_irqson();
 
 	return notifier_to_errno(ret);
@@ -33,10 +46,13 @@ static int cpu_pm_notify(enum cpu_pm_event event)
 
 static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event event_down)
 {
+	unsigned long flags;
 	int ret;
 
 	rcu_irq_enter_irqson();
-	ret = atomic_notifier_call_chain_robust(&cpu_pm_notifier_chain, event_up, event_down, NULL);
+	raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
+	ret = raw_notifier_call_chain_robust(&cpu_pm_notifier.chain, event_up, event_down, NULL);
+	raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
 	rcu_irq_exit_irqson();
 
 	return notifier_to_errno(ret);
@@ -49,12 +65,17 @@ static int cpu_pm_notify_robust(enum cpu_pm_event event_up, enum cpu_pm_event ev
  * Add a driver to a list of drivers that are notified about
  * CPU and CPU cluster low power entry and exit.
  *
- * This function may sleep, and has the same return conditions as
- * raw_notifier_chain_register.
+ * This function has the same return conditions as raw_notifier_chain_register.
  */
 int cpu_pm_register_notifier(struct notifier_block *nb)
 {
-	return atomic_notifier_chain_register(&cpu_pm_notifier_chain, nb);
+	unsigned long flags;
+	int ret;
+
+	raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
+	ret = raw_notifier_chain_register(&cpu_pm_notifier.chain, nb);
+	raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
 
@@ -64,12 +85,17 @@ EXPORT_SYMBOL_GPL(cpu_pm_register_notifier);
  *
  * Remove a driver from the CPU PM notifier list.
  *
- * This function may sleep, and has the same return conditions as
- * raw_notifier_chain_unregister.
+ * This function has the same return conditions as raw_notifier_chain_unregister.
  */
 int cpu_pm_unregister_notifier(struct notifier_block *nb)
 {
-	return atomic_notifier_chain_unregister(&cpu_pm_notifier_chain, nb);
+	unsigned long flags;
+	int ret;
+
+	raw_spin_lock_irqsave(&cpu_pm_notifier.lock, flags);
+	ret = raw_notifier_chain_unregister(&cpu_pm_notifier.chain, nb);
+	raw_spin_unlock_irqrestore(&cpu_pm_notifier.lock, flags);
+	return ret;
 }
 EXPORT_SYMBOL_GPL(cpu_pm_unregister_notifier);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 214/334] usb: host: ohci-tmio: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 213/334] PM: cpu: Make notifier chain use a raw_spinlock_t Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 215/334] usb: phy: tahvo: " Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alan Stern, Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 4ac5132e8a4300637a2da8f5d6bc7650db735b8a ]

The driver neglects to check the  result of platform_get_irq()'s call and
blithely passes the negative error codes to usb_add_hcd() (which takes
*unsigned* IRQ #), causing request_irq() that it calls to fail with
-EINVAL, overriding an original error code. Stop calling usb_add_hcd()
with the invalid IRQ #s.

Fixes: 78c73414f4f6 ("USB: ohci: add support for tmio-ohci cell")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/402e1a45-a0a4-0e08-566a-7ca1331506b1@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ohci-tmio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index 7f857bad9e95..08ec2ab0d95a 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -202,6 +202,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)
 	if (!cell)
 		return -EINVAL;
 
+	if (irq < 0)
+		return irq;
+
 	hcd = usb_create_hcd(&ohci_tmio_hc_driver, &dev->dev, dev_name(&dev->dev));
 	if (!hcd) {
 		ret = -ENOMEM;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 215/334] usb: phy: tahvo: add IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 214/334] usb: host: ohci-tmio: add IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 216/334] libbpf: Re-build libbpf.so when libbpf.map changes Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Sergey Shtylyov, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 0d45a1373e669880b8beaecc8765f44cb0241e47 ]

The driver neglects to check the result of platform_get_irq()'s call and
blithely passes the negative error codes to request_threaded_irq() (which
takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an
original error code.  Stop calling request_threaded_irq() with the invalid
IRQ #s.

Fixes: 9ba96ae5074c ("usb: omap1: Tahvo USB transceiver driver")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/8280d6a4-8e9a-7cfe-1aa9-db586dc9afdf@omp.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/phy/phy-tahvo.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c
index baebb1f5a973..a3e043e3e4aa 100644
--- a/drivers/usb/phy/phy-tahvo.c
+++ b/drivers/usb/phy/phy-tahvo.c
@@ -393,7 +393,9 @@ static int tahvo_usb_probe(struct platform_device *pdev)
 
 	dev_set_drvdata(&pdev->dev, tu);
 
-	tu->irq = platform_get_irq(pdev, 0);
+	tu->irq = ret = platform_get_irq(pdev, 0);
+	if (ret < 0)
+		return ret;
 	ret = request_threaded_irq(tu->irq, NULL, tahvo_usb_vbus_interrupt,
 				   IRQF_ONESHOT,
 				   "tahvo-vbus", tu);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 216/334] libbpf: Re-build libbpf.so when libbpf.map changes
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 215/334] usb: phy: tahvo: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 217/334] mac80211: Fix insufficient headroom issue for AMSDU Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrii Nakryiko, Daniel Borkmann,
	Yonghong Song, Sasha Levin

From: Andrii Nakryiko <andrii@kernel.org>

[ Upstream commit 61c7aa5020e98ac2fdcf07d07eec1baf2e9f0a08 ]

Ensure libbpf.so is re-built whenever libbpf.map is modified.  Without this,
changes to libbpf.map are not detected and versioned symbols mismatch error
will be reported until `make clean && make` is used, which is a suboptimal
developer experience.

Fixes: 306b267cb3c4 ("libbpf: Verify versioned symbols")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210815070609.987780-8-andrii@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/lib/bpf/Makefile | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile
index ec14aa725bb0..74c3b73a5fbe 100644
--- a/tools/lib/bpf/Makefile
+++ b/tools/lib/bpf/Makefile
@@ -4,8 +4,9 @@
 RM ?= rm
 srctree = $(abs_srctree)
 
+VERSION_SCRIPT := libbpf.map
 LIBBPF_VERSION := $(shell \
-	grep -oE '^LIBBPF_([0-9.]+)' libbpf.map | \
+	grep -oE '^LIBBPF_([0-9.]+)' $(VERSION_SCRIPT) | \
 	sort -rV | head -n1 | cut -d'_' -f2)
 LIBBPF_MAJOR_VERSION := $(firstword $(subst ., ,$(LIBBPF_VERSION)))
 
@@ -110,7 +111,6 @@ SHARED_OBJDIR	:= $(OUTPUT)sharedobjs/
 STATIC_OBJDIR	:= $(OUTPUT)staticobjs/
 BPF_IN_SHARED	:= $(SHARED_OBJDIR)libbpf-in.o
 BPF_IN_STATIC	:= $(STATIC_OBJDIR)libbpf-in.o
-VERSION_SCRIPT	:= libbpf.map
 BPF_HELPER_DEFS	:= $(OUTPUT)bpf_helper_defs.h
 
 LIB_TARGET	:= $(addprefix $(OUTPUT),$(LIB_TARGET))
@@ -163,10 +163,10 @@ $(BPF_HELPER_DEFS): $(srctree)/tools/include/uapi/linux/bpf.h
 
 $(OUTPUT)libbpf.so: $(OUTPUT)libbpf.so.$(LIBBPF_VERSION)
 
-$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED)
+$(OUTPUT)libbpf.so.$(LIBBPF_VERSION): $(BPF_IN_SHARED) $(VERSION_SCRIPT)
 	$(QUIET_LINK)$(CC) $(LDFLAGS) \
 		--shared -Wl,-soname,libbpf.so.$(LIBBPF_MAJOR_VERSION) \
-		-Wl,--version-script=$(VERSION_SCRIPT) $^ -lelf -lz -o $@
+		-Wl,--version-script=$(VERSION_SCRIPT) $< -lelf -lz -o $@
 	@ln -sf $(@F) $(OUTPUT)libbpf.so
 	@ln -sf $(@F) $(OUTPUT)libbpf.so.$(LIBBPF_MAJOR_VERSION)
 
@@ -181,7 +181,7 @@ $(OUTPUT)libbpf.pc:
 
 check: check_abi
 
-check_abi: $(OUTPUT)libbpf.so
+check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT)
 	@if [ "$(GLOBAL_SYM_COUNT)" != "$(VERSIONED_SYM_COUNT)" ]; then	 \
 		echo "Warning: Num of global symbols in $(BPF_IN_SHARED)"	 \
 		     "($(GLOBAL_SYM_COUNT)) does NOT match with num of"	 \
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 217/334] mac80211: Fix insufficient headroom issue for AMSDU
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 216/334] libbpf: Re-build libbpf.so when libbpf.map changes Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 218/334] locking/local_lock: Add missing owner initialization Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chih-Kang Chang, Ping-Ke Shih,
	Johannes Berg, Sasha Levin

From: Chih-Kang Chang <gary.chang@realtek.com>

[ Upstream commit f50d2ff8f016b79a2ff4acd5943a1eda40c545d4 ]

ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom,
the original reserved headroom might be eaten. Add the necessary
extra_tx_headroom.

Fixes: 6e0456b54545 ("mac80211: add A-MSDU tx support")
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://lore.kernel.org/r/20210816085128.10931-2-pkshih@realtek.com
[fix indentation]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/tx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 8509778ff31f..fa09a369214d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3242,7 +3242,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,
 	if (info->control.flags & IEEE80211_TX_CTRL_AMSDU)
 		return true;
 
-	if (!ieee80211_amsdu_realloc_pad(local, skb, sizeof(*amsdu_hdr)))
+	if (!ieee80211_amsdu_realloc_pad(local, skb,
+					 sizeof(*amsdu_hdr) +
+					 local->hw.extra_tx_headroom))
 		return false;
 
 	data = skb_push(skb, sizeof(*amsdu_hdr));
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 218/334] locking/local_lock: Add missing owner initialization
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 217/334] mac80211: Fix insufficient headroom issue for AMSDU Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 219/334] lockd: Fix invalid lockowner cast after vfs_test_lock Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Gleixner,
	Peter Zijlstra (Intel),
	Ingo Molnar, Sasha Levin

From: Thomas Gleixner <tglx@linutronix.de>

[ Upstream commit d8bbd97ad0b99a9394f2cd8410b884c48e218cf0 ]

If CONFIG_DEBUG_LOCK_ALLOC=y is enabled then local_lock_t has an 'owner'
member which is checked for consistency, but nothing initialized it to
zero explicitly.

The static initializer does so implicit, and the run time allocated per CPU
storage is usually zero initialized as well, but relying on that is not
really good practice.

Fixes: 91710728d172 ("locking: Introduce local_lock()")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210815211301.969975279@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/local_lock_internal.h | 42 ++++++++++++++++-------------
 1 file changed, 23 insertions(+), 19 deletions(-)

diff --git a/include/linux/local_lock_internal.h b/include/linux/local_lock_internal.h
index ded90b097e6e..3f02b818625e 100644
--- a/include/linux/local_lock_internal.h
+++ b/include/linux/local_lock_internal.h
@@ -14,29 +14,14 @@ typedef struct {
 } local_lock_t;
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
-# define LL_DEP_MAP_INIT(lockname)			\
+# define LOCAL_LOCK_DEBUG_INIT(lockname)		\
 	.dep_map = {					\
 		.name = #lockname,			\
 		.wait_type_inner = LD_WAIT_CONFIG,	\
-		.lock_type = LD_LOCK_PERCPU,			\
-	}
-#else
-# define LL_DEP_MAP_INIT(lockname)
-#endif
-
-#define INIT_LOCAL_LOCK(lockname)	{ LL_DEP_MAP_INIT(lockname) }
-
-#define __local_lock_init(lock)					\
-do {								\
-	static struct lock_class_key __key;			\
-								\
-	debug_check_no_locks_freed((void *)lock, sizeof(*lock));\
-	lockdep_init_map_type(&(lock)->dep_map, #lock, &__key, 0, \
-			      LD_WAIT_CONFIG, LD_WAIT_INV,	\
-			      LD_LOCK_PERCPU);			\
-} while (0)
+		.lock_type = LD_LOCK_PERCPU,		\
+	},						\
+	.owner = NULL,
 
-#ifdef CONFIG_DEBUG_LOCK_ALLOC
 static inline void local_lock_acquire(local_lock_t *l)
 {
 	lock_map_acquire(&l->dep_map);
@@ -51,11 +36,30 @@ static inline void local_lock_release(local_lock_t *l)
 	lock_map_release(&l->dep_map);
 }
 
+static inline void local_lock_debug_init(local_lock_t *l)
+{
+	l->owner = NULL;
+}
 #else /* CONFIG_DEBUG_LOCK_ALLOC */
+# define LOCAL_LOCK_DEBUG_INIT(lockname)
 static inline void local_lock_acquire(local_lock_t *l) { }
 static inline void local_lock_release(local_lock_t *l) { }
+static inline void local_lock_debug_init(local_lock_t *l) { }
 #endif /* !CONFIG_DEBUG_LOCK_ALLOC */
 
+#define INIT_LOCAL_LOCK(lockname)	{ LOCAL_LOCK_DEBUG_INIT(lockname) }
+
+#define __local_lock_init(lock)					\
+do {								\
+	static struct lock_class_key __key;			\
+								\
+	debug_check_no_locks_freed((void *)lock, sizeof(*lock));\
+	lockdep_init_map_type(&(lock)->dep_map, #lock, &__key,  \
+			      0, LD_WAIT_CONFIG, LD_WAIT_INV,	\
+			      LD_LOCK_PERCPU);			\
+	local_lock_debug_init(lock);				\
+} while (0)
+
 #define __local_lock(lock)					\
 	do {							\
 		preempt_disable();				\
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 219/334] lockd: Fix invalid lockowner cast after vfs_test_lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 218/334] locking/local_lock: Add missing owner initialization Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 220/334] SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Benjamin Coddington, Chuck Lever,
	Sasha Levin

From: Benjamin Coddington <bcodding@redhat.com>

[ Upstream commit cd2d644ddba183ec7b451b7c20d5c7cc06fcf0d7 ]

After calling vfs_test_lock() the pointer to a conflicting lock can be
returned, and that lock is not guarunteed to be owned by nlm.  In that
case, we cannot cast it to struct nlm_lockowner.  Instead return the pid
of that conflicting lock.

Fixes: 646d73e91b42 ("lockd: Show pid of lockd for remote locks")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/lockd/svclock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 61d3cc2283dc..498cb70c2c0d 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -634,7 +634,7 @@ nlmsvc_testlock(struct svc_rqst *rqstp, struct nlm_file *file,
 	conflock->caller = "somehost";	/* FIXME */
 	conflock->len = strlen(conflock->caller);
 	conflock->oh.len = 0;		/* don't return OH info */
-	conflock->svid = ((struct nlm_lockowner *)lock->fl.fl_owner)->pid;
+	conflock->svid = lock->fl.fl_pid;
 	conflock->fl.fl_type = lock->fl.fl_type;
 	conflock->fl.fl_start = lock->fl.fl_start;
 	conflock->fl.fl_end = lock->fl.fl_end;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 220/334] SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 219/334] lockd: Fix invalid lockowner cast after vfs_test_lock Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 221/334] nfsd4: Fix forced-expiry locking Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Sasha Levin

From: Chuck Lever <chuck.lever@oracle.com>

[ Upstream commit 5c11720767f70d34357d00a15ba5a0ad052c40fe ]

Some paths through svc_process() leave rqst->rq_procinfo set to
NULL, which triggers a crash if tracing happens to be enabled.

Fixes: 89ff87494c6e ("SUNRPC: Display RPC procedure names instead of proc numbers")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/sunrpc/svc.h    |  1 +
 include/trace/events/sunrpc.h |  8 ++++----
 net/sunrpc/svc.c              | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index e91d51ea028b..65185d1e07ea 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -523,6 +523,7 @@ void		   svc_wake_up(struct svc_serv *);
 void		   svc_reserve(struct svc_rqst *rqstp, int space);
 struct svc_pool *  svc_pool_for_cpu(struct svc_serv *serv, int cpu);
 char *		   svc_print_addr(struct svc_rqst *, char *, size_t);
+const char *	   svc_proc_name(const struct svc_rqst *rqstp);
 int		   svc_encode_result_payload(struct svc_rqst *rqstp,
 					     unsigned int offset,
 					     unsigned int length);
diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h
index 861f199896c6..d323f5a049c8 100644
--- a/include/trace/events/sunrpc.h
+++ b/include/trace/events/sunrpc.h
@@ -1642,7 +1642,7 @@ TRACE_EVENT(svc_process,
 		__field(u32, vers)
 		__field(u32, proc)
 		__string(service, name)
-		__string(procedure, rqst->rq_procinfo->pc_name)
+		__string(procedure, svc_proc_name(rqst))
 		__string(addr, rqst->rq_xprt ?
 			 rqst->rq_xprt->xpt_remotebuf : "(null)")
 	),
@@ -1652,7 +1652,7 @@ TRACE_EVENT(svc_process,
 		__entry->vers = rqst->rq_vers;
 		__entry->proc = rqst->rq_proc;
 		__assign_str(service, name);
-		__assign_str(procedure, rqst->rq_procinfo->pc_name);
+		__assign_str(procedure, svc_proc_name(rqst));
 		__assign_str(addr, rqst->rq_xprt ?
 			     rqst->rq_xprt->xpt_remotebuf : "(null)");
 	),
@@ -1918,7 +1918,7 @@ TRACE_EVENT(svc_stats_latency,
 	TP_STRUCT__entry(
 		__field(u32, xid)
 		__field(unsigned long, execute)
-		__string(procedure, rqst->rq_procinfo->pc_name)
+		__string(procedure, svc_proc_name(rqst))
 		__string(addr, rqst->rq_xprt->xpt_remotebuf)
 	),
 
@@ -1926,7 +1926,7 @@ TRACE_EVENT(svc_stats_latency,
 		__entry->xid = be32_to_cpu(rqst->rq_xid);
 		__entry->execute = ktime_to_us(ktime_sub(ktime_get(),
 							 rqst->rq_stime));
-		__assign_str(procedure, rqst->rq_procinfo->pc_name);
+		__assign_str(procedure, svc_proc_name(rqst));
 		__assign_str(addr, rqst->rq_xprt->xpt_remotebuf);
 	),
 
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 0de918cb3d90..a47e290b0668 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1629,6 +1629,21 @@ u32 svc_max_payload(const struct svc_rqst *rqstp)
 }
 EXPORT_SYMBOL_GPL(svc_max_payload);
 
+/**
+ * svc_proc_name - Return RPC procedure name in string form
+ * @rqstp: svc_rqst to operate on
+ *
+ * Return value:
+ *   Pointer to a NUL-terminated string
+ */
+const char *svc_proc_name(const struct svc_rqst *rqstp)
+{
+	if (rqstp && rqstp->rq_procinfo)
+		return rqstp->rq_procinfo->pc_name;
+	return "unknown";
+}
+
+
 /**
  * svc_encode_result_payload - mark a range of bytes as a result payload
  * @rqstp: svc_rqst to operate on
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 221/334] nfsd4: Fix forced-expiry locking
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 220/334] SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 222/334] arm64: dts: marvell: armada-37xx: Extend PCIe MEM space Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Chuck Lever, Sasha Levin

From: J. Bruce Fields <bfields@redhat.com>

[ Upstream commit f7104cc1a9159cd0d3e8526cb638ae0301de4b61 ]

This should use the network-namespace-wide client_lock, not the
per-client cl_lock.

You shouldn't see any bugs unless you're actually using the
forced-expiry interface introduced by 89c905beccbb.

Fixes: 89c905beccbb "nfsd: allow forced expiration of NFSv4 clients"
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/nfsd/nfs4state.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index fa67ecd5fe63..2bedc7839ec5 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2687,9 +2687,9 @@ static void force_expire_client(struct nfs4_client *clp)
 
 	trace_nfsd_clid_admin_expired(&clp->cl_clientid);
 
-	spin_lock(&clp->cl_lock);
+	spin_lock(&nn->client_lock);
 	clp->cl_time = 0;
-	spin_unlock(&clp->cl_lock);
+	spin_unlock(&nn->client_lock);
 
 	wait_event(expiry_wq, atomic_read(&clp->cl_rpc_users) == 0);
 	spin_lock(&nn->client_lock);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 222/334] arm64: dts: marvell: armada-37xx: Extend PCIe MEM space
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 221/334] nfsd4: Fix forced-expiry locking Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 223/334] clk: staging: correct reference to config IOMEM to config HAS_IOMEM Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pali Rohár, Gregory CLEMENT,
	Sasha Levin

From: Pali Rohár <pali@kernel.org>

[ Upstream commit 514ef1e62d6521c2199d192b1c71b79d2aa21d5a ]

Current PCIe MEM space of size 16 MB is not enough for some combination
of PCIe cards (e.g. NVMe disk together with ath11k wifi card). ARM Trusted
Firmware for Armada 3700 platform already assigns 128 MB for PCIe window,
so extend PCIe MEM space to the end of 128 MB PCIe window which allows to
allocate more PCIe BARs for more PCIe cards.

Without this change some combination of PCIe cards cannot be used and
kernel show error messages in dmesg during initialization:

    pci 0000:00:00.0: BAR 8: no space for [mem size 0x01800000]
    pci 0000:00:00.0: BAR 8: failed to assign [mem size 0x01800000]
    pci 0000:00:00.0: BAR 6: assigned [mem 0xe8000000-0xe80007ff pref]
    pci 0000:01:00.0: BAR 8: no space for [mem size 0x01800000]
    pci 0000:01:00.0: BAR 8: failed to assign [mem size 0x01800000]
    pci 0000:02:03.0: BAR 8: no space for [mem size 0x01000000]
    pci 0000:02:03.0: BAR 8: failed to assign [mem size 0x01000000]
    pci 0000:02:07.0: BAR 8: no space for [mem size 0x00100000]
    pci 0000:02:07.0: BAR 8: failed to assign [mem size 0x00100000]
    pci 0000:03:00.0: BAR 0: no space for [mem size 0x01000000 64bit]
    pci 0000:03:00.0: BAR 0: failed to assign [mem size 0x01000000 64bit]

Due to bugs in U-Boot port for Turris Mox, the second range in Turris Mox
kernel DTS file for PCIe must start at 16 MB offset. Otherwise U-Boot
crashes during loading of kernel DTB file. This bug is present only in
U-Boot code for Turris Mox and therefore other Armada 3700 devices are not
affected by this bug. Bug is fixed in U-Boot version 2021.07.

To not break booting new kernels on existing versions of U-Boot on Turris
Mox, use first 16 MB range for IO and second range with rest of PCIe window
for MEM.

Signed-off-by: Pali Rohár <pali@kernel.org>
Fixes: 76f6386b25cc ("arm64: dts: marvell: Add Aardvark PCIe support for Armada 3700")
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../boot/dts/marvell/armada-3720-turris-mox.dts | 17 +++++++++++++++++
 arch/arm64/boot/dts/marvell/armada-37xx.dtsi    | 11 +++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
index a05b1ab2dd12..04da07ae4420 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts
@@ -135,6 +135,23 @@
 	pinctrl-0 = <&pcie_reset_pins &pcie_clkreq_pins>;
 	status = "okay";
 	reset-gpios = <&gpiosb 3 GPIO_ACTIVE_LOW>;
+	/*
+	 * U-Boot port for Turris Mox has a bug which always expects that "ranges" DT property
+	 * contains exactly 2 ranges with 3 (child) address cells, 2 (parent) address cells and
+	 * 2 size cells and also expects that the second range starts at 16 MB offset. If these
+	 * conditions are not met then U-Boot crashes during loading kernel DTB file. PCIe address
+	 * space is 128 MB long, so the best split between MEM and IO is to use fixed 16 MB window
+	 * for IO and the rest 112 MB (64+32+16) for MEM, despite that maximal IO size is just 64 kB.
+	 * This bug is not present in U-Boot ports for other Armada 3700 devices and is fixed in
+	 * U-Boot version 2021.07. See relevant U-Boot commits (the last one contains fix):
+	 * https://source.denx.de/u-boot/u-boot/-/commit/cb2ddb291ee6fcbddd6d8f4ff49089dfe580f5d7
+	 * https://source.denx.de/u-boot/u-boot/-/commit/c64ac3b3185aeb3846297ad7391fc6df8ecd73bf
+	 * https://source.denx.de/u-boot/u-boot/-/commit/4a82fca8e330157081fc132a591ebd99ba02ee33
+	 */
+	#address-cells = <3>;
+	#size-cells = <2>;
+	ranges = <0x81000000 0 0xe8000000   0 0xe8000000   0 0x01000000   /* Port 0 IO */
+		  0x82000000 0 0xe9000000   0 0xe9000000   0 0x07000000>; /* Port 0 MEM */
 
 	/* enabled by U-Boot if PCIe module is present */
 	status = "disabled";
diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
index 5db81a416cd6..9acc5d2b5a00 100644
--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
@@ -489,8 +489,15 @@
 			#interrupt-cells = <1>;
 			msi-parent = <&pcie0>;
 			msi-controller;
-			ranges = <0x82000000 0 0xe8000000   0 0xe8000000 0 0x1000000 /* Port 0 MEM */
-				  0x81000000 0 0xe9000000   0 0xe9000000 0 0x10000>; /* Port 0 IO*/
+			/*
+			 * The 128 MiB address range [0xe8000000-0xf0000000] is
+			 * dedicated for PCIe and can be assigned to 8 windows
+			 * with size a power of two. Use one 64 KiB window for
+			 * IO at the end and the remaining seven windows
+			 * (totaling 127 MiB) for MEM.
+			 */
+			ranges = <0x82000000 0 0xe8000000   0 0xe8000000   0 0x07f00000   /* Port 0 MEM */
+				  0x81000000 0 0xefff0000   0 0xefff0000   0 0x00010000>; /* Port 0 IO */
 			interrupt-map-mask = <0 0 0 7>;
 			interrupt-map = <0 0 0 1 &pcie_intc 0>,
 					<0 0 0 2 &pcie_intc 1>,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 223/334] clk: staging: correct reference to config IOMEM to config HAS_IOMEM
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 222/334] arm64: dts: marvell: armada-37xx: Extend PCIe MEM space Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 224/334] i2c: synquacer: fix deferred probing Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Bulwahn, Sasha Levin

From: Lukas Bulwahn <lukas.bulwahn@gmail.com>

[ Upstream commit cbfa6f33e3a685c329d78e06b0cf1dcb23c9d849 ]

Commit 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx
Clocking Wizard driver") introduces a dependency on the non-existing config
IOMEM, which basically makes it impossible to include this driver into any
build. Fortunately, ./scripts/checkkconfigsymbols.py warns:

IOMEM
Referencing files: drivers/staging/clocking-wizard/Kconfig

The config for IOMEM support is called HAS_IOMEM. Correct this reference to
the intended config.

Fixes: 0a0a66c984b3 ("clk: staging: Specify IOMEM dependency for Xilinx Clocking Wizard driver")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Link: https://lore.kernel.org/r/20210817105404.13146-1-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/staging/clocking-wizard/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/clocking-wizard/Kconfig b/drivers/staging/clocking-wizard/Kconfig
index 69cf51445f08..2324b5d73788 100644
--- a/drivers/staging/clocking-wizard/Kconfig
+++ b/drivers/staging/clocking-wizard/Kconfig
@@ -5,6 +5,6 @@
 
 config COMMON_CLK_XLNX_CLKWZRD
 	tristate "Xilinx Clocking Wizard"
-	depends on COMMON_CLK && OF && IOMEM
+	depends on COMMON_CLK && OF && HAS_IOMEM
 	help
 	  Support for the Xilinx Clocking Wizard IP core clock generator.
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 224/334] i2c: synquacer: fix deferred probing
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 223/334] clk: staging: correct reference to config IOMEM to config HAS_IOMEM Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 225/334] hwmon: (pmbus/bpa-rs600) Dont use rated limits as warn limits Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Ard Biesheuvel,
	Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 8d744da241b81f4211f4813b0d3c1981326fa9ca ]

The driver overrides the error codes returned by platform_get_irq() to
-ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe
permanently instead of the deferred probing. Switch to propagating the
error codes upstream.

Fixes: 0d676a6c4390 ("i2c: add support for Socionext SynQuacer I2C controller")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-synquacer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-synquacer.c b/drivers/i2c/busses/i2c-synquacer.c
index 31be1811d5e6..e4026c5416b1 100644
--- a/drivers/i2c/busses/i2c-synquacer.c
+++ b/drivers/i2c/busses/i2c-synquacer.c
@@ -578,7 +578,7 @@ static int synquacer_i2c_probe(struct platform_device *pdev)
 
 	i2c->irq = platform_get_irq(pdev, 0);
 	if (i2c->irq < 0)
-		return -ENODEV;
+		return i2c->irq;
 
 	ret = devm_request_irq(&pdev->dev, i2c->irq, synquacer_i2c_isr,
 			       0, dev_name(&pdev->dev), i2c);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 225/334] hwmon: (pmbus/bpa-rs600) Dont use rated limits as warn limits
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 224/334] i2c: synquacer: fix deferred probing Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 226/334] hwmon: remove amd_energy driver in Makefile Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Packham, Guenter Roeck, Sasha Levin

From: Chris Packham <chris.packham@alliedtelesis.co.nz>

[ Upstream commit 7a8c68c57fd09541377f6971f25efdeb9a926c37 ]

In the initial implementation a number of PMBUS_x_WARN_LIMITs were
mapped to MFR fields. This was incorrect as these MFR limits reflect the
rated limit as opposed to a limit which will generate warning. Instead
return -ENXIO like we were already doing for other WARN_LIMITs.

Subsequently these rated limits have been exposed generically as new
fields in the sysfs ABI so the values are still available.

Fixes: 15b2703e5e02 ("hwmon: (pmbus) Add driver for BluTek BPA-RS600")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Link: https://lore.kernel.org/r/20210812014000.26293-2-chris.packham@alliedtelesis.co.nz
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pmbus/bpa-rs600.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/drivers/hwmon/pmbus/bpa-rs600.c b/drivers/hwmon/pmbus/bpa-rs600.c
index 2be69fedfa36..be76efe67d83 100644
--- a/drivers/hwmon/pmbus/bpa-rs600.c
+++ b/drivers/hwmon/pmbus/bpa-rs600.c
@@ -12,15 +12,6 @@
 #include <linux/pmbus.h>
 #include "pmbus.h"
 
-#define BPARS600_MFR_VIN_MIN	0xa0
-#define BPARS600_MFR_VIN_MAX	0xa1
-#define BPARS600_MFR_IIN_MAX	0xa2
-#define BPARS600_MFR_PIN_MAX	0xa3
-#define BPARS600_MFR_VOUT_MIN	0xa4
-#define BPARS600_MFR_VOUT_MAX	0xa5
-#define BPARS600_MFR_IOUT_MAX	0xa6
-#define BPARS600_MFR_POUT_MAX	0xa7
-
 static int bpa_rs600_read_byte_data(struct i2c_client *client, int page, int reg)
 {
 	int ret;
@@ -81,29 +72,13 @@ static int bpa_rs600_read_word_data(struct i2c_client *client, int page, int pha
 
 	switch (reg) {
 	case PMBUS_VIN_UV_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MIN);
-		break;
 	case PMBUS_VIN_OV_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VIN_MAX);
-		break;
 	case PMBUS_VOUT_UV_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MIN);
-		break;
 	case PMBUS_VOUT_OV_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_VOUT_MAX);
-		break;
 	case PMBUS_IIN_OC_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IIN_MAX);
-		break;
 	case PMBUS_IOUT_OC_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_IOUT_MAX);
-		break;
 	case PMBUS_PIN_OP_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_PIN_MAX);
-		break;
 	case PMBUS_POUT_OP_WARN_LIMIT:
-		ret = pmbus_read_word_data(client, 0, 0xff, BPARS600_MFR_POUT_MAX);
-		break;
 	case PMBUS_VIN_UV_FAULT_LIMIT:
 	case PMBUS_VIN_OV_FAULT_LIMIT:
 	case PMBUS_VOUT_UV_FAULT_LIMIT:
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 226/334] hwmon: remove amd_energy driver in Makefile
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 225/334] hwmon: (pmbus/bpa-rs600) Dont use rated limits as warn limits Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 227/334] ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Bulwahn, Guenter Roeck, Sasha Levin

From: Lukas Bulwahn <lukas.bulwahn@gmail.com>

[ Upstream commit b3a7ab2d4376726178909e27b6956c012277ac4e ]

Commit 9049572fb145 ("hwmon: Remove amd_energy driver") removes the driver,
but misses to adjust the Makefile.

Hence, ./scripts/checkkconfigsymbols.py warns:

SENSORS_AMD_ENERGY
Referencing files: drivers/hwmon/Makefile

Remove the missing piece of this driver removal.

Fixes: 9049572fb145 ("hwmon: Remove amd_energy driver")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Link: https://lore.kernel.org/r/20210817084811.10673-1-lukas.bulwahn@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/Makefile | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/hwmon/Makefile b/drivers/hwmon/Makefile
index d712c61c1f5e..0241ed84b692 100644
--- a/drivers/hwmon/Makefile
+++ b/drivers/hwmon/Makefile
@@ -45,7 +45,6 @@ obj-$(CONFIG_SENSORS_ADT7462)	+= adt7462.o
 obj-$(CONFIG_SENSORS_ADT7470)	+= adt7470.o
 obj-$(CONFIG_SENSORS_ADT7475)	+= adt7475.o
 obj-$(CONFIG_SENSORS_AHT10)	+= aht10.o
-obj-$(CONFIG_SENSORS_AMD_ENERGY) += amd_energy.o
 obj-$(CONFIG_SENSORS_APPLESMC)	+= applesmc.o
 obj-$(CONFIG_SENSORS_ARM_SCMI)	+= scmi-hwmon.o
 obj-$(CONFIG_SENSORS_ARM_SCPI)	+= scpi-hwmon.o
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 227/334] ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 226/334] hwmon: remove amd_energy driver in Makefile Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 228/334] firmware: raspberrypi: Fix a leak in rpi_firmware_get() Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shengjiu Wang, Mark Brown, Sasha Levin

From: Shengjiu Wang <shengjiu.wang@nxp.com>

[ Upstream commit 2fbbcffea5b6adbfe90ffc842a6b3eb2d7e381ed ]

The devm_clk_get() may return -EPROBE_DEFER, then clocks
will be assigned to NULL wrongly. As the clocks are
optional so we can use devm_clk_get_optional() instead of
devm_clk_get().

Fixes: b73d9e6225e8 ("ASoC: fsl_rpmsg: Add CPU DAI driver for audio base on rpmsg")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://lore.kernel.org/r/1629266614-6942-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_rpmsg.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/sound/soc/fsl/fsl_rpmsg.c b/sound/soc/fsl/fsl_rpmsg.c
index ea5c973e2e84..d60f4dac6c1b 100644
--- a/sound/soc/fsl/fsl_rpmsg.c
+++ b/sound/soc/fsl/fsl_rpmsg.c
@@ -165,25 +165,25 @@ static int fsl_rpmsg_probe(struct platform_device *pdev)
 	}
 
 	/* Get the optional clocks */
-	rpmsg->ipg = devm_clk_get(&pdev->dev, "ipg");
+	rpmsg->ipg = devm_clk_get_optional(&pdev->dev, "ipg");
 	if (IS_ERR(rpmsg->ipg))
-		rpmsg->ipg = NULL;
+		return PTR_ERR(rpmsg->ipg);
 
-	rpmsg->mclk = devm_clk_get(&pdev->dev, "mclk");
+	rpmsg->mclk = devm_clk_get_optional(&pdev->dev, "mclk");
 	if (IS_ERR(rpmsg->mclk))
-		rpmsg->mclk = NULL;
+		return PTR_ERR(rpmsg->mclk);
 
-	rpmsg->dma = devm_clk_get(&pdev->dev, "dma");
+	rpmsg->dma = devm_clk_get_optional(&pdev->dev, "dma");
 	if (IS_ERR(rpmsg->dma))
-		rpmsg->dma = NULL;
+		return PTR_ERR(rpmsg->dma);
 
-	rpmsg->pll8k = devm_clk_get(&pdev->dev, "pll8k");
+	rpmsg->pll8k = devm_clk_get_optional(&pdev->dev, "pll8k");
 	if (IS_ERR(rpmsg->pll8k))
-		rpmsg->pll8k = NULL;
+		return PTR_ERR(rpmsg->pll8k);
 
-	rpmsg->pll11k = devm_clk_get(&pdev->dev, "pll11k");
+	rpmsg->pll11k = devm_clk_get_optional(&pdev->dev, "pll11k");
 	if (IS_ERR(rpmsg->pll11k))
-		rpmsg->pll11k = NULL;
+		return PTR_ERR(rpmsg->pll11k);
 
 	platform_set_drvdata(pdev, rpmsg);
 	pm_runtime_enable(&pdev->dev);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 228/334] firmware: raspberrypi: Fix a leak in rpi_firmware_get()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 227/334] ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 229/334] usb: gadget: mv_u3d: request_irq() after initializing UDC Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 09cbd1df7d2615c19e40facbe31fdcb5f1ebfa96 ]

The reference taken by 'of_find_device_by_node()' must be released when
not needed anymore.

Add the corresponding 'put_device()' in the normal and error handling
paths.

Fixes: 4e3d60656a72 ("ARM: bcm2835: Add the Raspberry Pi firmware driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/5e17e5409b934cd08bf6f9279c73be5c1cb11cce.1628232242.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/firmware/raspberrypi.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index 250e01680742..4b8978b254f9 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c
@@ -329,12 +329,18 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node)
 
 	fw = platform_get_drvdata(pdev);
 	if (!fw)
-		return NULL;
+		goto err_put_device;
 
 	if (!kref_get_unless_zero(&fw->consumers))
-		return NULL;
+		goto err_put_device;
+
+	put_device(&pdev->dev);
 
 	return fw;
+
+err_put_device:
+	put_device(&pdev->dev);
+	return NULL;
 }
 EXPORT_SYMBOL_GPL(rpi_firmware_get);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 229/334] usb: gadget: mv_u3d: request_irq() after initializing UDC
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 228/334] firmware: raspberrypi: Fix a leak in rpi_firmware_get() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 230/334] mm/swap: consider max pages in iomap_swapfile_add_extent Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Felipe Balbi, Nadezda Lutovinova,
	Sasha Levin

From: Nadezda Lutovinova <lutovinova@ispras.ru>

[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]

If IRQ occurs between calling  request_irq() and  mv_u3d_eps_init(),
then null pointer dereference occurs since u3d->eps[] wasn't
initialized yet but used in mv_u3d_nuke().

The patch puts registration of the interrupt handler after
initializing of neccesery data.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
Acked-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210818141247.4794-1-lutovinova@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/drivers/usb/gadget/udc/mv_u3d_core.c b/drivers/usb/gadget/udc/mv_u3d_core.c
index ce3d7a3eb7e3..a1057ddfbda3 100644
--- a/drivers/usb/gadget/udc/mv_u3d_core.c
+++ b/drivers/usb/gadget/udc/mv_u3d_core.c
@@ -1921,14 +1921,6 @@ static int mv_u3d_probe(struct platform_device *dev)
 		goto err_get_irq;
 	}
 	u3d->irq = r->start;
-	if (request_irq(u3d->irq, mv_u3d_irq,
-		IRQF_SHARED, driver_name, u3d)) {
-		u3d->irq = 0;
-		dev_err(&dev->dev, "Request irq %d for u3d failed\n",
-			u3d->irq);
-		retval = -ENODEV;
-		goto err_request_irq;
-	}
 
 	/* initialize gadget structure */
 	u3d->gadget.ops = &mv_u3d_ops;	/* usb_gadget_ops */
@@ -1941,6 +1933,15 @@ static int mv_u3d_probe(struct platform_device *dev)
 
 	mv_u3d_eps_init(u3d);
 
+	if (request_irq(u3d->irq, mv_u3d_irq,
+		IRQF_SHARED, driver_name, u3d)) {
+		u3d->irq = 0;
+		dev_err(&dev->dev, "Request irq %d for u3d failed\n",
+			u3d->irq);
+		retval = -ENODEV;
+		goto err_request_irq;
+	}
+
 	/* external vbus detection */
 	if (u3d->vbus) {
 		u3d->clock_gating = 1;
@@ -1964,8 +1965,8 @@ static int mv_u3d_probe(struct platform_device *dev)
 
 err_unregister:
 	free_irq(u3d->irq, u3d);
-err_request_irq:
 err_get_irq:
+err_request_irq:
 	kfree(u3d->status_req);
 err_alloc_status_req:
 	kfree(u3d->eps);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 230/334] mm/swap: consider max pages in iomap_swapfile_add_extent
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 229/334] usb: gadget: mv_u3d: request_irq() after initializing UDC Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 231/334] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Gang Deng, Xu Yu, Darrick J. Wong,
	Christoph Hellwig, Sasha Levin

From: Xu Yu <xuyu@linux.alibaba.com>

[ Upstream commit 36ca7943ac18aebf8aad4c50829eb2ea5ec847df ]

When the max pages (last_page in the swap header + 1) is smaller than
the total pages (inode size) of the swapfile, iomap_swapfile_activate
overwrites sis->max with total pages.

However, frontswap_map is a swap page state bitmap allocated using the
initial sis->max page count read from the swap header.  If swapfile
activation increases sis->max, it's possible for the frontswap code to
walk off the end of the bitmap, thereby corrupting kernel memory.

[djwong: modify the description a bit; the original paragraph reads:

"However, frontswap_map is allocated using max pages. When test and clear
the sis offset, which is larger than max pages, of frontswap_map in
__frontswap_invalidate_page(), neighbors of frontswap_map may be
overwritten, i.e., slab is polluted."

Note also that this bug resulted in a behavioral change: activating a
swap file that was formatted and later extended results in all pages
being activated, not the number of pages recorded in the swap header.]

This fixes the issue by considering the limitation of max pages of swap
info in iomap_swapfile_add_extent().

To reproduce the case, compile kernel with slub RED ZONE, then run test:
$ sudo stress-ng -a 1 -x softlockup,resources -t 72h --metrics --times \
 --verify -v -Y /root/tmpdir/stress-ng/stress-statistic-12.yaml \
 --log-file /root/tmpdir/stress-ng/stress-logfile-12.txt \
 --temp-path /root/tmpdir/stress-ng/

We'll get the error log as below:

[ 1151.015141] =============================================================================
[ 1151.016489] BUG kmalloc-16 (Not tainted): Right Redzone overwritten
[ 1151.017486] -----------------------------------------------------------------------------
[ 1151.017486]
[ 1151.018997] Disabling lock debugging due to kernel taint
[ 1151.019873] INFO: 0x0000000084e43932-0x0000000098d17cae @offset=7392. First byte 0x0 instead of 0xcc
[ 1151.021303] INFO: Allocated in __do_sys_swapon+0xcf6/0x1170 age=43417 cpu=9 pid=3816
[ 1151.022538]  __slab_alloc+0xe/0x20
[ 1151.023069]  __kmalloc_node+0xfd/0x4b0
[ 1151.023704]  __do_sys_swapon+0xcf6/0x1170
[ 1151.024346]  do_syscall_64+0x33/0x40
[ 1151.024925]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1151.025749] INFO: Freed in put_cred_rcu+0xa1/0xc0 age=43424 cpu=3 pid=2041
[ 1151.026889]  kfree+0x276/0x2b0
[ 1151.027405]  put_cred_rcu+0xa1/0xc0
[ 1151.027949]  rcu_do_batch+0x17d/0x410
[ 1151.028566]  rcu_core+0x14e/0x2b0
[ 1151.029084]  __do_softirq+0x101/0x29e
[ 1151.029645]  asm_call_irq_on_stack+0x12/0x20
[ 1151.030381]  do_softirq_own_stack+0x37/0x40
[ 1151.031037]  do_softirq.part.15+0x2b/0x30
[ 1151.031710]  __local_bh_enable_ip+0x4b/0x50
[ 1151.032412]  copy_fpstate_to_sigframe+0x111/0x360
[ 1151.033197]  __setup_rt_frame+0xce/0x480
[ 1151.033809]  arch_do_signal+0x1a3/0x250
[ 1151.034463]  exit_to_user_mode_prepare+0xcf/0x110
[ 1151.035242]  syscall_exit_to_user_mode+0x27/0x190
[ 1151.035970]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1151.036795] INFO: Slab 0x000000003b9de4dc objects=44 used=9 fp=0x00000000539e349e flags=0xfffffc0010201
[ 1151.038323] INFO: Object 0x000000004855ba01 @offset=7376 fp=0x0000000000000000
[ 1151.038323]
[ 1151.039683] Redzone  000000008d0afd3d: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  ................
[ 1151.041180] Object   000000004855ba01: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[ 1151.042714] Redzone  0000000084e43932: 00 00 00 c0 cc cc cc cc                          ........
[ 1151.044120] Padding  000000000864c042: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  ZZZZZZZZZZZZZZZZ
[ 1151.045615] CPU: 5 PID: 3816 Comm: stress-ng Tainted: G    B             5.10.50+ #7
[ 1151.046846] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 1151.048633] Call Trace:
[ 1151.049072]  dump_stack+0x57/0x6a
[ 1151.049585]  check_bytes_and_report+0xed/0x110
[ 1151.050320]  check_object+0x1eb/0x290
[ 1151.050924]  ? __x64_sys_swapoff+0x39a/0x540
[ 1151.051646]  free_debug_processing+0x151/0x350
[ 1151.052333]  __slab_free+0x21a/0x3a0
[ 1151.052938]  ? _cond_resched+0x2d/0x40
[ 1151.053529]  ? __vunmap+0x1de/0x220
[ 1151.054139]  ? __x64_sys_swapoff+0x39a/0x540
[ 1151.054796]  ? kfree+0x276/0x2b0
[ 1151.055307]  kfree+0x276/0x2b0
[ 1151.055832]  __x64_sys_swapoff+0x39a/0x540
[ 1151.056466]  do_syscall_64+0x33/0x40
[ 1151.057084]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 1151.057866] RIP: 0033:0x150340b0ffb7
[ 1151.058481] Code: Unable to access opcode bytes at RIP 0x150340b0ff8d.
[ 1151.059537] RSP: 002b:00007fff7f4ee238 EFLAGS: 00000246 ORIG_RAX: 00000000000000a8
[ 1151.060768] RAX: ffffffffffffffda RBX: 00007fff7f4ee66c RCX: 0000150340b0ffb7
[ 1151.061904] RDX: 000000000000000a RSI: 0000000000018094 RDI: 00007fff7f4ee860
[ 1151.063033] RBP: 00007fff7f4ef980 R08: 0000000000000000 R09: 0000150340a672bd
[ 1151.064135] R10: 00007fff7f4edca0 R11: 0000000000000246 R12: 0000000000018094
[ 1151.065253] R13: 0000000000000005 R14: 000000000160d930 R15: 00007fff7f4ee66c
[ 1151.066413] FIX kmalloc-16: Restoring 0x0000000084e43932-0x0000000098d17cae=0xcc
[ 1151.066413]
[ 1151.067890] FIX kmalloc-16: Object at 0x000000004855ba01 not freed

Fixes: 67482129cdab ("iomap: add a swapfile activation function")
Fixes: a45c0eccc564 ("iomap: move the swapfile code into a separate file")
Signed-off-by: Gang Deng <gavin.dg@linux.alibaba.com>
Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/iomap/swapfile.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/fs/iomap/swapfile.c b/fs/iomap/swapfile.c
index 6250ca6a1f85..4ecf4e1f68ef 100644
--- a/fs/iomap/swapfile.c
+++ b/fs/iomap/swapfile.c
@@ -31,11 +31,16 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi)
 {
 	struct iomap *iomap = &isi->iomap;
 	unsigned long nr_pages;
+	unsigned long max_pages;
 	uint64_t first_ppage;
 	uint64_t first_ppage_reported;
 	uint64_t next_ppage;
 	int error;
 
+	if (unlikely(isi->nr_pages >= isi->sis->max))
+		return 0;
+	max_pages = isi->sis->max - isi->nr_pages;
+
 	/*
 	 * Round the start up and the end down so that the physical
 	 * extent aligns to a page boundary.
@@ -48,6 +53,7 @@ static int iomap_swapfile_add_extent(struct iomap_swapfile_info *isi)
 	if (first_ppage >= next_ppage)
 		return 0;
 	nr_pages = next_ppage - first_ppage;
+	nr_pages = min(nr_pages, max_pages);
 
 	/*
 	 * Calculate how much swap space we're adding; the first page contains
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 231/334] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 230/334] mm/swap: consider max pages in iomap_swapfile_add_extent Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 232/334] Bluetooth: add timeout sanity check to hci_inquiry Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kees Cook, Kevin Mitchell, Sasha Levin

From: Kevin Mitchell <kevmitch@arista.com>

[ Upstream commit d1f278da6b11585f05b2755adfc8851cbf14a1ec ]

When scsi_dispatch_cmd was moved to scsi_lib.c and made static, some
compilers (i.e., at least gcc 8.4.0) decided to compile this
inline. This is a problem for lkdtm.ko, which inserted a kprobe
on this function for the SCSI_DISPATCH_CMD crashpoint.

Move this crashpoint one function up the call chain to
scsi_queue_rq. Though this is also a static function, it should never be
inlined because it is assigned as a structure entry. Therefore,
kprobe_register should always be able to find it.

Fixes: 82042a2cdb55 ("scsi: move scsi_dispatch_cmd to scsi_lib.c")
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kevin Mitchell <kevmitch@arista.com>
Link: https://lore.kernel.org/r/20210819022940.561875-2-kevmitch@arista.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/fault-injection/provoke-crashes.rst | 2 +-
 drivers/misc/lkdtm/core.c                         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Documentation/fault-injection/provoke-crashes.rst b/Documentation/fault-injection/provoke-crashes.rst
index a20ba5d93932..18de17354206 100644
--- a/Documentation/fault-injection/provoke-crashes.rst
+++ b/Documentation/fault-injection/provoke-crashes.rst
@@ -29,7 +29,7 @@ recur_count
 cpoint_name
 	Where in the kernel to trigger the action. It can be
 	one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
-	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
+	FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_QUEUE_RQ,
 	IDE_CORE_CP, or DIRECT
 
 cpoint_type
diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c
index 9dda87c6b54a..016cb0b150fc 100644
--- a/drivers/misc/lkdtm/core.c
+++ b/drivers/misc/lkdtm/core.c
@@ -82,7 +82,7 @@ static struct crashpoint crashpoints[] = {
 	CRASHPOINT("FS_DEVRW",		 "ll_rw_block"),
 	CRASHPOINT("MEM_SWAPOUT",	 "shrink_inactive_list"),
 	CRASHPOINT("TIMERADD",		 "hrtimer_start"),
-	CRASHPOINT("SCSI_DISPATCH_CMD",	 "scsi_dispatch_cmd"),
+	CRASHPOINT("SCSI_QUEUE_RQ",	 "scsi_queue_rq"),
 	CRASHPOINT("IDE_CORE_CP",	 "generic_ide_ioctl"),
 #endif
 };
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 232/334] Bluetooth: add timeout sanity check to hci_inquiry
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 231/334] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 233/334] i2c: iop3xx: fix deferred probing Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Skripkin, Marcel Holtmann,
	Sasha Levin, syzbot+be2baed593ea56c6a84c

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit f41a4b2b5eb7872109723dab8ae1603bdd9d9ec1 ]

Syzbot hit "task hung" bug in hci_req_sync(). The problem was in
unreasonable huge inquiry timeout passed from userspace.
Fix it by adding sanity check for timeout value to hci_inquiry().

Since hci_inquiry() is the only user of hci_req_sync() with user
controlled timeout value, it makes sense to check timeout value in
hci_inquiry() and don't touch hci_req_sync().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+be2baed593ea56c6a84c@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/bluetooth/hci_core.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 2331612839d7..4c25bcd1ac4c 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1343,6 +1343,12 @@ int hci_inquiry(void __user *arg)
 		goto done;
 	}
 
+	/* Restrict maximum inquiry length to 60 seconds */
+	if (ir.length > 60) {
+		err = -EINVAL;
+		goto done;
+	}
+
 	hci_dev_lock(hdev);
 	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 233/334] i2c: iop3xx: fix deferred probing
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 232/334] Bluetooth: add timeout sanity check to hci_inquiry Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 234/334] i2c: s3c2410: fix IRQ check Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit a1299505162ad00def3573260c2c68b9c8e8d697 ]

When adding the code to handle platform_get_irq*() errors in the commit
489447380a29 ("handle errors returned by platform_get_irq*()"), the
actual error code was enforced to be -ENXIO in the driver for some
strange reason.  This didn't matter much until the deferred probing was
introduced -- which requires an actual error code to be propagated
upstream from the failure site.

While fixing this, also stop overriding the errors from request_irq() to
-EIO (done since the pre-git era).

Fixes: 489447380a29 ("[PATCH] handle errors returned by platform_get_irq*()")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-iop3xx.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index cfecaf18ccbb..4a6ff54d87fe 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -469,16 +469,14 @@ iop3xx_i2c_probe(struct platform_device *pdev)
 
 	irq = platform_get_irq(pdev, 0);
 	if (irq < 0) {
-		ret = -ENXIO;
+		ret = irq;
 		goto unmap;
 	}
 	ret = request_irq(irq, iop3xx_i2c_irq_handler, 0,
 				pdev->name, adapter_data);
 
-	if (ret) {
-		ret = -EIO;
+	if (ret)
 		goto unmap;
-	}
 
 	memcpy(new_adapter->name, pdev->name, strlen(pdev->name));
 	new_adapter->owner = THIS_MODULE;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 234/334] i2c: s3c2410: fix IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 233/334] i2c: iop3xx: fix deferred probing Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 235/334] i2c: hix5hd2: " Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Krzysztof Kozlowski,
	Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit d6840a5e370b7ea4fde16ce2caf431bcc87f9a75 ]

Iff platform_get_irq() returns 0, the driver's probe() method will return 0
early (as if the method's call was successful).  Let's consider IRQ0 valid
for simplicity -- devm_request_irq() can always override that decision...

Fixes: e0d1ec97853f ("i2c-s3c2410: Change IRQ to be plain integer.")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-s3c2410.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 4d82761e1585..b49a1b170bb2 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -1137,7 +1137,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)
 	 */
 	if (!(i2c->quirks & QUIRK_POLL)) {
 		i2c->irq = ret = platform_get_irq(pdev, 0);
-		if (ret <= 0) {
+		if (ret < 0) {
 			dev_err(&pdev->dev, "cannot find IRQ\n");
 			clk_unprepare(i2c->clk);
 			return ret;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 235/334] i2c: hix5hd2: fix IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 234/334] i2c: s3c2410: fix IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 236/334] gfs2: init system threads before freeze lock Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit f9b459c2ba5edfe247e86b45ad5dea8da542f3ea ]

Iff platform_get_irq() returns 0, the driver's probe() method will return 0
early (as if the method's call was successful).  Let's consider IRQ0 valid
for simplicity -- devm_request_irq() can always override that decision...

Fixes: 15ef27756b23 ("i2c: hix5hd2: add i2c controller driver")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-hix5hd2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-hix5hd2.c b/drivers/i2c/busses/i2c-hix5hd2.c
index aa00ba8bcb70..61ae58f57047 100644
--- a/drivers/i2c/busses/i2c-hix5hd2.c
+++ b/drivers/i2c/busses/i2c-hix5hd2.c
@@ -413,7 +413,7 @@ static int hix5hd2_i2c_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->regs);
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0)
+	if (irq < 0)
 		return irq;
 
 	priv->clk = devm_clk_get(&pdev->dev, NULL);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 236/334] gfs2: init system threads before freeze lock
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 235/334] i2c: hix5hd2: " Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 237/334] drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker() Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Peterson, Sasha Levin

From: Bob Peterson <rpeterso@redhat.com>

[ Upstream commit a28dc123fa66ba7f3eca7cffc4b01d96bfd35c27 ]

Patch 96b1454f2e ("gfs2: move freeze glock outside the make_fs_rw and _ro
functions") changed the gfs2 mount sequence so that it holds the freeze
lock before calling gfs2_make_fs_rw. Before this patch, gfs2_make_fs_rw
called init_threads to initialize the quotad and logd threads. That is a
problem if the system needs to withdraw due to IO errors early in the
mount sequence, for example, while initializing the system statfs inode:

1. An IO error causes the statfs glock to not sync properly after
   recovery, and leaves items on the ail list.
2. The leftover items on the ail list causes its do_xmote call to fail,
   which makes it want to withdraw. But since the glock code cannot
   withdraw (because the withdraw sequence uses glocks) it relies upon
   the logd daemon to initiate the withdraw.
3. The withdraw can never be performed by the logd daemon because all
   this takes place before the logd daemon is started.

This patch moves function init_threads from super.c to ops_fstype.c
and it changes gfs2_fill_super to start its threads before holding the
freeze lock, and if there's an error, stop its threads after releasing
it. This allows the logd to run unblocked by the freeze lock. Thus,
the logd daemon can perform its withdraw sequence properly.

Fixes: 96b1454f2e8e ("gfs2: move freeze glock outside the make_fs_rw and _ro functions")
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/ops_fstype.c | 42 ++++++++++++++++++++++++++++++
 fs/gfs2/super.c      | 61 +++++---------------------------------------
 2 files changed, 48 insertions(+), 55 deletions(-)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index bd3b3be1a473..ca76e3b8792c 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1089,6 +1089,34 @@ void gfs2_online_uevent(struct gfs2_sbd *sdp)
 	kobject_uevent_env(&sdp->sd_kobj, KOBJ_ONLINE, envp);
 }
 
+static int init_threads(struct gfs2_sbd *sdp)
+{
+	struct task_struct *p;
+	int error = 0;
+
+	p = kthread_run(gfs2_logd, sdp, "gfs2_logd");
+	if (IS_ERR(p)) {
+		error = PTR_ERR(p);
+		fs_err(sdp, "can't start logd thread: %d\n", error);
+		return error;
+	}
+	sdp->sd_logd_process = p;
+
+	p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad");
+	if (IS_ERR(p)) {
+		error = PTR_ERR(p);
+		fs_err(sdp, "can't start quotad thread: %d\n", error);
+		goto fail;
+	}
+	sdp->sd_quotad_process = p;
+	return 0;
+
+fail:
+	kthread_stop(sdp->sd_logd_process);
+	sdp->sd_logd_process = NULL;
+	return error;
+}
+
 /**
  * gfs2_fill_super - Read in superblock
  * @sb: The VFS superblock
@@ -1217,6 +1245,14 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 		goto fail_per_node;
 	}
 
+	if (!sb_rdonly(sb)) {
+		error = init_threads(sdp);
+		if (error) {
+			gfs2_withdraw_delayed(sdp);
+			goto fail_per_node;
+		}
+	}
+
 	error = gfs2_freeze_lock(sdp, &freeze_gh, 0);
 	if (error)
 		goto fail_per_node;
@@ -1226,6 +1262,12 @@ static int gfs2_fill_super(struct super_block *sb, struct fs_context *fc)
 
 	gfs2_freeze_unlock(&freeze_gh);
 	if (error) {
+		if (sdp->sd_quotad_process)
+			kthread_stop(sdp->sd_quotad_process);
+		sdp->sd_quotad_process = NULL;
+		if (sdp->sd_logd_process)
+			kthread_stop(sdp->sd_logd_process);
+		sdp->sd_logd_process = NULL;
 		fs_err(sdp, "can't make FS RW: %d\n", error);
 		goto fail_per_node;
 	}
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index 4d4ceb0b6903..2bdbba5ea8d7 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -119,34 +119,6 @@ int gfs2_jdesc_check(struct gfs2_jdesc *jd)
 	return 0;
 }
 
-static int init_threads(struct gfs2_sbd *sdp)
-{
-	struct task_struct *p;
-	int error = 0;
-
-	p = kthread_run(gfs2_logd, sdp, "gfs2_logd");
-	if (IS_ERR(p)) {
-		error = PTR_ERR(p);
-		fs_err(sdp, "can't start logd thread: %d\n", error);
-		return error;
-	}
-	sdp->sd_logd_process = p;
-
-	p = kthread_run(gfs2_quotad, sdp, "gfs2_quotad");
-	if (IS_ERR(p)) {
-		error = PTR_ERR(p);
-		fs_err(sdp, "can't start quotad thread: %d\n", error);
-		goto fail;
-	}
-	sdp->sd_quotad_process = p;
-	return 0;
-
-fail:
-	kthread_stop(sdp->sd_logd_process);
-	sdp->sd_logd_process = NULL;
-	return error;
-}
-
 /**
  * gfs2_make_fs_rw - Turn a Read-Only FS into a Read-Write one
  * @sdp: the filesystem
@@ -161,26 +133,17 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
 	struct gfs2_log_header_host head;
 	int error;
 
-	error = init_threads(sdp);
-	if (error) {
-		gfs2_withdraw_delayed(sdp);
-		return error;
-	}
-
 	j_gl->gl_ops->go_inval(j_gl, DIO_METADATA);
-	if (gfs2_withdrawn(sdp)) {
-		error = -EIO;
-		goto fail;
-	}
+	if (gfs2_withdrawn(sdp))
+		return -EIO;
 
 	error = gfs2_find_jhead(sdp->sd_jdesc, &head, false);
 	if (error || gfs2_withdrawn(sdp))
-		goto fail;
+		return error;
 
 	if (!(head.lh_flags & GFS2_LOG_HEAD_UNMOUNT)) {
 		gfs2_consist(sdp);
-		error = -EIO;
-		goto fail;
+		return -EIO;
 	}
 
 	/*  Initialize some head of the log stuff  */
@@ -188,20 +151,8 @@ int gfs2_make_fs_rw(struct gfs2_sbd *sdp)
 	gfs2_log_pointers_init(sdp, head.lh_blkno);
 
 	error = gfs2_quota_init(sdp);
-	if (error || gfs2_withdrawn(sdp))
-		goto fail;
-
-	set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
-
-	return 0;
-
-fail:
-	if (sdp->sd_quotad_process)
-		kthread_stop(sdp->sd_quotad_process);
-	sdp->sd_quotad_process = NULL;
-	if (sdp->sd_logd_process)
-		kthread_stop(sdp->sd_logd_process);
-	sdp->sd_logd_process = NULL;
+	if (!error && !gfs2_withdrawn(sdp))
+		set_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags);
 	return error;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 237/334] drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 236/334] gfs2: init system threads before freeze lock Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 238/334] rsi: fix error code in rsi_load_9116_firmware() Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wei Yongjun, Inki Dae,
	Sasha Levin

From: Wei Yongjun <weiyongjun1@huawei.com>

[ Upstream commit b74a29fac6de62f39b594e8f545b3a26db7edb5e ]

Add the missing unlock before return from function g2d_runqueue_worker()
in the error handling case.

Fixes: 445d3bed75de ("drm/exynos: use pm_runtime_resume_and_get()")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/exynos/exynos_drm_g2d.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index cab4d2c370a7..0ed665501ac4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -897,13 +897,14 @@ static void g2d_runqueue_worker(struct work_struct *work)
 			ret = pm_runtime_resume_and_get(g2d->dev);
 			if (ret < 0) {
 				dev_err(g2d->dev, "failed to enable G2D device.\n");
-				return;
+				goto out;
 			}
 
 			g2d_dma_start(g2d, g2d->runqueue_node);
 		}
 	}
 
+out:
 	mutex_unlock(&g2d->runqueue_mutex);
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 238/334] rsi: fix error code in rsi_load_9116_firmware()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 237/334] drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 239/334] rsi: fix an error code in rsi_probe() Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit d0f8430332a16c7baa80ce2886339182c5d85f37 ]

This code returns success if the kmemdup() fails, but obviously it
should return -ENOMEM instead.

Fixes: e5a1ecc97e5f ("rsi: add firmware loading for 9116 device")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210805103746.GA26417@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_hal.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
index 99b21a2c8386..f4a26f16f00f 100644
--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
+++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
@@ -1038,8 +1038,10 @@ static int rsi_load_9116_firmware(struct rsi_hw *adapter)
 	}
 
 	ta_firmware = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL);
-	if (!ta_firmware)
+	if (!ta_firmware) {
+		status = -ENOMEM;
 		goto fail_release_fw;
+	}
 	fw_p = ta_firmware;
 	instructions_sz = fw_entry->size;
 	rsi_dbg(INFO_ZONE, "FW Length = %d bytes\n", instructions_sz);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 239/334] rsi: fix an error code in rsi_probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 238/334] rsi: fix error code in rsi_load_9116_firmware() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 240/334] octeontx2-af: cn10k: Fix SDP base channel number Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 9adcdf6758d7c4c9bdaf22d78eb9fcae260ed113 ]

Return -ENODEV instead of success for unsupported devices.

Fixes: 54fdb318c111 ("rsi: add new device model for 9116")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210816183947.GA2119@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/rsi/rsi_91x_usb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
index 3fbe2a3c1455..416976f09888 100644
--- a/drivers/net/wireless/rsi/rsi_91x_usb.c
+++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
@@ -816,6 +816,7 @@ static int rsi_probe(struct usb_interface *pfunction,
 	} else {
 		rsi_dbg(ERR_ZONE, "%s: Unsupported RSI device id 0x%x\n",
 			__func__, id->idProduct);
+		status = -ENODEV;
 		goto err1;
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 240/334] octeontx2-af: cn10k: Fix SDP base channel number
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 239/334] rsi: fix an error code in rsi_probe() Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 241/334] octeontx2-pf: send correct vlan priority mask to npc_install_flow_req Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Subbaraya Sundeep <sbhatta@marvell.com>

[ Upstream commit 477b53f3f95ba5341b4320f8b7a92cedc5a67650 ]

As per hardware the base channel number configured
for programmable channels of a block must be multiple
of number of channels of that block. This condition
is not met for SDP base channel currently. Hence this
patch ensures all the base channel numbers of all
blocks are multiple of number of channels present in
the blocks. Also instead of hardcoding SDP number
of channels the same is read from the NIX_AF_CONST1
register.

Fixes: 242da439214b ("octeontx2-af: cn10k: Add support for programmable")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../ethernet/marvell/octeontx2/af/common.h    |  2 --
 .../ethernet/marvell/octeontx2/af/rvu_cn10k.c | 31 +++++++++++++------
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h
index 47f5ed006a93..e0b43aad203c 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h
@@ -195,8 +195,6 @@ enum nix_scheduler {
 #define NIX_CHAN_LBK_CHX(a, b)		(0 + 0x100 * (a) + (b))
 #define NIX_CHAN_SDP_CH_START		(0x700ull)
 
-#define SDP_CHANNELS			256
-
 /* The mask is to extract lower 10-bits of channel number
  * which CPT will pass to X2P.
  */
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
index 8d48b64485c6..28dcce7d575a 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
@@ -212,9 +212,10 @@ void rvu_reset_lmt_map_tbl(struct rvu *rvu, u16 pcifunc)
 
 int rvu_set_channels_base(struct rvu *rvu)
 {
+	u16 nr_lbk_chans, nr_sdp_chans, nr_cgx_chans, nr_cpt_chans;
+	u16 sdp_chan_base, cgx_chan_base, cpt_chan_base;
 	struct rvu_hwinfo *hw = rvu->hw;
-	u16 cpt_chan_base;
-	u64 nix_const;
+	u64 nix_const, nix_const1;
 	int blkaddr;
 
 	blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NIX, 0);
@@ -222,6 +223,7 @@ int rvu_set_channels_base(struct rvu *rvu)
 		return blkaddr;
 
 	nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST);
+	nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
 
 	hw->cgx = (nix_const >> 12) & 0xFULL;
 	hw->lmac_per_cgx = (nix_const >> 8) & 0xFULL;
@@ -244,14 +246,24 @@ int rvu_set_channels_base(struct rvu *rvu)
 	 * channels such that all channel numbers are contiguous
 	 * leaving no holes. This way the new CPT channels can be
 	 * accomodated. The order of channel numbers assigned is
-	 * LBK, SDP, CGX and CPT.
+	 * LBK, SDP, CGX and CPT. Also the base channel number
+	 * of a block must be multiple of number of channels
+	 * of the block.
 	 */
-	hw->sdp_chan_base = hw->lbk_chan_base + hw->lbk_links *
-				((nix_const >> 16) & 0xFFULL);
-	hw->cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * SDP_CHANNELS;
+	nr_lbk_chans = (nix_const >> 16) & 0xFFULL;
+	nr_sdp_chans = nix_const1 & 0xFFFULL;
+	nr_cgx_chans = nix_const & 0xFFULL;
+	nr_cpt_chans = (nix_const >> 32) & 0xFFFULL;
 
-	cpt_chan_base = hw->cgx_chan_base + hw->cgx_links *
-				(nix_const & 0xFFULL);
+	sdp_chan_base = hw->lbk_chan_base + hw->lbk_links * nr_lbk_chans;
+	/* Round up base channel to multiple of number of channels */
+	hw->sdp_chan_base = ALIGN(sdp_chan_base, nr_sdp_chans);
+
+	cgx_chan_base = hw->sdp_chan_base + hw->sdp_links * nr_sdp_chans;
+	hw->cgx_chan_base = ALIGN(cgx_chan_base, nr_cgx_chans);
+
+	cpt_chan_base = hw->cgx_chan_base + hw->cgx_links * nr_cgx_chans;
+	hw->cpt_chan_base = ALIGN(cpt_chan_base, nr_cpt_chans);
 
 	/* Out of 4096 channels start CPT from 2048 so
 	 * that MSB for CPT channels is always set
@@ -355,6 +367,7 @@ err_put:
 
 static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr)
 {
+	u64 nix_const1 = rvu_read64(rvu, blkaddr, NIX_AF_CONST1);
 	u64 nix_const = rvu_read64(rvu, blkaddr, NIX_AF_CONST);
 	u16 cgx_chans, lbk_chans, sdp_chans, cpt_chans;
 	struct rvu_hwinfo *hw = rvu->hw;
@@ -364,7 +377,7 @@ static void __rvu_nix_set_channels(struct rvu *rvu, int blkaddr)
 
 	cgx_chans = nix_const & 0xFFULL;
 	lbk_chans = (nix_const >> 16) & 0xFFULL;
-	sdp_chans = SDP_CHANNELS;
+	sdp_chans = nix_const1 & 0xFFFULL;
 	cpt_chans = (nix_const >> 32) & 0xFFFULL;
 
 	start = hw->cgx_chan_base;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 241/334] octeontx2-pf: send correct vlan priority mask to npc_install_flow_req
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 240/334] octeontx2-af: cn10k: Fix SDP base channel number Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 242/334] octeontx2-af: Check capability flag while freeing ipolicer memory Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naveen Mamindlapalli, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Naveen Mamindlapalli <naveenm@marvell.com>

[ Upstream commit 10df5a13ac6785b409ad749c4b10d4b220cc7e71 ]

This patch corrects the erroneous vlan priority mask field that was
send to npc_install_flow_req.

Fixes: 1d4d9e42c240 ("octeontx2-pf: Add tc flower hardware offload on ingress traffic")
Signed-off-by: Naveen Mamindlapalli <naveenm@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
index 972b202b9884..32d5c623fdfa 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -485,8 +485,8 @@ static int otx2_tc_prepare_flow(struct otx2_nic *nic, struct otx2_tc_flow *node,
 				   match.key->vlan_priority << 13;
 
 			vlan_tci_mask = match.mask->vlan_id |
-					match.key->vlan_dei << 12 |
-					match.key->vlan_priority << 13;
+					match.mask->vlan_dei << 12 |
+					match.mask->vlan_priority << 13;
 
 			flow_spec->vlan_tci = htons(vlan_tci);
 			flow_mask->vlan_tci = htons(vlan_tci_mask);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 242/334] octeontx2-af: Check capability flag while freeing ipolicer memory
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 241/334] octeontx2-pf: send correct vlan priority mask to npc_install_flow_req Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 243/334] octeontx2-pf: Dont install VLAN offload rule if netdev is down Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geetha sowjanya, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Geetha sowjanya <gakula@marvell.com>

[ Upstream commit 07cccffdbdd37820ba13c645af8e74a78a266557 ]

Bandwidth profiles (ipolicer structure)is implemented only on CN10K
platform. But current code try to free the ipolicer memory without
checking the capibility flag leading to driver crash on OCTEONTX2
platform. This patch fixes the issue by add capability flag check.

Fixes: e8e095b3b3700 ("octeontx2-af: cn10k: Bandwidth profiles config support")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
index 4bfbbdf38770..c32195073e8a 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
@@ -25,7 +25,7 @@ static int nix_update_mce_rule(struct rvu *rvu, u16 pcifunc,
 			       int type, bool add);
 static int nix_setup_ipolicers(struct rvu *rvu,
 			       struct nix_hw *nix_hw, int blkaddr);
-static void nix_ipolicer_freemem(struct nix_hw *nix_hw);
+static void nix_ipolicer_freemem(struct rvu *rvu, struct nix_hw *nix_hw);
 static int nix_verify_bandprof(struct nix_cn10k_aq_enq_req *req,
 			       struct nix_hw *nix_hw, u16 pcifunc);
 static int nix_free_all_bandprof(struct rvu *rvu, u16 pcifunc);
@@ -3849,7 +3849,7 @@ static void rvu_nix_block_freemem(struct rvu *rvu, int blkaddr,
 			kfree(txsch->schq.bmap);
 		}
 
-		nix_ipolicer_freemem(nix_hw);
+		nix_ipolicer_freemem(rvu, nix_hw);
 
 		vlan = &nix_hw->txvlan;
 		kfree(vlan->rsrc.bmap);
@@ -4225,11 +4225,14 @@ static int nix_setup_ipolicers(struct rvu *rvu,
 	return 0;
 }
 
-static void nix_ipolicer_freemem(struct nix_hw *nix_hw)
+static void nix_ipolicer_freemem(struct rvu *rvu, struct nix_hw *nix_hw)
 {
 	struct nix_ipolicer *ipolicer;
 	int layer;
 
+	if (!rvu->hw->cap.ipolicer)
+		return;
+
 	for (layer = 0; layer < BAND_PROF_NUM_LAYERS; layer++) {
 		ipolicer = &nix_hw->ipolicer[layer];
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 243/334] octeontx2-pf: Dont install VLAN offload rule if netdev is down
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 242/334] octeontx2-af: Check capability flag while freeing ipolicer memory Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 244/334] octeontx2-pf: Fix algorithm index in MCAM rules with RSS action Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sunil Goutham, David S. Miller, Sasha Levin

From: Sunil Goutham <sgoutham@marvell.com>

[ Upstream commit 05209e3570e452cdaa644e8398a8875b6a91051d ]

Whenever user changes interface MAC address both default DMAC based
MCAM rule and VLAN offload (for strip) rules are updated with new
MAC address. To update or install VLAN offload rule PF driver needs
interface's receive channel info, which is retrieved from admin
function at the time of NIXLF initialization.

If user changes MAC address before interface is UP, VLAN offload rule
installation will fail and throw error as receive channel is not valid.
To avoid this, skip VLAN offload rule installation if netdev is not UP.
This rule will anyway be reinslatted as part of open() call.

Fixes: fd9d7859db6c ("octeontx2-pf: Implement ingress/egress VLAN offload")
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
index 70fcc1fd962f..692099793005 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -208,7 +208,8 @@ int otx2_set_mac_address(struct net_device *netdev, void *p)
 	if (!otx2_hw_set_mac_addr(pfvf, addr->sa_data)) {
 		memcpy(netdev->dev_addr, addr->sa_data, netdev->addr_len);
 		/* update dmac field in vlan offload rule */
-		if (pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT)
+		if (netif_running(netdev) &&
+		    pfvf->flags & OTX2_FLAG_RX_VLAN_SUPPORT)
 			otx2_install_rxvlan_offload_flow(pfvf);
 		/* update dmac address in ntuple and DMAC filter list */
 		if (pfvf->flags & OTX2_FLAG_DMACFLTR_SUPPORT)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 244/334] octeontx2-pf: Fix algorithm index in MCAM rules with RSS action
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 243/334] octeontx2-pf: Dont install VLAN offload rule if netdev is down Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:14 ` [PATCH 5.14 245/334] octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1 Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sunil Goutham, David S. Miller, Sasha Levin

From: Sunil Goutham <sgoutham@marvell.com>

[ Upstream commit e7938365459f3a6d4edf212f435c4ad635621450 ]

Otherthan setting action as RSS in NPC MCAM entry, RSS flowkey
algorithm index also needs to be set. Otherwise whatever algorithm
is defined at flowkey index '0' will be considered by HW and pkt
flows will be distributed as such.

Fix this by saving the flowkey index sent by admin function while
initializing RSS and then use it when framing MCAM rules.

Fixes: 81a4362016e7 ("octeontx2-pf: Add RSS multi group support")
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/marvell/octeontx2/nic/otx2_common.c  | 11 +++++++++++
 .../net/ethernet/marvell/octeontx2/nic/otx2_common.h  |  3 +++
 .../net/ethernet/marvell/octeontx2/nic/otx2_flows.c   |  1 +
 3 files changed, 15 insertions(+)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
index 692099793005..a6210b020a57 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -269,6 +269,7 @@ unlock:
 int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
 {
 	struct otx2_rss_info *rss = &pfvf->hw.rss_info;
+	struct nix_rss_flowkey_cfg_rsp *rsp;
 	struct nix_rss_flowkey_cfg *req;
 	int err;
 
@@ -283,6 +284,16 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
 	req->group = DEFAULT_RSS_CONTEXT_GROUP;
 
 	err = otx2_sync_mbox_msg(&pfvf->mbox);
+	if (err)
+		goto fail;
+
+	rsp = (struct nix_rss_flowkey_cfg_rsp *)
+			otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
+	if (IS_ERR(rsp))
+		goto fail;
+
+	pfvf->hw.flowkey_alg_idx = rsp->alg_idx;
+fail:
 	mutex_unlock(&pfvf->mbox.lock);
 	return err;
 }
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
index 8fd58cd07f50..8c602d27108a 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.h
@@ -196,6 +196,9 @@ struct otx2_hw {
 	u8			lso_udpv4_idx;
 	u8			lso_udpv6_idx;
 
+	/* RSS */
+	u8			flowkey_alg_idx;
+
 	/* MSI-X */
 	u8			cint_cnt; /* CQ interrupt count */
 	u16			npa_msixoff; /* Offset of NPA vectors */
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
index 4d9de525802d..fdd27c4fea86 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c
@@ -858,6 +858,7 @@ static int otx2_add_flow_msg(struct otx2_nic *pfvf, struct otx2_flow *flow)
 		if (flow->flow_spec.flow_type & FLOW_RSS) {
 			req->op = NIX_RX_ACTIONOP_RSS;
 			req->index = flow->rss_ctx_id;
+			req->flow_key_alg = pfvf->hw.flowkey_alg_idx;
 		} else {
 			req->op = NIX_RX_ACTIONOP_UCAST;
 			req->index = ethtool_get_flow_spec_ring(ring_cookie);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 245/334] octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 244/334] octeontx2-pf: Fix algorithm index in MCAM rules with RSS action Greg Kroah-Hartman
@ 2021-09-13 13:14 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 246/334] m68k: coldfire: return success for clk_enable(NULL) Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:14 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geetha sowjanya, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Geetha sowjanya <gakula@marvell.com>

[ Upstream commit 623da5ca70b70f01cd483585f5cd4c463cf2f2da ]

RVU SMMU widget stores the final translated PA at
RVU_AF_SMMU_TLN_FLIT0<57:18> instead of FLIT1 register. This patch
fixes the address translation logic to use the correct register.

Fixes: 893ae97214c3 ("octeontx2-af: cn10k: Support configurable LMTST regions")
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c | 4 ++--
 drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
index 28dcce7d575a..dbe9149a215e 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cn10k.c
@@ -82,10 +82,10 @@ static int rvu_get_lmtaddr(struct rvu *rvu, u16 pcifunc,
 		dev_err(rvu->dev, "%s LMTLINE iova transulation failed err:%llx\n", __func__, val);
 		return -EIO;
 	}
-	/* PA[51:12] = RVU_AF_SMMU_TLN_FLIT1[60:21]
+	/* PA[51:12] = RVU_AF_SMMU_TLN_FLIT0[57:18]
 	 * PA[11:0] = IOVA[11:0]
 	 */
-	pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT1) >> 21;
+	pa = rvu_read64(rvu, BLKADDR_RVUM, RVU_AF_SMMU_TLN_FLIT0) >> 18;
 	pa &= GENMASK_ULL(39, 0);
 	*lmt_addr = (pa << 12) | (iova  & 0xFFF);
 
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h
index 8b01ef6e2c99..4215841c9f86 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_reg.h
@@ -53,7 +53,7 @@
 #define RVU_AF_SMMU_TXN_REQ		    (0x6008)
 #define RVU_AF_SMMU_ADDR_RSP_STS	    (0x6010)
 #define RVU_AF_SMMU_ADDR_TLN		    (0x6018)
-#define RVU_AF_SMMU_TLN_FLIT1		    (0x6030)
+#define RVU_AF_SMMU_TLN_FLIT0		    (0x6020)
 
 /* Admin function's privileged PF/VF registers */
 #define RVU_PRIV_CONST                      (0x8000000)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 246/334] m68k: coldfire: return success for clk_enable(NULL)
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2021-09-13 13:14 ` [PATCH 5.14 245/334] octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1 Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 247/334] ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Marc Kleine-Budde,
	Greg Ungerer, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit f6a4f0b424df957d84fa7b9f2d02981234ff5828 ]

The clk_enable is supposed work when CONFIG_HAVE_CLK is false, but it
returns -EINVAL.  That means some drivers fail during probe.

[    1.680000] flexcan: probe of flexcan.0 failed with error -22

Fixes: c1fb1bf64bb6 ("m68k: let clk_enable() return immediately if clk is NULL")
Fixes: bea8bcb12da0 ("m68knommu: Add support for the Coldfire m5441x.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/m68k/coldfire/clk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/m68k/coldfire/clk.c b/arch/m68k/coldfire/clk.c
index 2ed841e94111..d03b6c4aa86b 100644
--- a/arch/m68k/coldfire/clk.c
+++ b/arch/m68k/coldfire/clk.c
@@ -78,7 +78,7 @@ int clk_enable(struct clk *clk)
 	unsigned long flags;
 
 	if (!clk)
-		return -EINVAL;
+		return 0;
 
 	spin_lock_irqsave(&clk_lock, flags);
 	if ((clk->enabled++ == 0) && clk->clk_ops)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 247/334] ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 246/334] m68k: coldfire: return success for clk_enable(NULL) Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 248/334] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Lukasz Majczak,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit 6d41bbf2fd3615c56dbf2b67f6cbf9e83d14a2e2 ]

Contrary to what is said in board's file, topology targeting
kbl_da7219_max98373 expects format 16b, not 24/32b. Partially revert
changes added in 'ASoC: Intel: Boards: Add Maxim98373 support' to bring
old behavior back, aligning with topology expectations.

Fixes: 716d53cc7837 ("ASoC: Intel: Boards: Add Maxim98373 support")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Tested-by: Lukasz Majczak <lma@semihalf.com>
Link: https://lore.kernel.org/r/20210818075742.1515155-2-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/boards/kbl_da7219_max98927.c | 55 +++-----------------
 1 file changed, 7 insertions(+), 48 deletions(-)

diff --git a/sound/soc/intel/boards/kbl_da7219_max98927.c b/sound/soc/intel/boards/kbl_da7219_max98927.c
index a31a7a7bbf66..2b43459adc33 100644
--- a/sound/soc/intel/boards/kbl_da7219_max98927.c
+++ b/sound/soc/intel/boards/kbl_da7219_max98927.c
@@ -199,7 +199,7 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream,
 		}
 		if (!strcmp(codec_dai->component->name, MAX98373_DEV0_NAME)) {
 			ret = snd_soc_dai_set_tdm_slot(codec_dai,
-							0x03, 3, 8, 24);
+							0x30, 3, 8, 16);
 			if (ret < 0) {
 				dev_err(runtime->dev,
 						"DEV0 TDM slot err:%d\n", ret);
@@ -208,10 +208,10 @@ static int kabylake_ssp0_hw_params(struct snd_pcm_substream *substream,
 		}
 		if (!strcmp(codec_dai->component->name, MAX98373_DEV1_NAME)) {
 			ret = snd_soc_dai_set_tdm_slot(codec_dai,
-							0x0C, 3, 8, 24);
+							0xC0, 3, 8, 16);
 			if (ret < 0) {
 				dev_err(runtime->dev,
-						"DEV0 TDM slot err:%d\n", ret);
+						"DEV1 TDM slot err:%d\n", ret);
 				return ret;
 			}
 		}
@@ -311,24 +311,6 @@ static int kabylake_ssp_fixup(struct snd_soc_pcm_runtime *rtd,
 	 * The above 2 loops are mutually exclusive based on the stream direction,
 	 * thus rtd_dpcm variable will never be overwritten
 	 */
-	/*
-	 * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE,
-	 * where as kblda7219m98927 & kblmax98927 supports S16_LE by default.
-	 * Skipping the port wise FE and BE configuration for kblda7219m98373 &
-	 * kblmax98373 as the topology (FE & BE) supports S24_LE only.
-	 */
-
-	if (!strcmp(rtd->card->name, "kblda7219m98373") ||
-		!strcmp(rtd->card->name, "kblmax98373")) {
-		/* The ADSP will convert the FE rate to 48k, stereo */
-		rate->min = rate->max = 48000;
-		chan->min = chan->max = DUAL_CHANNEL;
-
-		/* set SSP to 24 bit */
-		snd_mask_none(fmt);
-		snd_mask_set_format(fmt, SNDRV_PCM_FORMAT_S24_LE);
-		return 0;
-	}
 
 	/*
 	 * The ADSP will convert the FE rate to 48k, stereo, 24 bit
@@ -479,31 +461,20 @@ static struct snd_pcm_hw_constraint_list constraints_channels_quad = {
 static int kbl_fe_startup(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
-	struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream);
 
 	/*
 	 * On this platform for PCM device we support,
 	 * 48Khz
 	 * stereo
+	 * 16 bit audio
 	 */
 
 	runtime->hw.channels_max = DUAL_CHANNEL;
 	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
 					   &constraints_channels);
-	/*
-	 * Setup S24_LE (32 bit container and 24 bit valid data) for
-	 * kblda7219m98373 & kblmax98373. For kblda7219m98927 &
-	 * kblmax98927 keeping it as 16/16 due to topology FW dependency.
-	 */
-	if (!strcmp(soc_rt->card->name, "kblda7219m98373") ||
-		!strcmp(soc_rt->card->name, "kblmax98373")) {
-		runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE;
-		snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24);
-
-	} else {
-		runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
-		snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
-	}
+
+	runtime->hw.formats = SNDRV_PCM_FMTBIT_S16_LE;
+	snd_pcm_hw_constraint_msbits(runtime, 0, 16, 16);
 
 	snd_pcm_hw_constraint_list(runtime, 0,
 				SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
@@ -536,23 +507,11 @@ static int kabylake_dmic_fixup(struct snd_soc_pcm_runtime *rtd,
 static int kabylake_dmic_startup(struct snd_pcm_substream *substream)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
-	struct snd_soc_pcm_runtime *soc_rt = asoc_substream_to_rtd(substream);
 
 	runtime->hw.channels_min = runtime->hw.channels_max = QUAD_CHANNEL;
 	snd_pcm_hw_constraint_list(runtime, 0, SNDRV_PCM_HW_PARAM_CHANNELS,
 			&constraints_channels_quad);
 
-	/*
-	 * Topology for kblda7219m98373 & kblmax98373 supports only S24_LE.
-	 * The DMIC also configured for S24_LE. Forcing the DMIC format to
-	 * S24_LE due to the topology FW dependency.
-	 */
-	if (!strcmp(soc_rt->card->name, "kblda7219m98373") ||
-		!strcmp(soc_rt->card->name, "kblmax98373")) {
-		runtime->hw.formats = SNDRV_PCM_FMTBIT_S24_LE;
-		snd_pcm_hw_constraint_msbits(runtime, 0, 32, 24);
-	}
-
 	return snd_pcm_hw_constraint_list(substream->runtime, 0,
 			SNDRV_PCM_HW_PARAM_RATE, &constraints_rates);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 248/334] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 247/334] ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 249/334] ASoC: Intel: Skylake: Fix module resource and format selection Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Lukasz Majczak,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit 126b3422adc80f29d2129db7f61e0113a8a526c6 ]

Advancing pointer initially fixed issue for some users but caused
regression for others. Leave data as it to make it easier for end users
to adjust their topology files if needed.

Fixes: a8cd7066f042 ("ASoC: Intel: Skylake: Strip T and L from TLV IPCs")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Tested-by: Lukasz Majczak <lma@semihalf.com>
Link: https://lore.kernel.org/r/20210818075742.1515155-3-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/skylake/skl-topology.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index c0fdab39e7c2..45b1521e6189 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -1463,12 +1463,6 @@ static int skl_tplg_tlv_control_set(struct snd_kcontrol *kcontrol,
 	struct skl_dev *skl = get_skl_ctx(w->dapm->dev);
 
 	if (ac->params) {
-		/*
-		 * Widget data is expected to be stripped of T and L
-		 */
-		size -= 2 * sizeof(unsigned int);
-		data += 2;
-
 		if (size > ac->max)
 			return -EINVAL;
 		ac->size = size;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 249/334] ASoC: Intel: Skylake: Fix module resource and format selection
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 248/334] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 250/334] mmc: sdhci: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cezary Rojewski, Lukasz Majczak,
	Mark Brown, Sasha Levin

From: Cezary Rojewski <cezary.rojewski@intel.com>

[ Upstream commit e8b374b649afe756c2470e0e6668022e90bf8518 ]

Module configuration may differ between its instances depending on
resources required and input and output audio format. Available
parameters to select from are stored in module resource and interface
(format) lists. These come from topology, together with description of
each of pipe's modules.

Ignoring index value provided by topology and relying always on 0th
entry leads to unexpected module behavior due to under/overbudged
resources assigned or impropper format selection. Fix by taking entry at
index specified by topology.

Fixes: f6fa56e22559 ("ASoC: Intel: Skylake: Parse and update module config structure")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Tested-by: Lukasz Majczak <lma@semihalf.com>
Link: https://lore.kernel.org/r/20210818075742.1515155-5-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/intel/skylake/skl-topology.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/sound/soc/intel/skylake/skl-topology.c b/sound/soc/intel/skylake/skl-topology.c
index 45b1521e6189..09037d555ec4 100644
--- a/sound/soc/intel/skylake/skl-topology.c
+++ b/sound/soc/intel/skylake/skl-topology.c
@@ -113,7 +113,7 @@ static int is_skl_dsp_widget_type(struct snd_soc_dapm_widget *w,
 
 static void skl_dump_mconfig(struct skl_dev *skl, struct skl_module_cfg *mcfg)
 {
-	struct skl_module_iface *iface = &mcfg->module->formats[0];
+	struct skl_module_iface *iface = &mcfg->module->formats[mcfg->fmt_idx];
 
 	dev_dbg(skl->dev, "Dumping config\n");
 	dev_dbg(skl->dev, "Input Format:\n");
@@ -195,8 +195,8 @@ static void skl_tplg_update_params_fixup(struct skl_module_cfg *m_cfg,
 	struct skl_module_fmt *in_fmt, *out_fmt;
 
 	/* Fixups will be applied to pin 0 only */
-	in_fmt = &m_cfg->module->formats[0].inputs[0].fmt;
-	out_fmt = &m_cfg->module->formats[0].outputs[0].fmt;
+	in_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].inputs[0].fmt;
+	out_fmt = &m_cfg->module->formats[m_cfg->fmt_idx].outputs[0].fmt;
 
 	if (params->stream == SNDRV_PCM_STREAM_PLAYBACK) {
 		if (is_fe) {
@@ -239,9 +239,9 @@ static void skl_tplg_update_buffer_size(struct skl_dev *skl,
 	/* Since fixups is applied to pin 0 only, ibs, obs needs
 	 * change for pin 0 only
 	 */
-	res = &mcfg->module->resources[0];
-	in_fmt = &mcfg->module->formats[0].inputs[0].fmt;
-	out_fmt = &mcfg->module->formats[0].outputs[0].fmt;
+	res = &mcfg->module->resources[mcfg->res_idx];
+	in_fmt = &mcfg->module->formats[mcfg->fmt_idx].inputs[0].fmt;
+	out_fmt = &mcfg->module->formats[mcfg->fmt_idx].outputs[0].fmt;
 
 	if (mcfg->m_type == SKL_MODULE_TYPE_SRCINT)
 		multiplier = 5;
@@ -1631,11 +1631,12 @@ int skl_tplg_update_pipe_params(struct device *dev,
 			struct skl_module_cfg *mconfig,
 			struct skl_pipe_params *params)
 {
-	struct skl_module_res *res = &mconfig->module->resources[0];
+	struct skl_module_res *res;
 	struct skl_dev *skl = get_skl_ctx(dev);
 	struct skl_module_fmt *format = NULL;
 	u8 cfg_idx = mconfig->pipe->cur_config_idx;
 
+	res = &mconfig->module->resources[mconfig->res_idx];
 	skl_tplg_fill_dma_id(mconfig, params);
 	mconfig->fmt_idx = mconfig->mod_cfg[cfg_idx].fmt_idx;
 	mconfig->res_idx = mconfig->mod_cfg[cfg_idx].res_idx;
@@ -1644,9 +1645,9 @@ int skl_tplg_update_pipe_params(struct device *dev,
 		return 0;
 
 	if (params->stream == SNDRV_PCM_STREAM_PLAYBACK)
-		format = &mconfig->module->formats[0].inputs[0].fmt;
+		format = &mconfig->module->formats[mconfig->fmt_idx].inputs[0].fmt;
 	else
-		format = &mconfig->module->formats[0].outputs[0].fmt;
+		format = &mconfig->module->formats[mconfig->fmt_idx].outputs[0].fmt;
 
 	/* set the hw_params */
 	format->s_freq = params->s_freq;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 250/334] mmc: sdhci: Fix issue with uninitialized dma_slave_config
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 249/334] ASoC: Intel: Skylake: Fix module resource and format selection Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 251/334] mmc: dw_mmc: " Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Chunyan Zhang,
	Faiz Abbas, Peter Ujfalusi, Vinod Koul, Tony Lindgren,
	Ulf Hansson, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 522654d534d315d540710124c57b49ca22ac5f72 ]

Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.

For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures at least if external TI SDMA is ever configured for sdhci.

For other external DMA cases, this is probably not currently an issue but
is still good to fix though.

Fixes: 18e762e3b7a7 ("mmc: sdhci: add support for using external DMA devices")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Chunyan Zhang <zhang.chunyan@linaro.org>
Cc: Faiz Abbas <faiz_abbas@ti.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Reviewed-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Link: https://lore.kernel.org/r/20210810081644.19353-1-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/sdhci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index aba6e10b8605..fff6c39a343e 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1222,6 +1222,7 @@ static int sdhci_external_dma_setup(struct sdhci_host *host,
 	if (!host->mapbase)
 		return -EINVAL;
 
+	memset(&cfg, 0, sizeof(cfg));
 	cfg.src_addr = host->mapbase + SDHCI_BUFFER;
 	cfg.dst_addr = host->mapbase + SDHCI_BUFFER;
 	cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 251/334] mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 250/334] mmc: sdhci: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 252/334] mmc: moxart: " Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shawn Lin, Jaehoon Chung,
	Peter Ujfalusi, Vinod Koul, Tony Lindgren, Ulf Hansson,
	Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit c3ff0189d3bc9c03845fe37472c140f0fefd0c79 ]

Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.

For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.

For dw_mmc, this is probably not currently an issue but is still good to
fix though.

Fixes: 3fc7eaef44db ("mmc: dw_mmc: Add external dma interface support")
Cc: Shawn Lin <shawn.lin@rock-chips.com>
Cc: Jaehoon Chung <jh80.chung@samsung.com>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210810081644.19353-2-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/dw_mmc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index c3229d8c7041..33cb70aa02aa 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -782,6 +782,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,
 	int ret = 0;
 
 	/* Set external dma config: burst size, burst width */
+	memset(&cfg, 0, sizeof(cfg));
 	cfg.dst_addr = host->phy_regs + fifo_offset;
 	cfg.src_addr = cfg.dst_addr;
 	cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 252/334] mmc: moxart: Fix issue with uninitialized dma_slave_config
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 251/334] mmc: dw_mmc: " Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 253/334] ASoC: wm_adsp: Put debugfs_remove_recursive back in Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jonas Jensen, Vinod Koul,
	Peter Ujfalusi, Tony Lindgren, Ulf Hansson, Sasha Levin

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit ee5165354d498e5bceb0b386e480ac84c5f8c28c ]

Depending on the DMA driver being used, the struct dma_slave_config may
need to be initialized to zero for the unused data.

For example, we have three DMA drivers using src_port_window_size and
dst_port_window_size. If these are left uninitialized, it can cause DMA
failures.

For moxart, this is probably not currently an issue but is still good to
fix though.

Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver")
Cc: Jonas Jensen <jonas.jensen@gmail.com>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20210810081644.19353-3-tony@atomide.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/mmc/host/moxart-mmc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
index bde298887579..6c9d38132f74 100644
--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -628,6 +628,7 @@ static int moxart_probe(struct platform_device *pdev)
 			 host->dma_chan_tx, host->dma_chan_rx);
 		host->have_dma = true;
 
+		memset(&cfg, 0, sizeof(cfg));
 		cfg.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
 		cfg.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 253/334] ASoC: wm_adsp: Put debugfs_remove_recursive back in
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 252/334] mmc: moxart: " Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 254/334] bpf: Fix possible out of bound write in narrow load handling Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown, Sasha Levin

From: Charles Keepax <ckeepax@opensource.cirrus.com>

[ Upstream commit e6d0b92ac00b53121a35b2a1ce8d393dc9179fdf ]

This patch reverts commit acbf58e53041 ("ASoC: wm_adsp: Let
soc_cleanup_component_debugfs remove debugfs"), and adds an
alternate solution to the issue. That patch removes the call to
debugfs_remove_recursive, which cleans up the DSPs debugfs. The
intention was to avoid an unbinding issue on an out of tree
driver/platform.

The issue with the patch is it means the driver no longer cleans up
its own debugfs, instead relying on ASoC to remove recurive on the
parent debugfs node. This is conceptually rather unclean, but also it
would prevent DSPs being added/removed independently of ASoC and soon
we are going to be upstreaming some non-audio parts with these DSPs,
which will require this.

Finally, it seems the issue on the platform is a result of the
wm_adsp2_cleanup_debugfs getting called twice. This is very likely a
problem on the platform side and will be resolved there. But in the mean
time make the code a little more robust to such issues, and again
conceptually a bit nicer, but clearing the debugfs_root variable in the
DSP structure when the debugfs is removed.

Fixes: acbf58e53041 ("ASoC: wm_adsp: Let soc_cleanup_component_debugfs remove debugfs"
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20210824101552.1119-1-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wm_adsp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index fe15cbc7bcaf..a4d4cbf716a1 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -747,6 +747,8 @@ static void wm_adsp2_init_debugfs(struct wm_adsp *dsp,
 static void wm_adsp2_cleanup_debugfs(struct wm_adsp *dsp)
 {
 	wm_adsp_debugfs_clear(dsp);
+	debugfs_remove_recursive(dsp->debugfs_root);
+	dsp->debugfs_root = NULL;
 }
 #else
 static inline void wm_adsp2_init_debugfs(struct wm_adsp *dsp,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 254/334] bpf: Fix possible out of bound write in narrow load handling
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 253/334] ASoC: wm_adsp: Put debugfs_remove_recursive back in Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 255/334] hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Andrey Ignatov,
	Alexei Starovoitov, Sasha Levin

From: Andrey Ignatov <rdna@fb.com>

[ Upstream commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 ]

Fix a verifier bug found by smatch static checker in [0].

This problem has never been seen in prod to my best knowledge. Fixing it
still seems to be a good idea since it's hard to say for sure whether
it's possible or not to have a scenario where a combination of
convert_ctx_access() and a narrow load would lead to an out of bound
write.

When narrow load is handled, one or two new instructions are added to
insn_buf array, but before it was only checked that

	cnt >= ARRAY_SIZE(insn_buf)

And it's safe to add a new instruction to insn_buf[cnt++] only once. The
second try will lead to out of bound write. And this is what can happen
if `shift` is set.

Fix it by making sure that if the BPF_RSH instruction has to be added in
addition to BPF_AND then there is enough space for two more instructions
in insn_buf.

The full report [0] is below:

kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array
kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array

kernel/bpf/verifier.c
    12282
    12283 			insn->off = off & ~(size_default - 1);
    12284 			insn->code = BPF_LDX | BPF_MEM | size_code;
    12285 		}
    12286
    12287 		target_size = 0;
    12288 		cnt = convert_ctx_access(type, insn, insn_buf, env->prog,
    12289 					 &target_size);
    12290 		if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) ||
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
Bounds check.

    12291 		    (ctx_field_size && !target_size)) {
    12292 			verbose(env, "bpf verifier is misconfigured\n");
    12293 			return -EINVAL;
    12294 		}
    12295
    12296 		if (is_narrower_load && size < target_size) {
    12297 			u8 shift = bpf_ctx_narrow_access_offset(
    12298 				off, size, size_default) * 8;
    12299 			if (ctx_field_size <= 4) {
    12300 				if (shift)
    12301 					insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
                                                         ^^^^^
increment beyond end of array

    12302 									insn->dst_reg,
    12303 									shift);
--> 12304 				insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg,
                                                 ^^^^^
out of bounds write

    12305 								(1 << size * 8) - 1);
    12306 			} else {
    12307 				if (shift)
    12308 					insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH,
    12309 									insn->dst_reg,
    12310 									shift);
    12311 				insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg,
                                        ^^^^^^^^^^^^^^^
Same.

    12312 								(1ULL << size * 8) - 1);
    12313 			}
    12314 		}
    12315
    12316 		new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
    12317 		if (!new_prog)
    12318 			return -ENOMEM;
    12319
    12320 		delta += cnt - 1;
    12321
    12322 		/* keep walking new program and skip insns we just inserted */
    12323 		env->prog = new_prog;
    12324 		insn      = new_prog->insnsi + i + delta;
    12325 	}
    12326
    12327 	return 0;
    12328 }

[0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/

v1->v2:
- clarify that problem was only seen by static checker but not in prod;

Fixes: 46f53a65d2de ("bpf: Allow narrow loads with offset > 0")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20210820163935.1902398-1-rdna@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/bpf/verifier.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 10084c0600dd..9d94ac6ff50c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12013,6 +12013,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
 		if (is_narrower_load && size < target_size) {
 			u8 shift = bpf_ctx_narrow_access_offset(
 				off, size, size_default) * 8;
+			if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) {
+				verbose(env, "bpf verifier narrow ctx load misconfigured\n");
+				return -EINVAL;
+			}
 			if (ctx_field_size <= 4) {
 				if (shift)
 					insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 255/334] hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 254/334] bpf: Fix possible out of bound write in narrow load handling Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 256/334] CIFS: Fix a potencially linear read overflow Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vitaly Kuznetsov, Michael Kelley,
	Wei Liu, Sasha Levin

From: Vitaly Kuznetsov <vkuznets@redhat.com>

[ Upstream commit 9d68cd9120e4e3af38f843e165631c323b86b4e4 ]

Commit adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out
of the ring buffer") introduced a notion of maximum packet size and for
KVM and FCOPY drivers set it to the length of the receive buffer. VSS
driver wasn't updated, this means that the maximum packet size is now
VMBUS_DEFAULT_MAX_PKT_SIZE (4k). Apparently, this is not enough. I'm
observing a packet of 6304 bytes which is being truncated to 4096. When
VSS driver tries to read next packet from ring buffer it starts from the
wrong offset and receives garbage.

Set the maximum packet size to 'HV_HYP_PAGE_SIZE * 2' in VSS driver. This
matches the length of the receive buffer and is in line with other utils
drivers.

Fixes: adae1e931acd ("Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the ring buffer")
Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Reviewed-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20210825133857.847866-1-vkuznets@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hv/hv_snapshot.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c
index 2267bd4c3472..6018b9d1b1fb 100644
--- a/drivers/hv/hv_snapshot.c
+++ b/drivers/hv/hv_snapshot.c
@@ -375,6 +375,7 @@ hv_vss_init(struct hv_util_service *srv)
 	}
 	recv_buffer = srv->recv_buffer;
 	vss_transaction.recv_channel = srv->channel;
+	vss_transaction.recv_channel->max_pkt_size = HV_HYP_PAGE_SIZE * 2;
 
 	/*
 	 * When this driver loads, the user level daemon that
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 256/334] CIFS: Fix a potencially linear read overflow
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 255/334] hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 257/334] i2c: mt65xx: fix IRQ check Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Len Baker, Paulo Alcantara (SUSE),
	Jeff Layton, Steve French, Sasha Levin

From: Len Baker <len.baker@gmx.com>

[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]

strlcpy() reads the entire source buffer first. This read may exceed the
destination size limit. This is both inefficient and can lead to linear
read overflows if a source string is not NUL-terminated.

Also, the strnlen() call does not avoid the read overflow in the strlcpy
function when a not NUL-terminated string is passed.

So, replace this block by a call to kstrndup() that avoids this type of
overflow and does the same.

Fixes: 066ce6899484d ("cifs: rename cifs_strlcpy_to_host and make it use new functions")
Signed-off-by: Len Baker <len.baker@gmx.com>
Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/cifs_unicode.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 9bd03a231032..171ad8b42107 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -358,14 +358,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,
 		if (!dst)
 			return NULL;
 		cifs_from_utf16(dst, (__le16 *) src, len, maxlen, codepage,
-			       NO_MAP_UNI_RSVD);
+				NO_MAP_UNI_RSVD);
 	} else {
-		len = strnlen(src, maxlen);
-		len++;
-		dst = kmalloc(len, GFP_KERNEL);
-		if (!dst)
-			return NULL;
-		strlcpy(dst, src, len);
+		dst = kstrndup(src, maxlen, GFP_KERNEL);
 	}
 
 	return dst;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 257/334] i2c: mt65xx: fix IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 256/334] CIFS: Fix a potencially linear read overflow Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 258/334] i2c: xlp9xx: fix main " Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, Qii Wang,
	Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 58fb7c643d346e2364404554f531cfa6a1a3917c ]

Iff platform_get_irq() returns 0, the driver's probe() method will return 0
early (as if the method's call was successful).  Let's consider IRQ0 valid
for simplicity -- devm_request_irq() can always override that decision...

Fixes: ce38815d39ea ("I2C: mediatek: Add driver for MediaTek I2C controller")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omprussia.ru>
Reviewed-by: Qii Wang <qii.wang@mediatek.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-mt65xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c
index 4ca716e09149..477480d1de6b 100644
--- a/drivers/i2c/busses/i2c-mt65xx.c
+++ b/drivers/i2c/busses/i2c-mt65xx.c
@@ -1211,7 +1211,7 @@ static int mtk_i2c_probe(struct platform_device *pdev)
 		return PTR_ERR(i2c->pdmabase);
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0)
+	if (irq < 0)
 		return irq;
 
 	init_completion(&i2c->msg_complete);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 258/334] i2c: xlp9xx: fix main IRQ check
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 257/334] i2c: mt65xx: fix IRQ check Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 259/334] octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg() Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Shtylyov, George Cherian,
	Wolfram Sang, Sasha Levin

From: Sergey Shtylyov <s.shtylyov@omp.ru>

[ Upstream commit 661e8a88e8317eb9ffe69c69d6cb4876370fe7e2 ]

Iff platform_get_irq() returns 0 for the main IRQ, the driver's probe()
method will return 0 early (as if the method's call was successful).
Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always
override that decision...

Fixes: 2bbd681ba2b ("i2c: xlp9xx: Driver for Netlogic XLP9XX/5XX I2C controller")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: George Cherian <george.cherian@marvell.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/i2c/busses/i2c-xlp9xx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-xlp9xx.c b/drivers/i2c/busses/i2c-xlp9xx.c
index f2241cedf5d3..6d24dc385522 100644
--- a/drivers/i2c/busses/i2c-xlp9xx.c
+++ b/drivers/i2c/busses/i2c-xlp9xx.c
@@ -517,7 +517,7 @@ static int xlp9xx_i2c_probe(struct platform_device *pdev)
 		return PTR_ERR(priv->base);
 
 	priv->irq = platform_get_irq(pdev, 0);
-	if (priv->irq <= 0)
+	if (priv->irq < 0)
 		return priv->irq;
 	/* SMBAlert irq */
 	priv->alert_data.irq = platform_get_irq(pdev, 1);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 259/334] octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 258/334] i2c: xlp9xx: fix main " Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 260/334] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yang Yingliang,
	David S. Miller, Sasha Levin

From: Yang Yingliang <yangyingliang@huawei.com>

[ Upstream commit 5e8243e66b4d80eeaf9ed8cb0235ff133630a014 ]

If otx2_mbox_get_rsp() fails, otx2_set_flowkey_cfg() need return an
error code.

Fixes: e7938365459f ("octeontx2-pf: Fix algorithm index in MCAM rules with RSS action")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
index a6210b020a57..94dfd64f526f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_common.c
@@ -289,8 +289,10 @@ int otx2_set_flowkey_cfg(struct otx2_nic *pfvf)
 
 	rsp = (struct nix_rss_flowkey_cfg_rsp *)
 			otx2_mbox_get_rsp(&pfvf->mbox.mbox, 0, &req->hdr);
-	if (IS_ERR(rsp))
+	if (IS_ERR(rsp)) {
+		err = PTR_ERR(rsp);
 		goto fail;
+	}
 
 	pfvf->hw.flowkey_alg_idx = rsp->alg_idx;
 fail:
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 260/334] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 259/334] octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 261/334] usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Alan Stern,
	Evgeny Novikov, Kirill Shilimanov, Sasha Levin

From: Evgeny Novikov <novikov@ispras.ru>

[ Upstream commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 ]

ehci_orion_drv_probe() did not account for possible errors of
clk_prepare_enable() that in particular could cause invocation of
clk_disable_unprepare() on clocks that were not prepared/enabled yet,
e.g. in remove or on handling errors of usb_add_hcd() in probe. Though,
there were several patches fixing different issues with clocks in this
driver, they did not solve this problem.

Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe()
to avoid calls of clk_disable_unprepare() without previous successful
invocation of clk_prepare_enable().

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: 8c869edaee07 ("ARM: Orion: EHCI: Add support for enabling clocks")
Co-developed-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Kirill Shilimanov <kirill.shilimanov@huawei.com>
Link: https://lore.kernel.org/r/20210825170902.11234-1-novikov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/host/ehci-orion.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/ehci-orion.c b/drivers/usb/host/ehci-orion.c
index a319b1df3011..3626758b3e2a 100644
--- a/drivers/usb/host/ehci-orion.c
+++ b/drivers/usb/host/ehci-orion.c
@@ -264,8 +264,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)
 	 * the clock does not exists.
 	 */
 	priv->clk = devm_clk_get(&pdev->dev, NULL);
-	if (!IS_ERR(priv->clk))
-		clk_prepare_enable(priv->clk);
+	if (!IS_ERR(priv->clk)) {
+		err = clk_prepare_enable(priv->clk);
+		if (err)
+			goto err_put_hcd;
+	}
 
 	priv->phy = devm_phy_optional_get(&pdev->dev, "usb");
 	if (IS_ERR(priv->phy)) {
@@ -311,6 +314,7 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)
 err_dis_clk:
 	if (!IS_ERR(priv->clk))
 		clk_disable_unprepare(priv->clk);
+err_put_hcd:
 	usb_put_hcd(hcd);
 err:
 	dev_err(&pdev->dev, "init %s fail, %d\n",
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 261/334] usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 260/334] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 262/334] usb: bdc: Fix a resource leak in the error handling path of bdc_probe() Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Christophe JAILLET,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 ]

If no suitable DMA configuration is available, a previous 'bdc_phy_init()'
call must be undone by a corresponding 'bdc_phy_exit()' call.

Branch to the existing error handling path instead of returning
directly.

Fixes: cc29d4f67757 ("usb: bdc: Add support for USB phy")
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/0c5910979f39225d5d8fe68c9ab1c147c68ddee1.1629314734.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/bdc/bdc_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
index 0bef6b3f049b..251db57e51fa 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
@@ -560,7 +560,8 @@ static int bdc_probe(struct platform_device *pdev)
 		if (ret) {
 			dev_err(dev,
 				"No suitable DMA config available, abort\n");
-			return -ENOTSUPP;
+			ret = -ENOTSUPP;
+			goto phycleanup;
 		}
 		dev_dbg(dev, "Using 32-bit address\n");
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 262/334] usb: bdc: Fix a resource leak in the error handling path of bdc_probe()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 261/334] usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 263/334] tty: serial: fsl_lpuart: fix the wrong mapbase value Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Christophe JAILLET,
	Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 6f15a2a09cecb7a2faba4a75bbd101f6f962294b ]

If an error occurs after a successful 'clk_prepare_enable()' call, it must
be undone by a corresponding 'clk_disable_unprepare()' call.
This call is already present in the remove function.

Add this call in the error handling path and reorder the code so that the
'clk_prepare_enable()' call happens later in the function.
The goal is to have as much managed resources functions as possible
before the 'clk_prepare_enable()' call in order to keep the error handling
path simple.

While at it, remove the now unneeded 'clk' variable.

Fixes: c87dca047849 ("usb: bdc: Add clock enable for new chips with a separate BDC clock")
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/f8a4a6897deb0c8cb2e576580790303550f15fcd.1629314734.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/usb/gadget/udc/bdc/bdc_core.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/drivers/usb/gadget/udc/bdc/bdc_core.c b/drivers/usb/gadget/udc/bdc/bdc_core.c
index 251db57e51fa..fa1a3908ec3b 100644
--- a/drivers/usb/gadget/udc/bdc/bdc_core.c
+++ b/drivers/usb/gadget/udc/bdc/bdc_core.c
@@ -488,27 +488,14 @@ static int bdc_probe(struct platform_device *pdev)
 	int irq;
 	u32 temp;
 	struct device *dev = &pdev->dev;
-	struct clk *clk;
 	int phy_num;
 
 	dev_dbg(dev, "%s()\n", __func__);
 
-	clk = devm_clk_get_optional(dev, "sw_usbd");
-	if (IS_ERR(clk))
-		return PTR_ERR(clk);
-
-	ret = clk_prepare_enable(clk);
-	if (ret) {
-		dev_err(dev, "could not enable clock\n");
-		return ret;
-	}
-
 	bdc = devm_kzalloc(dev, sizeof(*bdc), GFP_KERNEL);
 	if (!bdc)
 		return -ENOMEM;
 
-	bdc->clk = clk;
-
 	bdc->regs = devm_platform_ioremap_resource(pdev, 0);
 	if (IS_ERR(bdc->regs))
 		return PTR_ERR(bdc->regs);
@@ -545,10 +532,20 @@ static int bdc_probe(struct platform_device *pdev)
 		}
 	}
 
+	bdc->clk = devm_clk_get_optional(dev, "sw_usbd");
+	if (IS_ERR(bdc->clk))
+		return PTR_ERR(bdc->clk);
+
+	ret = clk_prepare_enable(bdc->clk);
+	if (ret) {
+		dev_err(dev, "could not enable clock\n");
+		return ret;
+	}
+
 	ret = bdc_phy_init(bdc);
 	if (ret) {
 		dev_err(bdc->dev, "BDC phy init failure:%d\n", ret);
-		return ret;
+		goto disable_clk;
 	}
 
 	temp = bdc_readl(bdc->regs, BDC_BDCCAP1);
@@ -581,6 +578,8 @@ cleanup:
 	bdc_hw_exit(bdc);
 phycleanup:
 	bdc_phy_exit(bdc);
+disable_clk:
+	clk_disable_unprepare(bdc->clk);
 	return ret;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 263/334] tty: serial: fsl_lpuart: fix the wrong mapbase value
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 262/334] usb: bdc: Fix a resource leak in the error handling path of bdc_probe() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 264/334] ASoC: wcd9335: Fix a double irq free in the remove function Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leonard Crestez, Adriana Reus,
	Sherry Sun, Andy Duan, Sasha Levin

From: Andy Duan <fugang.duan@nxp.com>

[ Upstream commit d5c38948448abc2bb6b36dbf85a554bf4748885e ]

Register offset needs to be applied on mapbase also.
dma_tx/rx_request use the physical address of UARTDATA.
Register offset is currently only applied to membase (the
corresponding virtual addr) but not on mapbase.

Fixes: 24b1e5f0e83c ("tty: serial: lpuart: add imx7ulp support")
Reviewed-by: Leonard Crestez <leonard.crestez@nxp.com>
Signed-off-by: Adriana Reus <adriana.reus@nxp.com>
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Andy Duan <fugang.duan@nxp.com>
Link: https://lore.kernel.org/r/20210819021033.32606-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/tty/serial/fsl_lpuart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index f0e5da77ed6d..460e428b7592 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -2611,7 +2611,7 @@ static int lpuart_probe(struct platform_device *pdev)
 		return PTR_ERR(sport->port.membase);
 
 	sport->port.membase += sdata->reg_off;
-	sport->port.mapbase = res->start;
+	sport->port.mapbase = res->start + sdata->reg_off;
 	sport->port.dev = &pdev->dev;
 	sport->port.type = PORT_LPUART;
 	sport->devtype = sdata->devtype;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 264/334] ASoC: wcd9335: Fix a double irq free in the remove function
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 263/334] tty: serial: fsl_lpuart: fix the wrong mapbase value Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 265/334] ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Mark Brown, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit 7a6a723e98aa45f393e6add18f7309dfffa1b0e2 ]

There is no point in calling 'free_irq()' explicitly for
'WCD9335_IRQ_SLIMBUS' in the remove function.

The irqs are requested in 'wcd9335_setup_irqs()' using a resource managed
function (i.e. 'devm_request_threaded_irq()').
'wcd9335_setup_irqs()' requests all what is defined in the 'wcd9335_irqs'
structure.
This structure has only one entry for 'WCD9335_IRQ_SLIMBUS'.

So 'devm_request...irq()' + explicit 'free_irq()' would lead to a double
free.

Remove the unneeded 'free_irq()' from the remove function.

Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Message-Id: <0614d63bc00edd7e81dd367504128f3d84f72efa.1629091028.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wcd9335.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 86c92e03ea5d..933f59e4e56f 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -4869,7 +4869,6 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)
 	struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev);
 
 	wcd_clsh_ctrl_free(wcd->clsh_ctrl);
-	free_irq(regmap_irq_get_virq(wcd->irq_data, WCD9335_IRQ_SLIMBUS), wcd);
 }
 
 static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 265/334] ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 264/334] ASoC: wcd9335: Fix a double irq free in the remove function Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 266/334] ASoC: wcd9335: Disable irq on slave ports in the remove function Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Mark Brown, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit fc6fc81caa63900cef9ebb8b2e365c3ed5a9effb ]

If 'wcd9335_setup_irqs()' fails, me must release the memory allocated in
'wcd_clsh_ctrl_alloc()', as already done in the remove function.

Add an error handling path and the missing 'wcd_clsh_ctrl_free()' call.

Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Message-Id: <6dc12372f09fabb70bf05941dbe6a1382dc93e43.1629091028.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wcd9335.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 933f59e4e56f..47fe68edea3a 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -4844,6 +4844,7 @@ static void wcd9335_codec_init(struct snd_soc_component *component)
 static int wcd9335_codec_probe(struct snd_soc_component *component)
 {
 	struct wcd9335_codec *wcd = dev_get_drvdata(component->dev);
+	int ret;
 	int i;
 
 	snd_soc_component_init_regmap(component, wcd->regmap);
@@ -4861,7 +4862,15 @@ static int wcd9335_codec_probe(struct snd_soc_component *component)
 	for (i = 0; i < NUM_CODEC_DAIS; i++)
 		INIT_LIST_HEAD(&wcd->dai[i].slim_ch_list);
 
-	return wcd9335_setup_irqs(wcd);
+	ret = wcd9335_setup_irqs(wcd);
+	if (ret)
+		goto free_clsh_ctrl;
+
+	return 0;
+
+free_clsh_ctrl:
+	wcd_clsh_ctrl_free(wcd->clsh_ctrl);
+	return ret;
 }
 
 static void wcd9335_codec_remove(struct snd_soc_component *comp)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 266/334] ASoC: wcd9335: Disable irq on slave ports in the remove function
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 265/334] ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 267/334] iwlwifi: skip first element in the WTAS ACPI table Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Mark Brown, Sasha Levin

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

[ Upstream commit d3efd26af2e044ff2b48d38bb871630282d77e60 ]

The probe calls 'wcd9335_setup_irqs()' to enable interrupts on all slave
ports.
This must be undone in the remove function.

Add a 'wcd9335_teardown_irqs()' function that undoes 'wcd9335_setup_irqs()'
function, and call it from the remove function.

Fixes: 20aedafdf492 ("ASoC: wcd9335: add support to wcd9335 codec")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Message-Id: <8f761244d79bd4c098af8a482be9121d3a486d1b.1629091028.git.christophe.jaillet@wanadoo.fr>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/codecs/wcd9335.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/sound/soc/codecs/wcd9335.c b/sound/soc/codecs/wcd9335.c
index 47fe68edea3a..d885ced34f60 100644
--- a/sound/soc/codecs/wcd9335.c
+++ b/sound/soc/codecs/wcd9335.c
@@ -4076,6 +4076,16 @@ static int wcd9335_setup_irqs(struct wcd9335_codec *wcd)
 	return ret;
 }
 
+static void wcd9335_teardown_irqs(struct wcd9335_codec *wcd)
+{
+	int i;
+
+	/* disable interrupts on all slave ports */
+	for (i = 0; i < WCD9335_SLIM_NUM_PORT_REG; i++)
+		regmap_write(wcd->if_regmap, WCD9335_SLIM_PGD_PORT_INT_EN0 + i,
+			     0x00);
+}
+
 static void wcd9335_cdc_sido_ccl_enable(struct wcd9335_codec *wcd,
 					bool ccl_flag)
 {
@@ -4878,6 +4888,7 @@ static void wcd9335_codec_remove(struct snd_soc_component *comp)
 	struct wcd9335_codec *wcd = dev_get_drvdata(comp->dev);
 
 	wcd_clsh_ctrl_free(wcd->clsh_ctrl);
+	wcd9335_teardown_irqs(wcd);
 }
 
 static int wcd9335_codec_set_sysclk(struct snd_soc_component *comp,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 267/334] iwlwifi: skip first element in the WTAS ACPI table
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 266/334] ASoC: wcd9335: Disable irq on slave ports in the remove function Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 268/334] net/mlx5: Lag, fix multipath lag activation Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Abhishek Naik, Luca Coelho, Sasha Levin

From: Abhishek Naik <abhishek.naik@intel.com>

[ Upstream commit 19426d54302e199b3fd2d575f926a13af66be2b9 ]

By mistake we were considering the first element of the WTAS wifi
package as part of the data we want to rid, but that element is the wifi
package signature (always 0x07), so it should be skipped.

Change the code to read the data starting from element 1 instead.

Signed-off-by: Abhishek Naik <abhishek.naik@intel.com>
Fixes: 28dd7ccdc56f ("iwlwifi: acpi: read TAS table from ACPI and send it to the FW")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210805141826.ff8148197b15.I70636c04e37b2b57a5df3ce611511f62203d27a7@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 34933f133a0a..66f8d949c1e6 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -264,7 +264,7 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
 		goto out_free;
 	}
 
-	enabled = !!wifi_pkg->package.elements[0].integer.value;
+	enabled = !!wifi_pkg->package.elements[1].integer.value;
 
 	if (!enabled) {
 		*block_list_size = -1;
@@ -273,15 +273,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
 		goto out_free;
 	}
 
-	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER ||
-	    wifi_pkg->package.elements[1].integer.value >
+	if (wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER ||
+	    wifi_pkg->package.elements[2].integer.value >
 	    APCI_WTAS_BLACK_LIST_MAX) {
 		IWL_DEBUG_RADIO(fwrt, "TAS invalid array size %llu\n",
 				wifi_pkg->package.elements[1].integer.value);
 		ret = -EINVAL;
 		goto out_free;
 	}
-	*block_list_size = wifi_pkg->package.elements[1].integer.value;
+	*block_list_size = wifi_pkg->package.elements[2].integer.value;
 
 	IWL_DEBUG_RADIO(fwrt, "TAS array size %d\n", *block_list_size);
 	if (*block_list_size > APCI_WTAS_BLACK_LIST_MAX) {
@@ -294,15 +294,15 @@ int iwl_acpi_get_tas(struct iwl_fw_runtime *fwrt,
 	for (i = 0; i < *block_list_size; i++) {
 		u32 country;
 
-		if (wifi_pkg->package.elements[2 + i].type !=
+		if (wifi_pkg->package.elements[3 + i].type !=
 		    ACPI_TYPE_INTEGER) {
 			IWL_DEBUG_RADIO(fwrt,
-					"TAS invalid array elem %d\n", 2 + i);
+					"TAS invalid array elem %d\n", 3 + i);
 			ret = -EINVAL;
 			goto out_free;
 		}
 
-		country = wifi_pkg->package.elements[2 + i].integer.value;
+		country = wifi_pkg->package.elements[3 + i].integer.value;
 		block_list_array[i] = cpu_to_le32(country);
 		IWL_DEBUG_RADIO(fwrt, "TAS block list country %d\n", country);
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 268/334] net/mlx5: Lag, fix multipath lag activation
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 267/334] iwlwifi: skip first element in the WTAS ACPI table Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 269/334] net/mlx5: Remove all auxiliary devices at the unregister event Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dima Chumak, Roi Dayan, Mark Bloch,
	Saeed Mahameed, Sasha Levin

From: Dima Chumak <dchumak@nvidia.com>

[ Upstream commit 2f8b6161cca5fb34b0065e2eac8bb2b61b7bfe87 ]

When handling FIB_EVENT_ENTRY_REPLACE event for a new multipath route,
lag activation can be missed if a stale (struct lag_mp)->mfi pointer
exists, which was associated with an older multipath route that had been
removed.

Normally, when a route is removed, it triggers mlx5_lag_fib_event(),
which handles FIB_EVENT_ENTRY_DEL and clears mfi pointer. But, if
mlx5_lag_check_prereq() condition isn't met, for example when eswitch is
in legacy mode, the fib event is skipped and mfi pointer becomes stale.

Fix by resetting mfi pointer to NULL in mlx5_deactivate_lag().

Fixes: 8a66e4585979 ("net/mlx5: Change ownership model for lag")
Signed-off-by: Dima Chumak <dchumak@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/lag.c    | 1 +
 drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 8 ++++++++
 drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h | 2 ++
 3 files changed, 11 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
index 5c043c5cc403..40ef60f562b4 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
@@ -277,6 +277,7 @@ static int mlx5_deactivate_lag(struct mlx5_lag *ldev)
 	int err;
 
 	ldev->flags &= ~MLX5_LAG_MODE_FLAGS;
+	mlx5_lag_mp_reset(ldev);
 
 	MLX5_SET(destroy_lag_in, in, opcode, MLX5_CMD_OP_DESTROY_LAG);
 	err = mlx5_cmd_exec_in(dev0, destroy_lag, in);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
index c4bf8b679541..516bfc2bd797 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c
@@ -302,6 +302,14 @@ static int mlx5_lag_fib_event(struct notifier_block *nb,
 	return NOTIFY_DONE;
 }
 
+void mlx5_lag_mp_reset(struct mlx5_lag *ldev)
+{
+	/* Clear mfi, as it might become stale when a route delete event
+	 * has been missed, see mlx5_lag_fib_route_event().
+	 */
+	ldev->lag_mp.mfi = NULL;
+}
+
 int mlx5_lag_mp_init(struct mlx5_lag *ldev)
 {
 	struct lag_mp *mp = &ldev->lag_mp;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
index 258ac7b2964e..729c839397a8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.h
@@ -21,11 +21,13 @@ struct lag_mp {
 
 #ifdef CONFIG_MLX5_ESWITCH
 
+void mlx5_lag_mp_reset(struct mlx5_lag *ldev);
 int mlx5_lag_mp_init(struct mlx5_lag *ldev);
 void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev);
 
 #else /* CONFIG_MLX5_ESWITCH */
 
+static inline void mlx5_lag_mp_reset(struct mlx5_lag *ldev) {};
 static inline int mlx5_lag_mp_init(struct mlx5_lag *ldev) { return 0; }
 static inline void mlx5_lag_mp_cleanup(struct mlx5_lag *ldev) {}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 269/334] net/mlx5: Remove all auxiliary devices at the unregister event
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 268/334] net/mlx5: Lag, fix multipath lag activation Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 270/334] net/mlx5e: Fix possible use-after-free deleting fdb rule Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leon Romanovsky, Saeed Mahameed,
	Sasha Levin, Yicong Yang

From: Leon Romanovsky <leonro@nvidia.com>

[ Upstream commit 8e7e2e8ed0e251138926838b7933f8eb6dd56b12 ]

The call to mlx5_unregister_device() means that mlx5_core driver is
removed. In such scenario, we need to disregard all other flags like
attach/detach and forcibly remove all auxiliary devices.

Fixes: a5ae8fc9058e ("net/mlx5e: Don't create devices during unload flow")
Tested-and-Reported-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
index def2156e50ee..20bb37266254 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c
@@ -397,7 +397,7 @@ int mlx5_register_device(struct mlx5_core_dev *dev)
 void mlx5_unregister_device(struct mlx5_core_dev *dev)
 {
 	mutex_lock(&mlx5_intf_mutex);
-	dev->priv.flags |= MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV;
+	dev->priv.flags = MLX5_PRIV_FLAGS_DISABLE_ALL_ADEV;
 	mlx5_rescan_drivers_locked(dev);
 	mutex_unlock(&mlx5_intf_mutex);
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 270/334] net/mlx5e: Fix possible use-after-free deleting fdb rule
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 269/334] net/mlx5: Remove all auxiliary devices at the unregister event Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 271/334] net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roi Dayan, Paul Blakey,
	Saeed Mahameed, Sasha Levin

From: Roi Dayan <roid@nvidia.com>

[ Upstream commit 9a5f9cc794e17cf6ed2a5bb215d2e8b6832db444 ]

After neigh-update-add failure we are still with a slow path rule but
the driver always assume the rule is an fdb rule.
Fix neigh-update-del by checking slow path tc flag on the flow.
Also fix neigh-update-add for when neigh-update-del fails the same.

Fixes: 5dbe906ff1d5 ("net/mlx5e: Use a slow path rule instead if vxlan neighbour isn't available")
Signed-off-by: Roi Dayan <roid@nvidia.com>
Reviewed-by: Paul Blakey <paulb@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
index 2e846b741280..1c44c6c345f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
@@ -147,7 +147,7 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv,
 	mlx5e_rep_queue_neigh_stats_work(priv);
 
 	list_for_each_entry(flow, flow_list, tmp_list) {
-		if (!mlx5e_is_offloaded_flow(flow))
+		if (!mlx5e_is_offloaded_flow(flow) || !flow_flag_test(flow, SLOW))
 			continue;
 		attr = flow->attr;
 		esw_attr = attr->esw_attr;
@@ -188,7 +188,7 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,
 	int err;
 
 	list_for_each_entry(flow, flow_list, tmp_list) {
-		if (!mlx5e_is_offloaded_flow(flow))
+		if (!mlx5e_is_offloaded_flow(flow) || flow_flag_test(flow, SLOW))
 			continue;
 		attr = flow->attr;
 		esw_attr = attr->esw_attr;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 271/334] net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 270/334] net/mlx5e: Fix possible use-after-free deleting fdb rule Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 272/334] net/mlx5e: Use correct eswitch for stack devices with lag Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maor Dickman, Roi Dayan,
	Saeed Mahameed, Sasha Levin

From: Maor Dickman <maord@nvidia.com>

[ Upstream commit ca6891f9b27db7764bba0798202b0a21d0dc909c ]

When indirect forward group is created, flow is added with vhca id but
without setting vhca id valid flag which violates the PRM.

Fix by setting the missing flag, vhca id valid.

Fixes: 34ca65352ddf ("net/mlx5: E-Switch, Indirect table infrastructure")
Signed-off-by: Maor Dickman <maord@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
index 3da7becc1069..425c91814b34 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/indir_table.c
@@ -364,6 +364,7 @@ static int mlx5_create_indir_fwd_group(struct mlx5_eswitch *esw,
 	dest.type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
 	dest.vport.num = e->vport;
 	dest.vport.vhca_id = MLX5_CAP_GEN(esw->dev, vhca_id);
+	dest.vport.flags = MLX5_FLOW_DEST_VPORT_VHCA_ID;
 	e->fwd_rule = mlx5_add_flow_rules(e->ft, spec, &flow_act, &dest, 1);
 	if (IS_ERR(e->fwd_rule)) {
 		mlx5_destroy_flow_group(e->fwd_grp);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 272/334] net/mlx5e: Use correct eswitch for stack devices with lag
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 271/334] net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 273/334] misc/pvpanic: fix set driver data Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dmytro Linkin, Roi Dayan,
	Saeed Mahameed, Sasha Levin

From: Dmytro Linkin <dlinkin@nvidia.com>

[ Upstream commit f9d196bd632b8b79261ec3366c30ec3923ea9a02 ]

If link aggregation is used within stack devices driver rejects encap
rules if PF of the VF tunnel device is down. This happens because route
resolved for other PF and its eswitch instance is used to determine
correct vport.
To fix that use devcom feature to retrieve other eswitch instance if
failed to find vport for the 1st eswitch and LAG is active.

Fixes: 10742efc20a4 ("net/mlx5e: VF tunnel TX traffic offloading")
Signed-off-by: Dmytro Linkin <dlinkin@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlx5/core/en_tc.c    | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index d273758255c3..6eba574c5a36 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1338,6 +1338,7 @@ bool mlx5e_tc_is_vf_tunnel(struct net_device *out_dev, struct net_device *route_
 int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *route_dev, u16 *vport)
 {
 	struct mlx5e_priv *out_priv, *route_priv;
+	struct mlx5_devcom *devcom = NULL;
 	struct mlx5_core_dev *route_mdev;
 	struct mlx5_eswitch *esw;
 	u16 vhca_id;
@@ -1349,7 +1350,24 @@ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *ro
 	route_mdev = route_priv->mdev;
 
 	vhca_id = MLX5_CAP_GEN(route_mdev, vhca_id);
+	if (mlx5_lag_is_active(out_priv->mdev)) {
+		/* In lag case we may get devices from different eswitch instances.
+		 * If we failed to get vport num, it means, mostly, that we on the wrong
+		 * eswitch.
+		 */
+		err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport);
+		if (err != -ENOENT)
+			return err;
+
+		devcom = out_priv->mdev->priv.devcom;
+		esw = mlx5_devcom_get_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS);
+		if (!esw)
+			return -ENODEV;
+	}
+
 	err = mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport);
+	if (devcom)
+		mlx5_devcom_release_peer_data(devcom, MLX5_DEVCOM_ESW_OFFLOADS);
 	return err;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 273/334] misc/pvpanic: fix set driver data
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 272/334] net/mlx5e: Use correct eswitch for stack devices with lag Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 274/334] ice: fix Tx queue iteration for Tx timestamp enablement Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Mihai Carabas, Sasha Levin

From: Mihai Carabas <mihai.carabas@oracle.com>

[ Upstream commit a99009bc4f2f0b46e6c553704fda0b67e04395f5 ]

Add again dev_set_drvdata(), but this time in devm_pvpanic_probe(), in order
for dev_get_drvdata() to not return NULL.

Fixes: 394febc9d0a6 ("misc/pvpanic: Make 'pvpanic_probe()' resource managed")
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Link: https://lore.kernel.org/r/1629385946-4584-2-git-send-email-mihai.carabas@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/misc/pvpanic/pvpanic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/misc/pvpanic/pvpanic.c b/drivers/misc/pvpanic/pvpanic.c
index 02b807c788c9..bb7aa6368538 100644
--- a/drivers/misc/pvpanic/pvpanic.c
+++ b/drivers/misc/pvpanic/pvpanic.c
@@ -85,6 +85,8 @@ int devm_pvpanic_probe(struct device *dev, struct pvpanic_instance *pi)
 	list_add(&pi->list, &pvpanic_list);
 	spin_unlock(&pvpanic_lock);
 
+	dev_set_drvdata(dev, pi);
+
 	return devm_add_action_or_reset(dev, pvpanic_remove, pi);
 }
 EXPORT_SYMBOL_GPL(devm_pvpanic_probe);
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 274/334] ice: fix Tx queue iteration for Tx timestamp enablement
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 273/334] misc/pvpanic: fix set driver data Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 275/334] ice: add lock around Tx timestamp tracker flush Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacob Keller, Gurucharan G,
	Tony Nguyen, Sasha Levin

From: Jacob Keller <jacob.e.keller@intel.com>

[ Upstream commit 84c5fb8c4264ec12ef9d21905c562d2297a0234e ]

The driver accidentally copied the ice_for_each_rxq iterator when
implementing enablement of the ptp_tx bit for the Tx rings. We still
load the Tx rings and set the ptp_tx field, but we iterate over the
count of the num_rxq.

If the number of Tx and Rx queues differ, this could either cause
a buffer overrun when accessing the tx_rings list if num_txq is greater
than num_rxq, or it could cause us to fail to enable Tx timestamps for
some rings.

This was not noticed originally as we generally have the same number of
Tx and Rx queues.

Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_ptp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 9e3ddb9b8b51..f54148fb0e21 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -22,7 +22,7 @@ static void ice_set_tx_tstamp(struct ice_pf *pf, bool on)
 		return;
 
 	/* Set the timestamp enable flag for all the Tx rings */
-	ice_for_each_rxq(vsi, i) {
+	ice_for_each_txq(vsi, i) {
 		if (!vsi->tx_rings[i])
 			continue;
 		vsi->tx_rings[i]->ptp_tx = on;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 275/334] ice: add lock around Tx timestamp tracker flush
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 274/334] ice: fix Tx queue iteration for Tx timestamp enablement Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 276/334] ice: restart periodic outputs around time changes Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacob Keller, Gurucharan G,
	Tony Nguyen, Sasha Levin

From: Jacob Keller <jacob.e.keller@intel.com>

[ Upstream commit 4dd0d5c33c3ebf24a07cae6141648aeb7ba56072 ]

The driver didn't take the lock while flushing the Tx tracker, which
could cause a race where one thread is trying to read timestamps out
while another thread is trying to read the tracker to check the
timestamps.

Avoid this by ensuring that flushing is locked against read accesses.

Fixes: ea9b847cda64 ("ice: enable transmit timestamps for E810 devices")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_ptp.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index f54148fb0e21..8970037177fe 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -1278,6 +1278,8 @@ ice_ptp_flush_tx_tracker(struct ice_pf *pf, struct ice_ptp_tx *tx)
 {
 	u8 idx;
 
+	spin_lock(&tx->lock);
+
 	for (idx = 0; idx < tx->len; idx++) {
 		u8 phy_idx = idx + tx->quad_offset;
 
@@ -1290,6 +1292,8 @@ ice_ptp_flush_tx_tracker(struct ice_pf *pf, struct ice_ptp_tx *tx)
 			tx->tstamps[idx].skb = NULL;
 		}
 	}
+
+	spin_unlock(&tx->lock);
 }
 
 /**
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 276/334] ice: restart periodic outputs around time changes
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 275/334] ice: add lock around Tx timestamp tracker flush Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 277/334] ice: Only lock to update netdev dev_addr Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jacob Keller, Sunitha D Mekala,
	Tony Nguyen, Sasha Levin

From: Jacob Keller <jacob.e.keller@intel.com>

[ Upstream commit 9ee313433c483e4a6ecd517c38c0f8aee1962c53 ]

When we enabled auxiliary input/output support for the E810 device, we
forgot to add logic to restart the output when we change time. This is
important as the periodic output will be incorrect after a time change
otherwise.

This unfortunately includes the adjust time function, even though it
uses an atomic hardware interface. The atomic adjustment can still cause
the pin output to stall permanently, so we need to stop and restart it.

Introduce wrapper functions to temporarily disable and then re-enable
the clock outputs.

Fixes: 172db5f91d5f ("ice: add support for auxiliary input/output pins")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Tested-by: Sunitha D Mekala <sunithax.d.mekala@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_ptp.c | 49 ++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c
index 8970037177fe..234bc68e79f9 100644
--- a/drivers/net/ethernet/intel/ice/ice_ptp.c
+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c
@@ -688,6 +688,41 @@ err:
 	return -EFAULT;
 }
 
+/**
+ * ice_ptp_disable_all_clkout - Disable all currently configured outputs
+ * @pf: pointer to the PF structure
+ *
+ * Disable all currently configured clock outputs. This is necessary before
+ * certain changes to the PTP hardware clock. Use ice_ptp_enable_all_clkout to
+ * re-enable the clocks again.
+ */
+static void ice_ptp_disable_all_clkout(struct ice_pf *pf)
+{
+	uint i;
+
+	for (i = 0; i < pf->ptp.info.n_per_out; i++)
+		if (pf->ptp.perout_channels[i].ena)
+			ice_ptp_cfg_clkout(pf, i, NULL, false);
+}
+
+/**
+ * ice_ptp_enable_all_clkout - Enable all configured periodic clock outputs
+ * @pf: pointer to the PF structure
+ *
+ * Enable all currently configured clock outputs. Use this after
+ * ice_ptp_disable_all_clkout to reconfigure the output signals according to
+ * their configuration.
+ */
+static void ice_ptp_enable_all_clkout(struct ice_pf *pf)
+{
+	uint i;
+
+	for (i = 0; i < pf->ptp.info.n_per_out; i++)
+		if (pf->ptp.perout_channels[i].ena)
+			ice_ptp_cfg_clkout(pf, i, &pf->ptp.perout_channels[i],
+					   false);
+}
+
 /**
  * ice_ptp_gpio_enable_e810 - Enable/disable ancillary features of PHC
  * @info: the driver's PTP info structure
@@ -783,12 +818,17 @@ ice_ptp_settime64(struct ptp_clock_info *info, const struct timespec64 *ts)
 		goto exit;
 	}
 
+	/* Disable periodic outputs */
+	ice_ptp_disable_all_clkout(pf);
+
 	err = ice_ptp_write_init(pf, &ts64);
 	ice_ptp_unlock(hw);
 
 	if (!err)
 		ice_ptp_update_cached_phctime(pf);
 
+	/* Reenable periodic outputs */
+	ice_ptp_enable_all_clkout(pf);
 exit:
 	if (err) {
 		dev_err(ice_pf_to_dev(pf), "PTP failed to set time %d\n", err);
@@ -842,8 +882,14 @@ static int ice_ptp_adjtime(struct ptp_clock_info *info, s64 delta)
 		return -EBUSY;
 	}
 
+	/* Disable periodic outputs */
+	ice_ptp_disable_all_clkout(pf);
+
 	err = ice_ptp_write_adj(pf, delta);
 
+	/* Reenable periodic outputs */
+	ice_ptp_enable_all_clkout(pf);
+
 	ice_ptp_unlock(hw);
 
 	if (err) {
@@ -1554,6 +1600,9 @@ void ice_ptp_release(struct ice_pf *pf)
 	if (!pf->ptp.clock)
 		return;
 
+	/* Disable periodic outputs */
+	ice_ptp_disable_all_clkout(pf);
+
 	ice_clear_ptp_clock_index(pf);
 	ptp_clock_unregister(pf->ptp.clock);
 	pf->ptp.clock = NULL;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 277/334] ice: Only lock to update netdev dev_addr
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 276/334] ice: restart periodic outputs around time changes Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 278/334] net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brett Creeley, Gurucharan G,
	Tony Nguyen, Sasha Levin

From: Brett Creeley <brett.creeley@intel.com>

[ Upstream commit b357d9717be7f95fde2c6c4650b186a995b71e59 ]

commit 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync
list") introduced calls to netif_addr_lock_bh() and
netif_addr_unlock_bh() in the driver's ndo_set_mac() callback. This is
fine since the driver is updated the netdev's dev_addr, but since this
is a spinlock, the driver cannot sleep when the lock is held.
Unfortunately the functions to add/delete MAC filters depend on a mutex.
This was causing a trace with the lock debug kernel config options
enabled when changing the mac address via iproute.

[  203.273059] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281
[  203.273065] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6698, name: ip
[  203.273068] Preemption disabled at:
[  203.273068] [<ffffffffc04aaeab>] ice_set_mac_address+0x8b/0x1c0 [ice]
[  203.273097] CPU: 31 PID: 6698 Comm: ip Tainted: G S      W I       5.14.0-rc4 #2
[  203.273100] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0010.010620200716 01/06/2020
[  203.273102] Call Trace:
[  203.273107]  dump_stack_lvl+0x33/0x42
[  203.273113]  ? ice_set_mac_address+0x8b/0x1c0 [ice]
[  203.273124]  ___might_sleep.cold.150+0xda/0xea
[  203.273131]  mutex_lock+0x1c/0x40
[  203.273136]  ice_remove_mac+0xe3/0x180 [ice]
[  203.273155]  ? ice_fltr_add_mac_list+0x20/0x20 [ice]
[  203.273175]  ice_fltr_prepare_mac+0x43/0xa0 [ice]
[  203.273194]  ice_set_mac_address+0xab/0x1c0 [ice]
[  203.273206]  dev_set_mac_address+0xb8/0x120
[  203.273210]  dev_set_mac_address_user+0x2c/0x50
[  203.273212]  do_setlink+0x1dd/0x10e0
[  203.273217]  ? __nla_validate_parse+0x12d/0x1a0
[  203.273221]  __rtnl_newlink+0x530/0x910
[  203.273224]  ? __kmalloc_node_track_caller+0x17f/0x380
[  203.273230]  ? preempt_count_add+0x68/0xa0
[  203.273236]  ? _raw_spin_lock_irqsave+0x1f/0x30
[  203.273241]  ? kmem_cache_alloc_trace+0x4d/0x440
[  203.273244]  rtnl_newlink+0x43/0x60
[  203.273245]  rtnetlink_rcv_msg+0x13a/0x380
[  203.273248]  ? rtnl_calcit.isra.40+0x130/0x130
[  203.273250]  netlink_rcv_skb+0x4e/0x100
[  203.273256]  netlink_unicast+0x1a2/0x280
[  203.273258]  netlink_sendmsg+0x242/0x490
[  203.273260]  sock_sendmsg+0x58/0x60
[  203.273263]  ____sys_sendmsg+0x1ef/0x260
[  203.273265]  ? copy_msghdr_from_user+0x5c/0x90
[  203.273268]  ? ____sys_recvmsg+0xe6/0x170
[  203.273270]  ___sys_sendmsg+0x7c/0xc0
[  203.273272]  ? copy_msghdr_from_user+0x5c/0x90
[  203.273274]  ? ___sys_recvmsg+0x89/0xc0
[  203.273276]  ? __netlink_sendskb+0x50/0x50
[  203.273278]  ? mod_objcg_state+0xee/0x310
[  203.273282]  ? __dentry_kill+0x114/0x170
[  203.273286]  ? get_max_files+0x10/0x10
[  203.273288]  __sys_sendmsg+0x57/0xa0
[  203.273290]  do_syscall_64+0x37/0x80
[  203.273295]  entry_SYSCALL_64_after_hwframe+0x44/0xae
[  203.273296] RIP: 0033:0x7f8edf96e278
[  203.273298] Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 63 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55
[  203.273300] RSP: 002b:00007ffcb8bdac08 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  203.273303] RAX: ffffffffffffffda RBX: 000000006115e0ae RCX: 00007f8edf96e278
[  203.273304] RDX: 0000000000000000 RSI: 00007ffcb8bdac70 RDI: 0000000000000003
[  203.273305] RBP: 0000000000000000 R08: 0000000000000001 R09: 00007ffcb8bda5b0
[  203.273306] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  203.273306] R13: 0000555e10092020 R14: 0000000000000000 R15: 0000000000000005

Fix this by only locking when changing the netdev->dev_addr. Also, make
sure to restore the old netdev->dev_addr on any failures.

Fixes: 3ba7f53f8bf1 ("ice: don't remove netdev->dev_addr from uc sync list")
Signed-off-by: Brett Creeley <brett.creeley@intel.com>
Tested-by: Gurucharan G <gurucharanx.g@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index fe2ded775f25..a8bd512d5b45 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -5122,6 +5122,7 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
 	struct ice_hw *hw = &pf->hw;
 	struct sockaddr *addr = pi;
 	enum ice_status status;
+	u8 old_mac[ETH_ALEN];
 	u8 flags = 0;
 	int err = 0;
 	u8 *mac;
@@ -5144,8 +5145,13 @@ static int ice_set_mac_address(struct net_device *netdev, void *pi)
 	}
 
 	netif_addr_lock_bh(netdev);
+	ether_addr_copy(old_mac, netdev->dev_addr);
+	/* change the netdev's MAC address */
+	memcpy(netdev->dev_addr, mac, netdev->addr_len);
+	netif_addr_unlock_bh(netdev);
+
 	/* Clean up old MAC filter. Not an error if old filter doesn't exist */
-	status = ice_fltr_remove_mac(vsi, netdev->dev_addr, ICE_FWD_TO_VSI);
+	status = ice_fltr_remove_mac(vsi, old_mac, ICE_FWD_TO_VSI);
 	if (status && status != ICE_ERR_DOES_NOT_EXIST) {
 		err = -EADDRNOTAVAIL;
 		goto err_update_filters;
@@ -5168,13 +5174,12 @@ err_update_filters:
 	if (err) {
 		netdev_err(netdev, "can't set MAC %pM. filter update failed\n",
 			   mac);
+		netif_addr_lock_bh(netdev);
+		ether_addr_copy(netdev->dev_addr, old_mac);
 		netif_addr_unlock_bh(netdev);
 		return err;
 	}
 
-	/* change the netdev's MAC address */
-	memcpy(netdev->dev_addr, mac, netdev->addr_len);
-	netif_addr_unlock_bh(netdev);
 	netdev_dbg(vsi->netdev, "updated MAC address to %pM\n",
 		   netdev->dev_addr);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 278/334] net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 277/334] ice: Only lock to update netdev dev_addr Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 279/334] ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Marek Behún,
	Andrew Lunn, Jakub Kicinski, Sasha Levin

From: Vladimir Oltean <vladimir.oltean@nxp.com>

[ Upstream commit 0d55649d2ad7296acfda9127e1d05518d025734a ]

Enabling interrupts via device tree for the internal PHYs on the
mv88e6390 DSA switch does not work. The driver insists to use poll mode.

Stage one debugging shows that the fwnode_mdiobus_phy_device_register
function calls fwnode_irq_get properly, and phy->irq is set to a valid
interrupt line initially.

But it is then cleared.

Stage two debugging shows that it is cleared here:

phy_probe:

  /* Disable the interrupt if the PHY doesn't support it
   * but the interrupt is still a valid one
   */
  if (!phy_drv_supports_irq(phydrv) && phy_interrupt_is_valid(phydev))
	phydev->irq = PHY_POLL;

Okay, so does the "Marvell 88E6390 Family" PHY driver not have the
.config_intr and .handle_interrupt function pointers? Yes it does.

Stage three debugging shows that the PHY device does not attempt a probe
against the "Marvell 88E6390 Family" driver, but against the "mv88x3310"
driver.

Okay, so why does the "mv88x3310" driver match on a mv88x6390 internal
PHY? The PHY IDs (MARVELL_PHY_ID_88E6390_FAMILY vs
MARVELL_PHY_ID_88X3310) are way different.

Stage four debugging has us looking through:

phy_device_register
-> device_add
   -> bus_probe_device
      -> device_initial_probe
         -> __device_attach
            -> bus_for_each_drv
               -> driver_match_device
                  -> drv->bus->match
                     -> phy_bus_match

Okay, so as we said, the MII_PHYSID1 of mv88e6390 does not match the
mv88x3310 driver's PHY mask & ID, so why would phy_bus_match return...

Ahh, phy_bus_match calls a shortcircuit method,
phydrv->match_phy_device, and does not even bother to compare the PHY ID
if that is implemented.

So of course, we go inside the marvell10g.c driver and sure enough, it
implements .match_phy_device and does not bother to check the PHY ID.

What's interesting though is that at the end of the device_add() from
phy_device_register(), the driver for the internal PHYs _is_ the proper
"Marvell 88E6390 Family". This is because "mv88x3310" ends up failing to
probe after all, and __device_attach_driver(), to quote:

  /*
   * Ignore errors returned by ->probe so that the next driver can try
   * its luck.
   */

The next (and only other) driver that matches is the 6390 driver. For
this one, phy_probe doesn't fail, and everything expects to work as
normal, EXCEPT phydev->irq has already been cleared by the previous
unsuccessful probe of a driver which did not implement PHY interrupts,
and therefore cleared that IRQ.

Okay, so it is not just Marvell 6390 that has PHY interrupts broken.
Stuff like Atheros, Aquantia, Broadcom, Qualcomm work because they are
lexicographically before Marvell, and stuff like NXP, Realtek, Vitesse
are broken.

This goes to show how fragile it is to reset phydev->irq = PHY_POLL from
the actual beginning of phy_probe itself. That seems like an actual bug
of its own too, since phy_probe has side effects which are not restored
on probe failure, but the line of thought probably was, the same driver
will attempt probe again, so it doesn't matter. Well, looks like it
does.

Maybe it would make more sense to move the phydev->irq clearing after
the actual device_add() in phy_device_register() completes, and the
bound driver is the actual final one.

(also, a bit frightening that drivers are permitted to bypass the MDIO
bus matching in such a trivial way and perform PHY reads and writes from
the .match_phy_device method, on devices that do not even belong to
them. In the general case it might not be guaranteed that the MDIO
accesses one driver needs to make to figure out whether to match on a
device is safe for all other PHY devices)

Fixes: a5de4be0aaaa ("net: phy: marvell10g: fix differentiation of 88X3310 from 88X3340")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: Marek Behún <kabel@kernel.org>
Signed-off-by: Marek Behún <kabel@kernel.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20210827132541.28953-1-kabel@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/phy/marvell10g.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c
index 53a433442803..f4d758f8a1ee 100644
--- a/drivers/net/phy/marvell10g.c
+++ b/drivers/net/phy/marvell10g.c
@@ -987,11 +987,19 @@ static int mv3310_get_number_of_ports(struct phy_device *phydev)
 
 static int mv3310_match_phy_device(struct phy_device *phydev)
 {
+	if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] &
+	     MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310)
+		return 0;
+
 	return mv3310_get_number_of_ports(phydev) == 1;
 }
 
 static int mv3340_match_phy_device(struct phy_device *phydev)
 {
+	if ((phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] &
+	     MARVELL_PHY_ID_MASK) != MARVELL_PHY_ID_88X3310)
+		return 0;
+
 	return mv3310_get_number_of_ports(phydev) == 4;
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 279/334] ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 278/334] net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 280/334] ALSA: usb-audio: Add lowlatency module option Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe ]

This error path is unlikely because of it checked for NULL and
returned -ENOMEM earlier in the function.  But it should return
an error code here as well if we ever do hit it because of a
race condition or something.

Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210813113438.GB30697@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index b137e7f34397..bd1ef6334997 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -2504,8 +2504,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx)
 		goto free_data_skb;
 
 	for (index = 0; index < num_pri_streams; index++) {
-		if (WARN_ON(!data_sync_bufs[index].skb))
+		if (WARN_ON(!data_sync_bufs[index].skb)) {
+			ret = -ENOMEM;
 			goto free_data_skb;
+		}
 
 		ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev,
 					       data_sync_bufs[index].
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 280/334] ALSA: usb-audio: Add lowlatency module option
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 279/334] ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 281/334] atlantic: Fix driver resume flow Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin

From: Takashi Iwai <tiwai@suse.de>

[ Upstream commit 4801bee7d5a36c199b734a28cde5259183aff822 ]

For making user to switch back to the old playback mode, this patch
adds a new module option 'lowlatency' to snd-usb-audio driver.
When user face a regression due to the recent low-latency playback
support, they can test easily by passing lowlatency=0 option without
rebuilding the kernel.

Fixes: 307cc9baac5c ("ALSA: usb-audio: Reduce latency at playback start, take#2")
Link: https://lore.kernel.org/r/20210829073830.22686-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/usb/card.c     | 4 ++++
 sound/usb/pcm.c      | 3 ++-
 sound/usb/usbaudio.h | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/sound/usb/card.c b/sound/usb/card.c
index a1f8c3a026f5..6abfc9d079e7 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -68,6 +68,7 @@ static int pid[SNDRV_CARDS] = { [0 ... (SNDRV_CARDS-1)] = -1 };
 static int device_setup[SNDRV_CARDS]; /* device parameter for this card */
 static bool ignore_ctl_error;
 static bool autoclock = true;
+static bool lowlatency = true;
 static char *quirk_alias[SNDRV_CARDS];
 static char *delayed_register[SNDRV_CARDS];
 static bool implicit_fb[SNDRV_CARDS];
@@ -92,6 +93,8 @@ MODULE_PARM_DESC(ignore_ctl_error,
 		 "Ignore errors from USB controller for mixer interfaces.");
 module_param(autoclock, bool, 0444);
 MODULE_PARM_DESC(autoclock, "Enable auto-clock selection for UAC2 devices (default: yes).");
+module_param(lowlatency, bool, 0444);
+MODULE_PARM_DESC(lowlatency, "Enable low latency playback (default: yes).");
 module_param_array(quirk_alias, charp, NULL, 0444);
 MODULE_PARM_DESC(quirk_alias, "Quirk aliases, e.g. 0123abcd:5678beef.");
 module_param_array(delayed_register, charp, NULL, 0444);
@@ -599,6 +602,7 @@ static int snd_usb_audio_create(struct usb_interface *intf,
 	chip->setup = device_setup[idx];
 	chip->generic_implicit_fb = implicit_fb[idx];
 	chip->autoclock = autoclock;
+	chip->lowlatency = lowlatency;
 	atomic_set(&chip->active, 1); /* avoid autopm during probing */
 	atomic_set(&chip->usage_count, 0);
 	atomic_set(&chip->shutdown, 0);
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index f5cbf61ac366..5dc9266180e3 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -617,7 +617,8 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
 	/* check whether early start is needed for playback stream */
 	subs->early_playback_start =
 		subs->direction == SNDRV_PCM_STREAM_PLAYBACK &&
-		subs->data_endpoint->nominal_queue_size >= subs->buffer_bytes;
+		(!chip->lowlatency ||
+		 (subs->data_endpoint->nominal_queue_size >= subs->buffer_bytes));
 
 	if (subs->early_playback_start)
 		ret = start_endpoints(subs);
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index 538831cbd925..8b70c9ea91b9 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -57,6 +57,7 @@ struct snd_usb_audio {
 	bool generic_implicit_fb;	/* from the 'implicit_fb' module param */
 	bool autoclock;			/* from the 'autoclock' module param */
 
+	bool lowlatency;		/* from the 'lowlatency' module param */
 	struct usb_host_interface *ctrl_intf;	/* the audio control interface */
 	struct media_device *media_dev;
 	struct media_intf_devnode *ctl_intf_media_devnode;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 281/334] atlantic: Fix driver resume flow.
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 280/334] ALSA: usb-audio: Add lowlatency module option Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 282/334] bcma: Fix memory leak for internally-handled cores Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru,
	Igor Russkikh, David S. Miller, Sasha Levin

From: Sudarsana Reddy Kalluru <skalluru@marvell.com>

[ Upstream commit 57f780f1c43362b86fd23d20bd940e2468237716 ]

Driver crashes when restoring from the Hibernate. In the resume flow,
driver need to clean up the older nic/vec objects and re-initialize them.

Fixes: 8aaa112a57c1d ("net: atlantic: refactoring pm logic")
Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
index 59253846e885..f26d03735619 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c
@@ -417,6 +417,9 @@ static int atl_resume_common(struct device *dev, bool deep)
 	pci_restore_state(pdev);
 
 	if (deep) {
+		/* Reinitialize Nic/Vecs objects */
+		aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol);
+
 		ret = aq_nic_init(nic);
 		if (ret)
 			goto err_exit;
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 282/334] bcma: Fix memory leak for internally-handled cores
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 281/334] atlantic: Fix driver resume flow Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 283/334] brcmfmac: pcie: fix oops on failure to resume and reprobe Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zenghui Yu, Kalle Valo, Sasha Levin

From: Zenghui Yu <yuzenghui@huawei.com>

[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]

kmemleak reported that dev_name() of internally-handled cores were leaked
on driver unbinding. Let's use device_initialize() to take refcounts for
them and put_device() to properly free the related stuff.

While looking at it, there's another potential issue for those which should
be *registered* into driver core. If device_register() failed, we put
device once and freed bcma_device structures. In bcma_unregister_cores(),
they're treated as unregistered and we hit both UAF and double-free. That
smells not good and has also been fixed now.

Fixes: ab54bc8460b5 ("bcma: fill core details for every device")
Signed-off-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210727025232.663-2-yuzenghui@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bcma/main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 6535614a7dc1..1df2b5801c3b 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);
 
 void bcma_prepare_core(struct bcma_bus *bus, struct bcma_device *core)
 {
+	device_initialize(&core->dev);
 	core->dev.release = bcma_release_core_dev;
 	core->dev.bus = &bcma_bus_type;
 	dev_set_name(&core->dev, "bcma%d:%d", bus->num, core->core_index);
@@ -277,11 +278,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core)
 {
 	int err;
 
-	err = device_register(&core->dev);
+	err = device_add(&core->dev);
 	if (err) {
 		bcma_err(bus, "Could not register dev for core 0x%03X\n",
 			 core->id.id);
-		put_device(&core->dev);
 		return;
 	}
 	core->dev_registered = true;
@@ -372,7 +372,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)
 	/* Now noone uses internally-handled cores, we can free them */
 	list_for_each_entry_safe(core, tmp, &bus->cores, list) {
 		list_del(&core->list);
-		kfree(core);
+		put_device(&core->dev);
 	}
 }
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 283/334] brcmfmac: pcie: fix oops on failure to resume and reprobe
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 282/334] bcma: Fix memory leak for internally-handled cores Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 284/334] ipv6: make exception cache less predictible Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ahmad Fatoum, Kalle Valo, Sasha Levin

From: Ahmad Fatoum <a.fatoum@pengutronix.de>

[ Upstream commit d745ca4f2c4ae9f1bd8cf7d8ac6e22d739bffd19 ]

When resuming from suspend, brcmf_pcie_pm_leave_D3 will first attempt a
hot resume and then fall back to removing the PCI device and then
reprobing. If this probe fails, the kernel will oops, because brcmf_err,
which is called to report the failure will dereference the stale bus
pointer. Open code and use the default bus-less brcmf_err to avoid this.

Fixes: 8602e62441ab ("brcmfmac: pass bus to the __brcmf_err() in pcie.c")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210817063521.22450-1-a.fatoum@pengutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
index c49dd0c36ae4..bbd72c2db088 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
@@ -2075,7 +2075,7 @@ cleanup:
 
 	err = brcmf_pcie_probe(pdev, NULL);
 	if (err)
-		brcmf_err(bus, "probe after resume failed, err=%d\n", err);
+		__brcmf_err(NULL, __func__, "probe after resume failed, err=%d\n", err);
 
 	return err;
 }
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 284/334] ipv6: make exception cache less predictible
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 283/334] brcmfmac: pcie: fix oops on failure to resume and reprobe Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 285/334] ipv4: " Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Keyu Man, Wei Wang,
	Martin KaFai Lau, David Ahern, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit a00df2caffed3883c341d5685f830434312e4a43 ]

Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"),
an attacker can still use brute force to learn some secrets from a victim
linux host.

One way to defeat these attacks is to make the max depth of the hash
table bucket a random value.

Before this patch, each bucket of the hash table used to store exceptions
could contain 6 items under attack.

After the patch, each bucket would contains a random number of items,
between 6 and 10. The attacker can no longer infer secrets.

This is slightly increasing memory size used by the hash table,
we do not expect this to be a problem.

Following patch is dealing with the same issue in IPv4.

Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Wei Wang <weiwan@google.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv6/route.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c5e8ecb96426..603340302101 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt,
 	struct in6_addr *src_key = NULL;
 	struct rt6_exception *rt6_ex;
 	struct fib6_nh *nh = res->nh;
+	int max_depth;
 	int err = 0;
 
 	spin_lock_bh(&rt6_exception_lock);
@@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt,
 	bucket->depth++;
 	net->ipv6.rt6_stats->fib_rt_cache++;
 
-	if (bucket->depth > FIB6_MAX_DEPTH)
+	/* Randomize max depth to avoid some side channels attacks. */
+	max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH);
+	while (bucket->depth > max_depth)
 		rt6_exception_remove_oldest(bucket);
 
 out:
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 285/334] ipv4: make exception cache less predictible
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 284/334] ipv6: make exception cache less predictible Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 286/334] net: qrtr: make checks in qrtr_endpoint_post() stricter Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Keyu Man,
	Willy Tarreau, David S. Miller, David Ahern, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ]

Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in
fnhe_hashfun()"), an attacker can still use brute force to learn
some secrets from a victim linux host.

One way to defeat these attacks is to make the max depth of the hash
table bucket a random value.

Before this patch, each bucket of the hash table used to store exceptions
could contain 6 items under attack.

After the patch, each bucket would contains a random number of items,
between 6 and 10. The attacker can no longer infer secrets.

This is slightly increasing memory size used by the hash table,
by 50% in average, we do not expect this to be a problem.

This patch is more complex than the prior one (IPv6 equivalent),
because IPv4 was reusing the oldest entry.
Since we need to be able to evict more than one entry per
update_or_create_fnhe() call, I had to replace
fnhe_oldest() with fnhe_remove_oldest().

Also note that we will queue extra kfree_rcu() calls under stress,
which hopefully wont be a too big issue.

Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Keyu Man <kman001@ucr.edu>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Reviewed-by: David Ahern <dsahern@kernel.org>
Tested-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/route.c | 46 ++++++++++++++++++++++++++++++----------------
 1 file changed, 30 insertions(+), 16 deletions(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index a6f20ee35335..225714b5efc0 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -586,18 +586,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
 	}
 }
 
-static struct fib_nh_exception *fnhe_oldest(struct fnhe_hash_bucket *hash)
+static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
 {
-	struct fib_nh_exception *fnhe, *oldest;
+	struct fib_nh_exception __rcu **fnhe_p, **oldest_p;
+	struct fib_nh_exception *fnhe, *oldest = NULL;
 
-	oldest = rcu_dereference(hash->chain);
-	for (fnhe = rcu_dereference(oldest->fnhe_next); fnhe;
-	     fnhe = rcu_dereference(fnhe->fnhe_next)) {
-		if (time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp))
+	for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) {
+		fnhe = rcu_dereference_protected(*fnhe_p,
+						 lockdep_is_held(&fnhe_lock));
+		if (!fnhe)
+			break;
+		if (!oldest ||
+		    time_before(fnhe->fnhe_stamp, oldest->fnhe_stamp)) {
 			oldest = fnhe;
+			oldest_p = fnhe_p;
+		}
 	}
 	fnhe_flush_routes(oldest);
-	return oldest;
+	*oldest_p = oldest->fnhe_next;
+	kfree_rcu(oldest, rcu);
 }
 
 static u32 fnhe_hashfun(__be32 daddr)
@@ -676,16 +683,21 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,
 		if (rt)
 			fill_route_from_fnhe(rt, fnhe);
 	} else {
-		if (depth > FNHE_RECLAIM_DEPTH)
-			fnhe = fnhe_oldest(hash);
-		else {
-			fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
-			if (!fnhe)
-				goto out_unlock;
-
-			fnhe->fnhe_next = hash->chain;
-			rcu_assign_pointer(hash->chain, fnhe);
+		/* Randomize max depth to avoid some side channels attacks. */
+		int max_depth = FNHE_RECLAIM_DEPTH +
+				prandom_u32_max(FNHE_RECLAIM_DEPTH);
+
+		while (depth > max_depth) {
+			fnhe_remove_oldest(hash);
+			depth--;
 		}
+
+		fnhe = kzalloc(sizeof(*fnhe), GFP_ATOMIC);
+		if (!fnhe)
+			goto out_unlock;
+
+		fnhe->fnhe_next = hash->chain;
+
 		fnhe->fnhe_genid = genid;
 		fnhe->fnhe_daddr = daddr;
 		fnhe->fnhe_gw = gw;
@@ -693,6 +705,8 @@ static void update_or_create_fnhe(struct fib_nh_common *nhc, __be32 daddr,
 		fnhe->fnhe_mtu_locked = lock;
 		fnhe->fnhe_expires = max(1UL, expires);
 
+		rcu_assign_pointer(hash->chain, fnhe);
+
 		/* Exception created; mark the cached routes for the nexthop
 		 * stale, so anyone caching it rechecks if this exception
 		 * applies to them.
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 286/334] net: qrtr: make checks in qrtr_endpoint_post() stricter
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 285/334] ipv4: " Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 287/334] sch_htb: Fix inconsistency when leaf qdisc creation fails Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit aaa8e4922c887ff47ad66ef918193682bccc1905 ]

These checks are still not strict enough.  The main problem is that if
"cb->type == QRTR_TYPE_NEW_SERVER" is true then "len - hdrlen" is
guaranteed to be 4 but we need to be at least 16 bytes.  In fact, we
can reject everything smaller than sizeof(*pkt) which is 20 bytes.

Also I don't like the ALIGN(size, 4).  It's better to just insist that
data is needs to be aligned at the start.

Fixes: 0baa99ee353c ("net: qrtr: Allow non-immediate node routing")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/qrtr/qrtr.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
index 0c30908628ba..bdbda61db8b9 100644
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -493,7 +493,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 		goto err;
 	}
 
-	if (!size || len != ALIGN(size, 4) + hdrlen)
+	if (!size || size & 3 || len != size + hdrlen)
 		goto err;
 
 	if (cb->dst_port != QRTR_PORT_CTRL && cb->type != QRTR_TYPE_DATA &&
@@ -506,8 +506,12 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
 
 	if (cb->type == QRTR_TYPE_NEW_SERVER) {
 		/* Remote node endpoint can bridge other distant nodes */
-		const struct qrtr_ctrl_pkt *pkt = data + hdrlen;
+		const struct qrtr_ctrl_pkt *pkt;
 
+		if (size < sizeof(*pkt))
+			goto err;
+
+		pkt = data + hdrlen;
 		qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
 	}
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 287/334] sch_htb: Fix inconsistency when leaf qdisc creation fails
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 286/334] net: qrtr: make checks in qrtr_endpoint_post() stricter Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 288/334] net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maxim Mikityanskiy, Tariq Toukan,
	Jakub Kicinski, Sasha Levin

From: Maxim Mikityanskiy <maximmi@nvidia.com>

[ Upstream commit ca49bfd90a9dde175d2929dc1544b54841e33804 ]

In HTB offload mode, qdiscs of leaf classes are grafted to netdev
queues. sch_htb expects the dev_queue field of these qdiscs to point to
the corresponding queues. However, qdisc creation may fail, and in that
case noop_qdisc is used instead. Its dev_queue doesn't point to the
right queue, so sch_htb can lose track of used netdev queues, which will
cause internal inconsistencies.

This commit fixes this bug by keeping track of the netdev queue inside
struct htb_class. All reads of cl->leaf.q->dev_queue are replaced by the
new field, the two values are synced on writes, and WARNs are added to
assert equality of the two values.

The driver API has changed: when TC_HTB_LEAF_DEL needs to move a queue,
the driver used to pass the old and new queue IDs to sch_htb. Now that
there is a new field (offload_queue) in struct htb_class that needs to
be updated on this operation, the driver will pass the old class ID to
sch_htb instead (it already knows the new class ID).

Fixes: d03b195b5aa0 ("sch_htb: Hierarchical QoS hardware offload")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20210826115425.1744053-1-maximmi@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 .../net/ethernet/mellanox/mlx5/core/en/qos.c  | 15 ++-
 .../net/ethernet/mellanox/mlx5/core/en/qos.h  |  4 +-
 .../net/ethernet/mellanox/mlx5/core/en_main.c |  3 +-
 include/net/pkt_cls.h                         |  3 +-
 net/sched/sch_htb.c                           | 97 ++++++++++++-------
 5 files changed, 72 insertions(+), 50 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
index 5efe3278b0f6..1fd8baf19829 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c
@@ -733,8 +733,8 @@ static void mlx5e_reset_qdisc(struct net_device *dev, u16 qid)
 	spin_unlock_bh(qdisc_lock(qdisc));
 }
 
-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
-		       u16 *new_qid, struct netlink_ext_ack *extack)
+int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid,
+		       struct netlink_ext_ack *extack)
 {
 	struct mlx5e_qos_node *node;
 	struct netdev_queue *txq;
@@ -742,11 +742,9 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
 	bool opened;
 	int err;
 
-	qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", classid);
-
-	*old_qid = *new_qid = 0;
+	qos_dbg(priv->mdev, "TC_HTB_LEAF_DEL classid %04x\n", *classid);
 
-	node = mlx5e_sw_node_find(priv, classid);
+	node = mlx5e_sw_node_find(priv, *classid);
 	if (!node)
 		return -ENOENT;
 
@@ -764,7 +762,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
 	err = mlx5_qos_destroy_node(priv->mdev, node->hw_id);
 	if (err) /* Not fatal. */
 		qos_warn(priv->mdev, "Failed to destroy leaf node %u (class %04x), err = %d\n",
-			 node->hw_id, classid, err);
+			 node->hw_id, *classid, err);
 
 	mlx5e_sw_node_delete(priv, node);
 
@@ -826,8 +824,7 @@ int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
 	if (opened)
 		mlx5e_reactivate_qos_sq(priv, moved_qid, txq);
 
-	*old_qid = mlx5e_qid_from_qos(&priv->channels, moved_qid);
-	*new_qid = mlx5e_qid_from_qos(&priv->channels, qid);
+	*classid = node->classid;
 	return 0;
 }
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
index 5af7991fcd19..757682b7c0e0 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.h
@@ -34,8 +34,8 @@ int mlx5e_htb_leaf_alloc_queue(struct mlx5e_priv *priv, u16 classid,
 			       struct netlink_ext_ack *extack);
 int mlx5e_htb_leaf_to_inner(struct mlx5e_priv *priv, u16 classid, u16 child_classid,
 			    u64 rate, u64 ceil, struct netlink_ext_ack *extack);
-int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 classid, u16 *old_qid,
-		       u16 *new_qid, struct netlink_ext_ack *extack);
+int mlx5e_htb_leaf_del(struct mlx5e_priv *priv, u16 *classid,
+		       struct netlink_ext_ack *extack);
 int mlx5e_htb_leaf_del_last(struct mlx5e_priv *priv, u16 classid, bool force,
 			    struct netlink_ext_ack *extack);
 int mlx5e_htb_node_modify(struct mlx5e_priv *priv, u16 classid, u64 rate, u64 ceil,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index b7be1ef4cbb2..2d53eaf3b924 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -3453,8 +3453,7 @@ static int mlx5e_setup_tc_htb(struct mlx5e_priv *priv, struct tc_htb_qopt_offloa
 		return mlx5e_htb_leaf_to_inner(priv, htb->parent_classid, htb->classid,
 					       htb->rate, htb->ceil, htb->extack);
 	case TC_HTB_LEAF_DEL:
-		return mlx5e_htb_leaf_del(priv, htb->classid, &htb->moved_qid, &htb->qid,
-					  htb->extack);
+		return mlx5e_htb_leaf_del(priv, &htb->classid, htb->extack);
 	case TC_HTB_LEAF_DEL_LAST:
 	case TC_HTB_LEAF_DEL_LAST_FORCE:
 		return mlx5e_htb_leaf_del_last(priv, htb->classid,
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index 298a8d10168b..fb34b66aefa7 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -824,10 +824,9 @@ enum tc_htb_command {
 struct tc_htb_qopt_offload {
 	struct netlink_ext_ack *extack;
 	enum tc_htb_command command;
-	u16 classid;
 	u32 parent_classid;
+	u16 classid;
 	u16 qid;
-	u16 moved_qid;
 	u64 rate;
 	u64 ceil;
 };
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5f7ac27a5264..f22d26a2c89f 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -125,6 +125,7 @@ struct htb_class {
 		struct htb_class_leaf {
 			int		deficit[TC_HTB_MAXDEPTH];
 			struct Qdisc	*q;
+			struct netdev_queue *offload_queue;
 		} leaf;
 		struct htb_class_inner {
 			struct htb_prio clprio[TC_HTB_NUMPRIO];
@@ -1411,24 +1412,47 @@ htb_graft_helper(struct netdev_queue *dev_queue, struct Qdisc *new_q)
 	return old_q;
 }
 
-static void htb_offload_move_qdisc(struct Qdisc *sch, u16 qid_old, u16 qid_new)
+static struct netdev_queue *htb_offload_get_queue(struct htb_class *cl)
+{
+	struct netdev_queue *queue;
+
+	queue = cl->leaf.offload_queue;
+	if (!(cl->leaf.q->flags & TCQ_F_BUILTIN))
+		WARN_ON(cl->leaf.q->dev_queue != queue);
+
+	return queue;
+}
+
+static void htb_offload_move_qdisc(struct Qdisc *sch, struct htb_class *cl_old,
+				   struct htb_class *cl_new, bool destroying)
 {
 	struct netdev_queue *queue_old, *queue_new;
 	struct net_device *dev = qdisc_dev(sch);
-	struct Qdisc *qdisc;
 
-	queue_old = netdev_get_tx_queue(dev, qid_old);
-	queue_new = netdev_get_tx_queue(dev, qid_new);
+	queue_old = htb_offload_get_queue(cl_old);
+	queue_new = htb_offload_get_queue(cl_new);
 
-	if (dev->flags & IFF_UP)
-		dev_deactivate(dev);
-	qdisc = dev_graft_qdisc(queue_old, NULL);
-	qdisc->dev_queue = queue_new;
-	qdisc = dev_graft_qdisc(queue_new, qdisc);
-	if (dev->flags & IFF_UP)
-		dev_activate(dev);
+	if (!destroying) {
+		struct Qdisc *qdisc;
 
-	WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN));
+		if (dev->flags & IFF_UP)
+			dev_deactivate(dev);
+		qdisc = dev_graft_qdisc(queue_old, NULL);
+		WARN_ON(qdisc != cl_old->leaf.q);
+	}
+
+	if (!(cl_old->leaf.q->flags & TCQ_F_BUILTIN))
+		cl_old->leaf.q->dev_queue = queue_new;
+	cl_old->leaf.offload_queue = queue_new;
+
+	if (!destroying) {
+		struct Qdisc *qdisc;
+
+		qdisc = dev_graft_qdisc(queue_new, cl_old->leaf.q);
+		if (dev->flags & IFF_UP)
+			dev_activate(dev);
+		WARN_ON(!(qdisc->flags & TCQ_F_BUILTIN));
+	}
 }
 
 static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
@@ -1442,10 +1466,8 @@ static int htb_graft(struct Qdisc *sch, unsigned long arg, struct Qdisc *new,
 	if (cl->level)
 		return -EINVAL;
 
-	if (q->offload) {
-		dev_queue = new->dev_queue;
-		WARN_ON(dev_queue != cl->leaf.q->dev_queue);
-	}
+	if (q->offload)
+		dev_queue = htb_offload_get_queue(cl);
 
 	if (!new) {
 		new = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
@@ -1514,6 +1536,8 @@ static void htb_parent_to_leaf(struct Qdisc *sch, struct htb_class *cl,
 	parent->ctokens = parent->cbuffer;
 	parent->t_c = ktime_get_ns();
 	parent->cmode = HTB_CAN_SEND;
+	if (q->offload)
+		parent->leaf.offload_queue = cl->leaf.offload_queue;
 }
 
 static void htb_parent_to_leaf_offload(struct Qdisc *sch,
@@ -1534,6 +1558,7 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 				     struct netlink_ext_ack *extack)
 {
 	struct tc_htb_qopt_offload offload_opt;
+	struct netdev_queue *dev_queue;
 	struct Qdisc *q = cl->leaf.q;
 	struct Qdisc *old = NULL;
 	int err;
@@ -1542,16 +1567,15 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 		return -EINVAL;
 
 	WARN_ON(!q);
-	if (!destroying) {
-		/* On destroy of HTB, two cases are possible:
-		 * 1. q is a normal qdisc, but q->dev_queue has noop qdisc.
-		 * 2. q is a noop qdisc (for nodes that were inner),
-		 *    q->dev_queue is noop_netdev_queue.
+	dev_queue = htb_offload_get_queue(cl);
+	old = htb_graft_helper(dev_queue, NULL);
+	if (destroying)
+		/* Before HTB is destroyed, the kernel grafts noop_qdisc to
+		 * all queues.
 		 */
-		old = htb_graft_helper(q->dev_queue, NULL);
-		WARN_ON(!old);
+		WARN_ON(!(old->flags & TCQ_F_BUILTIN));
+	else
 		WARN_ON(old != q);
-	}
 
 	if (cl->parent) {
 		cl->parent->bstats_bias.bytes += q->bstats.bytes;
@@ -1570,18 +1594,17 @@ static int htb_destroy_class_offload(struct Qdisc *sch, struct htb_class *cl,
 	if (!err || destroying)
 		qdisc_put(old);
 	else
-		htb_graft_helper(q->dev_queue, old);
+		htb_graft_helper(dev_queue, old);
 
 	if (last_child)
 		return err;
 
-	if (!err && offload_opt.moved_qid != 0) {
-		if (destroying)
-			q->dev_queue = netdev_get_tx_queue(qdisc_dev(sch),
-							   offload_opt.qid);
-		else
-			htb_offload_move_qdisc(sch, offload_opt.moved_qid,
-					       offload_opt.qid);
+	if (!err && offload_opt.classid != TC_H_MIN(cl->common.classid)) {
+		u32 classid = TC_H_MAJ(sch->handle) |
+			      TC_H_MIN(offload_opt.classid);
+		struct htb_class *moved_cl = htb_find(classid, sch);
+
+		htb_offload_move_qdisc(sch, moved_cl, cl, destroying);
 	}
 
 	return err;
@@ -1704,9 +1727,11 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg,
 	}
 
 	if (last_child) {
-		struct netdev_queue *dev_queue;
+		struct netdev_queue *dev_queue = sch->dev_queue;
+
+		if (q->offload)
+			dev_queue = htb_offload_get_queue(cl);
 
-		dev_queue = q->offload ? cl->leaf.q->dev_queue : sch->dev_queue;
 		new_q = qdisc_create_dflt(dev_queue, &pfifo_qdisc_ops,
 					  cl->parent->common.classid,
 					  NULL);
@@ -1878,7 +1903,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
 			}
 			dev_queue = netdev_get_tx_queue(dev, offload_opt.qid);
 		} else { /* First child. */
-			dev_queue = parent->leaf.q->dev_queue;
+			dev_queue = htb_offload_get_queue(parent);
 			old_q = htb_graft_helper(dev_queue, NULL);
 			WARN_ON(old_q != parent->leaf.q);
 			offload_opt = (struct tc_htb_qopt_offload) {
@@ -1935,6 +1960,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
 
 		/* leaf (we) needs elementary qdisc */
 		cl->leaf.q = new_q ? new_q : &noop_qdisc;
+		if (q->offload)
+			cl->leaf.offload_queue = dev_queue;
 
 		cl->parent = parent;
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 288/334] net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 287/334] sch_htb: Fix inconsistency when leaf qdisc creation fails Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 289/334] net: qualcomm: fix QCA7000 checksum handling Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiyu Yang, Cong Wang, Jakub Kicinski,
	Sasha Levin

From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

[ Upstream commit c66070125837900163b81a03063ddd657a7e9bfb ]

The reference counting issue happens in one exception handling path of
cbq_change_class(). When failing to get tcf_block, the function forgets
to decrease the refcount of "rtab" increased by qdisc_put_rtab(),
causing a refcount leak.

Fix this issue by jumping to "failure" label when get tcf_block failed.

Fixes: 6529eaba33f0 ("net: sched: introduce tcf block infractructure")
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Reviewed-by: Cong Wang <cong.wang@bytedance.com>
Link: https://lore.kernel.org/r/1630252681-71588-1-git-send-email-xiyuyang19@fudan.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/sched/sch_cbq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index b79a7e27bb31..38a3a8394bbd 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1614,7 +1614,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 	err = tcf_block_get(&cl->block, &cl->filter_list, sch, extack);
 	if (err) {
 		kfree(cl);
-		return err;
+		goto failure;
 	}
 
 	if (tca[TCA_RATE]) {
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 289/334] net: qualcomm: fix QCA7000 checksum handling
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 288/334] net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 290/334] octeontx2-af: Fix loop in free and unmap counter Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Heimpold, Stefan Wahren,
	David S. Miller, Sasha Levin

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 429205da6c834447a57279af128bdd56ccd5225e ]

Based on tests the QCA7000 doesn't support checksum offloading. So assume
ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum
handling. This fixes data transfer issues in noisy environments.

Reported-by: Michael Heimpold <michael.heimpold@in-tech.com>
Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/qualcomm/qca_spi.c  | 2 +-
 drivers/net/ethernet/qualcomm/qca_uart.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
index b64c254e00ba..8427fe1b8fd1 100644
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -434,7 +434,7 @@ qcaspi_receive(struct qcaspi *qca)
 				skb_put(qca->rx_skb, retcode);
 				qca->rx_skb->protocol = eth_type_trans(
 					qca->rx_skb, qca->rx_skb->dev);
-				qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
+				skb_checksum_none_assert(qca->rx_skb);
 				netif_rx_ni(qca->rx_skb);
 				qca->rx_skb = netdev_alloc_skb_ip_align(net_dev,
 					net_dev->mtu + VLAN_ETH_HLEN);
diff --git a/drivers/net/ethernet/qualcomm/qca_uart.c b/drivers/net/ethernet/qualcomm/qca_uart.c
index bcdeca7b3366..ce3f7ce31adc 100644
--- a/drivers/net/ethernet/qualcomm/qca_uart.c
+++ b/drivers/net/ethernet/qualcomm/qca_uart.c
@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data,
 			skb_put(qca->rx_skb, retcode);
 			qca->rx_skb->protocol = eth_type_trans(
 						qca->rx_skb, qca->rx_skb->dev);
-			qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY;
+			skb_checksum_none_assert(qca->rx_skb);
 			netif_rx_ni(qca->rx_skb);
 			qca->rx_skb = netdev_alloc_skb_ip_align(netdev,
 								netdev->mtu +
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 290/334] octeontx2-af: Fix loop in free and unmap counter
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 289/334] net: qualcomm: fix QCA7000 checksum handling Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 291/334] octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Subbaraya Sundeep <sbhatta@marvell.com>

[ Upstream commit 6537e96d743b89294b397b4865c6c061abae31b0 ]

When the given counter does not belong to the entry
then code ends up in infinite loop because the loop
cursor, entry is not getting updated further. This
patch fixes that by updating entry for every iteration.

Fixes: a958dd59f9ce ("octeontx2-af: Map or unmap NPC MCAM entry and counter")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
index 52b255426c22..38e8d58cf8a0 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -2990,10 +2990,11 @@ int rvu_mbox_handler_npc_mcam_unmap_counter(struct rvu *rvu,
 		index = find_next_bit(mcam->bmap, mcam->bmap_entries, entry);
 		if (index >= mcam->bmap_entries)
 			break;
+		entry = index + 1;
+
 		if (mcam->entry2cntr_map[index] != req->cntr)
 			continue;
 
-		entry = index + 1;
 		npc_unmap_mcam_entry_and_cntr(rvu, mcam, blkaddr,
 					      index, req->cntr);
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 291/334] octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 290/334] octeontx2-af: Fix loop in free and unmap counter Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 292/334] octeontx2-af: Fix static code analyzer reported issues Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Subbaraya Sundeep <sbhatta@marvell.com>

[ Upstream commit f2e4568ec95166605c77577953b2787c7f909978 ]

In npc_update_vf_flow_entry function the loop cursor
'index' is being changed inside the loop causing
the loop to spin forever. This in turn hogs the kworker
thread forever and no other mbox message is processed
by AF driver after that. Fix this by using
another variable in the loop.

Fixes: 55307fcb9258 ("octeontx2-af: Add mbox messages to install and delete MCAM rules")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
index 38e8d58cf8a0..0122310ee3a7 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -938,7 +938,7 @@ void rvu_npc_enable_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf,
 static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
 				     int blkaddr, u16 pcifunc, u64 rx_action)
 {
-	int actindex, index, bank;
+	int actindex, index, bank, entry;
 	bool enable;
 
 	if (!(pcifunc & RVU_PFVF_FUNC_MASK))
@@ -949,7 +949,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
 		if (mcam->entry2target_pffunc[index] == pcifunc) {
 			bank = npc_get_bank(mcam, index);
 			actindex = index;
-			index &= (mcam->banksize - 1);
+			entry = index & (mcam->banksize - 1);
 
 			/* read vf flow entry enable status */
 			enable = is_mcam_entry_enabled(rvu, mcam, blkaddr,
@@ -959,7 +959,7 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam,
 					      false);
 			/* update 'action' */
 			rvu_write64(rvu, blkaddr,
-				    NPC_AF_MCAMEX_BANKX_ACTION(index, bank),
+				    NPC_AF_MCAMEX_BANKX_ACTION(entry, bank),
 				    rx_action);
 			if (enable)
 				npc_enable_mcam_entry(rvu, mcam, blkaddr,
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 292/334] octeontx2-af: Fix static code analyzer reported issues
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 291/334] octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 293/334] octeontx2-af: Set proper errorcode for IPv4 checksum errors Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Subbaraya Sundeep, Sunil Goutham,
	David S. Miller, Sasha Levin

From: Subbaraya Sundeep <sbhatta@marvell.com>

[ Upstream commit 698a82ebfb4b2f2014baf31b7324b328a2a6366e ]

This patch fixes the static code analyzer reported issues
in rvu_npc.c. The reported errors are different sizes of
operands in bitops and returning uninitialized values.

Fixes: 651cd2652339 ("octeontx2-af: MCAM entry installation support")
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
index 0122310ee3a7..0a9ff2e0c9bb 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -23,7 +23,7 @@
 #define RSVD_MCAM_ENTRIES_PER_NIXLF	1 /* Ucast for LFs */
 
 #define NPC_PARSE_RESULT_DMAC_OFFSET	8
-#define NPC_HW_TSTAMP_OFFSET		8
+#define NPC_HW_TSTAMP_OFFSET		8ULL
 #define NPC_KEX_CHAN_MASK		0xFFFULL
 #define NPC_KEX_PF_FUNC_MASK		0xFFFFULL
 
@@ -2166,7 +2166,7 @@ static void npc_unmap_mcam_entry_and_cntr(struct rvu *rvu,
 					  int blkaddr, u16 entry, u16 cntr)
 {
 	u16 index = entry & (mcam->banksize - 1);
-	u16 bank = npc_get_bank(mcam, entry);
+	u32 bank = npc_get_bank(mcam, entry);
 
 	/* Remove mapping and reduce counter's refcnt */
 	mcam->entry2cntr_map[entry] = NPC_MCAM_INVALID_MAP;
@@ -2788,8 +2788,8 @@ int rvu_mbox_handler_npc_mcam_shift_entry(struct rvu *rvu,
 	struct npc_mcam *mcam = &rvu->hw->mcam;
 	u16 pcifunc = req->hdr.pcifunc;
 	u16 old_entry, new_entry;
+	int blkaddr, rc = 0;
 	u16 index, cntr;
-	int blkaddr, rc;
 
 	blkaddr = rvu_get_blkaddr(rvu, BLKTYPE_NPC, 0);
 	if (blkaddr < 0)
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 293/334] octeontx2-af: Set proper errorcode for IPv4 checksum errors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 292/334] octeontx2-af: Fix static code analyzer reported issues Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 294/334] ipv4: fix endianness issue in inet_rtm_getroute_build_skb() Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sunil Goutham, Subbaraya Sundeep,
	David S. Miller, Sasha Levin

From: Sunil Goutham <sgoutham@marvell.com>

[ Upstream commit 1e4428b6dba9b683dc2ec0a56ed7879de3200cce ]

With current config, for packets with IPv4 checksum errors,
errorcode is being set to UNKNOWN. Hence added a separate
errorcodes for outer and inner IPv4 checksum and changed
NPC configuration accordingly.

Also turn on L2 multicast address check in NPC protocol check block.

Fixes: 6b3321bacc5a ("octeontx2-af: Enable packet length and csum validation")
Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
index 0a9ff2e0c9bb..26a792407c40 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c
@@ -2030,14 +2030,15 @@ int rvu_npc_init(struct rvu *rvu)
 
 	/* Enable below for Rx pkts.
 	 * - Outer IPv4 header checksum validation.
-	 * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2M].
+	 * - Detect outer L2 broadcast address and set NPC_RESULT_S[L2B].
+	 * - Detect outer L2 multicast address and set NPC_RESULT_S[L2M].
 	 * - Inner IPv4 header checksum validation.
 	 * - Set non zero checksum error code value
 	 */
 	rvu_write64(rvu, blkaddr, NPC_AF_PCK_CFG,
 		    rvu_read64(rvu, blkaddr, NPC_AF_PCK_CFG) |
-		    BIT_ULL(32) | BIT_ULL(24) | BIT_ULL(6) |
-		    BIT_ULL(2) | BIT_ULL(1));
+		    ((u64)NPC_EC_OIP4_CSUM << 32) | (NPC_EC_IIP4_CSUM << 24) |
+		    BIT_ULL(7) | BIT_ULL(6) | BIT_ULL(2) | BIT_ULL(1));
 
 	rvu_npc_setup_interfaces(rvu, blkaddr);
 
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 294/334] ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 293/334] octeontx2-af: Set proper errorcode for IPv4 checksum errors Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 295/334] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Roopa Prabhu,
	David Ahern, David S. Miller, Sasha Levin

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 92548b0ee220e000d81c27ac9a80e0ede895a881 ]

The UDP length field should be in network order.
This removes the following sparse error:

net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types)
net/ipv4/route.c:3173:27:    expected restricted __be16 [usertype] len
net/ipv4/route.c:3173:27:    got unsigned long

Fixes: 404eb77ea766 ("ipv4: support sport, dport and ip_proto in RTM_GETROUTE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@nvidia.com>
Cc: David Ahern <dsahern@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 225714b5efc0..94e33d3eaf62 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3184,7 +3184,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
 		udph = skb_put_zero(skb, sizeof(struct udphdr));
 		udph->source = sport;
 		udph->dest = dport;
-		udph->len = sizeof(struct udphdr);
+		udph->len = htons(sizeof(struct udphdr));
 		udph->check = 0;
 		break;
 	}
-- 
2.30.2




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* [PATCH 5.14 295/334] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 294/334] ipv4: fix endianness issue in inet_rtm_getroute_build_skb() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 296/334] iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Douglas Anderson,
	Stephen Boyd, Mark Brown

From: Douglas Anderson <dianders@chromium.org>

commit a1ea05723c27a6f77894a60038a7b2b12fcec9a7 upstream.

In commit 772d44526e20 ("ASoC: rt5682: Properly turn off regulators if
wrong device ID") I deleted code but forgot to delete a variable
that's now unused. Delete it.

Fixes: 772d44526e20 ("ASoC: rt5682: Properly turn off regulators if wrong device ID")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Link: https://lore.kernel.org/r/20210813073402.1.Iaa9425cfab80f5233afa78b32d02b6dc23256eb3@changeid
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 sound/soc/codecs/rt5682-i2c.c |    2 --
 1 file changed, 2 deletions(-)

--- a/sound/soc/codecs/rt5682-i2c.c
+++ b/sound/soc/codecs/rt5682-i2c.c
@@ -294,8 +294,6 @@ static void rt5682_i2c_shutdown(struct i
 
 static int rt5682_i2c_remove(struct i2c_client *client)
 {
-	struct rt5682_priv *rt5682 = i2c_get_clientdata(client);
-
 	rt5682_i2c_shutdown(client);
 
 	return 0;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 296/334] iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 295/334] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 297/334] f2fs: guarantee to write dirty data when enabling checkpoint back Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Justin M. Forbes, Jaehoon Chung, Kalle Valo

From: Justin M. Forbes <jforbes@fedoraproject.org>

commit 2f32c147a3816d789722c0bd242a9431332ec3ed upstream.

The Samsung Galaxy Book Flex2 Alpha uses an ax201 with the ID a0f0/6074.
This works fine with the existing driver once it knows to claim it.
Simple patch to add the device.

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210702223155.1981510-1-jforbes@fedoraproject.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/wireless/intel/iwlwifi/pcie/drv.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c
@@ -558,6 +558,7 @@ static const struct iwl_dev_info iwl_dev
 	IWL_DEV_INFO(0xA0F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, NULL),
 	IWL_DEV_INFO(0xA0F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0xA0F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL),
+	IWL_DEV_INFO(0xA0F0, 0x6074, iwl_ax201_cfg_qu_hr, NULL),
 	IWL_DEV_INFO(0x02F0, 0x0070, iwl_ax201_cfg_quz_hr, NULL),
 	IWL_DEV_INFO(0x02F0, 0x0074, iwl_ax201_cfg_quz_hr, NULL),
 	IWL_DEV_INFO(0x02F0, 0x6074, iwl_ax201_cfg_quz_hr, NULL),



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 297/334] f2fs: guarantee to write dirty data when enabling checkpoint back
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 296/334] iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns() Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chao Yu, Jaegeuk Kim

From: Jaegeuk Kim <jaegeuk@kernel.org>

commit dddd3d65293a52c2c3850c19b1e5115712e534d8 upstream.

We must flush all the dirty data when enabling checkpoint back. Let's guarantee
that first by adding a retry logic on sync_inodes_sb(). In addition to that,
this patch adds to flush data in fsync when checkpoint is disabled, which can
mitigate the sync_inodes_sb() failures in advance.

Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/f2fs/file.c  |    5 ++---
 fs/f2fs/super.c |   11 ++++++++++-
 2 files changed, 12 insertions(+), 4 deletions(-)

--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -261,8 +261,7 @@ static int f2fs_do_sync_file(struct file
 	};
 	unsigned int seq_id = 0;
 
-	if (unlikely(f2fs_readonly(inode->i_sb) ||
-				is_sbi_flag_set(sbi, SBI_CP_DISABLED)))
+	if (unlikely(f2fs_readonly(inode->i_sb)))
 		return 0;
 
 	trace_f2fs_sync_file_enter(inode);
@@ -276,7 +275,7 @@ static int f2fs_do_sync_file(struct file
 	ret = file_write_and_wait_range(file, start, end);
 	clear_inode_flag(inode, FI_NEED_IPU);
 
-	if (ret) {
+	if (ret || is_sbi_flag_set(sbi, SBI_CP_DISABLED)) {
 		trace_f2fs_sync_file_exit(inode, cp_reason, datasync, ret);
 		return ret;
 	}
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2039,8 +2039,17 @@ restore_flag:
 
 static void f2fs_enable_checkpoint(struct f2fs_sb_info *sbi)
 {
+	int retry = DEFAULT_RETRY_IO_COUNT;
+
 	/* we should flush all the data to keep data consistency */
-	sync_inodes_sb(sbi->sb);
+	do {
+		sync_inodes_sb(sbi->sb);
+		cond_resched();
+		congestion_wait(BLK_RW_ASYNC, DEFAULT_IO_TIMEOUT);
+	} while (get_pages(sbi, F2FS_DIRTY_DATA) && retry--);
+
+	if (unlikely(retry < 0))
+		f2fs_warn(sbi, "checkpoint=enable has some unwritten data.");
 
 	down_write(&sbi->gc_lock);
 	f2fs_dirty_to_prefree(sbi);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 297/334] f2fs: guarantee to write dirty data when enabling checkpoint back Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-15 19:00   ` Arnd Bergmann
  2021-09-13 13:15 ` [PATCH 5.14 299/334] auxdisplay: hd44780: Fix oops on module unloading Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  339 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Hannen, Thomas Gleixner

From: Lukas Hannen <lukas.hannen@opensource.tttech-industrial.com>

commit 39ff83f2f6cc5cc1458dfcea9697f96338210beb upstream.

timespec64_ns() prevents multiplication overflows by comparing the seconds
value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it
returns KTIME_MAX.

But that check casts the signed seconds value to unsigned which makes the
comparision true for all negative values and therefore return wrongly
KTIME_MAX.

Negative second values are perfectly valid and required in some places,
e.g. ptp_clock_adjtime().

Remove the cast and add a check for the negative boundary which is required
to prevent undefined behaviour due to multiplication underflow.

Fixes: cb47755725da ("time: Prevent undefined behaviour in timespec64_to_ns()")'
Signed-off-by: Lukas Hannen <lukas.hannen@opensource.tttech-industrial.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5416.eurprd01.prod.exchangelabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/time64.h |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/include/linux/time64.h
+++ b/include/linux/time64.h
@@ -25,7 +25,9 @@ struct itimerspec64 {
 #define TIME64_MIN			(-TIME64_MAX - 1)
 
 #define KTIME_MAX			((s64)~((u64)1 << 63))
+#define KTIME_MIN			(-KTIME_MAX - 1)
 #define KTIME_SEC_MAX			(KTIME_MAX / NSEC_PER_SEC)
+#define KTIME_SEC_MIN			(KTIME_MIN / NSEC_PER_SEC)
 
 /*
  * Limits for settimeofday():
@@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett
  */
 static inline s64 timespec64_to_ns(const struct timespec64 *ts)
 {
-	/* Prevent multiplication overflow */
-	if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
+	/* Prevent multiplication overflow / underflow */
+	if (ts->tv_sec >= KTIME_SEC_MAX)
 		return KTIME_MAX;
 
+	if (ts->tv_sec <= KTIME_SEC_MIN)
+		return KTIME_MIN;
+
 	return ((s64) ts->tv_sec * NSEC_PER_SEC) + ts->tv_nsec;
 }
 



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 299/334] auxdisplay: hd44780: Fix oops on module unloading
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns() Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 300/334] io_uring: limit fixed table size by RLIMIT_NOFILE Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Lars Poeschel, Miguel Ojeda

From: Lars Poeschel <poeschel@lemonage.de>

commit 333ff32d54cdefc2e479892e7f15ac91e026b57d upstream.

Fixes: 718e05ed92ec ("auxdisplay: Introduce hd44780_common.[ch]")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/lkml/CAHp75VfKyqy+vM0XkP9Yb+znGOTVT4zYCRY3A3nQ7C3WNUVN0g@mail.gmail.com/
Reported-By: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Lars Poeschel <poeschel@lemonage.de>
Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
[added Link, Fixes, Cc stable tags, edited message]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/auxdisplay/hd44780.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/auxdisplay/hd44780.c
+++ b/drivers/auxdisplay/hd44780.c
@@ -323,8 +323,8 @@ static int hd44780_remove(struct platfor
 {
 	struct charlcd *lcd = platform_get_drvdata(pdev);
 
-	kfree(lcd->drvdata);
 	charlcd_unregister(lcd);
+	kfree(lcd->drvdata);
 
 	kfree(lcd);
 	return 0;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 300/334] io_uring: limit fixed table size by RLIMIT_NOFILE
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 299/334] auxdisplay: hd44780: Fix oops on module unloading Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 301/334] io_uring: IORING_OP_WRITE needs hash_reg_file set Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jens Axboe, Pavel Begunkov

From: Pavel Begunkov <asml.silence@gmail.com>

commit 3a1b8a4e843f96b636431450d8d79061605cf74b upstream.

Limit the number of files in io_uring fixed tables by RLIMIT_NOFILE,
that's the first and the simpliest restriction that we should impose.

Cc: stable@vger.kernel.org
Suggested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/b2756c340aed7d6c0b302c26dab50c6c5907f4ce.1629451684.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7722,6 +7722,8 @@ static int io_sqe_files_register(struct
 		return -EINVAL;
 	if (nr_args > IORING_MAX_FIXED_FILES)
 		return -EMFILE;
+	if (nr_args > rlimit(RLIMIT_NOFILE))
+		return -EMFILE;
 	ret = io_rsrc_node_switch_start(ctx);
 	if (ret)
 		return ret;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 301/334] io_uring: IORING_OP_WRITE needs hash_reg_file set
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 300/334] io_uring: limit fixed table size by RLIMIT_NOFILE Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 302/334] io_uring: io_uring_complete() trace should take an integer Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jens Axboe

From: Jens Axboe <axboe@kernel.dk>

commit 7b3188e7ed54102a5dcc73d07727f41fb528f7c8 upstream.

During some testing, it became evident that using IORING_OP_WRITE doesn't
hash buffered writes like the other writes commands do. That's simply
an oversight, and can cause performance regressions when doing buffered
writes with this command.

Correct that and add the flag, so that buffered writes are correctly
hashed when using the non-iovec based write command.

Cc: stable@vger.kernel.org
Fixes: 3a6820f2bb8a ("io_uring: add non-vectored read/write commands")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1001,6 +1001,7 @@ static const struct io_op_def io_op_defs
 	},
 	[IORING_OP_WRITE] = {
 		.needs_file		= 1,
+		.hash_reg_file		= 1,
 		.unbound_nonreg_file	= 1,
 		.pollout		= 1,
 		.plug			= 1,



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 302/334] io_uring: io_uring_complete() trace should take an integer
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 301/334] io_uring: IORING_OP_WRITE needs hash_reg_file set Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 303/334] io_uring: fail links of cancelled timeouts Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jens Axboe

From: Jens Axboe <axboe@kernel.dk>

commit 2fc2a7a62eb58650e71b4550cf6fa6cc0a75b2d2 upstream.

It currently takes a long, and while that's normally OK, the io_uring
limit is an int. Internally in io_uring it's an int, but sometimes it's
passed as a long. That can yield confusing results where a completions
seems to generate a huge result:

ou-sqp-1297-1298    [001] ...1   788.056371: io_uring_complete: ring 000000000e98e046, user_data 0x0, result 4294967171, cflags 0

which is due to -ECANCELED being stored in an unsigned, and then passed
in as a long. Using the right int type, the trace looks correct:

iou-sqp-338-339     [002] ...1    15.633098: io_uring_complete: ring 00000000e0ac60cf, user_data 0x0, result -125, cflags 0

Cc: stable@vger.kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/trace/events/io_uring.h |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/include/trace/events/io_uring.h
+++ b/include/trace/events/io_uring.h
@@ -295,14 +295,14 @@ TRACE_EVENT(io_uring_fail_link,
  */
 TRACE_EVENT(io_uring_complete,
 
-	TP_PROTO(void *ctx, u64 user_data, long res, unsigned cflags),
+	TP_PROTO(void *ctx, u64 user_data, int res, unsigned cflags),
 
 	TP_ARGS(ctx, user_data, res, cflags),
 
 	TP_STRUCT__entry (
 		__field(  void *,	ctx		)
 		__field(  u64,		user_data	)
-		__field(  long,		res		)
+		__field(  int,		res		)
 		__field(  unsigned,	cflags		)
 	),
 
@@ -313,7 +313,7 @@ TRACE_EVENT(io_uring_complete,
 		__entry->cflags		= cflags;
 	),
 
-	TP_printk("ring %p, user_data 0x%llx, result %ld, cflags %x",
+	TP_printk("ring %p, user_data 0x%llx, result %d, cflags %x",
 			  __entry->ctx, (unsigned long long)__entry->user_data,
 			  __entry->res, __entry->cflags)
 );



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 303/334] io_uring: fail links of cancelled timeouts
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 302/334] io_uring: io_uring_complete() trace should take an integer Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 304/334] bio: fix page leak bio_add_hw_page failure Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit 2ae2eb9dde18979b40629dd413b9adbd6c894cdf upstream.

When we cancel a timeout we should mark it with REQ_F_FAIL, so
linked requests are cancelled as well, but not queued for further
execution.

Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/fff625b44eeced3a5cae79f60e6acf3fbdf8f990.1631192135.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io_uring.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1329,6 +1329,8 @@ static void io_kill_timeout(struct io_ki
 	struct io_timeout_data *io = req->async_data;
 
 	if (hrtimer_try_to_cancel(&io->timer) != -1) {
+		if (status)
+			req_set_fail(req);
 		atomic_set(&req->ctx->cq_timeouts,
 			atomic_read(&req->ctx->cq_timeouts) + 1);
 		list_del_init(&req->timeout.list);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 304/334] bio: fix page leak bio_add_hw_page failure
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 303/334] io_uring: fail links of cancelled timeouts Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:15 ` [PATCH 5.14 305/334] raid1: ensure write behind bio has less than BIO_MAX_VECS sectors Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Begunkov, Jens Axboe

From: Pavel Begunkov <asml.silence@gmail.com>

commit d9cf3bd531844ffbfe94b16e417037a16efc988d upstream.

__bio_iov_append_get_pages() doesn't put not appended pages on
bio_add_hw_page() failure, so potentially leaking them, fix it. Also, do
the same for __bio_iov_iter_get_pages(), even though it looks like it
can't be triggered by userspace in this case.

Fixes: 0512a75b98f8 ("block: Introduce REQ_OP_ZONE_APPEND")
Cc: stable@vger.kernel.org # 5.8+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/1edfa6a2ffd66d55e6345a477df5387d2c1415d0.1626653825.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 block/bio.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/block/bio.c
+++ b/block/bio.c
@@ -979,6 +979,14 @@ static int bio_iov_bvec_set_append(struc
 	return 0;
 }
 
+static void bio_put_pages(struct page **pages, size_t size, size_t off)
+{
+	size_t i, nr = DIV_ROUND_UP(size + (off & ~PAGE_MASK), PAGE_SIZE);
+
+	for (i = 0; i < nr; i++)
+		put_page(pages[i]);
+}
+
 #define PAGE_PTRS_PER_BVEC     (sizeof(struct bio_vec) / sizeof(struct page *))
 
 /**
@@ -1023,8 +1031,10 @@ static int __bio_iov_iter_get_pages(stru
 			if (same_page)
 				put_page(page);
 		} else {
-			if (WARN_ON_ONCE(bio_full(bio, len)))
-                                return -EINVAL;
+			if (WARN_ON_ONCE(bio_full(bio, len))) {
+				bio_put_pages(pages + i, left, offset);
+				return -EINVAL;
+			}
 			__bio_add_page(bio, page, len, offset);
 		}
 		offset = 0;
@@ -1069,6 +1079,7 @@ static int __bio_iov_append_get_pages(st
 		len = min_t(size_t, PAGE_SIZE - offset, left);
 		if (bio_add_hw_page(q, bio, page, len, offset,
 				max_append_sectors, &same_page) != len) {
+			bio_put_pages(pages + i, left, offset);
 			ret = -EINVAL;
 			break;
 		}



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 305/334] raid1: ensure write behind bio has less than BIO_MAX_VECS sectors
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 304/334] bio: fix page leak bio_add_hw_page failure Greg Kroah-Hartman
@ 2021-09-13 13:15 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 306/334] cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:15 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jens Stutte, Christoph Hellwig,
	Guoqing Jiang, Song Liu

From: Guoqing Jiang <jiangguoqing@kylinos.cn>

commit 6607cd319b6b91bff94e90f798a61c031650b514 upstream.

We can't split write behind bio with more than BIO_MAX_VECS sectors,
otherwise the below call trace was triggered because we could allocate
oversized write behind bio later.

[ 8.097936] bvec_alloc+0x90/0xc0
[ 8.098934] bio_alloc_bioset+0x1b3/0x260
[ 8.099959] raid1_make_request+0x9ce/0xc50 [raid1]
[ 8.100988] ? __bio_clone_fast+0xa8/0xe0
[ 8.102008] md_handle_request+0x158/0x1d0 [md_mod]
[ 8.103050] md_submit_bio+0xcd/0x110 [md_mod]
[ 8.104084] submit_bio_noacct+0x139/0x530
[ 8.105127] submit_bio+0x78/0x1d0
[ 8.106163] ext4_io_submit+0x48/0x60 [ext4]
[ 8.107242] ext4_writepages+0x652/0x1170 [ext4]
[ 8.108300] ? do_writepages+0x41/0x100
[ 8.109338] ? __ext4_mark_inode_dirty+0x240/0x240 [ext4]
[ 8.110406] do_writepages+0x41/0x100
[ 8.111450] __filemap_fdatawrite_range+0xc5/0x100
[ 8.112513] file_write_and_wait_range+0x61/0xb0
[ 8.113564] ext4_sync_file+0x73/0x370 [ext4]
[ 8.114607] __x64_sys_fsync+0x33/0x60
[ 8.115635] do_syscall_64+0x33/0x40
[ 8.116670] entry_SYSCALL_64_after_hwframe+0x44/0xae

Thanks for the comment from Christoph.

[1]. https://bugs.archlinux.org/task/70992

Cc: stable@vger.kernel.org # v5.12+
Reported-by: Jens Stutte <jens@chianterastutte.eu>
Tested-by: Jens Stutte <jens@chianterastutte.eu>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Guoqing Jiang <jiangguoqing@kylinos.cn>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid1.c |   19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1329,6 +1329,7 @@ static void raid1_write_request(struct m
 	struct raid1_plug_cb *plug = NULL;
 	int first_clone;
 	int max_sectors;
+	bool write_behind = false;
 
 	if (mddev_is_clustered(mddev) &&
 	     md_cluster_ops->area_resyncing(mddev, WRITE,
@@ -1381,6 +1382,15 @@ static void raid1_write_request(struct m
 	max_sectors = r1_bio->sectors;
 	for (i = 0;  i < disks; i++) {
 		struct md_rdev *rdev = rcu_dereference(conf->mirrors[i].rdev);
+
+		/*
+		 * The write-behind io is only attempted on drives marked as
+		 * write-mostly, which means we could allocate write behind
+		 * bio later.
+		 */
+		if (rdev && test_bit(WriteMostly, &rdev->flags))
+			write_behind = true;
+
 		if (rdev && unlikely(test_bit(Blocked, &rdev->flags))) {
 			atomic_inc(&rdev->nr_pending);
 			blocked_rdev = rdev;
@@ -1454,6 +1464,15 @@ static void raid1_write_request(struct m
 		goto retry_write;
 	}
 
+	/*
+	 * When using a bitmap, we may call alloc_behind_master_bio below.
+	 * alloc_behind_master_bio allocates a copy of the data payload a page
+	 * at a time and thus needs a new bio that can fit the whole payload
+	 * this bio in page sized chunks.
+	 */
+	if (write_behind && bitmap)
+		max_sectors = min_t(int, max_sectors,
+				    BIO_MAX_VECS * (PAGE_SIZE >> 9));
 	if (max_sectors < bio_sectors(bio)) {
 		struct bio *split = bio_split(bio, max_sectors,
 					      GFP_NOIO, &conf->bio_split);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 306/334] cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2021-09-13 13:15 ` [PATCH 5.14 305/334] raid1: ensure write behind bio has less than BIO_MAX_VECS sectors Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 307/334] smb3: fix posix extensions mount option Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiaoli Feng, Ronnie Sahlberg, Steve French

From: Ronnie Sahlberg <lsahlber@redhat.com>

commit 3998f0b8bc49ec784990971dc1f16bf367b19078 upstream.

RHBZ: 1994393

If we hit a STATUS_USER_SESSION_DELETED for the Create part in the
Create/QueryDirectory compound that starts a directory scan
we will leak EDEADLK back to userspace and surprise glibc and the application.

Pick this up initiate_cifs_search() and retry a small number of tries before we
return an error to userspace.

Cc: stable@vger.kernel.org
Reported-by: Xiaoli Feng <xifeng@redhat.com>
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/readdir.c |   23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -369,7 +369,7 @@ int get_symlink_reparse_path(char *full_
  */
 
 static int
-initiate_cifs_search(const unsigned int xid, struct file *file,
+_initiate_cifs_search(const unsigned int xid, struct file *file,
 		     const char *full_path)
 {
 	__u16 search_flags;
@@ -451,6 +451,27 @@ error_exit:
 	return rc;
 }
 
+static int
+initiate_cifs_search(const unsigned int xid, struct file *file,
+		     const char *full_path)
+{
+	int rc, retry_count = 0;
+
+	do {
+		rc = _initiate_cifs_search(xid, file, full_path);
+		/*
+		 * If we don't have enough credits to start reading the
+		 * directory just try again after short wait.
+		 */
+		if (rc != -EDEADLK)
+			break;
+
+		usleep_range(512, 2048);
+	} while (retry_count++ < 5);
+
+	return rc;
+}
+
 /* return length of unicode string in bytes */
 static int cifs_unicode_bytelen(const char *str)
 {



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 307/334] smb3: fix posix extensions mount option
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 306/334] cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 308/334] tty: Fix data race between tiocsti() and flush_to_ldisc() Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Brauner, Namjae Jeon, Steve French

From: Steve French <stfrench@microsoft.com>

commit 7321be2663da5922343cc121f1ff04924cee2e76 upstream.

We were incorrectly initializing the posix extensions in the
conversion to the new mount API.

CC: <stable@vger.kernel.org> # 5.11+
Reported-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Suggested-by: Namjae Jeon <namjae.jeon@samsung.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/cifs/fs_context.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/fs/cifs/fs_context.c
+++ b/fs/cifs/fs_context.c
@@ -1266,10 +1266,17 @@ static int smb3_fs_context_parse_param(s
 			ctx->posix_paths = 1;
 		break;
 	case Opt_unix:
-		if (result.negated)
+		if (result.negated) {
+			if (ctx->linux_ext == 1)
+				pr_warn_once("conflicting posix mount options specified\n");
 			ctx->linux_ext = 0;
-		else
 			ctx->no_linux_ext = 1;
+		} else {
+			if (ctx->no_linux_ext == 1)
+				pr_warn_once("conflicting posix mount options specified\n");
+			ctx->linux_ext = 1;
+			ctx->no_linux_ext = 0;
+		}
 		break;
 	case Opt_nocase:
 		ctx->nocase = 1;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 308/334] tty: Fix data race between tiocsti() and flush_to_ldisc()
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 307/334] smb3: fix posix extensions mount option Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 309/334] perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+97388eb9d31b997fe1d0,
	Jiri Slaby, Nguyen Dinh Phi

From: Nguyen Dinh Phi <phind.uet@gmail.com>

commit bb2853a6a421a052268eee00fd5d3f6b3504b2b1 upstream.

The ops->receive_buf() may be accessed concurrently from these two
functions.  If the driver flushes data to the line discipline
receive_buf() method while tiocsti() is waiting for the
ops->receive_buf() to finish its work, the data race will happen.

For example:
tty_ioctl			|tty_ldisc_receive_buf
 ->tioctsi			| ->tty_port_default_receive_buf
				|  ->tty_ldisc_receive_buf
   ->hci_uart_tty_receive	|   ->hci_uart_tty_receive
    ->h4_recv                   |    ->h4_recv

In this case, the h4 receive buffer will be overwritten by the
latecomer, and we will lost the data.

Hence, change tioctsi() function to use the exclusive lock interface
from tty_buffer to avoid the data race.

Reported-by: syzbot+97388eb9d31b997fe1d0@syzkaller.appspotmail.com
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Link: https://lore.kernel.org/r/20210823000641.2082292-1-phind.uet@gmail.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/tty/tty_io.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2290,8 +2290,6 @@ static int tty_fasync(int fd, struct fil
  *	Locking:
  *		Called functions take tty_ldiscs_lock
  *		current->signal->tty check is safe without locks
- *
- *	FIXME: may race normal receive processing
  */
 
 static int tiocsti(struct tty_struct *tty, char __user *p)
@@ -2307,8 +2305,10 @@ static int tiocsti(struct tty_struct *tt
 	ld = tty_ldisc_ref_wait(tty);
 	if (!ld)
 		return -EIO;
+	tty_buffer_lock_exclusive(tty->port);
 	if (ld->ops->receive_buf)
 		ld->ops->receive_buf(tty, &ch, &mbz, 1);
+	tty_buffer_unlock_exclusive(tty->port);
 	tty_ldisc_deref(ld);
 	return 0;
 }



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 309/334] perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 308/334] tty: Fix data race between tiocsti() and flush_to_ldisc() Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 310/334] Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Antonov,
	Peter Zijlstra (Intel),
	Kan Liang

From: Alexander Antonov <alexander.antonov@linux.intel.com>

commit 3f2cbe3810a60111a33f5f6267bd5a237b826fc9 upstream.

skx_iio_cleanup_mapping() is re-used for snr and icx, but in those
cases it fails to use the appropriate XXX_iio_mapping_group and as
such fails to free previously allocated resources, leading to memory
leaks.

Fixes: 10337e95e04c ("perf/x86/intel/uncore: Enable I/O stacks to IIO PMON mapping on ICX")
Signed-off-by: Alexander Antonov <alexander.antonov@linux.intel.com>
[peterz: Changelog]
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210706090723.41850-1-alexander.antonov@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/events/intel/uncore_snbep.c |   40 ++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 12 deletions(-)

--- a/arch/x86/events/intel/uncore_snbep.c
+++ b/arch/x86/events/intel/uncore_snbep.c
@@ -3838,26 +3838,32 @@ clear_attr_update:
 	return ret;
 }
 
-static int skx_iio_set_mapping(struct intel_uncore_type *type)
-{
-	return pmu_iio_set_mapping(type, &skx_iio_mapping_group);
-}
-
-static void skx_iio_cleanup_mapping(struct intel_uncore_type *type)
+static void
+pmu_iio_cleanup_mapping(struct intel_uncore_type *type, struct attribute_group *ag)
 {
-	struct attribute **attr = skx_iio_mapping_group.attrs;
+	struct attribute **attr = ag->attrs;
 
 	if (!attr)
 		return;
 
 	for (; *attr; attr++)
 		kfree((*attr)->name);
-	kfree(attr_to_ext_attr(*skx_iio_mapping_group.attrs));
-	kfree(skx_iio_mapping_group.attrs);
-	skx_iio_mapping_group.attrs = NULL;
+	kfree(attr_to_ext_attr(*ag->attrs));
+	kfree(ag->attrs);
+	ag->attrs = NULL;
 	kfree(type->topology);
 }
 
+static int skx_iio_set_mapping(struct intel_uncore_type *type)
+{
+	return pmu_iio_set_mapping(type, &skx_iio_mapping_group);
+}
+
+static void skx_iio_cleanup_mapping(struct intel_uncore_type *type)
+{
+	pmu_iio_cleanup_mapping(type, &skx_iio_mapping_group);
+}
+
 static struct intel_uncore_type skx_uncore_iio = {
 	.name			= "iio",
 	.num_counters		= 4,
@@ -4501,6 +4507,11 @@ static int snr_iio_set_mapping(struct in
 	return pmu_iio_set_mapping(type, &snr_iio_mapping_group);
 }
 
+static void snr_iio_cleanup_mapping(struct intel_uncore_type *type)
+{
+	pmu_iio_cleanup_mapping(type, &snr_iio_mapping_group);
+}
+
 static struct intel_uncore_type snr_uncore_iio = {
 	.name			= "iio",
 	.num_counters		= 4,
@@ -4517,7 +4528,7 @@ static struct intel_uncore_type snr_unco
 	.attr_update		= snr_iio_attr_update,
 	.get_topology		= snr_iio_get_topology,
 	.set_mapping		= snr_iio_set_mapping,
-	.cleanup_mapping	= skx_iio_cleanup_mapping,
+	.cleanup_mapping	= snr_iio_cleanup_mapping,
 };
 
 static struct intel_uncore_type snr_uncore_irp = {
@@ -5092,6 +5103,11 @@ static int icx_iio_set_mapping(struct in
 	return pmu_iio_set_mapping(type, &icx_iio_mapping_group);
 }
 
+static void icx_iio_cleanup_mapping(struct intel_uncore_type *type)
+{
+	pmu_iio_cleanup_mapping(type, &icx_iio_mapping_group);
+}
+
 static struct intel_uncore_type icx_uncore_iio = {
 	.name			= "iio",
 	.num_counters		= 4,
@@ -5109,7 +5125,7 @@ static struct intel_uncore_type icx_unco
 	.attr_update		= icx_iio_attr_update,
 	.get_topology		= icx_iio_get_topology,
 	.set_mapping		= icx_iio_set_mapping,
-	.cleanup_mapping	= skx_iio_cleanup_mapping,
+	.cleanup_mapping	= icx_iio_cleanup_mapping,
 };
 
 static struct intel_uncore_type icx_uncore_irp = {



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 310/334] Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()"
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 309/334] perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 311/334] KVM: s390: index kvm->arch.idle_mask by vcpu_idx Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+200c08e88ae818f849ce,
	Sean Christopherson, Vitaly Kuznetsov, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit e7177339d7b5f9594b316842122b5fda9513d5e2 upstream.

Revert a misguided illegal GPA check when "translating" a non-nested GPA.
The check is woefully incomplete as it does not fill in @exception as
expected by all callers, which leads to KVM attempting to inject a bogus
exception, potentially exposing kernel stack information in the process.

 WARNING: CPU: 0 PID: 8469 at arch/x86/kvm/x86.c:525 exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525
 CPU: 1 PID: 8469 Comm: syz-executor531 Not tainted 5.14.0-rc7-syzkaller #0
 RIP: 0010:exception_type+0x98/0xb0 arch/x86/kvm/x86.c:525
 Call Trace:
  x86_emulate_instruction+0xef6/0x1460 arch/x86/kvm/x86.c:7853
  kvm_mmu_page_fault+0x2f0/0x1810 arch/x86/kvm/mmu/mmu.c:5199
  handle_ept_misconfig+0xdf/0x3e0 arch/x86/kvm/vmx/vmx.c:5336
  __vmx_handle_exit arch/x86/kvm/vmx/vmx.c:6021 [inline]
  vmx_handle_exit+0x336/0x1800 arch/x86/kvm/vmx/vmx.c:6038
  vcpu_enter_guest+0x2a1c/0x4430 arch/x86/kvm/x86.c:9712
  vcpu_run arch/x86/kvm/x86.c:9779 [inline]
  kvm_arch_vcpu_ioctl_run+0x47d/0x1b20 arch/x86/kvm/x86.c:10010
  kvm_vcpu_ioctl+0x49e/0xe50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3652

The bug has escaped notice because practically speaking the GPA check is
useless.  The GPA check in question only comes into play when KVM is
walking guest page tables (or "translating" CR3), and KVM already handles
illegal GPA checks by setting reserved bits in rsvd_bits_mask for each
PxE, or in the case of CR3 for loading PTDPTRs, manually checks for an
illegal CR3.  This particular failure doesn't hit the existing reserved
bits checks because syzbot sets guest.MAXPHYADDR=1, and IA32 architecture
simply doesn't allow for such an absurd MAXPHYADDR, e.g. 32-bit paging
doesn't define any reserved PA bits checks, which KVM emulates by only
incorporating the reserved PA bits into the "high" bits, i.e. bits 63:32.

Simply remove the bogus check.  There is zero meaningful value and no
architectural justification for supporting guest.MAXPHYADDR < 32, and
properly filling the exception would introduce non-trivial complexity.

This reverts commit ec7771ab471ba6a945350353617e2e3385d0e013.

Fixes: ec7771ab471b ("KVM: x86: mmu: Add guest physical address check in translate_gpa()")
Cc: stable@vger.kernel.org
Reported-by: syzbot+200c08e88ae818f849ce@syzkaller.appspotmail.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210831164224.1119728-2-seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c |    6 ------
 1 file changed, 6 deletions(-)

--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -323,12 +323,6 @@ static bool check_mmio_spte(struct kvm_v
 static gpa_t translate_gpa(struct kvm_vcpu *vcpu, gpa_t gpa, u32 access,
                                   struct x86_exception *exception)
 {
-	/* Check if guest physical address doesn't exceed guest maximum */
-	if (kvm_vcpu_is_illegal_gpa(vcpu, gpa)) {
-		exception->error_code |= PFERR_RSVD_MASK;
-		return UNMAPPED_GVA;
-	}
-
         return gpa;
 }
 



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 311/334] KVM: s390: index kvm->arch.idle_mask by vcpu_idx
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 310/334] Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 312/334] KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Halil Pasic,
	Christian Bornträger, Claudio Imbrenda

From: Halil Pasic <pasic@linux.ibm.com>

commit a3e03bc1368c1bc16e19b001fc96dc7430573cc8 upstream.

While in practice vcpu->vcpu_idx ==  vcpu->vcp_id is often true, it may
not always be, and we must not rely on this. Reason is that KVM decides
the vcpu_idx, userspace decides the vcpu_id, thus the two might not
match.

Currently kvm->arch.idle_mask is indexed by vcpu_id, which implies
that code like
for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) {
                vcpu = kvm_get_vcpu(kvm, vcpu_id);
		do_stuff(vcpu);
}
is not legit. Reason is that kvm_get_vcpu expects an vcpu_idx, not an
vcpu_id.  The trouble is, we do actually use kvm->arch.idle_mask like
this. To fix this problem we have two options. Either use
kvm_get_vcpu_by_id(vcpu_id), which would loop to find the right vcpu_id,
or switch to indexing via vcpu_idx. The latter is preferable for obvious
reasons.

Let us make switch from indexing kvm->arch.idle_mask by vcpu_id to
indexing it by vcpu_idx.  To keep gisa_int.kicked_mask indexed by the
same index as idle_mask lets make the same change for it as well.

Fixes: 1ee0bc559dc3 ("KVM: s390: get rid of local_int array")
Signed-off-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Christian Bornträger <borntraeger@de.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Cc: <stable@vger.kernel.org> # 3.15+
Link: https://lore.kernel.org/r/20210827125429.1912577-1-pasic@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/s390/include/asm/kvm_host.h |    1 +
 arch/s390/kvm/interrupt.c        |   12 ++++++------
 arch/s390/kvm/kvm-s390.c         |    2 +-
 arch/s390/kvm/kvm-s390.h         |    2 +-
 4 files changed, 9 insertions(+), 8 deletions(-)

--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -957,6 +957,7 @@ struct kvm_arch{
 	atomic64_t cmma_dirty_pages;
 	/* subset of available cpu features enabled by user space */
 	DECLARE_BITMAP(cpu_feat, KVM_S390_VM_CPU_FEAT_NR_BITS);
+	/* indexed by vcpu_idx */
 	DECLARE_BITMAP(idle_mask, KVM_MAX_VCPUS);
 	struct kvm_s390_gisa_interrupt gisa_int;
 	struct kvm_s390_pv pv;
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -419,13 +419,13 @@ static unsigned long deliverable_irqs(st
 static void __set_cpu_idle(struct kvm_vcpu *vcpu)
 {
 	kvm_s390_set_cpuflags(vcpu, CPUSTAT_WAIT);
-	set_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
+	set_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);
 }
 
 static void __unset_cpu_idle(struct kvm_vcpu *vcpu)
 {
 	kvm_s390_clear_cpuflags(vcpu, CPUSTAT_WAIT);
-	clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
+	clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);
 }
 
 static void __reset_intercept_indicators(struct kvm_vcpu *vcpu)
@@ -3050,18 +3050,18 @@ int kvm_s390_get_irq_state(struct kvm_vc
 
 static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
 {
-	int vcpu_id, online_vcpus = atomic_read(&kvm->online_vcpus);
+	int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
 	struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
 	struct kvm_vcpu *vcpu;
 
-	for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) {
-		vcpu = kvm_get_vcpu(kvm, vcpu_id);
+	for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
+		vcpu = kvm_get_vcpu(kvm, vcpu_idx);
 		if (psw_ioint_disabled(vcpu))
 			continue;
 		deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
 		if (deliverable_mask) {
 			/* lately kicked but not yet running */
-			if (test_and_set_bit(vcpu_id, gi->kicked_mask))
+			if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
 				return;
 			kvm_s390_vcpu_wakeup(vcpu);
 			return;
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -4044,7 +4044,7 @@ static int vcpu_pre_run(struct kvm_vcpu
 		kvm_s390_patch_guest_per_regs(vcpu);
 	}
 
-	clear_bit(vcpu->vcpu_id, vcpu->kvm->arch.gisa_int.kicked_mask);
+	clear_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.gisa_int.kicked_mask);
 
 	vcpu->arch.sie_block->icptcode = 0;
 	cpuflags = atomic_read(&vcpu->arch.sie_block->cpuflags);
--- a/arch/s390/kvm/kvm-s390.h
+++ b/arch/s390/kvm/kvm-s390.h
@@ -79,7 +79,7 @@ static inline int is_vcpu_stopped(struct
 
 static inline int is_vcpu_idle(struct kvm_vcpu *vcpu)
 {
-	return test_bit(vcpu->vcpu_id, vcpu->kvm->arch.idle_mask);
+	return test_bit(kvm_vcpu_get_idx(vcpu), vcpu->kvm->arch.idle_mask);
 }
 
 static inline int kvm_is_ucontrol(struct kvm *kvm)



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 312/334] KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 311/334] KVM: s390: index kvm->arch.idle_mask by vcpu_idx Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 313/334] KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zelin Deng, Paolo Bonzini

From: Zelin Deng <zelin.deng@linux.alibaba.com>

commit d9130a2dfdd4b21736c91b818f87dbc0ccd1e757 upstream.

When MSR_IA32_TSC_ADJUST is written by guest due to TSC ADJUST feature
especially there's a big tsc warp (like a new vCPU is hot-added into VM
which has been up for a long time), tsc_offset is added by a large value
then go back to guest. This causes system time jump as tsc_timestamp is
not adjusted in the meantime and pvclock monotonic character.
To fix this, just notify kvm to update vCPU's guest time before back to
guest.

Cc: stable@vger.kernel.org
Signed-off-by: Zelin Deng <zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <1619576521-81399-2-git-send-email-zelin.deng@linux.alibaba.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/x86.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3316,6 +3316,10 @@ int kvm_set_msr_common(struct kvm_vcpu *
 			if (!msr_info->host_initiated) {
 				s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr;
 				adjust_tsc_offset_guest(vcpu, adj);
+				/* Before back to guest, tsc_timestamp must be adjusted
+				 * as well, otherwise guest's percpu pvclock time could jump.
+				 */
+				kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
 			}
 			vcpu->arch.ia32_tsc_adjust_msr = data;
 		}



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 313/334] KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 312/334] KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 314/334] KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paolo Bonzini

From: Paolo Bonzini <pbonzini@redhat.com>

commit ec607a564f70519b340f7eb4cfc0f4a6b55285ac upstream.

This change started as a way to make kvm_mmu_hugepage_adjust a bit simpler,
but it does fix two bugs as well.

One bug is in zapping collapsible PTEs.  If a large page size is
disallowed but not all of them, kvm_mmu_max_mapping_level will return the
host mapping level and the small PTEs will be zapped up to that level.
However, if e.g. 1GB are prohibited, we can still zap 4KB mapping and
preserve the 2MB ones. This can happen for example when NX huge pages
are in use.

The second would happen when userspace backs guest memory
with a 1gb hugepage but only assign a subset of the page to
the guest.  1gb pages would be disallowed by the memslot, but
not 2mb.  kvm_mmu_max_mapping_level() would fall through to the
host_pfn_mapping_level() logic, see the 1gb hugepage, and map the whole
thing into the guest.

Fixes: 2f57b7051fe8 ("KVM: x86/mmu: Persist gfn_lpage_is_disallowed() to max_level")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/mmu.c |   13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2846,6 +2846,7 @@ int kvm_mmu_max_mapping_level(struct kvm
 			      kvm_pfn_t pfn, int max_level)
 {
 	struct kvm_lpage_info *linfo;
+	int host_level;
 
 	max_level = min(max_level, max_huge_page_level);
 	for ( ; max_level > PG_LEVEL_4K; max_level--) {
@@ -2857,7 +2858,8 @@ int kvm_mmu_max_mapping_level(struct kvm
 	if (max_level == PG_LEVEL_4K)
 		return PG_LEVEL_4K;
 
-	return host_pfn_mapping_level(kvm, gfn, pfn, slot);
+	host_level = host_pfn_mapping_level(kvm, gfn, pfn, slot);
+	return min(host_level, max_level);
 }
 
 int kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, gfn_t gfn,
@@ -2881,17 +2883,12 @@ int kvm_mmu_hugepage_adjust(struct kvm_v
 	if (!slot)
 		return PG_LEVEL_4K;
 
-	level = kvm_mmu_max_mapping_level(vcpu->kvm, slot, gfn, pfn, max_level);
-	if (level == PG_LEVEL_4K)
-		return level;
-
-	*req_level = level = min(level, max_level);
-
 	/*
 	 * Enforce the iTLB multihit workaround after capturing the requested
 	 * level, which will be used to do precise, accurate accounting.
 	 */
-	if (huge_page_disallowed)
+	*req_level = level = kvm_mmu_max_mapping_level(vcpu->kvm, slot, gfn, pfn, max_level);
+	if (level == PG_LEVEL_4K || huge_page_disallowed)
 		return PG_LEVEL_4K;
 
 	/*



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 314/334] KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 313/334] KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 315/334] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Matlack, Ben Gardon,
	Sean Christopherson, Mingwei Zhang, Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit 088acd23526647844aec1c39db4ad02552c86c7b upstream.

Factor in whether or not the old/new SPTEs are shadow-present when
adjusting the large page stats in the TDP MMU.  A modified MMIO SPTE can
toggle the page size bit, as bit 7 is used to store the MMIO generation,
i.e. is_large_pte() can get a false positive when called on a MMIO SPTE.
Ditto for nuking SPTEs with REMOVED_SPTE, which sets bit 7 in its magic
value.

Opportunistically move the logic below the check to verify at least one
of the old/new SPTEs is shadow present.

Use is/was_leaf even though is/was_present would suffice.  The code
generation is roughly equivalent since all flags need to be computed
prior to the code in question, and using the *_leaf flags will minimize
the diff in a future enhancement to account all pages, i.e. will change
the check to "is_leaf != was_leaf".

Reviewed-by: David Matlack <dmatlack@google.com>
Reviewed-by: Ben Gardon <bgardon@google.com>

Fixes: 1699f65c8b65 ("kvm/x86: Fix 'lpages' kvm stat for TDM MMU")
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Mingwei Zhang <mizhang@google.com>
Message-Id: <20210803044607.599629-3-mizhang@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/mmu/tdp_mmu.c |   20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

--- a/arch/x86/kvm/mmu/tdp_mmu.c
+++ b/arch/x86/kvm/mmu/tdp_mmu.c
@@ -412,6 +412,7 @@ static void __handle_changed_spte(struct
 	bool was_leaf = was_present && is_last_spte(old_spte, level);
 	bool is_leaf = is_present && is_last_spte(new_spte, level);
 	bool pfn_changed = spte_to_pfn(old_spte) != spte_to_pfn(new_spte);
+	bool was_large, is_large;
 
 	WARN_ON(level > PT64_ROOT_MAX_LEVEL);
 	WARN_ON(level < PG_LEVEL_4K);
@@ -445,13 +446,6 @@ static void __handle_changed_spte(struct
 
 	trace_kvm_tdp_mmu_spte_changed(as_id, gfn, level, old_spte, new_spte);
 
-	if (is_large_pte(old_spte) != is_large_pte(new_spte)) {
-		if (is_large_pte(old_spte))
-			atomic64_sub(1, (atomic64_t*)&kvm->stat.lpages);
-		else
-			atomic64_add(1, (atomic64_t*)&kvm->stat.lpages);
-	}
-
 	/*
 	 * The only times a SPTE should be changed from a non-present to
 	 * non-present state is when an MMIO entry is installed/modified/
@@ -477,6 +471,18 @@ static void __handle_changed_spte(struct
 		return;
 	}
 
+	/*
+	 * Update large page stats if a large page is being zapped, created, or
+	 * is replacing an existing shadow page.
+	 */
+	was_large = was_leaf && is_large_pte(old_spte);
+	is_large = is_leaf && is_large_pte(new_spte);
+	if (was_large != is_large) {
+		if (was_large)
+			atomic64_sub(1, (atomic64_t *)&kvm->stat.lpages);
+		else
+			atomic64_add(1, (atomic64_t *)&kvm->stat.lpages);
+	}
 
 	if (was_leaf && is_dirty_spte(old_spte) &&
 	    (!is_present || !is_dirty_spte(new_spte) || pfn_changed))



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 315/334] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (313 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 314/334] KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 316/334] KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Maxim Levitsky, Paolo Bonzini

From: Maxim Levitsky <mlevitsk@redhat.com>

commit 81b4b56d4f8130bbb99cf4e2b48082e5b4cfccb9 upstream.

If we are emulating an invalid guest state, we don't have a correct
exit reason, and thus we shouldn't do anything in this function.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20210826095750.1650467-2-mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Fixes: 95b5a48c4f2b ("KVM: VMX: Handle NMIs, #MCs and async #PFs in common irqs-disabled fn", 2019-06-18)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/vmx.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -6368,6 +6368,9 @@ static void vmx_handle_exit_irqoff(struc
 {
 	struct vcpu_vmx *vmx = to_vmx(vcpu);
 
+	if (vmx->emulation_required)
+		return;
+
 	if (vmx->exit_reason.basic == EXIT_REASON_EXTERNAL_INTERRUPT)
 		handle_external_interrupt_irqoff(vcpu);
 	else if (vmx->exit_reason.basic == EXIT_REASON_EXCEPTION_NMI)



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 316/334] KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (314 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 315/334] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 317/334] KVM: arm64: Unregister HYP sections from kmemleak in protected mode Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jim Mattson, Sean Christopherson,
	Paolo Bonzini

From: Sean Christopherson <seanjc@google.com>

commit f7782bb8d818d8f47c26b22079db10599922787a upstream.

Clear nested.pi_pending on nested VM-Enter even if L2 will run without
posted interrupts enabled.  If nested.pi_pending is left set from a
previous L2, vmx_complete_nested_posted_interrupt() will pick up the
stale flag and exit to userspace with an "internal emulation error" due
the new L2 not having a valid nested.pi_desc.

Arguably, vmx_complete_nested_posted_interrupt() should first check for
posted interrupts being enabled, but it's also completely reasonable that
KVM wouldn't screw up a fundamental flag.  Not to mention that the mere
existence of nested.pi_pending is a long-standing bug as KVM shouldn't
move the posted interrupt out of the IRR until it's actually processed,
e.g. KVM effectively drops an interrupt when it performs a nested VM-Exit
with a "pending" posted interrupt.  Fixing the mess is a future problem.

Prior to vmx_complete_nested_posted_interrupt() interpreting a null PI
descriptor as an error, this was a benign bug as the null PI descriptor
effectively served as a check on PI not being enabled.  Even then, the
new flow did not become problematic until KVM started checking the result
of kvm_check_nested_events().

Fixes: 705699a13994 ("KVM: nVMX: Enable nested posted interrupt processing")
Fixes: 966eefb89657 ("KVM: nVMX: Disable vmcs02 posted interrupts if vmcs12 PID isn't mappable")
Fixes: 47d3530f86c0 ("KVM: x86: Exit to userspace when kvm_check_nested_events fails")
Cc: stable@vger.kernel.org
Cc: Jim Mattson <jmattson@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-Id: <20210810144526.2662272-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/x86/kvm/vmx/nested.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -2223,12 +2223,11 @@ static void prepare_vmcs02_early(struct
 			 ~PIN_BASED_VMX_PREEMPTION_TIMER);
 
 	/* Posted interrupts setting is only taken from vmcs12.  */
-	if (nested_cpu_has_posted_intr(vmcs12)) {
+	vmx->nested.pi_pending = false;
+	if (nested_cpu_has_posted_intr(vmcs12))
 		vmx->nested.posted_intr_nv = vmcs12->posted_intr_nv;
-		vmx->nested.pi_pending = false;
-	} else {
+	else
 		exec_control &= ~PIN_BASED_POSTED_INTR;
-	}
 	pin_controls_set(vmx, exec_control);
 
 	/*



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 317/334] KVM: arm64: Unregister HYP sections from kmemleak in protected mode
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (315 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 316/334] KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 318/334] KVM: arm64: vgic: Resample HW pending state on deactivation Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Quentin Perret, Catalin Marinas,
	Marc Zyngier

From: Marc Zyngier <maz@kernel.org>

commit 47e6223c841e029bfc23c3ce594dac5525cebaf8 upstream.

Booting a KVM host in protected mode with kmemleak quickly results
in a pretty bad crash, as kmemleak doesn't know that the HYP sections
have been taken away. This is specially true for the BSS section,
which is part of the kernel BSS section and registered at boot time
by kmemleak itself.

Unregister the HYP part of the BSS before making that section
HYP-private. The rest of the HYP-specific data is obtained via
the page allocator or lives in other sections, none of which is
subjected to kmemleak.

Fixes: 90134ac9cabb ("KVM: arm64: Protect the .hyp sections from the host")
Reviewed-by: Quentin Perret <qperret@google.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org # 5.13
Link: https://lore.kernel.org/r/20210802123830.2195174-3-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/arm.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -15,6 +15,7 @@
 #include <linux/fs.h>
 #include <linux/mman.h>
 #include <linux/sched.h>
+#include <linux/kmemleak.h>
 #include <linux/kvm.h>
 #include <linux/kvm_irqfd.h>
 #include <linux/irqbypass.h>
@@ -1986,6 +1987,12 @@ static int finalize_hyp_mode(void)
 	if (ret)
 		return ret;
 
+	/*
+	 * Exclude HYP BSS from kmemleak so that it doesn't get peeked
+	 * at, which would end badly once the section is inaccessible.
+	 * None of other sections should ever be introspected.
+	 */
+	kmemleak_free_part(__hyp_bss_start, __hyp_bss_end - __hyp_bss_start);
 	ret = pkvm_mark_hyp_section(__hyp_bss);
 	if (ret)
 		return ret;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 318/334] KVM: arm64: vgic: Resample HW pending state on deactivation
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (316 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 317/334] KVM: arm64: Unregister HYP sections from kmemleak in protected mode Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 319/334] ARM: dts: at91: add pinctrl-{names, 0} for all gpios Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Raghavendra Rao Ananta, Oliver Upton,
	Marc Zyngier

From: Marc Zyngier <maz@kernel.org>

commit 3134cc8beb69d0db9de651081707c4651c011621 upstream.

When a mapped level interrupt (a timer, for example) is deactivated
by the guest, the corresponding host interrupt is equally deactivated.
However, the fate of the pending state still needs to be dealt
with in SW.

This is specially true when the interrupt was in the active+pending
state in the virtual distributor at the point where the guest
was entered. On exit, the pending state is potentially stale
(the guest may have put the interrupt in a non-pending state).

If we don't do anything, the interrupt will be spuriously injected
in the guest. Although this shouldn't have any ill effect (spurious
interrupts are always possible), we can improve the emulation by
detecting the deactivation-while-pending case and resample the
interrupt.

While we're at it, move the logic into a common helper that can
be shared between the two GIC implementations.

Fixes: e40cc57bac79 ("KVM: arm/arm64: vgic: Support level-triggered mapped interrupts")
Reported-by: Raghavendra Rao Ananta <rananta@google.com>
Tested-by: Raghavendra Rao Ananta <rananta@google.com>
Reviewed-by: Oliver Upton <oupton@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20210819180305.1670525-1-maz@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm64/kvm/vgic/vgic-v2.c |   36 +++++-------------------------------
 arch/arm64/kvm/vgic/vgic-v3.c |   36 +++++-------------------------------
 arch/arm64/kvm/vgic/vgic.c    |   38 ++++++++++++++++++++++++++++++++++++++
 arch/arm64/kvm/vgic/vgic.h    |    2 ++
 4 files changed, 50 insertions(+), 62 deletions(-)

--- a/arch/arm64/kvm/vgic/vgic-v2.c
+++ b/arch/arm64/kvm/vgic/vgic-v2.c
@@ -60,6 +60,7 @@ void vgic_v2_fold_lr_state(struct kvm_vc
 		u32 val = cpuif->vgic_lr[lr];
 		u32 cpuid, intid = val & GICH_LR_VIRTUALID;
 		struct vgic_irq *irq;
+		bool deactivated;
 
 		/* Extract the source vCPU id from the LR */
 		cpuid = val & GICH_LR_PHYSID_CPUID;
@@ -75,7 +76,8 @@ void vgic_v2_fold_lr_state(struct kvm_vc
 
 		raw_spin_lock(&irq->irq_lock);
 
-		/* Always preserve the active bit */
+		/* Always preserve the active bit, note deactivation */
+		deactivated = irq->active && !(val & GICH_LR_ACTIVE_BIT);
 		irq->active = !!(val & GICH_LR_ACTIVE_BIT);
 
 		if (irq->active && vgic_irq_is_sgi(intid))
@@ -96,36 +98,8 @@ void vgic_v2_fold_lr_state(struct kvm_vc
 		if (irq->config == VGIC_CONFIG_LEVEL && !(val & GICH_LR_STATE))
 			irq->pending_latch = false;
 
-		/*
-		 * Level-triggered mapped IRQs are special because we only
-		 * observe rising edges as input to the VGIC.
-		 *
-		 * If the guest never acked the interrupt we have to sample
-		 * the physical line and set the line level, because the
-		 * device state could have changed or we simply need to
-		 * process the still pending interrupt later.
-		 *
-		 * If this causes us to lower the level, we have to also clear
-		 * the physical active state, since we will otherwise never be
-		 * told when the interrupt becomes asserted again.
-		 *
-		 * Another case is when the interrupt requires a helping hand
-		 * on deactivation (no HW deactivation, for example).
-		 */
-		if (vgic_irq_is_mapped_level(irq)) {
-			bool resample = false;
-
-			if (val & GICH_LR_PENDING_BIT) {
-				irq->line_level = vgic_get_phys_line_level(irq);
-				resample = !irq->line_level;
-			} else if (vgic_irq_needs_resampling(irq) &&
-				   !(irq->active || irq->pending_latch)) {
-				resample = true;
-			}
-
-			if (resample)
-				vgic_irq_set_phys_active(irq, false);
-		}
+		/* Handle resampling for mapped interrupts if required */
+		vgic_irq_handle_resampling(irq, deactivated, val & GICH_LR_PENDING_BIT);
 
 		raw_spin_unlock(&irq->irq_lock);
 		vgic_put_irq(vcpu->kvm, irq);
--- a/arch/arm64/kvm/vgic/vgic-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-v3.c
@@ -46,6 +46,7 @@ void vgic_v3_fold_lr_state(struct kvm_vc
 		u32 intid, cpuid;
 		struct vgic_irq *irq;
 		bool is_v2_sgi = false;
+		bool deactivated;
 
 		cpuid = val & GICH_LR_PHYSID_CPUID;
 		cpuid >>= GICH_LR_PHYSID_CPUID_SHIFT;
@@ -68,7 +69,8 @@ void vgic_v3_fold_lr_state(struct kvm_vc
 
 		raw_spin_lock(&irq->irq_lock);
 
-		/* Always preserve the active bit */
+		/* Always preserve the active bit, note deactivation */
+		deactivated = irq->active && !(val & ICH_LR_ACTIVE_BIT);
 		irq->active = !!(val & ICH_LR_ACTIVE_BIT);
 
 		if (irq->active && is_v2_sgi)
@@ -89,36 +91,8 @@ void vgic_v3_fold_lr_state(struct kvm_vc
 		if (irq->config == VGIC_CONFIG_LEVEL && !(val & ICH_LR_STATE))
 			irq->pending_latch = false;
 
-		/*
-		 * Level-triggered mapped IRQs are special because we only
-		 * observe rising edges as input to the VGIC.
-		 *
-		 * If the guest never acked the interrupt we have to sample
-		 * the physical line and set the line level, because the
-		 * device state could have changed or we simply need to
-		 * process the still pending interrupt later.
-		 *
-		 * If this causes us to lower the level, we have to also clear
-		 * the physical active state, since we will otherwise never be
-		 * told when the interrupt becomes asserted again.
-		 *
-		 * Another case is when the interrupt requires a helping hand
-		 * on deactivation (no HW deactivation, for example).
-		 */
-		if (vgic_irq_is_mapped_level(irq)) {
-			bool resample = false;
-
-			if (val & ICH_LR_PENDING_BIT) {
-				irq->line_level = vgic_get_phys_line_level(irq);
-				resample = !irq->line_level;
-			} else if (vgic_irq_needs_resampling(irq) &&
-				   !(irq->active || irq->pending_latch)) {
-				resample = true;
-			}
-
-			if (resample)
-				vgic_irq_set_phys_active(irq, false);
-		}
+		/* Handle resampling for mapped interrupts if required */
+		vgic_irq_handle_resampling(irq, deactivated, val & ICH_LR_PENDING_BIT);
 
 		raw_spin_unlock(&irq->irq_lock);
 		vgic_put_irq(vcpu->kvm, irq);
--- a/arch/arm64/kvm/vgic/vgic.c
+++ b/arch/arm64/kvm/vgic/vgic.c
@@ -1022,3 +1022,41 @@ bool kvm_vgic_map_is_active(struct kvm_v
 
 	return map_is_active;
 }
+
+/*
+ * Level-triggered mapped IRQs are special because we only observe rising
+ * edges as input to the VGIC.
+ *
+ * If the guest never acked the interrupt we have to sample the physical
+ * line and set the line level, because the device state could have changed
+ * or we simply need to process the still pending interrupt later.
+ *
+ * We could also have entered the guest with the interrupt active+pending.
+ * On the next exit, we need to re-evaluate the pending state, as it could
+ * otherwise result in a spurious interrupt by injecting a now potentially
+ * stale pending state.
+ *
+ * If this causes us to lower the level, we have to also clear the physical
+ * active state, since we will otherwise never be told when the interrupt
+ * becomes asserted again.
+ *
+ * Another case is when the interrupt requires a helping hand on
+ * deactivation (no HW deactivation, for example).
+ */
+void vgic_irq_handle_resampling(struct vgic_irq *irq,
+				bool lr_deactivated, bool lr_pending)
+{
+	if (vgic_irq_is_mapped_level(irq)) {
+		bool resample = false;
+
+		if (unlikely(vgic_irq_needs_resampling(irq))) {
+			resample = !(irq->active || irq->pending_latch);
+		} else if (lr_pending || (lr_deactivated && irq->line_level)) {
+			irq->line_level = vgic_get_phys_line_level(irq);
+			resample = !irq->line_level;
+		}
+
+		if (resample)
+			vgic_irq_set_phys_active(irq, false);
+	}
+}
--- a/arch/arm64/kvm/vgic/vgic.h
+++ b/arch/arm64/kvm/vgic/vgic.h
@@ -169,6 +169,8 @@ void vgic_irq_set_phys_active(struct vgi
 bool vgic_queue_irq_unlock(struct kvm *kvm, struct vgic_irq *irq,
 			   unsigned long flags);
 void vgic_kick_vcpus(struct kvm *kvm);
+void vgic_irq_handle_resampling(struct vgic_irq *irq,
+				bool lr_deactivated, bool lr_pending);
 
 int vgic_check_ioaddr(struct kvm *kvm, phys_addr_t *ioaddr,
 		      phys_addr_t addr, phys_addr_t alignment);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 319/334] ARM: dts: at91: add pinctrl-{names, 0} for all gpios
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (317 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 318/334] KVM: arm64: vgic: Resample HW pending state on deactivation Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 320/334] io-wq: check max_worker limits if a worker transitions bound state Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Claudiu Beznea, Nicolas Ferre

From: Claudiu Beznea <claudiu.beznea@microchip.com>

commit bf781869e5cf3e4ec1a47dad69b6f0df97629cbd upstream.

Add pinctrl-names and pinctrl-0 properties on controllers that claims to
use pins to avoid failures due to
commit 2ab73c6d8323 ("gpio: Support GPIO controllers without pin-ranges")
and also to avoid using pins that may be claimed my other IPs.

Fixes: b7c2b6157079 ("ARM: at91: add Atmel's SAMA5D3 Xplained board")
Fixes: 1e5f532c2737 ("ARM: dts: at91: sam9x60: add device tree for soc and board")
Fixes: 38153a017896 ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Link: https://lore.kernel.org/r/20210727074006.1609989-1-claudiu.beznea@microchip.com
Cc: <stable@vger.kernel.org> # v5.7+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/arm/boot/dts/at91-sam9x60ek.dts        |   16 ++++++++++++++-
 arch/arm/boot/dts/at91-sama5d3_xplained.dts |   29 ++++++++++++++++++++++++++++
 arch/arm/boot/dts/at91-sama5d4_xplained.dts |   19 ++++++++++++++++++
 3 files changed, 63 insertions(+), 1 deletion(-)

--- a/arch/arm/boot/dts/at91-sam9x60ek.dts
+++ b/arch/arm/boot/dts/at91-sam9x60ek.dts
@@ -92,6 +92,8 @@
 
 	leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_gpio_leds>;
 		status = "okay"; /* Conflict with pwm0. */
 
 		red {
@@ -537,6 +539,10 @@
 				 AT91_PIOA 19 AT91_PERIPH_A (AT91_PINCTRL_PULL_UP | AT91_PINCTRL_DRIVE_STRENGTH_HI)	/* PA19 DAT2 periph A with pullup */
 				 AT91_PIOA 20 AT91_PERIPH_A (AT91_PINCTRL_PULL_UP | AT91_PINCTRL_DRIVE_STRENGTH_HI)>;	/* PA20 DAT3 periph A with pullup */
 		};
+		pinctrl_sdmmc0_cd: sdmmc0_cd {
+			atmel,pins =
+				<AT91_PIOA 23 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+		};
 	};
 
 	sdmmc1 {
@@ -569,6 +575,14 @@
 				      AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
 		};
 	};
+
+	leds {
+		pinctrl_gpio_leds: gpio_leds {
+			atmel,pins = <AT91_PIOB 11 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+				      AT91_PIOB 12 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+				      AT91_PIOB 13 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+		};
+	};
 }; /* pinctrl */
 
 &pwm0 {
@@ -580,7 +594,7 @@
 &sdmmc0 {
 	bus-width = <4>;
 	pinctrl-names = "default";
-	pinctrl-0 = <&pinctrl_sdmmc0_default>;
+	pinctrl-0 = <&pinctrl_sdmmc0_default &pinctrl_sdmmc0_cd>;
 	status = "okay";
 	cd-gpios = <&pioA 23 GPIO_ACTIVE_LOW>;
 	disable-wp;
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -57,6 +57,8 @@
 			};
 
 			spi0: spi@f0004000 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&pinctrl_spi0_cs>;
 				cs-gpios = <&pioD 13 0>, <0>, <0>, <&pioD 16 0>;
 				status = "okay";
 			};
@@ -169,6 +171,8 @@
 			};
 
 			spi1: spi@f8008000 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&pinctrl_spi1_cs>;
 				cs-gpios = <&pioC 25 0>;
 				status = "okay";
 			};
@@ -248,6 +252,26 @@
 							<AT91_PIOE 3 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
 							 AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
 					};
+
+					pinctrl_gpio_leds: gpio_leds_default {
+						atmel,pins =
+							<AT91_PIOE 23 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 24 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
+
+					pinctrl_spi0_cs: spi0_cs_default {
+						atmel,pins =
+							<AT91_PIOD 13 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOD 16 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
+
+					pinctrl_spi1_cs: spi1_cs_default {
+						atmel,pins = <AT91_PIOC 25 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
+
+					pinctrl_vcc_mmc0_reg_gpio: vcc_mmc0_reg_gpio_default {
+						atmel,pins = <AT91_PIOE 2 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -339,6 +363,8 @@
 
 	vcc_mmc0_reg: fixedregulator_mmc0 {
 		compatible = "regulator-fixed";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_vcc_mmc0_reg_gpio>;
 		gpio = <&pioE 2 GPIO_ACTIVE_LOW>;
 		regulator-name = "mmc0-card-supply";
 		regulator-min-microvolt = <3300000>;
@@ -362,6 +388,9 @@
 
 	leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_gpio_leds>;
+		status = "okay";
 
 		d2 {
 			label = "d2";
--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts
@@ -90,6 +90,8 @@
 			};
 
 			spi1: spi@fc018000 {
+				pinctrl-names = "default";
+				pinctrl-0 = <&pinctrl_spi0_cs>;
 				cs-gpios = <&pioB 21 0>;
 				status = "okay";
 			};
@@ -147,6 +149,19 @@
 						atmel,pins =
 							<AT91_PIOE 1 AT91_PERIPH_GPIO AT91_PINCTRL_PULL_UP_DEGLITCH>;
 					};
+					pinctrl_spi0_cs: spi0_cs_default {
+						atmel,pins =
+							<AT91_PIOB 21 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
+					pinctrl_gpio_leds: gpio_leds_default {
+						atmel,pins =
+							<AT91_PIOD 30 AT91_PERIPH_GPIO AT91_PINCTRL_NONE
+							 AT91_PIOE 15 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
+					pinctrl_vcc_mmc1_reg: vcc_mmc1_reg {
+						atmel,pins =
+							<AT91_PIOE 4 AT91_PERIPH_GPIO AT91_PINCTRL_NONE>;
+					};
 				};
 			};
 		};
@@ -252,6 +267,8 @@
 
 	leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_gpio_leds>;
 		status = "okay";
 
 		d8 {
@@ -278,6 +295,8 @@
 
 	vcc_mmc1_reg: fixedregulator_mmc1 {
 		compatible = "regulator-fixed";
+		pinctrl-names = "default";
+		pinctrl-0 = <&pinctrl_vcc_mmc1_reg>;
 		gpio = <&pioE 4 GPIO_ACTIVE_LOW>;
 		regulator-name = "VDD MCI1";
 		regulator-min-microvolt = <3300000>;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 320/334] io-wq: check max_worker limits if a worker transitions bound state
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (318 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 319/334] ARM: dts: at91: add pinctrl-{names, 0} for all gpios Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 321/334] md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Lundberg, Jens Axboe

From: Jens Axboe <axboe@kernel.dk>

commit ecc53c48c13d995e6fe5559e30ffee48d92784fd upstream.

For the two places where new workers are created, we diligently check if
we are allowed to create a new worker. If we're currently at the limit
of how many workers of a given type we can have, then we don't create
any new ones.

If you have a mixed workload with various types of bound and unbounded
work, then it can happen that a worker finishes one type of work and
is then transitioned to the other type. For this case, we don't check
if we are actually allowed to do so. This can cause io-wq to temporarily
exceed the allowed number of workers for a given type.

When retrieving work, check that the types match. If they don't, check
if we are allowed to transition to the other type. If not, then don't
handle the new work.

Cc: stable@vger.kernel.org
Reported-by: Johannes Lundberg <johalun0@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/io-wq.c |   33 ++++++++++++++++++++++++++++++---
 1 file changed, 30 insertions(+), 3 deletions(-)

--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -423,7 +423,28 @@ static void io_wait_on_hash(struct io_wq
 	spin_unlock(&wq->hash->wait.lock);
 }
 
-static struct io_wq_work *io_get_next_work(struct io_wqe *wqe)
+/*
+ * We can always run the work if the worker is currently the same type as
+ * the work (eg both are bound, or both are unbound). If they are not the
+ * same, only allow it if incrementing the worker count would be allowed.
+ */
+static bool io_worker_can_run_work(struct io_worker *worker,
+				   struct io_wq_work *work)
+{
+	struct io_wqe_acct *acct;
+
+	if (!(worker->flags & IO_WORKER_F_BOUND) !=
+	    !(work->flags & IO_WQ_WORK_UNBOUND))
+		return true;
+
+	/* not the same type, check if we'd go over the limit */
+	acct = io_work_get_acct(worker->wqe, work);
+	return acct->nr_workers < acct->max_workers;
+}
+
+static struct io_wq_work *io_get_next_work(struct io_wqe *wqe,
+					   struct io_worker *worker,
+					   bool *stalled)
 	__must_hold(wqe->lock)
 {
 	struct io_wq_work_node *node, *prev;
@@ -435,6 +456,9 @@ static struct io_wq_work *io_get_next_wo
 
 		work = container_of(node, struct io_wq_work, list);
 
+		if (!io_worker_can_run_work(worker, work))
+			break;
+
 		/* not hashed, can run anytime */
 		if (!io_wq_is_hashed(work)) {
 			wq_list_del(&wqe->work_list, node, prev);
@@ -461,6 +485,7 @@ static struct io_wq_work *io_get_next_wo
 		raw_spin_unlock(&wqe->lock);
 		io_wait_on_hash(wqe, stall_hash);
 		raw_spin_lock(&wqe->lock);
+		*stalled = true;
 	}
 
 	return NULL;
@@ -500,6 +525,7 @@ static void io_worker_handle_work(struct
 
 	do {
 		struct io_wq_work *work;
+		bool stalled;
 get_next:
 		/*
 		 * If we got some work, mark us as busy. If we didn't, but
@@ -508,10 +534,11 @@ get_next:
 		 * can't make progress, any work completion or insertion will
 		 * clear the stalled flag.
 		 */
-		work = io_get_next_work(wqe);
+		stalled = false;
+		work = io_get_next_work(wqe, worker, &stalled);
 		if (work)
 			__io_worker_busy(wqe, worker, work);
-		else if (!wq_list_empty(&wqe->work_list))
+		else if (stalled)
 			wqe->flags |= IO_WQE_FLAG_STALLED;
 
 		raw_spin_unlock_irq(&wqe->lock);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 321/334] md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (319 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 320/334] io-wq: check max_worker limits if a worker transitions bound state Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 322/334] char: tpm: Kconfig: remove bad i2c cr50 select Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Xiao Ni, Guoqing Jiang, Song Liu

From: Xiao Ni <xni@redhat.com>

commit 46d4703b1db4c86ab5acb2331b10df999f005e8e upstream.

We are seeing the following warning in raid10_handle_discard.
[  695.110751] =============================
[  695.131439] WARNING: suspicious RCU usage
[  695.151389] 4.18.0-319.el8.x86_64+debug #1 Not tainted
[  695.174413] -----------------------------
[  695.192603] drivers/md/raid10.c:1776 suspicious
rcu_dereference_check() usage!
[  695.225107] other info that might help us debug this:
[  695.260940] rcu_scheduler_active = 2, debug_locks = 1
[  695.290157] no locks held by mkfs.xfs/10186.

In the first loop of function raid10_handle_discard. It already
determines which disk need to handle discard request and add the
rdev reference count rdev->nr_pending. So the conf->mirrors will
not change until all bios come back from underlayer disks. It
doesn't need to use rcu_dereference to get rdev.

Cc: stable@vger.kernel.org
Fixes: d30588b2731f ('md/raid10: improve raid10 discard request')
Signed-off-by: Xiao Ni <xni@redhat.com>
Acked-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/md/raid10.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1712,6 +1712,11 @@ retry_discard:
 	} else
 		r10_bio->master_bio = (struct bio *)first_r10bio;
 
+	/*
+	 * first select target devices under rcu_lock and
+	 * inc refcount on their rdev.  Record them by setting
+	 * bios[x] to bio
+	 */
 	rcu_read_lock();
 	for (disk = 0; disk < geo->raid_disks; disk++) {
 		struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev);
@@ -1743,9 +1748,6 @@ retry_discard:
 	for (disk = 0; disk < geo->raid_disks; disk++) {
 		sector_t dev_start, dev_end;
 		struct bio *mbio, *rbio = NULL;
-		struct md_rdev *rdev = rcu_dereference(conf->mirrors[disk].rdev);
-		struct md_rdev *rrdev = rcu_dereference(
-			conf->mirrors[disk].replacement);
 
 		/*
 		 * Now start to calculate the start and end address for each disk.
@@ -1775,9 +1777,12 @@ retry_discard:
 
 		/*
 		 * It only handles discard bio which size is >= stripe size, so
-		 * dev_end > dev_start all the time
+		 * dev_end > dev_start all the time.
+		 * It doesn't need to use rcu lock to get rdev here. We already
+		 * add rdev->nr_pending in the first loop.
 		 */
 		if (r10_bio->devs[disk].bio) {
+			struct md_rdev *rdev = conf->mirrors[disk].rdev;
 			mbio = bio_clone_fast(bio, GFP_NOIO, &mddev->bio_set);
 			mbio->bi_end_io = raid10_end_discard_request;
 			mbio->bi_private = r10_bio;
@@ -1790,6 +1795,7 @@ retry_discard:
 			bio_endio(mbio);
 		}
 		if (r10_bio->devs[disk].repl_bio) {
+			struct md_rdev *rrdev = conf->mirrors[disk].replacement;
 			rbio = bio_clone_fast(bio, GFP_NOIO, &mddev->bio_set);
 			rbio->bi_end_io = raid10_end_discard_request;
 			rbio->bi_private = r10_bio;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 322/334] char: tpm: Kconfig: remove bad i2c cr50 select
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (320 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 321/334] md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 323/334] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jarkko Sakkinen, Adrian Ratiu

From: Adrian Ratiu <adrian.ratiu@collabora.com>

commit 847fdae1579f4ee930b01f24a7847b8043bf468c upstream.

This fixes a minor bug which went unnoticed during the initial
driver upstreaming review: TCG_CR50 does not exist in mainline
kernels, so remove it.

Fixes: 3a253caaad11 ("char: tpm: add i2c driver for cr50")
Cc: stable@vger.kernel.org
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Adrian Ratiu <adrian.ratiu@collabora.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/char/tpm/Kconfig |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -89,7 +89,6 @@ config TCG_TIS_SYNQUACER
 config TCG_TIS_I2C_CR50
 	tristate "TPM Interface Specification 2.0 Interface (I2C - CR50)"
 	depends on I2C
-	select TCG_CR50
 	help
 	  This is a driver for the Google cr50 I2C TPM interface which is a
 	  custom microcontroller and requires a custom i2c protocol interface



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 323/334] fuse: truncate pagecache on atomic_o_trunc
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (321 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 322/334] char: tpm: Kconfig: remove bad i2c cr50 select Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 325/334] fuse: wait for writepages in syncfs Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xie Yongji, Miklos Szeredi,
	syzbot+bea44a5189836d956894

From: Miklos Szeredi <mszeredi@redhat.com>

commit 76224355db7570cbe6b6f75c8929a1558828dd55 upstream.

fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic
O_TRUNC.  This can deadlock with fuse_wait_on_page_writeback() in
fuse_launder_page() triggered by invalidate_inode_pages2().

Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a
truncate_pagecache() call.  This makes sense regardless of FOPEN_KEEP_CACHE
or fc->writeback cache, so do it unconditionally.

Reported-by: Xie Yongji <xieyongji@bytedance.com>
Reported-and-tested-by: syzbot+bea44a5189836d956894@syzkaller.appspotmail.com
Fixes: e4648309b85a ("fuse: truncate pending writes on O_TRUNC")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/file.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -198,12 +198,11 @@ void fuse_finish_open(struct inode *inod
 	struct fuse_file *ff = file->private_data;
 	struct fuse_conn *fc = get_fuse_conn(inode);
 
-	if (!(ff->open_flags & FOPEN_KEEP_CACHE))
-		invalidate_inode_pages2(inode->i_mapping);
 	if (ff->open_flags & FOPEN_STREAM)
 		stream_open(inode, file);
 	else if (ff->open_flags & FOPEN_NONSEEKABLE)
 		nonseekable_open(inode, file);
+
 	if (fc->atomic_o_trunc && (file->f_flags & O_TRUNC)) {
 		struct fuse_inode *fi = get_fuse_inode(inode);
 
@@ -211,10 +210,14 @@ void fuse_finish_open(struct inode *inod
 		fi->attr_version = atomic64_inc_return(&fc->attr_version);
 		i_size_write(inode, 0);
 		spin_unlock(&fi->lock);
+		truncate_pagecache(inode, 0);
 		fuse_invalidate_attr(inode);
 		if (fc->writeback_cache)
 			file_update_time(file);
+	} else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) {
+		invalidate_inode_pages2(inode->i_mapping);
 	}
+
 	if ((file->f_mode & FMODE_WRITE) && fc->writeback_cache)
 		fuse_link_write_file(file);
 }



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 325/334] fuse: wait for writepages in syncfs
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (322 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 323/334] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 326/334] IMA: remove -Wmissing-prototypes warning Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amir Goldstein, Miklos Szeredi

From: Miklos Szeredi <mszeredi@redhat.com>

commit 660585b56e63ca034ad506ea53c807c5cdca3196 upstream.

In case of fuse the MM subsystem doesn't guarantee that page writeback
completes by the time ->sync_fs() is called.  This is because fuse
completes page writeback immediately to prevent DoS of memory reclaim by
the userspace file server.

This means that fuse itself must ensure that writes are synced before
sending the SYNCFS request to the server.

Introduce sync buckets, that hold a counter for the number of outstanding
write requests.  On syncfs replace the current bucket with a new one and
wait until the old bucket's counter goes down to zero.

It is possible to have multiple syncfs calls in parallel, in which case
there could be more than one waited-on buckets.  Descendant buckets must
not complete until the parent completes.  Add a count to the child (new)
bucket until the (parent) old bucket completes.

Use RCU protection to dereference the current bucket and to wake up an
emptied bucket.  Use fc->lock to protect against parallel assignments to
the current bucket.

This leaves just the counter to be a possible scalability issue.  The
fc->num_waiting counter has a similar issue, so both should be addressed at
the same time.

Reported-by: Amir Goldstein <amir73il@gmail.com>
Fixes: 2d82ab251ef0 ("virtiofs: propagate sync() to file server")
Cc: <stable@vger.kernel.org> # v5.14
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/fuse/file.c   |   21 +++++++++++++++++++
 fs/fuse/fuse_i.h |   19 +++++++++++++++++
 fs/fuse/inode.c  |   60 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+)

--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -392,6 +392,7 @@ struct fuse_writepage_args {
 	struct list_head queue_entry;
 	struct fuse_writepage_args *next;
 	struct inode *inode;
+	struct fuse_sync_bucket *bucket;
 };
 
 static struct fuse_writepage_args *fuse_find_writeback(struct fuse_inode *fi,
@@ -1611,6 +1612,9 @@ static void fuse_writepage_free(struct f
 	struct fuse_args_pages *ap = &wpa->ia.ap;
 	int i;
 
+	if (wpa->bucket)
+		fuse_sync_bucket_dec(wpa->bucket);
+
 	for (i = 0; i < ap->num_pages; i++)
 		__free_page(ap->pages[i]);
 
@@ -1874,6 +1878,20 @@ static struct fuse_writepage_args *fuse_
 
 }
 
+static void fuse_writepage_add_to_bucket(struct fuse_conn *fc,
+					 struct fuse_writepage_args *wpa)
+{
+	if (!fc->sync_fs)
+		return;
+
+	rcu_read_lock();
+	/* Prevent resurrection of dead bucket in unlikely race with syncfs */
+	do {
+		wpa->bucket = rcu_dereference(fc->curr_bucket);
+	} while (unlikely(!atomic_inc_not_zero(&wpa->bucket->count)));
+	rcu_read_unlock();
+}
+
 static int fuse_writepage_locked(struct page *page)
 {
 	struct address_space *mapping = page->mapping;
@@ -1901,6 +1919,7 @@ static int fuse_writepage_locked(struct
 	if (!wpa->ia.ff)
 		goto err_nofile;
 
+	fuse_writepage_add_to_bucket(fc, wpa);
 	fuse_write_args_fill(&wpa->ia, wpa->ia.ff, page_offset(page), 0);
 
 	copy_highpage(tmp_page, page);
@@ -2151,6 +2170,8 @@ static int fuse_writepages_fill(struct p
 			__free_page(tmp_page);
 			goto out_unlock;
 		}
+		fuse_writepage_add_to_bucket(fc, wpa);
+
 		data->max_pages = 1;
 
 		ap = &wpa->ia.ap;
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -515,6 +515,13 @@ struct fuse_fs_context {
 	void **fudptr;
 };
 
+struct fuse_sync_bucket {
+	/* count is a possible scalability bottleneck */
+	atomic_t count;
+	wait_queue_head_t waitq;
+	struct rcu_head rcu;
+};
+
 /**
  * A Fuse connection.
  *
@@ -807,6 +814,9 @@ struct fuse_conn {
 
 	/** List of filesystems using this connection */
 	struct list_head mounts;
+
+	/* New writepages go into this bucket */
+	struct fuse_sync_bucket __rcu *curr_bucket;
 };
 
 /*
@@ -910,6 +920,15 @@ static inline void fuse_page_descs_lengt
 		descs[i].length = PAGE_SIZE - descs[i].offset;
 }
 
+static inline void fuse_sync_bucket_dec(struct fuse_sync_bucket *bucket)
+{
+	/* Need RCU protection to prevent use after free after the decrement */
+	rcu_read_lock();
+	if (atomic_dec_and_test(&bucket->count))
+		wake_up(&bucket->waitq);
+	rcu_read_unlock();
+}
+
 /** Device operations */
 extern const struct file_operations fuse_dev_operations;
 
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -506,6 +506,57 @@ static int fuse_statfs(struct dentry *de
 	return err;
 }
 
+static struct fuse_sync_bucket *fuse_sync_bucket_alloc(void)
+{
+	struct fuse_sync_bucket *bucket;
+
+	bucket = kzalloc(sizeof(*bucket), GFP_KERNEL | __GFP_NOFAIL);
+	if (bucket) {
+		init_waitqueue_head(&bucket->waitq);
+		/* Initial active count */
+		atomic_set(&bucket->count, 1);
+	}
+	return bucket;
+}
+
+static void fuse_sync_fs_writes(struct fuse_conn *fc)
+{
+	struct fuse_sync_bucket *bucket, *new_bucket;
+	int count;
+
+	new_bucket = fuse_sync_bucket_alloc();
+	spin_lock(&fc->lock);
+	bucket = rcu_dereference_protected(fc->curr_bucket, 1);
+	count = atomic_read(&bucket->count);
+	WARN_ON(count < 1);
+	/* No outstanding writes? */
+	if (count == 1) {
+		spin_unlock(&fc->lock);
+		kfree(new_bucket);
+		return;
+	}
+
+	/*
+	 * Completion of new bucket depends on completion of this bucket, so add
+	 * one more count.
+	 */
+	atomic_inc(&new_bucket->count);
+	rcu_assign_pointer(fc->curr_bucket, new_bucket);
+	spin_unlock(&fc->lock);
+	/*
+	 * Drop initial active count.  At this point if all writes in this and
+	 * ancestor buckets complete, the count will go to zero and this task
+	 * will be woken up.
+	 */
+	atomic_dec(&bucket->count);
+
+	wait_event(bucket->waitq, atomic_read(&bucket->count) == 0);
+
+	/* Drop temp count on descendant bucket */
+	fuse_sync_bucket_dec(new_bucket);
+	kfree_rcu(bucket, rcu);
+}
+
 static int fuse_sync_fs(struct super_block *sb, int wait)
 {
 	struct fuse_mount *fm = get_fuse_mount_super(sb);
@@ -528,6 +579,8 @@ static int fuse_sync_fs(struct super_blo
 	if (!fc->sync_fs)
 		return 0;
 
+	fuse_sync_fs_writes(fc);
+
 	memset(&inarg, 0, sizeof(inarg));
 	args.in_numargs = 1;
 	args.in_args[0].size = sizeof(inarg);
@@ -763,6 +816,7 @@ void fuse_conn_put(struct fuse_conn *fc)
 {
 	if (refcount_dec_and_test(&fc->count)) {
 		struct fuse_iqueue *fiq = &fc->iq;
+		struct fuse_sync_bucket *bucket;
 
 		if (IS_ENABLED(CONFIG_FUSE_DAX))
 			fuse_dax_conn_free(fc);
@@ -770,6 +824,11 @@ void fuse_conn_put(struct fuse_conn *fc)
 			fiq->ops->release(fiq);
 		put_pid_ns(fc->pid_ns);
 		put_user_ns(fc->user_ns);
+		bucket = rcu_dereference_protected(fc->curr_bucket, 1);
+		if (bucket) {
+			WARN_ON(atomic_read(&bucket->count) != 1);
+			kfree(bucket);
+		}
 		fc->release(fc);
 	}
 }
@@ -1418,6 +1477,7 @@ int fuse_fill_super_common(struct super_
 	if (sb->s_flags & SB_MANDLOCK)
 		goto err;
 
+	rcu_assign_pointer(fc->curr_bucket, fuse_sync_bucket_alloc());
 	fuse_sb_defaults(sb);
 
 	if (ctx->is_bdev) {



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 326/334] IMA: remove -Wmissing-prototypes warning
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (323 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 325/334] fuse: wait for writepages in syncfs Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 327/334] IMA: remove the dependency on CRYPTO_MD5 Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Austin Kim, Mimi Zohar

From: Austin Kim <austin.kim@lge.com>

commit a32ad90426a9c8eb3915eed26e08ce133bd9e0da upstream.

With W=1 build, the compiler throws warning message as below:

   security/integrity/ima/ima_mok.c:24:12: warning:
   no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes]
       __init int ima_mok_init(void)

Silence the warning by adding static keyword to ima_mok_init().

Signed-off-by: Austin Kim <austin.kim@lge.com>
Fixes: 41c89b64d718 ("IMA: create machine owner and blacklist keyrings")
Cc: stable@vger.kernel.org
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/ima/ima_mok.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/security/integrity/ima/ima_mok.c
+++ b/security/integrity/ima/ima_mok.c
@@ -21,7 +21,7 @@ struct key *ima_blacklist_keyring;
 /*
  * Allocate the IMA blacklist keyring
  */
-__init int ima_mok_init(void)
+static __init int ima_mok_init(void)
 {
 	struct key_restriction *restriction;
 



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 327/334] IMA: remove the dependency on CRYPTO_MD5
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (324 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 326/334] IMA: remove -Wmissing-prototypes warning Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 328/334] fbmem: dont allow too huge resolutions Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, THOBY Simon, Lakshmi Ramasubramanian,
	Mimi Zohar

From: THOBY Simon <Simon.THOBY@viveris.fr>

commit 8510505d55e194d3f6c9644c9f9d12c4f6b0395a upstream.

MD5 is a weak digest algorithm that shouldn't be used for cryptographic
operation. It hinders the efficiency of a patch set that aims to limit
the digests allowed for the extended file attribute namely security.ima.
MD5 is no longer a requirement for IMA, nor should it be used there.

The sole place where we still use the MD5 algorithm inside IMA is setting
the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5'
parameter on the command line.  With commit ab60368ab6a4 ("ima: Fallback
to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully
when CRYPTO_MD5 is not set:
	ima: Can not allocate md5 (reason: -2)
	ima: Allocating md5 failed, going to use default hash algorithm sha256

Remove the CRYPTO_MD5 dependency for IMA.

Signed-off-by: THOBY Simon <Simon.THOBY@viveris.fr>
Reviewed-by: Lakshmi Ramasubramanian <nramas@linux.microsoft.com>
[zohar@linux.ibm.com: include commit number in patch description for
stable.]
Cc: stable@vger.kernel.org # 4.17
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 security/integrity/ima/Kconfig |    1 -
 1 file changed, 1 deletion(-)

--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -6,7 +6,6 @@ config IMA
 	select SECURITYFS
 	select CRYPTO
 	select CRYPTO_HMAC
-	select CRYPTO_MD5
 	select CRYPTO_SHA1
 	select CRYPTO_HASH_INFO
 	select TCG_TPM if HAS_IOMEM && !UML



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 328/334] fbmem: dont allow too huge resolutions
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (325 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 327/334] IMA: remove the dependency on CRYPTO_MD5 Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 329/334] ACPI: PRM: Find PRMT table before parsing it Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa,
	Geert Uytterhoeven, Daniel Vetter, Randy Dunlap

From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>

commit 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae upstream.

syzbot is reporting page fault at vga16fb_fillrect() [1], for
vga16fb_check_var() is failing to detect multiplication overflow.

  if (vxres * vyres > maxmem) {
    vyres = maxmem / vxres;
    if (vyres < yres)
      return -ENOMEM;
  }

Since no module would accept too huge resolutions where multiplication
overflow happens, let's reject in the common path.

Link: https://syzkaller.appspot.com/bug?extid=04168c8063cfdde1db5e [1]
Reported-by: syzbot <syzbot+04168c8063cfdde1db5e@syzkaller.appspotmail.com>
Debugged-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/185175d6-227a-7b55-433d-b070929b262c@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/fbdev/core/fbmem.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -962,6 +962,7 @@ fb_set_var(struct fb_info *info, struct
 	struct fb_var_screeninfo old_var;
 	struct fb_videomode mode;
 	struct fb_event event;
+	u32 unused;
 
 	if (var->activate & FB_ACTIVATE_INV_MODE) {
 		struct fb_videomode mode1, mode2;
@@ -1008,6 +1009,11 @@ fb_set_var(struct fb_info *info, struct
 	if (var->xres < 8 || var->yres < 8)
 		return -EINVAL;
 
+	/* Too huge resolution causes multiplication overflow. */
+	if (check_mul_overflow(var->xres, var->yres, &unused) ||
+	    check_mul_overflow(var->xres_virtual, var->yres_virtual, &unused))
+		return -EINVAL;
+
 	ret = info->fbops->fb_check_var(var, info);
 
 	if (ret)



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 329/334] ACPI: PRM: Find PRMT table before parsing it
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (326 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 328/334] fbmem: dont allow too huge resolutions Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 330/334] RDMA/mlx5: Fix number of allocated XLT entries Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aubrey Li, Paul Menzel, Rafael J. Wysocki

From: Aubrey Li <aubrey.li@intel.com>

commit 3265cc3ec52e75fc8daf189954cebda27ad26b2e upstream.

Find and verify PRMT before parsing it, which eliminates a
warning on machines without PRMT:

	[    7.197173] ACPI: PRMT not present

Fixes: cefc7ca46235 ("ACPI: PRM: implement OperationRegion handler for the PlatformRtMechanism subtype")
Signed-off-by: Aubrey Li <aubrey.li@linux.intel.com>
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Cc: 5.14+ <stable@vger.kernel.org> # 5.14+
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/acpi/prmt.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/acpi/prmt.c
+++ b/drivers/acpi/prmt.c
@@ -288,10 +288,18 @@ invalid_guid:
 
 void __init init_prmt(void)
 {
+	struct acpi_table_header *tbl;
 	acpi_status status;
-	int mc = acpi_table_parse_entries(ACPI_SIG_PRMT, sizeof(struct acpi_table_prmt) +
+	int mc;
+
+	status = acpi_get_table(ACPI_SIG_PRMT, 0, &tbl);
+	if (ACPI_FAILURE(status))
+		return;
+
+	mc = acpi_table_parse_entries(ACPI_SIG_PRMT, sizeof(struct acpi_table_prmt) +
 					  sizeof (struct acpi_table_prmt_header),
 					  0, acpi_parse_prmt, 0);
+	acpi_put_table(tbl);
 	/*
 	 * Return immediately if PRMT table is not present or no PRM module found.
 	 */



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 330/334] RDMA/mlx5: Fix number of allocated XLT entries
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (327 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 329/334] ACPI: PRM: Find PRMT table before parsing it Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 331/334] bootconfig: Fix missing return check of xbc_node_compose_key function Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Niklas Schnelle, Jason Gunthorpe

From: Niklas Schnelle <schnelle@linux.ibm.com>

commit 9660dcbe0d9186976917c94bce4e69dbd8d7a974 upstream.

In commit 8010d74b9965b ("RDMA/mlx5: Split the WR setup out of
mlx5_ib_update_xlt()") the allocation logic was split out of
mlx5_ib_update_xlt() and the logic was changed to enable better OOM
handling. Sadly this change introduced a miscalculation of the number of
entries that were actually allocated when under memory pressure where it
can actually become 0 which on s390 lets dma_map_single() fail.

It can also lead to corruption of the free pages list when the wrong
number of entries is used in the calculation of sg->length which is used
as argument for free_pages().

Fix this by using the allocation size instead of misusing get_order(size).

Cc: stable@vger.kernel.org
Fixes: 8010d74b9965 ("RDMA/mlx5: Split the WR setup out of mlx5_ib_update_xlt()")
Link: https://lore.kernel.org/r/20210908081849.7948-1-schnelle@linux.ibm.com
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/infiniband/hw/mlx5/mr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1024,7 +1024,7 @@ static void *mlx5_ib_alloc_xlt(size_t *n
 
 	if (size > MLX5_SPARE_UMR_CHUNK) {
 		size = MLX5_SPARE_UMR_CHUNK;
-		*nents = get_order(size) / ent_size;
+		*nents = size / ent_size;
 		res = (void *)__get_free_pages(gfp_mask | __GFP_NOWARN,
 					       get_order(size));
 		if (res)



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 331/334] bootconfig: Fix missing return check of xbc_node_compose_key function
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (328 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 330/334] RDMA/mlx5: Fix number of allocated XLT entries Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 332/334] backlight: pwm_bl: Improve bootloader/kernel device handover Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Julio Faracco, Masami Hiramatsu,
	Steven Rostedt (VMware)

From: Julio Faracco <jcfaracco@gmail.com>

commit 903bd067faa837fddb6e5c8b740c3374dc582f04 upstream.

The function `xbc_show_list should` handle the keys during the
composition. Even the errors returned by the compose function. Instead
of removing the `ret` variable, it should save the value and show the
exact error. This missing variable is causing a compilation issue also.

Link: https://lkml.kernel.org/r/163077087861.222577.12884543474750968146.stgit@devnote2

Fixes: e5efaeb8a8f5 ("bootconfig: Support mixing a value and subkeys under a key")
Signed-off-by: Julio Faracco <jcfaracco@gmail.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 tools/bootconfig/main.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/tools/bootconfig/main.c
+++ b/tools/bootconfig/main.c
@@ -111,9 +111,11 @@ static void xbc_show_list(void)
 	char key[XBC_KEYLEN_MAX];
 	struct xbc_node *leaf;
 	const char *val;
+	int ret;
 
 	xbc_for_each_key_value(leaf, val) {
-		if (xbc_node_compose_key(leaf, key, XBC_KEYLEN_MAX) < 0) {
+		ret = xbc_node_compose_key(leaf, key, XBC_KEYLEN_MAX);
+		if (ret < 0) {
 			fprintf(stderr, "Failed to compose key %d\n", ret);
 			break;
 		}



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 332/334] backlight: pwm_bl: Improve bootloader/kernel device handover
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (329 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 331/334] bootconfig: Fix missing return check of xbc_node_compose_key function Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 333/334] parisc: Fix unaligned-access crash in bootloader Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marek Vasut, Daniel Thompson, Lee Jones

From: Daniel Thompson <daniel.thompson@linaro.org>

commit 79fad92f2e596f5a8dd085788a24f540263ef887 upstream.

Currently there are (at least) two problems in the way pwm_bl starts
managing the enable_gpio pin. Both occur when the backlight is initially
off and the driver finds the pin not already in output mode and, as a
result, unconditionally switches it to output-mode and asserts the signal.

Problem 1: This could cause the backlight to flicker since, at this stage
in driver initialisation, we have no idea what the PWM and regulator are
doing (an unconfigured PWM could easily "rest" at 100% duty cycle).

Problem 2: This will cause us not to correctly honour the
post_pwm_on_delay (which also risks flickers).

Fix this by moving the code to configure the GPIO output mode until after
we have examines the handover state. That allows us to initialize
enable_gpio to off if the backlight is currently off and on if the
backlight is on.

Cc: stable@vger.kernel.org
Reported-by: Marek Vasut <marex@denx.de>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Acked-by: Marek Vasut <marex@denx.de>
Tested-by: Marek Vasut <marex@denx.de>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/video/backlight/pwm_bl.c |   54 ++++++++++++++++++++-------------------
 1 file changed, 28 insertions(+), 26 deletions(-)

--- a/drivers/video/backlight/pwm_bl.c
+++ b/drivers/video/backlight/pwm_bl.c
@@ -409,6 +409,33 @@ static bool pwm_backlight_is_linear(stru
 static int pwm_backlight_initial_power_state(const struct pwm_bl_data *pb)
 {
 	struct device_node *node = pb->dev->of_node;
+	bool active = true;
+
+	/*
+	 * If the enable GPIO is present, observable (either as input
+	 * or output) and off then the backlight is not currently active.
+	 * */
+	if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
+		active = false;
+
+	if (!regulator_is_enabled(pb->power_supply))
+		active = false;
+
+	if (!pwm_is_enabled(pb->pwm))
+		active = false;
+
+	/*
+	 * Synchronize the enable_gpio with the observed state of the
+	 * hardware.
+	 */
+	if (pb->enable_gpio)
+		gpiod_direction_output(pb->enable_gpio, active);
+
+	/*
+	 * Do not change pb->enabled here! pb->enabled essentially
+	 * tells us if we own one of the regulator's use counts and
+	 * right now we do not.
+	 */
 
 	/* Not booted with device tree or no phandle link to the node */
 	if (!node || !node->phandle)
@@ -420,20 +447,7 @@ static int pwm_backlight_initial_power_s
 	 * assume that another driver will enable the backlight at the
 	 * appropriate time. Therefore, if it is disabled, keep it so.
 	 */
-
-	/* if the enable GPIO is disabled, do not enable the backlight */
-	if (pb->enable_gpio && gpiod_get_value_cansleep(pb->enable_gpio) == 0)
-		return FB_BLANK_POWERDOWN;
-
-	/* The regulator is disabled, do not enable the backlight */
-	if (!regulator_is_enabled(pb->power_supply))
-		return FB_BLANK_POWERDOWN;
-
-	/* The PWM is disabled, keep it like this */
-	if (!pwm_is_enabled(pb->pwm))
-		return FB_BLANK_POWERDOWN;
-
-	return FB_BLANK_UNBLANK;
+	return active ? FB_BLANK_UNBLANK: FB_BLANK_POWERDOWN;
 }
 
 static int pwm_backlight_probe(struct platform_device *pdev)
@@ -486,18 +500,6 @@ static int pwm_backlight_probe(struct pl
 		goto err_alloc;
 	}
 
-	/*
-	 * If the GPIO is not known to be already configured as output, that
-	 * is, if gpiod_get_direction returns either 1 or -EINVAL, change the
-	 * direction to output and set the GPIO as active.
-	 * Do not force the GPIO to active when it was already output as it
-	 * could cause backlight flickering or we would enable the backlight too
-	 * early. Leave the decision of the initial backlight state for later.
-	 */
-	if (pb->enable_gpio &&
-	    gpiod_get_direction(pb->enable_gpio) != 0)
-		gpiod_direction_output(pb->enable_gpio, 1);
-
 	pb->power_supply = devm_regulator_get(&pdev->dev, "power");
 	if (IS_ERR(pb->power_supply)) {
 		ret = PTR_ERR(pb->power_supply);



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 333/334] parisc: Fix unaligned-access crash in bootloader
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (330 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 332/334] backlight: pwm_bl: Improve bootloader/kernel device handover Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 13:16 ` [PATCH 5.14 334/334] clk: kirkwood: Fix a clocking boot regression Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Helge Deller, Arnd Bergmann,
	John David Anglin

From: Helge Deller <deller@gmx.de>

commit c42813b71a06a2ff4a155aa87ac609feeab76cf3 upstream.

Kernel v5.14 has various changes to optimize unaligned memory accesses,
e.g. commit 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers").

Those changes triggered an unalignment-exception and thus crashed the
bootloader on parisc because the unaligned "output_len" variable now suddenly
was read word-wise while it was read byte-wise in the past.

Fix this issue by declaring the external output_len variable as char which then
forces the compiler to generate byte-accesses.

Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Arnd Bergmann <arnd@kernel.org>
Cc: John David Anglin <dave.anglin@bell.net>
Bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102162
Fixes: 8c031ba63f8f ("parisc: Unbreak bootloader due to gcc-7 optimizations")
Fixes: 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers")
Cc: <stable@vger.kernel.org> # v5.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 arch/parisc/boot/compressed/misc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/parisc/boot/compressed/misc.c
+++ b/arch/parisc/boot/compressed/misc.c
@@ -26,7 +26,7 @@
 extern char input_data[];
 extern int input_len;
 /* output_len is inserted by the linker possibly at an unaligned address */
-extern __le32 output_len __aligned(1);
+extern char output_len;
 extern char _text, _end;
 extern char _bss, _ebss;
 extern char _startcode_end;



^ permalink raw reply	[flat|nested] 383+ messages in thread

* [PATCH 5.14 334/334] clk: kirkwood: Fix a clocking boot regression
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (331 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 333/334] parisc: Fix unaligned-access crash in bootloader Greg Kroah-Hartman
@ 2021-09-13 13:16 ` Greg Kroah-Hartman
  2021-09-13 18:00 ` [PATCH 5.14 000/334] 5.14.4-rc1 review Naresh Kamboju
                   ` (6 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 13:16 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Chris Packham,
	Gregory CLEMENT, Sebastian Hesselbarth, Linus Walleij,
	Stephen Boyd

From: Linus Walleij <linus.walleij@linaro.org>

commit aaedb9e00e5400220a8871180d23a83e67f29f63 upstream.

Since a few kernel releases the Pogoplug 4 has crashed like this
during boot:

Unable to handle kernel NULL pointer dereference at virtual address 00000002
(...)
[<c04116ec>] (strlen) from [<c00ead80>] (kstrdup+0x1c/0x4c)
[<c00ead80>] (kstrdup) from [<c04591d8>] (__clk_register+0x44/0x37c)
[<c04591d8>] (__clk_register) from [<c04595ec>] (clk_hw_register+0x20/0x44)
[<c04595ec>] (clk_hw_register) from [<c045bfa8>] (__clk_hw_register_mux+0x198/0x1e4)
[<c045bfa8>] (__clk_hw_register_mux) from [<c045c050>] (clk_register_mux_table+0x5c/0x6c)
[<c045c050>] (clk_register_mux_table) from [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0+0x13c/0x1ac)
[<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0) from [<c0aceae0>] (of_clk_init+0x12c/0x214)
[<c0aceae0>] (of_clk_init) from [<c0ab576c>] (time_init+0x20/0x2c)
[<c0ab576c>] (time_init) from [<c0ab3d18>] (start_kernel+0x3dc/0x56c)
[<c0ab3d18>] (start_kernel) from [<00000000>] (0x0)
Code: e3130020 1afffffb e12fff1e c08a1078 (e5d03000)

This is because the "powersave" mux clock 0 was provided in an unterminated
array, which is required by the loop in the driver:

        /* Count, allocate, and register clock muxes */
        for (n = 0; desc[n].name;)
                n++;

Here n will go out of bounds and then call clk_register_mux() on random
memory contents after the mux clock.

Fix this by terminating the array with a blank entry.

Fixes: 105299381d87 ("cpufreq: kirkwood: use the powersave multiplexer")
Cc: stable@vger.kernel.org
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Chris Packham <chris.packham@alliedtelesis.co.nz>
Cc: Gregory CLEMENT <gregory.clement@bootlin.com>
Cc: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20210814235514.403426-1-linus.walleij@linaro.org
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/clk/mvebu/kirkwood.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/clk/mvebu/kirkwood.c
+++ b/drivers/clk/mvebu/kirkwood.c
@@ -265,6 +265,7 @@ static const char *powersave_parents[] =
 static const struct clk_muxing_soc_desc kirkwood_mux_desc[] __initconst = {
 	{ "powersave", powersave_parents, ARRAY_SIZE(powersave_parents),
 		11, 1, 0 },
+	{ }
 };
 
 static struct clk *clk_muxing_get_src(



^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-13 13:13 ` [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC Greg Kroah-Hartman
@ 2021-09-13 13:57   ` Doug Anderson
  2021-09-13 16:09     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 383+ messages in thread
From: Doug Anderson @ 2021-09-13 13:57 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

Hi,

On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Douglas Anderson <dianders@chromium.org>
>
> [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
>
> This is really just a revert of commit 58074b08c04a ("drm/bridge:
> ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
>
> The old code failed to read the EDID properly in a very important
> case: before the bridge's pre_enable() was called. The way things need
> to work:
> 1. Read the EDID.
> 2. Based on the EDID, decide on video settings and pixel clock.
> 3. Enable the bridge w/ the desired settings.
>
> The way things were working:
> 1. Try to read the EDID but fail; fall back to hardcoded values.
> 2. Based on hardcoded values, decide on video settings and pixel clock.
> 3. Enable the bridge w/ the desired settings.
> 4. Try again to read the EDID, it works now!
> 5. Realize that the hardcoded settings weren't quite right.
> 6. Disable / reenable the bridge w/ the right settings.
>
> The reasons for the failures were twofold:
> a) Since we never ran the bridge chip's pre-enable then we never set
>    the bit to ignore HPD. This meant the bridge chip didn't even _try_
>    to go out on the bus and communicate with the panel.
> b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
>    if the panel wasn't on.
>
> Instead of reverting the code, we could fix it to set the HPD bit and
> also power on the panel. However, it also works nicely to just let the
> panel code read the EDID. Now that we've split the driver up we can
> expose the DDC AUX channel bus to the panel node. The panel can take
> charge of reading the EDID.
>
> NOTE: in order for things to work, anyone that needs to read the EDID
> will need to instantiate their panel using the new DP AUX bus (AKA by
> listing their panel under the "aux-bus" node of the bridge chip in the
> device tree).
>
> In the future if we want to use the bridge chip to provide a full
> external DP port (which won't have a panel) then we will have to
> conditinally add EDID reading back in.
>
> Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> Signed-off-by: Douglas Anderson <dianders@chromium.org>
> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
>  1 file changed, 22 deletions(-)

I guess it's not a huge deal, but I did respond to Sasha and request
that this patch be dropped from the stable queue unless the whole big
pile of patches was being backported. See:

https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/

I said:

> I would suggest against backporting this one unless you're going to
> backport the whole pile of DP AUX bus patches, which probably doesn't
> make sense for stable. Even though the old EDID reading was broken for
> the first read, it still worked for later reads. ...and the first read
. didn't crash or anything--it just timed out.


-Doug

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-13 13:57   ` Doug Anderson
@ 2021-09-13 16:09     ` Greg Kroah-Hartman
  2021-09-13 16:31       ` Doug Anderson
  0 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 16:09 UTC (permalink / raw)
  To: Doug Anderson; +Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
> Hi,
> 
> On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > From: Douglas Anderson <dianders@chromium.org>
> >
> > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
> >
> > This is really just a revert of commit 58074b08c04a ("drm/bridge:
> > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
> >
> > The old code failed to read the EDID properly in a very important
> > case: before the bridge's pre_enable() was called. The way things need
> > to work:
> > 1. Read the EDID.
> > 2. Based on the EDID, decide on video settings and pixel clock.
> > 3. Enable the bridge w/ the desired settings.
> >
> > The way things were working:
> > 1. Try to read the EDID but fail; fall back to hardcoded values.
> > 2. Based on hardcoded values, decide on video settings and pixel clock.
> > 3. Enable the bridge w/ the desired settings.
> > 4. Try again to read the EDID, it works now!
> > 5. Realize that the hardcoded settings weren't quite right.
> > 6. Disable / reenable the bridge w/ the right settings.
> >
> > The reasons for the failures were twofold:
> > a) Since we never ran the bridge chip's pre-enable then we never set
> >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
> >    to go out on the bus and communicate with the panel.
> > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
> >    if the panel wasn't on.
> >
> > Instead of reverting the code, we could fix it to set the HPD bit and
> > also power on the panel. However, it also works nicely to just let the
> > panel code read the EDID. Now that we've split the driver up we can
> > expose the DDC AUX channel bus to the panel node. The panel can take
> > charge of reading the EDID.
> >
> > NOTE: in order for things to work, anyone that needs to read the EDID
> > will need to instantiate their panel using the new DP AUX bus (AKA by
> > listing their panel under the "aux-bus" node of the bridge chip in the
> > device tree).
> >
> > In the future if we want to use the bridge chip to provide a full
> > external DP port (which won't have a panel) then we will have to
> > conditinally add EDID reading back in.
> >
> > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
> >  1 file changed, 22 deletions(-)
> 
> I guess it's not a huge deal, but I did respond to Sasha and request
> that this patch be dropped from the stable queue unless the whole big
> pile of patches was being backported. See:
> 
> https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
> 
> I said:
> 
> > I would suggest against backporting this one unless you're going to
> > backport the whole pile of DP AUX bus patches, which probably doesn't
> > make sense for stable. Even though the old EDID reading was broken for
> > the first read, it still worked for later reads. ...and the first read
> . didn't crash or anything--it just timed out.

I see a "bunch" of patches for this driver in this -rc, did Sasha not
get them all?  If not, I can drop this one, but maybe it was needed for
the follow-on patches?

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 13:11 ` [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl() Greg Kroah-Hartman
@ 2021-09-13 16:22   ` Naresh Kamboju
  2021-09-13 17:58     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 383+ messages in thread
From: Naresh Kamboju @ 2021-09-13 16:22 UTC (permalink / raw)
  To: Greg Kroah-Hartman, Nathan Chancellor, Nick Desaulniers, Baokun Li
  Cc: open list, linux-stable, Hulk Robot, Josef Bacik, Jens Axboe,
	Sasha Levin, clang-built-linux, lkft-triage, llvm

On Mon, 13 Sept 2021 at 19:51, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Baokun Li <libaokun1@huawei.com>
>
> [ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ]
>
> If user specify a large enough value of NBD blocks option, it may trigger
> signed integer overflow which may lead to nbd->config->bytesize becomes a
> large or small value, zero in particular.
>
> UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31
> signed integer overflow:
> 1024 * 4611686155866341414 cannot be represented in type 'long long int'
> [...]
> Call trace:
> [...]
>  handle_overflow+0x188/0x1dc lib/ubsan.c:192
>  __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213
>  nbd_size_set drivers/block/nbd.c:325 [inline]
>  __nbd_ioctl drivers/block/nbd.c:1342 [inline]
>  nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395
>  __blkdev_driver_ioctl block/ioctl.c:311 [inline]
> [...]
>
> Although it is not a big deal, still silence the UBSAN by limit
> the input value.
>
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Baokun Li <libaokun1@huawei.com>
> Reviewed-by: Josef Bacik <josef@toxicpanda.com>
> Link: https://lore.kernel.org/r/20210804021212.990223-1-libaokun1@huawei.com
> [axboe: dropped unlikely()]
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/block/nbd.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 19f5d5a8b16a..acf3f85bf3c7 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>                        unsigned int cmd, unsigned long arg)
>  {
>         struct nbd_config *config = nbd->config;
> +       loff_t bytesize;
>
>         switch (cmd) {
>         case NBD_DISCONNECT:
> @@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
>         case NBD_SET_SIZE:
>                 return nbd_set_size(nbd, arg, config->blksize);
>         case NBD_SET_SIZE_BLOCKS:
> -               return nbd_set_size(nbd, arg * config->blksize,
> -                                   config->blksize);
> +               if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
> +                       return -EINVAL;
> +               return nbd_set_size(nbd, bytesize, config->blksize);
>         case NBD_SET_TIMEOUT:
>                 nbd_set_cmd_timeout(nbd, arg);
>                 return 0;

arm clang-10, clang-11, clang-12 and clang-13 builds failed.
due to this commit on 5.14 and 5.13 on following configs,
  - footbridge_defconfig
  - mini2440_defconfig
  - s3c2410_defconfig

This was already reported on the mailing list.

ERROR: modpost: "__mulodi4" [drivers/block/nbd.ko] undefined! #1438
https://github.com/ClangBuiltLinux/linux/issues/1438

[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/

linux-next: build failure while building Linus' tree
https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/

Full build log,
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111


--
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-13 16:09     ` Greg Kroah-Hartman
@ 2021-09-13 16:31       ` Doug Anderson
  2021-09-14 16:27         ` Greg Kroah-Hartman
  0 siblings, 1 reply; 383+ messages in thread
From: Doug Anderson @ 2021-09-13 16:31 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

Hi,

On Mon, Sep 13, 2021 at 9:09 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
> > Hi,
> >
> > On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > From: Douglas Anderson <dianders@chromium.org>
> > >
> > > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
> > >
> > > This is really just a revert of commit 58074b08c04a ("drm/bridge:
> > > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
> > >
> > > The old code failed to read the EDID properly in a very important
> > > case: before the bridge's pre_enable() was called. The way things need
> > > to work:
> > > 1. Read the EDID.
> > > 2. Based on the EDID, decide on video settings and pixel clock.
> > > 3. Enable the bridge w/ the desired settings.
> > >
> > > The way things were working:
> > > 1. Try to read the EDID but fail; fall back to hardcoded values.
> > > 2. Based on hardcoded values, decide on video settings and pixel clock.
> > > 3. Enable the bridge w/ the desired settings.
> > > 4. Try again to read the EDID, it works now!
> > > 5. Realize that the hardcoded settings weren't quite right.
> > > 6. Disable / reenable the bridge w/ the right settings.
> > >
> > > The reasons for the failures were twofold:
> > > a) Since we never ran the bridge chip's pre-enable then we never set
> > >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
> > >    to go out on the bus and communicate with the panel.
> > > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
> > >    if the panel wasn't on.
> > >
> > > Instead of reverting the code, we could fix it to set the HPD bit and
> > > also power on the panel. However, it also works nicely to just let the
> > > panel code read the EDID. Now that we've split the driver up we can
> > > expose the DDC AUX channel bus to the panel node. The panel can take
> > > charge of reading the EDID.
> > >
> > > NOTE: in order for things to work, anyone that needs to read the EDID
> > > will need to instantiate their panel using the new DP AUX bus (AKA by
> > > listing their panel under the "aux-bus" node of the bridge chip in the
> > > device tree).
> > >
> > > In the future if we want to use the bridge chip to provide a full
> > > external DP port (which won't have a panel) then we will have to
> > > conditinally add EDID reading back in.
> > >
> > > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> > > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > > ---
> > >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
> > >  1 file changed, 22 deletions(-)
> >
> > I guess it's not a huge deal, but I did respond to Sasha and request
> > that this patch be dropped from the stable queue unless the whole big
> > pile of patches was being backported. See:
> >
> > https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
> >
> > I said:
> >
> > > I would suggest against backporting this one unless you're going to
> > > backport the whole pile of DP AUX bus patches, which probably doesn't
> > > make sense for stable. Even though the old EDID reading was broken for
> > > the first read, it still worked for later reads. ...and the first read
> > . didn't crash or anything--it just timed out.
>
> I see a "bunch" of patches for this driver in this -rc, did Sasha not
> get them all?  If not, I can drop this one, but maybe it was needed for
> the follow-on patches?

It's been a long journey trying to make this bridge work better. I
think the easiest way to say it is that if you don't have the parent
of ${SUBJECT} patch, AKA:

e0bbcc6233f7 drm/bridge: ti-sn65dsi86: Add support for the DP AUX bus

...then you don't have DP AUX bus support and you shouldn't take
${SUBJECT} patch. If you have that patch and it compiles / builds then
it means that you have all the proper dependencies. However, there are
_a lot_ of dependencies and I wouldn't suggest picking them all to
stable unless it's critical for someone.

-Doug

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 16:22   ` Naresh Kamboju
@ 2021-09-13 17:58     ` Greg Kroah-Hartman
  2021-09-13 18:39       ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-13 17:58 UTC (permalink / raw)
  To: Naresh Kamboju
  Cc: Nathan Chancellor, Nick Desaulniers, Baokun Li, open list,
	linux-stable, Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm

On Mon, Sep 13, 2021 at 09:52:33PM +0530, Naresh Kamboju wrote:
> On Mon, 13 Sept 2021 at 19:51, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > From: Baokun Li <libaokun1@huawei.com>
> >
> > [ Upstream commit fad7cd3310db3099f95dd34312c77740fbc455e5 ]
> >
> > If user specify a large enough value of NBD blocks option, it may trigger
> > signed integer overflow which may lead to nbd->config->bytesize becomes a
> > large or small value, zero in particular.
> >
> > UBSAN: Undefined behaviour in drivers/block/nbd.c:325:31
> > signed integer overflow:
> > 1024 * 4611686155866341414 cannot be represented in type 'long long int'
> > [...]
> > Call trace:
> > [...]
> >  handle_overflow+0x188/0x1dc lib/ubsan.c:192
> >  __ubsan_handle_mul_overflow+0x34/0x44 lib/ubsan.c:213
> >  nbd_size_set drivers/block/nbd.c:325 [inline]
> >  __nbd_ioctl drivers/block/nbd.c:1342 [inline]
> >  nbd_ioctl+0x998/0xa10 drivers/block/nbd.c:1395
> >  __blkdev_driver_ioctl block/ioctl.c:311 [inline]
> > [...]
> >
> > Although it is not a big deal, still silence the UBSAN by limit
> > the input value.
> >
> > Reported-by: Hulk Robot <hulkci@huawei.com>
> > Signed-off-by: Baokun Li <libaokun1@huawei.com>
> > Reviewed-by: Josef Bacik <josef@toxicpanda.com>
> > Link: https://lore.kernel.org/r/20210804021212.990223-1-libaokun1@huawei.com
> > [axboe: dropped unlikely()]
> > Signed-off-by: Jens Axboe <axboe@kernel.dk>
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > ---
> >  drivers/block/nbd.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> > index 19f5d5a8b16a..acf3f85bf3c7 100644
> > --- a/drivers/block/nbd.c
> > +++ b/drivers/block/nbd.c
> > @@ -1388,6 +1388,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
> >                        unsigned int cmd, unsigned long arg)
> >  {
> >         struct nbd_config *config = nbd->config;
> > +       loff_t bytesize;
> >
> >         switch (cmd) {
> >         case NBD_DISCONNECT:
> > @@ -1402,8 +1403,9 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
> >         case NBD_SET_SIZE:
> >                 return nbd_set_size(nbd, arg, config->blksize);
> >         case NBD_SET_SIZE_BLOCKS:
> > -               return nbd_set_size(nbd, arg * config->blksize,
> > -                                   config->blksize);
> > +               if (check_mul_overflow((loff_t)arg, config->blksize, &bytesize))
> > +                       return -EINVAL;
> > +               return nbd_set_size(nbd, bytesize, config->blksize);
> >         case NBD_SET_TIMEOUT:
> >                 nbd_set_cmd_timeout(nbd, arg);
> >                 return 0;
> 
> arm clang-10, clang-11, clang-12 and clang-13 builds failed.
> due to this commit on 5.14 and 5.13 on following configs,
>   - footbridge_defconfig
>   - mini2440_defconfig
>   - s3c2410_defconfig
> 
> This was already reported on the mailing list.
> 
> ERROR: modpost: "__mulodi4" [drivers/block/nbd.ko] undefined! #1438
> https://github.com/ClangBuiltLinux/linux/issues/1438
> 
> [PATCH 00/10] raise minimum GCC version to 5.1
> https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/
> 
> linux-next: build failure while building Linus' tree
> https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/
> 
> Full build log,
> https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111

Has anyone submitted a fix for this upstream yet?  I can't seem to find
one :(

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (332 preceding siblings ...)
  2021-09-13 13:16 ` [PATCH 5.14 334/334] clk: kirkwood: Fix a clocking boot regression Greg Kroah-Hartman
@ 2021-09-13 18:00 ` Naresh Kamboju
  2021-09-13 18:13 ` Florian Fainelli
                   ` (5 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Naresh Kamboju @ 2021-09-13 18:00 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, shuah, f.fainelli, patches, lkft-triage, jonathanh,
	stable, pavel, akpm, torvalds, linux

On Mon, 13 Sept 2021 at 19:16, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

FYI,

arm clang-10, clang-11, clang-12 and clang-13 builds failed.
due to this commit on 5.14 and 5.13 on following configs,
  - footbridge_defconfig
  - mini2440_defconfig
  - s3c2410_defconfig

This was already reported on the mailing list.

ERROR: modpost: "__mulodi4" [drivers/block/nbd.ko] undefined! #1438
https://github.com/ClangBuiltLinux/linux/issues/1438

[PATCH 00/10] raise minimum GCC version to 5.1
https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/

linux-next: build failure while building Linus' tree
https://lore.kernel.org/all/20210909182525.372ee687@canb.auug.org.au/

Full build log,
https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc/-/jobs/1585407346#L1111


--
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (333 preceding siblings ...)
  2021-09-13 18:00 ` [PATCH 5.14 000/334] 5.14.4-rc1 review Naresh Kamboju
@ 2021-09-13 18:13 ` Florian Fainelli
  2021-09-13 19:12 ` Fox Chen
                   ` (4 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Florian Fainelli @ 2021-09-13 18:13 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
	jonathanh, stable



On 9/13/2021 6:10 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

On ARCH_BRCMSTB, using 32-bit and 64-bit ARM kernels:

Tested-by: Florian Fainelli <f.fainelli@gmail.com>
-- 
Florian


^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 17:58     ` Greg Kroah-Hartman
@ 2021-09-13 18:39       ` Nick Desaulniers
  2021-09-13 19:53         ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 18:39 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Naresh Kamboju, Nathan Chancellor, Baokun Li, open list,
	linux-stable, Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 10:58 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 09:52:33PM +0530, Naresh Kamboju wrote:
> > [PATCH 00/10] raise minimum GCC version to 5.1
> > https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/
>
> Has anyone submitted a fix for this upstream yet?  I can't seem to find
> one :(

That lore link has a series to address this, though that's maybe
something we don't want to backport to stable.

I thought about this all weekend; I think I might be able to work
around the one concern I had with my other approach, using
__builtin_choose_expr().

There's an issue with my alternative approach
(https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
with declaring the local variable z in div_64() since either operand
could be 64b, which result in an unwanted truncation if the dividend
is 32b (or less, and divisor is 64b). I think (what I realized this
weekend) is that we might be able to replace the `if` with
`__builtin_choose_expr`, then have that whole expression be the final
statement and thus the "return value" of the statement expression.

I need to play with that idea more; maybe that could be a more
manageable patch for stable.  But I also need to eat lunch, and I've
been in the Rust for Linux conference, and trying to organize 3 other
conferences for the next two weeks...
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* RE: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (334 preceding siblings ...)
  2021-09-13 18:13 ` Florian Fainelli
@ 2021-09-13 19:12 ` Fox Chen
  2021-09-13 20:06 ` Shuah Khan
                   ` (3 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Fox Chen @ 2021-09-13 19:12 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, jonathanh, f.fainelli, stable, Fox Chen

On Mon, 13 Sep 2021 15:10:54 +0200, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

5.14.4-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
                
Tested-by: Fox Chen <foxhlchen@gmail.com>


^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 18:39       ` Nick Desaulniers
@ 2021-09-13 19:53         ` Nick Desaulniers
  2021-09-13 19:57           ` Sedat Dilek
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 19:53 UTC (permalink / raw)
  To: Greg Kroah-Hartman, Linus Torvalds
  Cc: Naresh Kamboju, Nathan Chancellor, Baokun Li, open list,
	linux-stable, Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 11:39 AM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Mon, Sep 13, 2021 at 10:58 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Mon, Sep 13, 2021 at 09:52:33PM +0530, Naresh Kamboju wrote:
> > > [PATCH 00/10] raise minimum GCC version to 5.1
> > > https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/
> >
> > Has anyone submitted a fix for this upstream yet?  I can't seem to find
> > one :(
>
> That lore link has a series to address this, though that's maybe
> something we don't want to backport to stable.
>
> I thought about this all weekend; I think I might be able to work
> around the one concern I had with my other approach, using
> __builtin_choose_expr().
>
> There's an issue with my alternative approach
> (https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
> with declaring the local variable z in div_64() since either operand
> could be 64b, which result in an unwanted truncation if the dividend
> is 32b (or less, and divisor is 64b). I think (what I realized this
> weekend) is that we might be able to replace the `if` with
> `__builtin_choose_expr`, then have that whole expression be the final
> statement and thus the "return value" of the statement expression.

Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?

Anyways, I'll send something like this for stable:
---

diff --git a/include/linux/math64.h b/include/linux/math64.h
index 2928f03d6d46..e9ab8c25f8d3 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -11,6 +11,9 @@

 #define div64_long(x, y) div64_s64((x), (y))
 #define div64_ul(x, y)   div64_u64((x), (y))
+#ifndef is_signed_type
+#define is_signed_type(type)       (((type)(-1)) < (type)1)
+#endif

 /**
  * div_u64_rem - unsigned 64bit divide with 32bit divisor with remainder
@@ -112,6 +115,15 @@ extern s64 div64_s64(s64 dividend, s64 divisor);

 #endif /* BITS_PER_LONG */

+#define div64_x64(dividend, divisor) ({                        \
+       BUILD_BUG_ON_MSG(sizeof(dividend) < sizeof(u64),\
+                        "prefer div_x64");             \
+       __builtin_choose_expr(                          \
+               is_signed_type(typeof(dividend)),       \
+               div64_s64(dividend, divisor),           \
+               div64_u64(dividend, divisor));          \
+})
+
 /**
  * div_u64 - unsigned 64bit divide with 32bit divisor
  * @dividend: unsigned 64bit dividend
@@ -142,6 +154,28 @@ static inline s64 div_s64(s64 dividend, s32 divisor)
 }
 #endif

+#define div_x64(dividend, divisor) ({                  \
+       BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u32),\
+                        "prefer div64_x64");           \
+       __builtin_choose_expr(                          \
+               is_signed_type(typeof(dividend)),       \
+               div_s64(dividend, divisor),             \
+               div_u64(dividend, divisor));            \
+})
+
+// TODO: what if divisor is 128b?
+#define div_64(dividend, divisor) ({
         \
+       __builtin_choose_expr(
         \
+               __builtin_types_compatible_p(typeof(dividend), s64) ||
         \
+               __builtin_types_compatible_p(typeof(dividend), u64),
         \
+               __builtin_choose_expr(
         \
+                       __builtin_types_compatible_p(typeof(divisor),
s64) ||   \
+                       __builtin_types_compatible_p(typeof(divisor),
u64),     \
+                       div64_x64(dividend, divisor),
         \
+                       div_x64(dividend, divisor)),
         \
+               dividend / divisor);
         \
+})
+
 u32 iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder);

 #ifndef mul_u32_u32
---
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply related	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 19:53         ` Nick Desaulniers
@ 2021-09-13 19:57           ` Sedat Dilek
  2021-09-13 20:02             ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Sedat Dilek @ 2021-09-13 19:57 UTC (permalink / raw)
  To: Nick Desaulniers
  Cc: Greg Kroah-Hartman, Linus Torvalds, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 9:53 PM 'Nick Desaulniers' via Clang Built
Linux <clang-built-linux@googlegroups.com> wrote:
>
> On Mon, Sep 13, 2021 at 11:39 AM Nick Desaulniers
> <ndesaulniers@google.com> wrote:
> >
> > On Mon, Sep 13, 2021 at 10:58 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Mon, Sep 13, 2021 at 09:52:33PM +0530, Naresh Kamboju wrote:
> > > > [PATCH 00/10] raise minimum GCC version to 5.1
> > > > https://lore.kernel.org/lkml/20210910234047.1019925-1-ndesaulniers@google.com/
> > >
> > > Has anyone submitted a fix for this upstream yet?  I can't seem to find
> > > one :(
> >
> > That lore link has a series to address this, though that's maybe
> > something we don't want to backport to stable.
> >
> > I thought about this all weekend; I think I might be able to work
> > around the one concern I had with my other approach, using
> > __builtin_choose_expr().
> >
> > There's an issue with my alternative approach
> > (https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
> > with declaring the local variable z in div_64() since either operand
> > could be 64b, which result in an unwanted truncation if the dividend
> > is 32b (or less, and divisor is 64b). I think (what I realized this
> > weekend) is that we might be able to replace the `if` with
> > `__builtin_choose_expr`, then have that whole expression be the final
> > statement and thus the "return value" of the statement expression.
>
> Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?
>

"Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version)"

- Sedat -

https://git.kernel.org/linus/316346243be6df12799c0b64b788e06bad97c30b

> Anyways, I'll send something like this for stable:
> ---
>
> diff --git a/include/linux/math64.h b/include/linux/math64.h
> index 2928f03d6d46..e9ab8c25f8d3 100644
> --- a/include/linux/math64.h
> +++ b/include/linux/math64.h
> @@ -11,6 +11,9 @@
>
>  #define div64_long(x, y) div64_s64((x), (y))
>  #define div64_ul(x, y)   div64_u64((x), (y))
> +#ifndef is_signed_type
> +#define is_signed_type(type)       (((type)(-1)) < (type)1)
> +#endif
>
>  /**
>   * div_u64_rem - unsigned 64bit divide with 32bit divisor with remainder
> @@ -112,6 +115,15 @@ extern s64 div64_s64(s64 dividend, s64 divisor);
>
>  #endif /* BITS_PER_LONG */
>
> +#define div64_x64(dividend, divisor) ({                        \
> +       BUILD_BUG_ON_MSG(sizeof(dividend) < sizeof(u64),\
> +                        "prefer div_x64");             \
> +       __builtin_choose_expr(                          \
> +               is_signed_type(typeof(dividend)),       \
> +               div64_s64(dividend, divisor),           \
> +               div64_u64(dividend, divisor));          \
> +})
> +
>  /**
>   * div_u64 - unsigned 64bit divide with 32bit divisor
>   * @dividend: unsigned 64bit dividend
> @@ -142,6 +154,28 @@ static inline s64 div_s64(s64 dividend, s32 divisor)
>  }
>  #endif
>
> +#define div_x64(dividend, divisor) ({                  \
> +       BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u32),\
> +                        "prefer div64_x64");           \
> +       __builtin_choose_expr(                          \
> +               is_signed_type(typeof(dividend)),       \
> +               div_s64(dividend, divisor),             \
> +               div_u64(dividend, divisor));            \
> +})
> +
> +// TODO: what if divisor is 128b?
> +#define div_64(dividend, divisor) ({
>          \
> +       __builtin_choose_expr(
>          \
> +               __builtin_types_compatible_p(typeof(dividend), s64) ||
>          \
> +               __builtin_types_compatible_p(typeof(dividend), u64),
>          \
> +               __builtin_choose_expr(
>          \
> +                       __builtin_types_compatible_p(typeof(divisor),
> s64) ||   \
> +                       __builtin_types_compatible_p(typeof(divisor),
> u64),     \
> +                       div64_x64(dividend, divisor),
>          \
> +                       div_x64(dividend, divisor)),
>          \
> +               dividend / divisor);
>          \
> +})
> +
>  u32 iter_div_u64_rem(u64 dividend, u32 divisor, u64 *remainder);
>
>  #ifndef mul_u32_u32
> ---
> --
> Thanks,
> ~Nick Desaulniers
>
> --
> You received this message because you are subscribed to the Google Groups "Clang Built Linux" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/CAKwvOdmCS5Q7AzUL5nziYVU7RrtRjoE9JjOXfVBWagO1Bzbsew%40mail.gmail.com.

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 19:57           ` Sedat Dilek
@ 2021-09-13 20:02             ` Nick Desaulniers
  2021-09-13 20:10               ` Linus Torvalds
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 20:02 UTC (permalink / raw)
  To: sedat.dilek
  Cc: Greg Kroah-Hartman, Linus Torvalds, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 12:57 PM Sedat Dilek <sedat.dilek@gmail.com> wrote:
>
> On Mon, Sep 13, 2021 at 9:53 PM 'Nick Desaulniers' via Clang Built
> Linux <clang-built-linux@googlegroups.com> wrote:
> >
> > On Mon, Sep 13, 2021 at 11:39 AM Nick Desaulniers
> > <ndesaulniers@google.com> wrote:
> > >
> > > There's an issue with my alternative approach
> > > (https://gist.github.com/nickdesaulniers/2479818f4983bbf2d688cebbab435863)
> > > with declaring the local variable z in div_64() since either operand
> > > could be 64b, which result in an unwanted truncation if the dividend
> > > is 32b (or less, and divisor is 64b). I think (what I realized this
> > > weekend) is that we might be able to replace the `if` with
> > > `__builtin_choose_expr`, then have that whole expression be the final
> > > statement and thus the "return value" of the statement expression.
> >
> > Christ...that...works? Though, did Linus just merge my patches for gcc 5.1?
> >
>
> "Merge branch 'gcc-min-version-5.1' (make gcc-5.1 the minimum version)"

Ha! I pulled+rebased and this code disappeared...I thought I had
rebased on the wrong branch or committed work to master accidentally.
Patch to stable-only inbound.
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (335 preceding siblings ...)
  2021-09-13 19:12 ` Fox Chen
@ 2021-09-13 20:06 ` Shuah Khan
  2021-09-14  9:23 ` Naresh Kamboju
                   ` (2 subsequent siblings)
  339 siblings, 0 replies; 383+ messages in thread
From: Shuah Khan @ 2021-09-13 20:06 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
	jonathanh, f.fainelli, stable, Shuah Khan

On 9/13/21 7:10 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:02             ` Nick Desaulniers
@ 2021-09-13 20:10               ` Linus Torvalds
  2021-09-13 20:16                 ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Linus Torvalds @ 2021-09-13 20:10 UTC (permalink / raw)
  To: Nick Desaulniers
  Cc: Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 1:02 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> Ha! I pulled+rebased and this code disappeared...I thought I had
> rebased on the wrong branch or committed work to master accidentally.
> Patch to stable-only inbound.

Side note: for stable, can you look into using _Generic() instead of
__builtin_choose_expression() with typeof, or some
__builtin_types_compatible_p() magic?

Yes, yes, we use __builtin_choose_expression() elsewhere, but we've
started using _Generic(), and it's really the more natural model - in
addition to being the standard C one.

Of course, there may be some reason why _Generic() doesn't work, but
it _is_ the natural fit for any "for type X, do Y" kind of thing.

No?

          Linus

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:10               ` Linus Torvalds
@ 2021-09-13 20:16                 ` Nick Desaulniers
  2021-09-13 20:36                   ` Nick Desaulniers
  2021-09-13 20:42                   ` Linus Torvalds
  0 siblings, 2 replies; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 20:16 UTC (permalink / raw)
  To: Linus Torvalds, Arnd Bergmann
  Cc: Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 1:10 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 1:02 PM Nick Desaulniers
> <ndesaulniers@google.com> wrote:
> >
> > Ha! I pulled+rebased and this code disappeared...I thought I had
> > rebased on the wrong branch or committed work to master accidentally.
> > Patch to stable-only inbound.
>
> Side note: for stable, can you look into using _Generic() instead of
> __builtin_choose_expression() with typeof, or some
> __builtin_types_compatible_p() magic?
>
> Yes, yes, we use __builtin_choose_expression() elsewhere, but we've
> started using _Generic(), and it's really the more natural model - in
> addition to being the standard C one.
>
> Of course, there may be some reason why _Generic() doesn't work, but
> it _is_ the natural fit for any "for type X, do Y" kind of thing.
>
> No?

Man, c'mon, I just got the __builtin_choose_expression() working! It's
not...too bad...ish. (Besides, I'd actually have to learn how to use
_Generic...I've never quite gotten anything I've written trying to use
it to actually compile).

Do we have access to _Generic in GCC 4.9?
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:16                 ` Nick Desaulniers
@ 2021-09-13 20:36                   ` Nick Desaulniers
  2021-09-13 20:42                   ` Linus Torvalds
  1 sibling, 0 replies; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 20:36 UTC (permalink / raw)
  Cc: Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook, Linus Torvalds,
	Arnd Bergmann

On Mon, Sep 13, 2021 at 1:16 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Mon, Sep 13, 2021 at 1:10 PM Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> >
> > On Mon, Sep 13, 2021 at 1:02 PM Nick Desaulniers
> > <ndesaulniers@google.com> wrote:
> > >
> > > Ha! I pulled+rebased and this code disappeared...I thought I had
> > > rebased on the wrong branch or committed work to master accidentally.
> > > Patch to stable-only inbound.
> >
> > Side note: for stable, can you look into using _Generic() instead of
> > __builtin_choose_expression() with typeof, or some
> > __builtin_types_compatible_p() magic?
> >
> > Yes, yes, we use __builtin_choose_expression() elsewhere, but we've
> > started using _Generic(), and it's really the more natural model - in
> > addition to being the standard C one.
> >
> > Of course, there may be some reason why _Generic() doesn't work, but
> > it _is_ the natural fit for any "for type X, do Y" kind of thing.
> >
> > No?
>
> Man, c'mon, I just got the __builtin_choose_expression() working! It's
> not...too bad...ish. (Besides, I'd actually have to learn how to use
> _Generic...I've never quite gotten anything I've written trying to use
> it to actually compile).
>
> Do we have access to _Generic in GCC 4.9?

Follow up thread, sorry/not sorry for not taking the full cc list:
https://lore.kernel.org/stable/20210913203201.1844253-1-ndesaulniers@google.com/
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:16                 ` Nick Desaulniers
  2021-09-13 20:36                   ` Nick Desaulniers
@ 2021-09-13 20:42                   ` Linus Torvalds
  2021-09-13 20:50                     ` Nick Desaulniers
  1 sibling, 1 reply; 383+ messages in thread
From: Linus Torvalds @ 2021-09-13 20:42 UTC (permalink / raw)
  To: Nick Desaulniers
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 1:16 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> Do we have access to _Generic in GCC 4.9?

We've ended up using it unconditionally since last year, so yes.

In fact, the compiler version tests got removed when we raised the gcc
version requirement to 4.9 in commit 6ec4476ac825 ("Raise gcc version
requirement to 4.9"):

   "In particular, raising the minimum to 4.9 means that we can now just
    assume _Generic() exists, which is likely the much better replacement
    for a lot of very convoluted built-time magic with conditionals on
    sizeof and/or __builtin_choose_expr() with same_type() etc"

but we haven't used it much since.

The "seqprop" code for picking the right lock for seqlock is perhaps
the main example, and staring at that code will make you go blind, so
look away.

            Linus

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:42                   ` Linus Torvalds
@ 2021-09-13 20:50                     ` Nick Desaulniers
  2021-09-13 21:13                       ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 20:50 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 1:42 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 1:16 PM Nick Desaulniers
> <ndesaulniers@google.com> wrote:
> >
> > Do we have access to _Generic in GCC 4.9?
>
> We've ended up using it unconditionally since last year, so yes.

Sorry, grepping would have taken < 1s. I'm very lazy.
http://threevirtues.com/

>
> In fact, the compiler version tests got removed when we raised the gcc
> version requirement to 4.9 in commit 6ec4476ac825 ("Raise gcc version
> requirement to 4.9"):
>
>    "In particular, raising the minimum to 4.9 means that we can now just
>     assume _Generic() exists, which is likely the much better replacement
>     for a lot of very convoluted built-time magic with conditionals on
>     sizeof and/or __builtin_choose_expr() with same_type() etc"
>
> but we haven't used it much since.
>
> The "seqprop" code for picking the right lock for seqlock is perhaps
> the main example, and staring at that code will make you go blind, so
> look away.

Looking at my patch:
https://lore.kernel.org/stable/20210913203201.1844253-1-ndesaulniers@google.com/
I don't think _Generic helps us in the case of dispatching based on
the result of is_signed_type() (the operands could undergo type
promotion, so we'd need lots of cases that are more concisely covered
by is_signed_type()). It could replace the nested checks in div_64
with nested _Generics, I think. Not sure it's a huge win for
readability.  Maybe cut the number of expansions of the parameters in
half though. Let me give it a try just to see what it looks like.
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 20:50                     ` Nick Desaulniers
@ 2021-09-13 21:13                       ` Nick Desaulniers
  2021-09-13 21:15                         ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 21:13 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 1:50 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Mon, Sep 13, 2021 at 1:42 PM Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
> >
> > On Mon, Sep 13, 2021 at 1:16 PM Nick Desaulniers
> > <ndesaulniers@google.com> wrote:
> > >
> > > Do we have access to _Generic in GCC 4.9?
> >
> > We've ended up using it unconditionally since last year, so yes.
>
> Sorry, grepping would have taken < 1s. I'm very lazy.
> http://threevirtues.com/
>
> >
> > In fact, the compiler version tests got removed when we raised the gcc
> > version requirement to 4.9 in commit 6ec4476ac825 ("Raise gcc version
> > requirement to 4.9"):
> >
> >    "In particular, raising the minimum to 4.9 means that we can now just
> >     assume _Generic() exists, which is likely the much better replacement
> >     for a lot of very convoluted built-time magic with conditionals on
> >     sizeof and/or __builtin_choose_expr() with same_type() etc"
> >
> > but we haven't used it much since.
> >
> > The "seqprop" code for picking the right lock for seqlock is perhaps
> > the main example, and staring at that code will make you go blind, so
> > look away.
>
> Looking at my patch:
> https://lore.kernel.org/stable/20210913203201.1844253-1-ndesaulniers@google.com/
> I don't think _Generic helps us in the case of dispatching based on
> the result of is_signed_type() (the operands could undergo type
> promotion, so we'd need lots of cases that are more concisely covered
> by is_signed_type()). It could replace the nested checks in div_64
> with nested _Generics, I think. Not sure it's a huge win for
> readability.  Maybe cut the number of expansions of the parameters in
> half though. Let me give it a try just to see what it looks like.

Is this more readable? Same line count.  I'm not sure if there's such
a thing as "fallthrough" between the "cases" of _Generic to minimize
duplication, or whether this could be factored further.  Needs lots
more () around macro param use and tab'ed out line endings...






diff --git a/include/linux/math64.h b/include/linux/math64.h
index 8652a8a35d70..8fc4d56a45b9 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -162,17 +162,17 @@ static inline s64 div_s64(s64 dividend, s32 divisor)
                div_u64(dividend, divisor));            \
 })

-#define __div_64(dividend) _Generic((divisor), \
-  s64: div64_x64,      \
-  u64: div64_x64,      \
-  default: div_x64)
+#define __div_64(dividend, divisor) _Generic((divisor),        \
+  s64: div64_x64(dividend, divisor),   \
+  u64: div64_x64(dividend, divisor),   \
+  default: div_x64(dividend, divisor))

 #define div_64(dividend, divisor) ({
         \
        BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u64),
         \
                         "128b div unsupported");
         \
        _Generic((dividend),    \
-               s64: __div_64(dividend)(dividend, divisor),     \
-               u64: __div_64(dividend)(dividend, divisor),     \
+               s64: __div_64(dividend, divisor),       \
+               u64: __div_64(dividend, divisor),       \
                default: dividend / divisor);   \
 })

-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply related	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 21:13                       ` Nick Desaulniers
@ 2021-09-13 21:15                         ` Nick Desaulniers
  2021-09-13 23:00                           ` Linus Torvalds
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 21:15 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 2:13 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Mon, Sep 13, 2021 at 1:50 PM Nick Desaulniers
> <ndesaulniers@google.com> wrote:
> >
> > On Mon, Sep 13, 2021 at 1:42 PM Linus Torvalds
> > <torvalds@linux-foundation.org> wrote:
> > >
> > > On Mon, Sep 13, 2021 at 1:16 PM Nick Desaulniers
> > > <ndesaulniers@google.com> wrote:
> > > >
> > > > Do we have access to _Generic in GCC 4.9?
> > >
> > > We've ended up using it unconditionally since last year, so yes.
> >
> > Sorry, grepping would have taken < 1s. I'm very lazy.
> > http://threevirtues.com/
> >
> > >
> > > In fact, the compiler version tests got removed when we raised the gcc
> > > version requirement to 4.9 in commit 6ec4476ac825 ("Raise gcc version
> > > requirement to 4.9"):
> > >
> > >    "In particular, raising the minimum to 4.9 means that we can now just
> > >     assume _Generic() exists, which is likely the much better replacement
> > >     for a lot of very convoluted built-time magic with conditionals on
> > >     sizeof and/or __builtin_choose_expr() with same_type() etc"
> > >
> > > but we haven't used it much since.
> > >
> > > The "seqprop" code for picking the right lock for seqlock is perhaps
> > > the main example, and staring at that code will make you go blind, so
> > > look away.
> >
> > Looking at my patch:
> > https://lore.kernel.org/stable/20210913203201.1844253-1-ndesaulniers@google.com/
> > I don't think _Generic helps us in the case of dispatching based on
> > the result of is_signed_type() (the operands could undergo type
> > promotion, so we'd need lots of cases that are more concisely covered
> > by is_signed_type()). It could replace the nested checks in div_64
> > with nested _Generics, I think. Not sure it's a huge win for
> > readability.  Maybe cut the number of expansions of the parameters in
> > half though. Let me give it a try just to see what it looks like.
>
> Is this more readable? Same line count.  I'm not sure if there's such
> a thing as "fallthrough" between the "cases" of _Generic to minimize
> duplication, or whether this could be factored further.  Needs lots
> more () around macro param use and tab'ed out line endings...

Sorry wrong diff:
diff --git a/include/linux/math64.h b/include/linux/math64.h
index bc9c12c168d0..8fc4d56a45b9 100644
--- a/include/linux/math64.h
+++ b/include/linux/math64.h
@@ -162,18 +162,18 @@ static inline s64 div_s64(s64 dividend, s32 divisor)
                div_u64(dividend, divisor));            \
 })

+#define __div_64(dividend, divisor) _Generic((divisor),        \
+  s64: div64_x64(dividend, divisor),   \
+  u64: div64_x64(dividend, divisor),   \
+  default: div_x64(dividend, divisor))
+
 #define div_64(dividend, divisor) ({
         \
        BUILD_BUG_ON_MSG(sizeof(dividend) > sizeof(u64),
         \
                         "128b div unsupported");
         \
-       __builtin_choose_expr(
         \
-               __builtin_types_compatible_p(typeof(dividend), s64) ||
         \
-               __builtin_types_compatible_p(typeof(dividend), u64),
         \
-               __builtin_choose_expr(
         \
-                       __builtin_types_compatible_p(typeof(divisor),
s64) ||   \
-                       __builtin_types_compatible_p(typeof(divisor),
u64),     \
-                       div64_x64(dividend, divisor),
         \
-                       div_x64(dividend, divisor)),
         \
-               dividend / divisor);
         \
+       _Generic((dividend),    \
+               s64: __div_64(dividend, divisor),       \
+               u64: __div_64(dividend, divisor),       \
+               default: dividend / divisor);   \
 })
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply related	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 21:15                         ` Nick Desaulniers
@ 2021-09-13 23:00                           ` Linus Torvalds
  2021-09-13 23:23                             ` Nick Desaulniers
  0 siblings, 1 reply; 383+ messages in thread
From: Linus Torvalds @ 2021-09-13 23:00 UTC (permalink / raw)
  To: Nick Desaulniers
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 2:15 PM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> Sorry wrong diff:

Well, this second diff was seriously whitespace-damaged and hard to
read, but while it seems to be the same number of lines, it sure looks
a lot more readable in this format.

Except I think that

                default: dividend / divisor);

should really have parentheses around both of those macro arguments.

That's a preexisting problem, but it should be fixed while at it.

I'm also not sure why that (again, preexisting) BUILD_BUG_ON_MSG()
only checks the size of the dividend, not the divisor. Very strange.
But probably not worth worrying about.

               Linus

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 23:00                           ` Linus Torvalds
@ 2021-09-13 23:23                             ` Nick Desaulniers
  2021-09-14  2:13                               ` libaokun (A)
  0 siblings, 1 reply; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-13 23:23 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, Baokun Li, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 4:00 PM Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 2:15 PM Nick Desaulniers
> <ndesaulniers@google.com> wrote:
> >
> > Sorry wrong diff:
>
> Well, this second diff was seriously whitespace-damaged and hard to
> read, but while it seems to be the same number of lines, it sure looks
> a lot more readable in this format.
>
> Except I think that
>
>                 default: dividend / divisor);
>
> should really have parentheses around both of those macro arguments.
>
> That's a preexisting problem, but it should be fixed while at it.

Ok, I'll send a revised v2 based on _Generic; Rasmus can help review
when he's awake.

> I'm also not sure why that (again, preexisting) BUILD_BUG_ON_MSG()
> only checks the size of the dividend, not the divisor. Very strange.
> But probably not worth worrying about.

I sent a not-yet-applied diff of my not-yet-applied diff.  I was
playing with this last week, and IIRC we had divisors that were less
than 32b being promoted to int. But I'll test it some more.
-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-13 23:23                             ` Nick Desaulniers
@ 2021-09-14  2:13                               ` libaokun (A)
  2021-09-14  3:30                                 ` Nick Desaulniers
  2021-09-14  8:14                                 ` David Laight
  0 siblings, 2 replies; 383+ messages in thread
From: libaokun (A) @ 2021-09-14  2:13 UTC (permalink / raw)
  To: Nick Desaulniers, Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, open list, linux-stable, Hulk Robot,
	Josef Bacik, Jens Axboe, Sasha Levin, clang-built-linux,
	lkft-triage, llvm, Kees Cook

在 2021/9/14 7:23, Nick Desaulniers 写道:
> On Mon, Sep 13, 2021 at 4:00 PM Linus Torvalds
> <torvalds@linux-foundation.org> wrote:
>> On Mon, Sep 13, 2021 at 2:15 PM Nick Desaulniers
>> <ndesaulniers@google.com> wrote:
>>> Sorry wrong diff:
>> Well, this second diff was seriously whitespace-damaged and hard to
>> read, but while it seems to be the same number of lines, it sure looks
>> a lot more readable in this format.
>>
>> Except I think that
>>
>>                  default: dividend / divisor);
>>
>> should really have parentheses around both of those macro arguments.
>>
>> That's a preexisting problem, but it should be fixed while at it.
> Ok, I'll send a revised v2 based on _Generic; Rasmus can help review
> when he's awake.
>
>> I'm also not sure why that (again, preexisting) BUILD_BUG_ON_MSG()
>> only checks the size of the dividend, not the divisor. Very strange.
>> But probably not worth worrying about.
> I sent a not-yet-applied diff of my not-yet-applied diff.  I was
> playing with this last week, and IIRC we had divisors that were less
> than 32b being promoted to int. But I'll test it some more.

How about deleting the check_mul_overflow in the __nbd_ioctl as follows?

diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 5170a630778d..f404e0540476 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1393,7 +1393,6 @@ static int __nbd_ioctl(struct block_device *bdev, 
struct nbd_device *nbd,
                        unsigned int cmd, unsigned long arg)
  {
         struct nbd_config *config = nbd->config;
-       loff_t bytesize;

         switch (cmd) {
         case NBD_DISCONNECT:
@@ -1408,9 +1407,10 @@ static int __nbd_ioctl(struct block_device *bdev, 
struct nbd_device *nbd,
         case NBD_SET_SIZE:
                 return nbd_set_size(nbd, arg, config->blksize);
         case NBD_SET_SIZE_BLOCKS:
-               if (check_mul_overflow((loff_t)arg, config->blksize, 
&bytesize))
+               if (arg && (LLONG_MAX / arg <= config->blksize))
                         return -EINVAL;
-               return nbd_set_size(nbd, bytesize, config->blksize);
+               return nbd_set_size(nbd, arg * config->blksize,
+                                   config->blksize);
         case NBD_SET_TIMEOUT:
                 nbd_set_cmd_timeout(nbd, arg);
                 return 0;
--
2.31.1

-- 
With Best Regards,
Baokun Li




^ permalink raw reply related	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-14  2:13                               ` libaokun (A)
@ 2021-09-14  3:30                                 ` Nick Desaulniers
  2021-09-14  8:14                                 ` David Laight
  1 sibling, 0 replies; 383+ messages in thread
From: Nick Desaulniers @ 2021-09-14  3:30 UTC (permalink / raw)
  To: libaokun (A)
  Cc: Linus Torvalds, Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman,
	Naresh Kamboju, Nathan Chancellor, open list, linux-stable,
	Hulk Robot, Josef Bacik, Jens Axboe, Sasha Levin,
	clang-built-linux, lkft-triage, llvm, Kees Cook

On Mon, Sep 13, 2021 at 7:13 PM libaokun (A) <libaokun1@huawei.com> wrote:
>
> 在 2021/9/14 7:23, Nick Desaulniers 写道:
> > On Mon, Sep 13, 2021 at 4:00 PM Linus Torvalds
> > <torvalds@linux-foundation.org> wrote:
> >> On Mon, Sep 13, 2021 at 2:15 PM Nick Desaulniers
> >> <ndesaulniers@google.com> wrote:
> >>> Sorry wrong diff:
> >> Well, this second diff was seriously whitespace-damaged and hard to
> >> read, but while it seems to be the same number of lines, it sure looks
> >> a lot more readable in this format.
> >>
> >> Except I think that
> >>
> >>                  default: dividend / divisor);
> >>
> >> should really have parentheses around both of those macro arguments.
> >>
> >> That's a preexisting problem, but it should be fixed while at it.
> > Ok, I'll send a revised v2 based on _Generic; Rasmus can help review
> > when he's awake.
> >
> >> I'm also not sure why that (again, preexisting) BUILD_BUG_ON_MSG()
> >> only checks the size of the dividend, not the divisor. Very strange.
> >> But probably not worth worrying about.
> > I sent a not-yet-applied diff of my not-yet-applied diff.  I was
> > playing with this last week, and IIRC we had divisors that were less
> > than 32b being promoted to int. But I'll test it some more.
>
> How about deleting the check_mul_overflow in the __nbd_ioctl as follows?
>
> diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
> index 5170a630778d..f404e0540476 100644
> --- a/drivers/block/nbd.c
> +++ b/drivers/block/nbd.c
> @@ -1393,7 +1393,6 @@ static int __nbd_ioctl(struct block_device *bdev,
> struct nbd_device *nbd,
>                         unsigned int cmd, unsigned long arg)
>   {
>          struct nbd_config *config = nbd->config;
> -       loff_t bytesize;
>
>          switch (cmd) {
>          case NBD_DISCONNECT:
> @@ -1408,9 +1407,10 @@ static int __nbd_ioctl(struct block_device *bdev,
> struct nbd_device *nbd,
>          case NBD_SET_SIZE:
>                  return nbd_set_size(nbd, arg, config->blksize);
>          case NBD_SET_SIZE_BLOCKS:
> -               if (check_mul_overflow((loff_t)arg, config->blksize,
> &bytesize))
> +               if (arg && (LLONG_MAX / arg <= config->blksize))
>                          return -EINVAL;

64b division is going to need do_div(), yeah? Besides, this is likely
to pop up again for other callers of check_mul_overflow(), might as
well fix it.

> -               return nbd_set_size(nbd, bytesize, config->blksize);
> +               return nbd_set_size(nbd, arg * config->blksize,
> +                                   config->blksize);
>          case NBD_SET_TIMEOUT:
>                  nbd_set_cmd_timeout(nbd, arg);
>                  return 0;
> --
> 2.31.1
>
> --
> With Best Regards,
> Baokun Li
>
>
>


-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 383+ messages in thread

* RE: [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl()
  2021-09-14  2:13                               ` libaokun (A)
  2021-09-14  3:30                                 ` Nick Desaulniers
@ 2021-09-14  8:14                                 ` David Laight
  1 sibling, 0 replies; 383+ messages in thread
From: David Laight @ 2021-09-14  8:14 UTC (permalink / raw)
  To: 'libaokun (A)', Nick Desaulniers, Linus Torvalds
  Cc: Arnd Bergmann, Sedat Dilek, Greg Kroah-Hartman, Naresh Kamboju,
	Nathan Chancellor, open list, linux-stable, Hulk Robot,
	Josef Bacik, Jens Axboe, Sasha Levin, clang-built-linux,
	lkft-triage, llvm, Kees Cook

...
>          case NBD_SET_SIZE:
>                  return nbd_set_size(nbd, arg, config->blksize);
>          case NBD_SET_SIZE_BLOCKS:
> -               if (check_mul_overflow((loff_t)arg, config->blksize,
> &bytesize))
> +               if (arg && (LLONG_MAX / arg <= config->blksize))
>                          return -EINVAL;
> -               return nbd_set_size(nbd, bytesize, config->blksize);
> +               return nbd_set_size(nbd, arg * config->blksize,
> +                                   config->blksize);

Shouldn't there just be sanity bound checks on 'config->blksize' and
'arg' so that the product is never going to overflow?

It isn't as though any values near the overflow limit are sane.

I suspect you could check config->blksize <= 64k && arg <= 32k
and even that would be generous.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (336 preceding siblings ...)
  2021-09-13 20:06 ` Shuah Khan
@ 2021-09-14  9:23 ` Naresh Kamboju
  2021-09-14 15:57 ` Guenter Roeck
  2021-09-14 16:08 ` Justin Forbes
  339 siblings, 0 replies; 383+ messages in thread
From: Naresh Kamboju @ 2021-09-14  9:23 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Shuah Khan, Florian Fainelli, patches, lkft-triage,
	Jon Hunter, linux-stable, Pavel Machek, Andrew Morton,
	Linus Torvalds, Guenter Roeck

On Mon, 13 Sept 2021 at 19:16, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
Regressions on arm.

ERROR: modpost: __mulodi4 [drivers/block/nbd.ko] undefined!

arm clang-10, clang-11, clang-12 and clang-13 builds failed
on stable rc 5.14 and 5.13 with following arm configs,
  - footbridge_defconfig
  - mini2440_defconfig
  - s3c2410_defconfig

Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>

## Build
* kernel: 5.14.4-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.14.y
* git commit: 03f7369f8044e5ef52c269cbefefb634573e3cf8
* git describe: v5.14.3-335-g03f7369f8044
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.14.y/build/v5.14.3-335-g03f7369f8044

## Regressions (compared to v5.14.3-295-gfbfe8bda5718)
arm clang-10, clang-11, clang-12 and clang-13 builds failed
on stable rc 5.14 and 5.13 with following arm configs,
  - footbridge_defconfig
  - mini2440_defconfig
  - s3c2410_defconfig

## No fixes (compared to v5.14.3-295-gfbfe8bda5718)

## Test result summary
total: 91273, pass: 75879, fail: 1142, skip: 13231, xfail: 1021

## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 289 total, 277 passed, 12 failed
* arm64: 39 total, 39 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 38 total, 38 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 51 total, 51 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 36 total, 35 passed, 1 failed
* riscv: 30 total, 30 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x15: 1 total, 0 passed, 1 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 39 total, 39 passed, 0 failed

## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* timesync-off
* v4l2-compliance

--
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (337 preceding siblings ...)
  2021-09-14  9:23 ` Naresh Kamboju
@ 2021-09-14 15:57 ` Guenter Roeck
  2021-09-14 16:08 ` Justin Forbes
  339 siblings, 0 replies; 383+ messages in thread
From: Guenter Roeck @ 2021-09-14 15:57 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel,
	jonathanh, f.fainelli, stable

On Mon, Sep 13, 2021 at 03:10:54PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
> 

Build results:
	total: 154 pass: 154 fail: 0
Qemu test results:
	total: 480 pass: 480 fail: 0

Tested-by: Guenter Roeck <linux@roeck-us.net>

Guenter

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 000/334] 5.14.4-rc1 review
  2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
                   ` (338 preceding siblings ...)
  2021-09-14 15:57 ` Guenter Roeck
@ 2021-09-14 16:08 ` Justin Forbes
  339 siblings, 0 replies; 383+ messages in thread
From: Justin Forbes @ 2021-09-14 16:08 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, linux, shuah, patches, lkft-triage,
	pavel, jonathanh, f.fainelli, stable

On Mon, Sep 13, 2021 at 03:10:54PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.14.4 release.
> There are 334 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 15 Sep 2021 13:10:21 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.4-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Tested rc1 against the Fedora build system (aarch64, armv7, ppc64le,
s390x, x86_64), and boot tested x86_64. No regressions noted.

Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-13 16:31       ` Doug Anderson
@ 2021-09-14 16:27         ` Greg Kroah-Hartman
  2021-09-14 17:02           ` Sasha Levin
  2021-09-14 17:24           ` Doug Anderson
  0 siblings, 2 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-14 16:27 UTC (permalink / raw)
  To: Doug Anderson; +Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

On Mon, Sep 13, 2021 at 09:31:03AM -0700, Doug Anderson wrote:
> Hi,
> 
> On Mon, Sep 13, 2021 at 9:09 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
> > > Hi,
> > >
> > > On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > From: Douglas Anderson <dianders@chromium.org>
> > > >
> > > > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
> > > >
> > > > This is really just a revert of commit 58074b08c04a ("drm/bridge:
> > > > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
> > > >
> > > > The old code failed to read the EDID properly in a very important
> > > > case: before the bridge's pre_enable() was called. The way things need
> > > > to work:
> > > > 1. Read the EDID.
> > > > 2. Based on the EDID, decide on video settings and pixel clock.
> > > > 3. Enable the bridge w/ the desired settings.
> > > >
> > > > The way things were working:
> > > > 1. Try to read the EDID but fail; fall back to hardcoded values.
> > > > 2. Based on hardcoded values, decide on video settings and pixel clock.
> > > > 3. Enable the bridge w/ the desired settings.
> > > > 4. Try again to read the EDID, it works now!
> > > > 5. Realize that the hardcoded settings weren't quite right.
> > > > 6. Disable / reenable the bridge w/ the right settings.
> > > >
> > > > The reasons for the failures were twofold:
> > > > a) Since we never ran the bridge chip's pre-enable then we never set
> > > >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
> > > >    to go out on the bus and communicate with the panel.
> > > > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
> > > >    if the panel wasn't on.
> > > >
> > > > Instead of reverting the code, we could fix it to set the HPD bit and
> > > > also power on the panel. However, it also works nicely to just let the
> > > > panel code read the EDID. Now that we've split the driver up we can
> > > > expose the DDC AUX channel bus to the panel node. The panel can take
> > > > charge of reading the EDID.
> > > >
> > > > NOTE: in order for things to work, anyone that needs to read the EDID
> > > > will need to instantiate their panel using the new DP AUX bus (AKA by
> > > > listing their panel under the "aux-bus" node of the bridge chip in the
> > > > device tree).
> > > >
> > > > In the future if we want to use the bridge chip to provide a full
> > > > external DP port (which won't have a panel) then we will have to
> > > > conditinally add EDID reading back in.
> > > >
> > > > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> > > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > > > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> > > > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> > > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > > > ---
> > > >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
> > > >  1 file changed, 22 deletions(-)
> > >
> > > I guess it's not a huge deal, but I did respond to Sasha and request
> > > that this patch be dropped from the stable queue unless the whole big
> > > pile of patches was being backported. See:
> > >
> > > https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
> > >
> > > I said:
> > >
> > > > I would suggest against backporting this one unless you're going to
> > > > backport the whole pile of DP AUX bus patches, which probably doesn't
> > > > make sense for stable. Even though the old EDID reading was broken for
> > > > the first read, it still worked for later reads. ...and the first read
> > > . didn't crash or anything--it just timed out.
> >
> > I see a "bunch" of patches for this driver in this -rc, did Sasha not
> > get them all?  If not, I can drop this one, but maybe it was needed for
> > the follow-on patches?
> 
> It's been a long journey trying to make this bridge work better. I
> think the easiest way to say it is that if you don't have the parent
> of ${SUBJECT} patch, AKA:
> 
> e0bbcc6233f7 drm/bridge: ti-sn65dsi86: Add support for the DP AUX bus
> 
> ...then you don't have DP AUX bus support and you shouldn't take
> ${SUBJECT} patch. If you have that patch and it compiles / builds then
> it means that you have all the proper dependencies. However, there are
> _a lot_ of dependencies and I wouldn't suggest picking them all to
> stable unless it's critical for someone.

I tried to drop this one, and it turned out to be a depandancy for
another patch for this driver.  And that was another dependancy.  So
I've now dropped all of these from the queue.

Here are the commits I dropped.  If you think any should be added back,
please let us know:

05a7f4a8dff1 ("devlink: Break parameter notification sequence to be before/after unload/load driver")
e183bf31cf0d ("drm/bridge: ti-sn65dsi86: Add some 100 us delays")
c7782443a889 ("drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors")
a70e558c1510 ("drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC")
acb06210b096 ("drm/bridge: ti-sn65dsi86: Fix power off sequence")
4c1b3d94bf63 ("drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()")
4e5763f03e10 ("drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge")

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-14 16:27         ` Greg Kroah-Hartman
@ 2021-09-14 17:02           ` Sasha Levin
  2021-09-14 17:24           ` Doug Anderson
  1 sibling, 0 replies; 383+ messages in thread
From: Sasha Levin @ 2021-09-14 17:02 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Doug Anderson, LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson

On Tue, Sep 14, 2021 at 06:27:08PM +0200, Greg Kroah-Hartman wrote:
>On Mon, Sep 13, 2021 at 09:31:03AM -0700, Doug Anderson wrote:
>> Hi,
>>
>> On Mon, Sep 13, 2021 at 9:09 AM Greg Kroah-Hartman
>> <gregkh@linuxfoundation.org> wrote:
>> >
>> > On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
>> > > Hi,
>> > >
>> > > On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
>> > > <gregkh@linuxfoundation.org> wrote:
>> > > >
>> > > > From: Douglas Anderson <dianders@chromium.org>
>> > > >
>> > > > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
>> > > >
>> > > > This is really just a revert of commit 58074b08c04a ("drm/bridge:
>> > > > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
>> > > >
>> > > > The old code failed to read the EDID properly in a very important
>> > > > case: before the bridge's pre_enable() was called. The way things need
>> > > > to work:
>> > > > 1. Read the EDID.
>> > > > 2. Based on the EDID, decide on video settings and pixel clock.
>> > > > 3. Enable the bridge w/ the desired settings.
>> > > >
>> > > > The way things were working:
>> > > > 1. Try to read the EDID but fail; fall back to hardcoded values.
>> > > > 2. Based on hardcoded values, decide on video settings and pixel clock.
>> > > > 3. Enable the bridge w/ the desired settings.
>> > > > 4. Try again to read the EDID, it works now!
>> > > > 5. Realize that the hardcoded settings weren't quite right.
>> > > > 6. Disable / reenable the bridge w/ the right settings.
>> > > >
>> > > > The reasons for the failures were twofold:
>> > > > a) Since we never ran the bridge chip's pre-enable then we never set
>> > > >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
>> > > >    to go out on the bus and communicate with the panel.
>> > > > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
>> > > >    if the panel wasn't on.
>> > > >
>> > > > Instead of reverting the code, we could fix it to set the HPD bit and
>> > > > also power on the panel. However, it also works nicely to just let the
>> > > > panel code read the EDID. Now that we've split the driver up we can
>> > > > expose the DDC AUX channel bus to the panel node. The panel can take
>> > > > charge of reading the EDID.
>> > > >
>> > > > NOTE: in order for things to work, anyone that needs to read the EDID
>> > > > will need to instantiate their panel using the new DP AUX bus (AKA by
>> > > > listing their panel under the "aux-bus" node of the bridge chip in the
>> > > > device tree).
>> > > >
>> > > > In the future if we want to use the bridge chip to provide a full
>> > > > external DP port (which won't have a panel) then we will have to
>> > > > conditinally add EDID reading back in.
>> > > >
>> > > > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
>> > > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
>> > > > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
>> > > > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
>> > > > Signed-off-by: Sasha Levin <sashal@kernel.org>
>> > > > ---
>> > > >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
>> > > >  1 file changed, 22 deletions(-)
>> > >
>> > > I guess it's not a huge deal, but I did respond to Sasha and request
>> > > that this patch be dropped from the stable queue unless the whole big
>> > > pile of patches was being backported. See:
>> > >
>> > > https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
>> > >
>> > > I said:
>> > >
>> > > > I would suggest against backporting this one unless you're going to
>> > > > backport the whole pile of DP AUX bus patches, which probably doesn't
>> > > > make sense for stable. Even though the old EDID reading was broken for
>> > > > the first read, it still worked for later reads. ...and the first read
>> > > . didn't crash or anything--it just timed out.
>> >
>> > I see a "bunch" of patches for this driver in this -rc, did Sasha not
>> > get them all?  If not, I can drop this one, but maybe it was needed for
>> > the follow-on patches?
>>
>> It's been a long journey trying to make this bridge work better. I
>> think the easiest way to say it is that if you don't have the parent
>> of ${SUBJECT} patch, AKA:
>>
>> e0bbcc6233f7 drm/bridge: ti-sn65dsi86: Add support for the DP AUX bus
>>
>> ...then you don't have DP AUX bus support and you shouldn't take
>> ${SUBJECT} patch. If you have that patch and it compiles / builds then
>> it means that you have all the proper dependencies. However, there are
>> _a lot_ of dependencies and I wouldn't suggest picking them all to
>> stable unless it's critical for someone.
>
>I tried to drop this one, and it turned out to be a depandancy for
>another patch for this driver.  And that was another dependancy.  So
>I've now dropped all of these from the queue.
>
>Here are the commits I dropped.  If you think any should be added back,
>please let us know:
>
>05a7f4a8dff1 ("devlink: Break parameter notification sequence to be before/after unload/load driver")
>e183bf31cf0d ("drm/bridge: ti-sn65dsi86: Add some 100 us delays")
>c7782443a889 ("drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors")
>a70e558c1510 ("drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC")
>acb06210b096 ("drm/bridge: ti-sn65dsi86: Fix power off sequence")
>4c1b3d94bf63 ("drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()")
>4e5763f03e10 ("drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge")

Thanks! And yes, I dropped the patch based on the request but it snuck
in as a dependency for a few patches with a Fixes tag.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-14 16:27         ` Greg Kroah-Hartman
  2021-09-14 17:02           ` Sasha Levin
@ 2021-09-14 17:24           ` Doug Anderson
  2021-09-14 17:34             ` Greg Kroah-Hartman
  1 sibling, 1 reply; 383+ messages in thread
From: Doug Anderson @ 2021-09-14 17:24 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

Hi,

On Tue, Sep 14, 2021 at 9:27 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Sep 13, 2021 at 09:31:03AM -0700, Doug Anderson wrote:
> > Hi,
> >
> > On Mon, Sep 13, 2021 at 9:09 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > >
> > > On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
> > > > Hi,
> > > >
> > > > On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
> > > > <gregkh@linuxfoundation.org> wrote:
> > > > >
> > > > > From: Douglas Anderson <dianders@chromium.org>
> > > > >
> > > > > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
> > > > >
> > > > > This is really just a revert of commit 58074b08c04a ("drm/bridge:
> > > > > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
> > > > >
> > > > > The old code failed to read the EDID properly in a very important
> > > > > case: before the bridge's pre_enable() was called. The way things need
> > > > > to work:
> > > > > 1. Read the EDID.
> > > > > 2. Based on the EDID, decide on video settings and pixel clock.
> > > > > 3. Enable the bridge w/ the desired settings.
> > > > >
> > > > > The way things were working:
> > > > > 1. Try to read the EDID but fail; fall back to hardcoded values.
> > > > > 2. Based on hardcoded values, decide on video settings and pixel clock.
> > > > > 3. Enable the bridge w/ the desired settings.
> > > > > 4. Try again to read the EDID, it works now!
> > > > > 5. Realize that the hardcoded settings weren't quite right.
> > > > > 6. Disable / reenable the bridge w/ the right settings.
> > > > >
> > > > > The reasons for the failures were twofold:
> > > > > a) Since we never ran the bridge chip's pre-enable then we never set
> > > > >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
> > > > >    to go out on the bus and communicate with the panel.
> > > > > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
> > > > >    if the panel wasn't on.
> > > > >
> > > > > Instead of reverting the code, we could fix it to set the HPD bit and
> > > > > also power on the panel. However, it also works nicely to just let the
> > > > > panel code read the EDID. Now that we've split the driver up we can
> > > > > expose the DDC AUX channel bus to the panel node. The panel can take
> > > > > charge of reading the EDID.
> > > > >
> > > > > NOTE: in order for things to work, anyone that needs to read the EDID
> > > > > will need to instantiate their panel using the new DP AUX bus (AKA by
> > > > > listing their panel under the "aux-bus" node of the bridge chip in the
> > > > > device tree).
> > > > >
> > > > > In the future if we want to use the bridge chip to provide a full
> > > > > external DP port (which won't have a panel) then we will have to
> > > > > conditinally add EDID reading back in.
> > > > >
> > > > > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> > > > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > > > > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> > > > > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> > > > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > > > > ---
> > > > >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
> > > > >  1 file changed, 22 deletions(-)
> > > >
> > > > I guess it's not a huge deal, but I did respond to Sasha and request
> > > > that this patch be dropped from the stable queue unless the whole big
> > > > pile of patches was being backported. See:
> > > >
> > > > https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
> > > >
> > > > I said:
> > > >
> > > > > I would suggest against backporting this one unless you're going to
> > > > > backport the whole pile of DP AUX bus patches, which probably doesn't
> > > > > make sense for stable. Even though the old EDID reading was broken for
> > > > > the first read, it still worked for later reads. ...and the first read
> > > > . didn't crash or anything--it just timed out.
> > >
> > > I see a "bunch" of patches for this driver in this -rc, did Sasha not
> > > get them all?  If not, I can drop this one, but maybe it was needed for
> > > the follow-on patches?
> >
> > It's been a long journey trying to make this bridge work better. I
> > think the easiest way to say it is that if you don't have the parent
> > of ${SUBJECT} patch, AKA:
> >
> > e0bbcc6233f7 drm/bridge: ti-sn65dsi86: Add support for the DP AUX bus
> >
> > ...then you don't have DP AUX bus support and you shouldn't take
> > ${SUBJECT} patch. If you have that patch and it compiles / builds then
> > it means that you have all the proper dependencies. However, there are
> > _a lot_ of dependencies and I wouldn't suggest picking them all to
> > stable unless it's critical for someone.
>
> I tried to drop this one, and it turned out to be a depandancy for
> another patch for this driver.  And that was another dependancy.  So
> I've now dropped all of these from the queue.

Ugh. :(


> Here are the commits I dropped.  If you think any should be added back,
> please let us know:
>
> 05a7f4a8dff1 ("devlink: Break parameter notification sequence to be before/after unload/load driver")

I don't understand what the "devlink" patch had to do with
ti-sn65dsi86. I'll assume you didn't intend to have it in your list.


> e183bf31cf0d ("drm/bridge: ti-sn65dsi86: Add some 100 us delays")
> c7782443a889 ("drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors")
> a70e558c1510 ("drm/bridge: ti-sn65dsi86: Don't read EDID blob over DDC")
> acb06210b096 ("drm/bridge: ti-sn65dsi86: Fix power off sequence")
> 4c1b3d94bf63 ("drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe()")
> 4e5763f03e10 ("drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge")

I'd say it's OK to drop these. If someone demonstrates a need for them
on stable channel then I can help with backporting, but otherwise I
can't see that it's worth it. Basically:

1. I think ${SUBJECT} patch without full DP AUX support for people
could cause a real regression if anyone is using this bridge chip on
5.14 stable.

2. I think picking back full DP AUX support is too heavy for a
stable-channel backport without a demonstrated need.

3. Of the above patches, only one fixes a problem that was observed on
real hardware ("Fix power off sequence"). That was only seen on a
panel that _requires_ the full DP AUX support in order to work. Other
ones are fixes based on code inspection, cleanups, or fixes for other
patches in the series there.

-Doug

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC
  2021-09-14 17:24           ` Doug Anderson
@ 2021-09-14 17:34             ` Greg Kroah-Hartman
  0 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-14 17:34 UTC (permalink / raw)
  To: Doug Anderson; +Cc: LKML, # 4.0+, Andrzej Hajda, Bjorn Andersson, Sasha Levin

On Tue, Sep 14, 2021 at 10:24:35AM -0700, Doug Anderson wrote:
> Hi,
> 
> On Tue, Sep 14, 2021 at 9:27 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Mon, Sep 13, 2021 at 09:31:03AM -0700, Doug Anderson wrote:
> > > Hi,
> > >
> > > On Mon, Sep 13, 2021 at 9:09 AM Greg Kroah-Hartman
> > > <gregkh@linuxfoundation.org> wrote:
> > > >
> > > > On Mon, Sep 13, 2021 at 06:57:20AM -0700, Doug Anderson wrote:
> > > > > Hi,
> > > > >
> > > > > On Mon, Sep 13, 2021 at 6:51 AM Greg Kroah-Hartman
> > > > > <gregkh@linuxfoundation.org> wrote:
> > > > > >
> > > > > > From: Douglas Anderson <dianders@chromium.org>
> > > > > >
> > > > > > [ Upstream commit a70e558c151043ce46a5e5999f4310e0b3551f57 ]
> > > > > >
> > > > > > This is really just a revert of commit 58074b08c04a ("drm/bridge:
> > > > > > ti-sn65dsi86: Read EDID blob over DDC"), resolving conflicts.
> > > > > >
> > > > > > The old code failed to read the EDID properly in a very important
> > > > > > case: before the bridge's pre_enable() was called. The way things need
> > > > > > to work:
> > > > > > 1. Read the EDID.
> > > > > > 2. Based on the EDID, decide on video settings and pixel clock.
> > > > > > 3. Enable the bridge w/ the desired settings.
> > > > > >
> > > > > > The way things were working:
> > > > > > 1. Try to read the EDID but fail; fall back to hardcoded values.
> > > > > > 2. Based on hardcoded values, decide on video settings and pixel clock.
> > > > > > 3. Enable the bridge w/ the desired settings.
> > > > > > 4. Try again to read the EDID, it works now!
> > > > > > 5. Realize that the hardcoded settings weren't quite right.
> > > > > > 6. Disable / reenable the bridge w/ the right settings.
> > > > > >
> > > > > > The reasons for the failures were twofold:
> > > > > > a) Since we never ran the bridge chip's pre-enable then we never set
> > > > > >    the bit to ignore HPD. This meant the bridge chip didn't even _try_
> > > > > >    to go out on the bus and communicate with the panel.
> > > > > > b) Even if we fixed things to ignore HPD, the EDID still wouldn't read
> > > > > >    if the panel wasn't on.
> > > > > >
> > > > > > Instead of reverting the code, we could fix it to set the HPD bit and
> > > > > > also power on the panel. However, it also works nicely to just let the
> > > > > > panel code read the EDID. Now that we've split the driver up we can
> > > > > > expose the DDC AUX channel bus to the panel node. The panel can take
> > > > > > charge of reading the EDID.
> > > > > >
> > > > > > NOTE: in order for things to work, anyone that needs to read the EDID
> > > > > > will need to instantiate their panel using the new DP AUX bus (AKA by
> > > > > > listing their panel under the "aux-bus" node of the bridge chip in the
> > > > > > device tree).
> > > > > >
> > > > > > In the future if we want to use the bridge chip to provide a full
> > > > > > external DP port (which won't have a panel) then we will have to
> > > > > > conditinally add EDID reading back in.
> > > > > >
> > > > > > Suggested-by: Andrzej Hajda <a.hajda@samsung.com>
> > > > > > Signed-off-by: Douglas Anderson <dianders@chromium.org>
> > > > > > Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
> > > > > > Link: https://patchwork.freedesktop.org/patch/msgid/20210611101711.v10.9.I9330684c25f65bb318eff57f0616500f83eac3cc@changeid
> > > > > > Signed-off-by: Sasha Levin <sashal@kernel.org>
> > > > > > ---
> > > > > >  drivers/gpu/drm/bridge/ti-sn65dsi86.c | 22 ----------------------
> > > > > >  1 file changed, 22 deletions(-)
> > > > >
> > > > > I guess it's not a huge deal, but I did respond to Sasha and request
> > > > > that this patch be dropped from the stable queue unless the whole big
> > > > > pile of patches was being backported. See:
> > > > >
> > > > > https://lore.kernel.org/lkml/CAD=FV=U2dGjeEzp+K1vnLTj8oPJ-GKBTTKz2XQ1OZ7QF_sTHuw@mail.gmail.com/
> > > > >
> > > > > I said:
> > > > >
> > > > > > I would suggest against backporting this one unless you're going to
> > > > > > backport the whole pile of DP AUX bus patches, which probably doesn't
> > > > > > make sense for stable. Even though the old EDID reading was broken for
> > > > > > the first read, it still worked for later reads. ...and the first read
> > > > > . didn't crash or anything--it just timed out.
> > > >
> > > > I see a "bunch" of patches for this driver in this -rc, did Sasha not
> > > > get them all?  If not, I can drop this one, but maybe it was needed for
> > > > the follow-on patches?
> > >
> > > It's been a long journey trying to make this bridge work better. I
> > > think the easiest way to say it is that if you don't have the parent
> > > of ${SUBJECT} patch, AKA:
> > >
> > > e0bbcc6233f7 drm/bridge: ti-sn65dsi86: Add support for the DP AUX bus
> > >
> > > ...then you don't have DP AUX bus support and you shouldn't take
> > > ${SUBJECT} patch. If you have that patch and it compiles / builds then
> > > it means that you have all the proper dependencies. However, there are
> > > _a lot_ of dependencies and I wouldn't suggest picking them all to
> > > stable unless it's critical for someone.
> >
> > I tried to drop this one, and it turned out to be a depandancy for
> > another patch for this driver.  And that was another dependancy.  So
> > I've now dropped all of these from the queue.
> 
> Ugh. :(
> 
> 
> > Here are the commits I dropped.  If you think any should be added back,
> > please let us know:
> >
> > 05a7f4a8dff1 ("devlink: Break parameter notification sequence to be before/after unload/load driver")
> 
> I don't understand what the "devlink" patch had to do with
> ti-sn65dsi86. I'll assume you didn't intend to have it in your list.

Odd, good point, I think I messed up in removing too many patches, let
me go add that back...

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-13 13:15 ` [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns() Greg Kroah-Hartman
@ 2021-09-15 19:00   ` Arnd Bergmann
  2021-09-16  9:12     ` Greg Kroah-Hartman
                       ` (2 more replies)
  0 siblings, 3 replies; 383+ messages in thread
From: Arnd Bergmann @ 2021-09-15 19:00 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Linux Kernel Mailing List, # 3.4.x, Lukas Hannen, Thomas Gleixner

On Tue, Sep 14, 2021 at 1:22 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>  /*
>   * Limits for settimeofday():
> @@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett
>   */
>  static inline s64 timespec64_to_ns(const struct timespec64 *ts)
>  {
> -       /* Prevent multiplication overflow */
> -       if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
> +       /* Prevent multiplication overflow / underflow */
> +       if (ts->tv_sec >= KTIME_SEC_MAX)
>                 return KTIME_MAX;
>
> +       if (ts->tv_sec <= KTIME_SEC_MIN)
> +               return KTIME_MIN;
> +

I just saw this get merged for the stable kernels, and had not seen this when
Thomas originally merged it.

I can see how this helps the ptp_clock_adjtime() users, but I just
double-checked
what other callers exist, and I think it introduces a regression in setitimer(),
which does

        nval = timespec64_to_ns(&value->it_value);
        ninterval = timespec64_to_ns(&value->it_interval);

without any further range checking that I could find. Setting timers
with negative intervals sounds like a bad idea, and interpreting negative
it_value as a past time instead of KTIME_SEC_MAX sounds like an
unintended interface change.

I haven't done any proper analysis of the changes, so maybe it's all
good, but I think we need to double-check this, and possibly revert
it from the stable kernels until a final conclusion.

        Arnd

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-15 19:00   ` Arnd Bergmann
@ 2021-09-16  9:12     ` Greg Kroah-Hartman
       [not found]     ` <AM0PR01MB5410E0963A0AF9A525509DB2EEDC9@AM0PR01MB5410.eurprd01.prod.exchangelabs.com>
  2021-09-16 22:32     ` Thomas Gleixner
  2 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-16  9:12 UTC (permalink / raw)
  To: Arnd Bergmann
  Cc: Linux Kernel Mailing List, # 3.4.x, Lukas Hannen, Thomas Gleixner

On Wed, Sep 15, 2021 at 09:00:32PM +0200, Arnd Bergmann wrote:
> On Tue, Sep 14, 2021 at 1:22 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >  /*
> >   * Limits for settimeofday():
> > @@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett
> >   */
> >  static inline s64 timespec64_to_ns(const struct timespec64 *ts)
> >  {
> > -       /* Prevent multiplication overflow */
> > -       if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
> > +       /* Prevent multiplication overflow / underflow */
> > +       if (ts->tv_sec >= KTIME_SEC_MAX)
> >                 return KTIME_MAX;
> >
> > +       if (ts->tv_sec <= KTIME_SEC_MIN)
> > +               return KTIME_MIN;
> > +
> 
> I just saw this get merged for the stable kernels, and had not seen this when
> Thomas originally merged it.
> 
> I can see how this helps the ptp_clock_adjtime() users, but I just
> double-checked
> what other callers exist, and I think it introduces a regression in setitimer(),
> which does
> 
>         nval = timespec64_to_ns(&value->it_value);
>         ninterval = timespec64_to_ns(&value->it_interval);
> 
> without any further range checking that I could find. Setting timers
> with negative intervals sounds like a bad idea, and interpreting negative
> it_value as a past time instead of KTIME_SEC_MAX sounds like an
> unintended interface change.
> 
> I haven't done any proper analysis of the changes, so maybe it's all
> good, but I think we need to double-check this, and possibly revert
> it from the stable kernels until a final conclusion.

I will revert it now from all stable kernels, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
       [not found]     ` <AM0PR01MB5410E0963A0AF9A525509DB2EEDC9@AM0PR01MB5410.eurprd01.prod.exchangelabs.com>
@ 2021-09-16 20:57       ` Arnd Bergmann
  2021-09-16 22:38         ` Thomas Gleixner
  0 siblings, 1 reply; 383+ messages in thread
From: Arnd Bergmann @ 2021-09-16 20:57 UTC (permalink / raw)
  To: OPENSOURCE Lukas Hannen
  Cc: EMC: linux-kernel@vger.kernel.org, # 3.4.x, Thomas Gleixner

On Thu, Sep 16, 2021 at 6:50 PM OPENSOURCE Lukas Hannen
<lukas.hannen@opensource.tttech-industrial.com> wrote:
>
> > I can see how this helps the ptp_clock_adjtime() users, but I just double-checked what
> > other callers exist, and I think it introduces a regression in setitimer(), which does
> >
> >         nval = timespec64_to_ns(&value->it_value);
> >         ninterval = timespec64_to_ns(&value->it_interval);
> >
> > without any further range checking that I could find. Setting timers with negative intervals
> > sounds like a bad idea, and interpreting negative it_value as a past time instead of KTIME_SEC_MAX
> > sounds like an unintended interface change.
>
> Hello Arnd,
>
> I have looked into this, and it seems like before your
> commit bd40a175769d ("y2038: itimer: change implementation to timespec64")
> the "clamping and converting to positive ns" was done using timeval_to_ktime()
> and ktime_to_ns().

Actually, looking back at this change, I see that there was an
explicit timeval_valid()
check in get_itimerval(), and this was moved around but is still
there, I guess we're
good for this syscall, and the user-visible behavior never actually changed.

> When Commit c5021b2547ad ( "time: Prevent undefined behaviour in timespec64_to_ns()" )
> put this functionally into timespec64_to_ns(), the patchnotes mentioned the clamping to
> KTIME_SEC_MAX, but did not mention the explicit need to return KTIME_SEC_MAX for any
> negative input.

Right.

> Since timespec64_to_ns() is widely used in drivers, where negative nanosecond values are
> quite sensible, I propose to view both of the effects I mentioned above as separate functionalities,
>
> either to be implemented as separate functions in time64.h (named, for example, timespec64_to_ns()
> and timespec64_to_positive_ns),

I don't mind having the common version work the way it does after your patch, I
was only worried about silently changing the behavior for a documented syscall.

> or alternatively, since the setitimer() code seems to be the only one not expecting negative nanoseconds
> out of timespec64_to_ns() when fed negative input, the clamping of negative nanosecond values
> to KTIME_SEC_MAX to be moved into the setitimer() code, and timespec64_to_ns() to be changed
> according to the patch I submitted.
>
> Both of those alternatives seem trivial and I can send in patches for both of them,
> but since this is more a matter of style I would like to hear your opinions on this beforehand.

It looks like we don't have to do anything for setitimer(), but that
was just the first one that
I happened to look at. Did you check the other instances to see if
anything might be going
wrong there? If they are all good,  then I have no other concerns and
we should probably
put your fix back into the stable kernels (Greg has just reverted it
after my initial mail).

I went through all instances other than the ptp related ones, and I'm
pretty confident
that they are all good now, in each case either your patch fixes a bug
or the value is
already known to be positive and it doesn't matter. Are you confident
that the ptp
instances are all good as well?

I did stumble over one small detail:

        if (ts->tv_sec <= KTIME_SEC_MIN)
                return KTIME_MIN;

I think this is not entirely correct for the case of tv_sec==KTIME_SEC_MIN
with a nonzero tv_nsec, as we now round down to the full second. Not sure
if that's worth changing, as we also round up for any value between
KTIME_SEC_MAX*NSEC_PER_SEC and KTIME_MAX, or between
KTIME_MIN and KTIME_SEC_MIN*NSEC_PER_SEC.
In practice I guess we care very little about the last nanosecond in the corner
cases.

        Arnd

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-15 19:00   ` Arnd Bergmann
  2021-09-16  9:12     ` Greg Kroah-Hartman
       [not found]     ` <AM0PR01MB5410E0963A0AF9A525509DB2EEDC9@AM0PR01MB5410.eurprd01.prod.exchangelabs.com>
@ 2021-09-16 22:32     ` Thomas Gleixner
  2021-09-16 22:53       ` Thomas Gleixner
                         ` (2 more replies)
  2 siblings, 3 replies; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-16 22:32 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

Arnd,

On Wed, Sep 15 2021 at 21:00, Arnd Bergmann wrote:
> On Tue, Sep 14, 2021 at 1:22 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
>>  /*
>>   * Limits for settimeofday():
>> @@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett
>>   */
>>  static inline s64 timespec64_to_ns(const struct timespec64 *ts)
>>  {
>> -       /* Prevent multiplication overflow */
>> -       if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
>> +       /* Prevent multiplication overflow / underflow */
>> +       if (ts->tv_sec >= KTIME_SEC_MAX)
>>                 return KTIME_MAX;
>>
>> +       if (ts->tv_sec <= KTIME_SEC_MIN)
>> +               return KTIME_MIN;
>> +
>
> I just saw this get merged for the stable kernels, and had not seen this when
> Thomas originally merged it.
>
> I can see how this helps the ptp_clock_adjtime() users, but I just
> double-checked
> what other callers exist, and I think it introduces a regression in setitimer(),
> which does
>
>         nval = timespec64_to_ns(&value->it_value);
>         ninterval = timespec64_to_ns(&value->it_interval);
>
> without any further range checking that I could find. Setting timers
> with negative intervals sounds like a bad idea, and interpreting negative
> it_value as a past time instead of KTIME_SEC_MAX sounds like an
> unintended interface change.
>
> I haven't done any proper analysis of the changes, so maybe it's all
> good, but I think we need to double-check this, and possibly revert
> it from the stable kernels until a final conclusion.

I have done the analysis. setitimer() does not have any problem with
that simply because it already checks at the call site that the seconds
value is > 0 and so do all the other user visible interfaces. See
get_itimerval() ...

Granted  that the kernel internal interfaces do not have those checks,
but they already have other safety nets in place to prevent this and I
could not identify any callsite which has trouble with that change.

If I failed to spot one then what the heck is the problem? It was broken
before that change already!

I usually spend quite some time on tagging patches for stable and it's
annoying me that this patch got reverted while stuff which I explicitely
did not tag for stable got backported for whatever reason and completely
against the stable rules:

  627ef5ae2df8 ("hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()")

What the heck qualifies this to be backported?

 1) It's hot of the press and just got merged in the 5.15-rc1 merge
    window and is not tagged for stable

 2) https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html

    clearly states the rules but obviously our new fangled "AI" driven
    approach to select patches for stable is blissfully ignorant of
    these rules. I assume that AI stands for "Artifical Ignorance' here.

I already got a private bug report vs. that on 5.10.65. Annoyingly
5.10.5 does not have the issue despite the fact that the resulting diff
between those two versions in hrtimer.c is just in comments.

Bah!

Thanks,

        tglx




^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-16 20:57       ` Arnd Bergmann
@ 2021-09-16 22:38         ` Thomas Gleixner
  0 siblings, 0 replies; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-16 22:38 UTC (permalink / raw)
  To: Arnd Bergmann, OPENSOURCE Lukas Hannen
  Cc: EMC: linux-kernel@vger.kernel.org, # 3.4.x

On Thu, Sep 16 2021 at 22:57, Arnd Bergmann wrote:
> On Thu, Sep 16, 2021 at 6:50 PM OPENSOURCE Lukas Hannen
> <lukas.hannen@opensource.tttech-industrial.com> wrote:
> I did stumble over one small detail:
>
>         if (ts->tv_sec <= KTIME_SEC_MIN)
>                 return KTIME_MIN;
>
> I think this is not entirely correct for the case of tv_sec==KTIME_SEC_MIN
> with a nonzero tv_nsec, as we now round down to the full second. Not sure
> if that's worth changing, as we also round up for any value between
> KTIME_SEC_MAX*NSEC_PER_SEC and KTIME_MAX, or between
> KTIME_MIN and KTIME_SEC_MIN*NSEC_PER_SEC.
> In practice I guess we care very little about the last nanosecond in the corner
> cases.

It's completely irrelevant whether the result is off by one second
related to the 292 years limit.

Thanks,

        tglx

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-16 22:32     ` Thomas Gleixner
@ 2021-09-16 22:53       ` Thomas Gleixner
  2021-09-17  7:31       ` Arnd Bergmann
  2021-09-17  8:25       ` Greg Kroah-Hartman
  2 siblings, 0 replies; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-16 22:53 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman
  Cc: Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17 2021 at 00:32, Thomas Gleixner wrote:
> I usually spend quite some time on tagging patches for stable and it's
> annoying me that this patch got reverted while stuff which I explicitely
> did not tag for stable got backported for whatever reason and completely
> against the stable rules:
>
>   627ef5ae2df8 ("hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()")
>
> What the heck qualifies this to be backported?
>
>  1) It's hot of the press and just got merged in the 5.15-rc1 merge
>     window and is not tagged for stable
>
>  2) https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
>
>     clearly states the rules but obviously our new fangled "AI" driven
>     approach to select patches for stable is blissfully ignorant of
>     these rules. I assume that AI stands for "Artifical Ignorance' here.
>
> I already got a private bug report vs. that on 5.10.65. Annoyingly
> 5.10.5 does not have the issue despite the fact that the resulting diff

5.14.5 obviously...

> between those two versions in hrtimer.c is just in comments.
>
> Bah!
>
> Thanks,
>
>         tglx

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-16 22:32     ` Thomas Gleixner
  2021-09-16 22:53       ` Thomas Gleixner
@ 2021-09-17  7:31       ` Arnd Bergmann
  2021-09-17  8:25         ` Greg Kroah-Hartman
  2021-09-17  8:25       ` Greg Kroah-Hartman
  2 siblings, 1 reply; 383+ messages in thread
From: Arnd Bergmann @ 2021-09-17  7:31 UTC (permalink / raw)
  To: Thomas Gleixner
  Cc: Greg Kroah-Hartman, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17, 2021 at 12:32 AM Thomas Gleixner <tglx@linutronix.de> wrote:
> On Wed, Sep 15 2021 at 21:00, Arnd Bergmann wrote:
>
> I have done the analysis. setitimer() does not have any problem with
> that simply because it already checks at the call site that the seconds
> value is > 0 and so do all the other user visible interfaces. See
> get_itimerval() ...

Right, I now came to the same conclusion after taking a closer look,
see my reply from yesterday.

> Granted  that the kernel internal interfaces do not have those checks,
> but they already have other safety nets in place to prevent this and I
> could not identify any callsite which has trouble with that change.
>
> If I failed to spot one then what the heck is the problem? It was broken
> before that change already!

My bad for the unfortunate timing. When only saw the patch when Greg
posted it during the stable review and wasn't completely sure about it
at the time, so I was hoping that he could just hold off until you had a chance
to reply either saying that you had already checked this case or that it
was dangerous, but now it's already reverted.

I agree we should put back the fix into all stable kernels.

        Arnd

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-16 22:32     ` Thomas Gleixner
  2021-09-16 22:53       ` Thomas Gleixner
  2021-09-17  7:31       ` Arnd Bergmann
@ 2021-09-17  8:25       ` Greg Kroah-Hartman
  2021-09-17 10:38         ` Thomas Gleixner
  2 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-17  8:25 UTC (permalink / raw)
  To: Thomas Gleixner
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17, 2021 at 12:32:17AM +0200, Thomas Gleixner wrote:
> Arnd,
> 
> On Wed, Sep 15 2021 at 21:00, Arnd Bergmann wrote:
> > On Tue, Sep 14, 2021 at 1:22 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> >>  /*
> >>   * Limits for settimeofday():
> >> @@ -124,10 +126,13 @@ static inline bool timespec64_valid_sett
> >>   */
> >>  static inline s64 timespec64_to_ns(const struct timespec64 *ts)
> >>  {
> >> -       /* Prevent multiplication overflow */
> >> -       if ((unsigned long long)ts->tv_sec >= KTIME_SEC_MAX)
> >> +       /* Prevent multiplication overflow / underflow */
> >> +       if (ts->tv_sec >= KTIME_SEC_MAX)
> >>                 return KTIME_MAX;
> >>
> >> +       if (ts->tv_sec <= KTIME_SEC_MIN)
> >> +               return KTIME_MIN;
> >> +
> >
> > I just saw this get merged for the stable kernels, and had not seen this when
> > Thomas originally merged it.
> >
> > I can see how this helps the ptp_clock_adjtime() users, but I just
> > double-checked
> > what other callers exist, and I think it introduces a regression in setitimer(),
> > which does
> >
> >         nval = timespec64_to_ns(&value->it_value);
> >         ninterval = timespec64_to_ns(&value->it_interval);
> >
> > without any further range checking that I could find. Setting timers
> > with negative intervals sounds like a bad idea, and interpreting negative
> > it_value as a past time instead of KTIME_SEC_MAX sounds like an
> > unintended interface change.
> >
> > I haven't done any proper analysis of the changes, so maybe it's all
> > good, but I think we need to double-check this, and possibly revert
> > it from the stable kernels until a final conclusion.
> 
> I have done the analysis. setitimer() does not have any problem with
> that simply because it already checks at the call site that the seconds
> value is > 0 and so do all the other user visible interfaces. See
> get_itimerval() ...
> 
> Granted  that the kernel internal interfaces do not have those checks,
> but they already have other safety nets in place to prevent this and I
> could not identify any callsite which has trouble with that change.
> 
> If I failed to spot one then what the heck is the problem? It was broken
> before that change already!
> 
> I usually spend quite some time on tagging patches for stable and it's
> annoying me that this patch got reverted while stuff which I explicitely
> did not tag for stable got backported for whatever reason and completely
> against the stable rules:
> 
>   627ef5ae2df8 ("hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()")
> 
> What the heck qualifies this to be backported?
> 
>  1) It's hot of the press and just got merged in the 5.15-rc1 merge
>     window and is not tagged for stable
> 
>  2) https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
> 
>     clearly states the rules but obviously our new fangled "AI" driven
>     approach to select patches for stable is blissfully ignorant of
>     these rules. I assume that AI stands for "Artifical Ignorance' here.
> 
> I already got a private bug report vs. that on 5.10.65. Annoyingly
> 5.10.5 does not have the issue despite the fact that the resulting diff
> between those two versions in hrtimer.c is just in comments.

Looks like Sasha picked it up with the AUTOSEL process, and emailed you
about this on Sep 5:
	https://lore.kernel.org/r/20210906012153.929962-12-sashal@kernel.org

I will revert it if you don't think it should be in the stable trees.

Also, if you want AUTOSEL to not look at any hrtimer.c patches, just let
us know and Sasha will add it to the ignore-list.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-17  7:31       ` Arnd Bergmann
@ 2021-09-17  8:25         ` Greg Kroah-Hartman
  0 siblings, 0 replies; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-17  8:25 UTC (permalink / raw)
  To: Arnd Bergmann
  Cc: Thomas Gleixner, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17, 2021 at 09:31:33AM +0200, Arnd Bergmann wrote:
> On Fri, Sep 17, 2021 at 12:32 AM Thomas Gleixner <tglx@linutronix.de> wrote:
> > On Wed, Sep 15 2021 at 21:00, Arnd Bergmann wrote:
> >
> > I have done the analysis. setitimer() does not have any problem with
> > that simply because it already checks at the call site that the seconds
> > value is > 0 and so do all the other user visible interfaces. See
> > get_itimerval() ...
> 
> Right, I now came to the same conclusion after taking a closer look,
> see my reply from yesterday.
> 
> > Granted  that the kernel internal interfaces do not have those checks,
> > but they already have other safety nets in place to prevent this and I
> > could not identify any callsite which has trouble with that change.
> >
> > If I failed to spot one then what the heck is the problem? It was broken
> > before that change already!
> 
> My bad for the unfortunate timing. When only saw the patch when Greg
> posted it during the stable review and wasn't completely sure about it
> at the time, so I was hoping that he could just hold off until you had a chance
> to reply either saying that you had already checked this case or that it
> was dangerous, but now it's already reverted.
> 
> I agree we should put back the fix into all stable kernels.

Ok, I'll queue it up again after this round goes out.

thanks for the additional review.

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-17  8:25       ` Greg Kroah-Hartman
@ 2021-09-17 10:38         ` Thomas Gleixner
  2021-09-17 15:20           ` Greg Kroah-Hartman
  0 siblings, 1 reply; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-17 10:38 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17 2021 at 10:25, Greg Kroah-Hartman wrote:
> On Fri, Sep 17, 2021 at 12:32:17AM +0200, Thomas Gleixner wrote:
>> I already got a private bug report vs. that on 5.10.65. Annoyingly
>> 5.10.5 does not have the issue despite the fact that the resulting diff
>> between those two versions in hrtimer.c is just in comments.

The bug report turned out to be a red hering. Probably caused by a
bisect gone wrong. The real culprit was the posix-cpu-timer change which
got reverted already.

> Looks like Sasha picked it up with the AUTOSEL process, and emailed you
> about this on Sep 5:
> 	https://lore.kernel.org/r/20210906012153.929962-12-sashal@kernel.org

which I obviously missed.

> I will revert it if you don't think it should be in the stable trees.

It's a pure performance improvement, so according to stable rules it
should not be there.

> Also, if you want AUTOSEL to not look at any hrtimer.c patches, just let
> us know and Sasha will add it to the ignore-list.

Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
could we change the rules slightly?

Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
put on hold until acked by the maintainer unless it is a prerequisite
for applying a stable tagged fix?

This can be default off and made effective on maintainer request.

Hmm?

Thanks,

        tglx



^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-17 10:38         ` Thomas Gleixner
@ 2021-09-17 15:20           ` Greg Kroah-Hartman
  2021-09-17 19:29             ` Thomas Gleixner
  0 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-17 15:20 UTC (permalink / raw)
  To: Thomas Gleixner
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17, 2021 at 12:38:43PM +0200, Thomas Gleixner wrote:
> On Fri, Sep 17 2021 at 10:25, Greg Kroah-Hartman wrote:
> > On Fri, Sep 17, 2021 at 12:32:17AM +0200, Thomas Gleixner wrote:
> >> I already got a private bug report vs. that on 5.10.65. Annoyingly
> >> 5.10.5 does not have the issue despite the fact that the resulting diff
> >> between those two versions in hrtimer.c is just in comments.
> 
> The bug report turned out to be a red hering. Probably caused by a
> bisect gone wrong. The real culprit was the posix-cpu-timer change which
> got reverted already.
> 
> > Looks like Sasha picked it up with the AUTOSEL process, and emailed you
> > about this on Sep 5:
> > 	https://lore.kernel.org/r/20210906012153.929962-12-sashal@kernel.org
> 
> which I obviously missed.
> 
> > I will revert it if you don't think it should be in the stable trees.
> 
> It's a pure performance improvement, so according to stable rules it
> should not be there.
> 
> > Also, if you want AUTOSEL to not look at any hrtimer.c patches, just let
> > us know and Sasha will add it to the ignore-list.
> 
> Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
> could we change the rules slightly?
> 
> Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
> put on hold until acked by the maintainer unless it is a prerequisite
> for applying a stable tagged fix?
> 
> This can be default off and made effective on maintainer request.
> 
> Hmm?

The whole point of the AUTOSEL patches are for the huge numbers of
subsystems where maintainers and developers do not care about the stable
trees at all, and so they do not mark patches to be backported.  So
requireing an opt-in like this would defeat the purpose.

We do allow the ability to take files/subsystems out of the AUTOSEL
process as there are many maintainers that do do this right and get
annoyed when patches are picked that they feel shouldn't have.  That's
the best thing we can do for stuff like this.

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-17 15:20           ` Greg Kroah-Hartman
@ 2021-09-17 19:29             ` Thomas Gleixner
  2021-09-18 15:46               ` Greg Kroah-Hartman
  0 siblings, 1 reply; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-17 19:29 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

Greg,

On Fri, Sep 17 2021 at 17:20, Greg Kroah-Hartman wrote:
> On Fri, Sep 17, 2021 at 12:38:43PM +0200, Thomas Gleixner wrote:
>> Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
>> could we change the rules slightly?
>> 
>> Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
>> put on hold until acked by the maintainer unless it is a prerequisite
>> for applying a stable tagged fix?
>> 
>> This can be default off and made effective on maintainer request.
>> 
>> Hmm?
>
> The whole point of the AUTOSEL patches are for the huge numbers of
> subsystems where maintainers and developers do not care about the stable
> trees at all, and so they do not mark patches to be backported.  So
> requireing an opt-in like this would defeat the purpose.
>
> We do allow the ability to take files/subsystems out of the AUTOSEL
> process as there are many maintainers that do do this right and get
> annoyed when patches are picked that they feel shouldn't have.  That's
> the best thing we can do for stuff like this.

I guess I was not able to express myself correctly. What I wanted to say
is:

  1) Default is AUTOSEL

  2) Maintainer can take files/subsystems out of AUTOSEL completely

     Exists today

  3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
     without a stable tag requires an explicit ACK from the maintainer
     for the backport.

     Is new and I would be the first to opt-in :)

My rationale for #3 is that even when being careful about stable tags,
it happens that one is missing. Occasionaly AUTOSEL finds one of those
in my subsystems which I appreciate.

Does that make more sense now?

Thanks,

        tglx

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-17 19:29             ` Thomas Gleixner
@ 2021-09-18 15:46               ` Greg Kroah-Hartman
  2021-09-20 14:31                 ` Sasha Levin
  0 siblings, 1 reply; 383+ messages in thread
From: Greg Kroah-Hartman @ 2021-09-18 15:46 UTC (permalink / raw)
  To: Thomas Gleixner, Sasha Levin
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen

On Fri, Sep 17, 2021 at 09:29:32PM +0200, Thomas Gleixner wrote:
> Greg,
> 
> On Fri, Sep 17 2021 at 17:20, Greg Kroah-Hartman wrote:
> > On Fri, Sep 17, 2021 at 12:38:43PM +0200, Thomas Gleixner wrote:
> >> Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
> >> could we change the rules slightly?
> >> 
> >> Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
> >> put on hold until acked by the maintainer unless it is a prerequisite
> >> for applying a stable tagged fix?
> >> 
> >> This can be default off and made effective on maintainer request.
> >> 
> >> Hmm?
> >
> > The whole point of the AUTOSEL patches are for the huge numbers of
> > subsystems where maintainers and developers do not care about the stable
> > trees at all, and so they do not mark patches to be backported.  So
> > requireing an opt-in like this would defeat the purpose.
> >
> > We do allow the ability to take files/subsystems out of the AUTOSEL
> > process as there are many maintainers that do do this right and get
> > annoyed when patches are picked that they feel shouldn't have.  That's
> > the best thing we can do for stuff like this.
> 
> I guess I was not able to express myself correctly. What I wanted to say
> is:
> 
>   1) Default is AUTOSEL
> 
>   2) Maintainer can take files/subsystems out of AUTOSEL completely
> 
>      Exists today
> 
>   3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
>      without a stable tag requires an explicit ACK from the maintainer
>      for the backport.
> 
>      Is new and I would be the first to opt-in :)
> 
> My rationale for #3 is that even when being careful about stable tags,
> it happens that one is missing. Occasionaly AUTOSEL finds one of those
> in my subsystems which I appreciate.
> 
> Does that make more sense now?

Ah, yes, that makes much more sense, sorry for the confusion.

Sasha, what do you think?  You are the one that scripts all of this, not
me :)

greg k-h

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-18 15:46               ` Greg Kroah-Hartman
@ 2021-09-20 14:31                 ` Sasha Levin
  2021-09-21 19:20                   ` Sasha Levin
  0 siblings, 1 reply; 383+ messages in thread
From: Sasha Levin @ 2021-09-20 14:31 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Thomas Gleixner, Arnd Bergmann, Linux Kernel Mailing List,
	# 3.4.x, Lukas Hannen

On Sat, Sep 18, 2021 at 05:46:57PM +0200, Greg Kroah-Hartman wrote:
>On Fri, Sep 17, 2021 at 09:29:32PM +0200, Thomas Gleixner wrote:
>> Greg,
>>
>> On Fri, Sep 17 2021 at 17:20, Greg Kroah-Hartman wrote:
>> > On Fri, Sep 17, 2021 at 12:38:43PM +0200, Thomas Gleixner wrote:
>> >> Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
>> >> could we change the rules slightly?
>> >>
>> >> Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
>> >> put on hold until acked by the maintainer unless it is a prerequisite
>> >> for applying a stable tagged fix?
>> >>
>> >> This can be default off and made effective on maintainer request.
>> >>
>> >> Hmm?
>> >
>> > The whole point of the AUTOSEL patches are for the huge numbers of
>> > subsystems where maintainers and developers do not care about the stable
>> > trees at all, and so they do not mark patches to be backported.  So
>> > requireing an opt-in like this would defeat the purpose.
>> >
>> > We do allow the ability to take files/subsystems out of the AUTOSEL
>> > process as there are many maintainers that do do this right and get
>> > annoyed when patches are picked that they feel shouldn't have.  That's
>> > the best thing we can do for stuff like this.
>>
>> I guess I was not able to express myself correctly. What I wanted to say
>> is:
>>
>>   1) Default is AUTOSEL
>>
>>   2) Maintainer can take files/subsystems out of AUTOSEL completely
>>
>>      Exists today
>>
>>   3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
>>      without a stable tag requires an explicit ACK from the maintainer
>>      for the backport.
>>
>>      Is new and I would be the first to opt-in :)
>>
>> My rationale for #3 is that even when being careful about stable tags,
>> it happens that one is missing. Occasionaly AUTOSEL finds one of those
>> in my subsystems which I appreciate.
>>
>> Does that make more sense now?
>
>Ah, yes, that makes much more sense, sorry for the confusion.
>
>Sasha, what do you think?  You are the one that scripts all of this, not
>me :)

I could give it a go. It adds some complexity here but is probably worth
it to avoid issues.

Let me think about the best way to go about it.

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-20 14:31                 ` Sasha Levin
@ 2021-09-21 19:20                   ` Sasha Levin
  2021-09-21 20:27                     ` Thomas Gleixner
  0 siblings, 1 reply; 383+ messages in thread
From: Sasha Levin @ 2021-09-21 19:20 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Thomas Gleixner, Arnd Bergmann, Linux Kernel Mailing List,
	# 3.4.x, Lukas Hannen

On Mon, Sep 20, 2021 at 10:31:08AM -0400, Sasha Levin wrote:
>On Sat, Sep 18, 2021 at 05:46:57PM +0200, Greg Kroah-Hartman wrote:
>>On Fri, Sep 17, 2021 at 09:29:32PM +0200, Thomas Gleixner wrote:
>>>Greg,
>>>
>>>On Fri, Sep 17 2021 at 17:20, Greg Kroah-Hartman wrote:
>>>> On Fri, Sep 17, 2021 at 12:38:43PM +0200, Thomas Gleixner wrote:
>>>>> Nah. I try to pay more attention. I'm not against AUTOSEL per se, but
>>>>> could we change the rules slightly?
>>>>>
>>>>> Any change which is selected by AUTOSEL and lacks a Cc: stable@... is
>>>>> put on hold until acked by the maintainer unless it is a prerequisite
>>>>> for applying a stable tagged fix?
>>>>>
>>>>> This can be default off and made effective on maintainer request.
>>>>>
>>>>> Hmm?
>>>>
>>>> The whole point of the AUTOSEL patches are for the huge numbers of
>>>> subsystems where maintainers and developers do not care about the stable
>>>> trees at all, and so they do not mark patches to be backported.  So
>>>> requireing an opt-in like this would defeat the purpose.
>>>>
>>>> We do allow the ability to take files/subsystems out of the AUTOSEL
>>>> process as there are many maintainers that do do this right and get
>>>> annoyed when patches are picked that they feel shouldn't have.  That's
>>>> the best thing we can do for stuff like this.
>>>
>>>I guess I was not able to express myself correctly. What I wanted to say
>>>is:
>>>
>>>  1) Default is AUTOSEL
>>>
>>>  2) Maintainer can take files/subsystems out of AUTOSEL completely
>>>
>>>     Exists today
>>>
>>>  3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
>>>     without a stable tag requires an explicit ACK from the maintainer
>>>     for the backport.
>>>
>>>     Is new and I would be the first to opt-in :)
>>>
>>>My rationale for #3 is that even when being careful about stable tags,
>>>it happens that one is missing. Occasionaly AUTOSEL finds one of those
>>>in my subsystems which I appreciate.
>>>
>>>Does that make more sense now?
>>
>>Ah, yes, that makes much more sense, sorry for the confusion.
>>
>>Sasha, what do you think?  You are the one that scripts all of this, not
>>me :)
>
>I could give it a go. It adds some complexity here but is probably worth
>it to avoid issues.
>
>Let me think about the best way to go about it.

So I'm thinking of yet another patch series that would go out, but
instead of AUTOSEL it'll be tagged with "MANUALSEL". It would work the
exact same way as AUTOSEL, without the final step of queueing up the
commits into the stable trees.

Thomas, do you want to give it a go? Want to describe how I filter for
commits you'd be taking care of? In the past I'd grep a combo of paths
and committers (i.e. net/ && davem@), but you have your hands in too
many things :)

-- 
Thanks,
Sasha

^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-21 19:20                   ` Sasha Levin
@ 2021-09-21 20:27                     ` Thomas Gleixner
  2021-09-22  6:20                       ` Paolo Bonzini
  0 siblings, 1 reply; 383+ messages in thread
From: Thomas Gleixner @ 2021-09-21 20:27 UTC (permalink / raw)
  To: Sasha Levin, Greg Kroah-Hartman
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen,
	Paolo Bonzini, Juergen Gross

On Tue, Sep 21 2021 at 15:20, Sasha Levin wrote:
> On Mon, Sep 20, 2021 at 10:31:08AM -0400, Sasha Levin wrote:
>>On Sat, Sep 18, 2021 at 05:46:57PM +0200, Greg Kroah-Hartman wrote:
>>>On Fri, Sep 17, 2021 at 09:29:32PM +0200, Thomas Gleixner wrote:
>>>>
>>>>I guess I was not able to express myself correctly. What I wanted to say
>>>>is:
>>>>
>>>>  1) Default is AUTOSEL
>>>>
>>>>  2) Maintainer can take files/subsystems out of AUTOSEL completely
>>>>
>>>>     Exists today
>>>>
>>>>  3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
>>>>     without a stable tag requires an explicit ACK from the maintainer
>>>>     for the backport.
>>>>
>>>>     Is new and I would be the first to opt-in :)
>>>>
>>>>My rationale for #3 is that even when being careful about stable tags,
>>>>it happens that one is missing. Occasionaly AUTOSEL finds one of those
>>>>in my subsystems which I appreciate.
>>>>
>>>>Does that make more sense now?
>>>
>>>Ah, yes, that makes much more sense, sorry for the confusion.
>>>
>>>Sasha, what do you think?  You are the one that scripts all of this, not
>>>me :)
>>
>>I could give it a go. It adds some complexity here but is probably worth
>>it to avoid issues.
>>
>>Let me think about the best way to go about it.
>
> So I'm thinking of yet another patch series that would go out, but
> instead of AUTOSEL it'll be tagged with "MANUALSEL". It would work the
> exact same way as AUTOSEL, without the final step of queueing up the
> commits into the stable trees.
>
> Thomas, do you want to give it a go? Want to describe how I filter for
> commits you'd be taking care of? In the past I'd grep a combo of paths
> and committers (i.e. net/ && davem@), but you have your hands in too
> many things :)

Indeed. :(

So pretty much all what matches in MAINTAINERS entries where my name
happened to end up for some reasons. That would be a good start.

Might be a bit overbroad as it also includes x86/kvm, x86/xen, x86/pci
which I'm not that involved with, but to make it simple for you, I just
volunteered the relevant maintainers (CCed) to participate in that
experiment. :)

Thanks,

        tglx







^ permalink raw reply	[flat|nested] 383+ messages in thread

* Re: [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns()
  2021-09-21 20:27                     ` Thomas Gleixner
@ 2021-09-22  6:20                       ` Paolo Bonzini
  0 siblings, 0 replies; 383+ messages in thread
From: Paolo Bonzini @ 2021-09-22  6:20 UTC (permalink / raw)
  To: Thomas Gleixner, Sasha Levin, Greg Kroah-Hartman
  Cc: Arnd Bergmann, Linux Kernel Mailing List, # 3.4.x, Lukas Hannen,
	Juergen Gross

On 21/09/21 22:27, Thomas Gleixner wrote:
>   3) Maintainer allows AUTOSEL, but anything picked from files/subsystems
>      without a stable tag requires an explicit ACK from the maintainer
>      for the backport.
> 
>      Is new and I would be the first to opt-in:)
> 
> My rationale for #3 is that even when being careful about stable tags,
> it happens that one is missing. Occasionaly AUTOSEL finds one of those
> in my subsystems which I appreciate.
> 
> Does that make more sense now?

I like this!

> Might be a bit overbroad as it also includes x86/kvm, x86/xen, x86/pci
> which I'm not that involved with, but to make it simple for you, I just
> volunteered the relevant maintainers (CCed) to participate in that
> experiment. 

I would opt in to MANUALSEL too; so Sasha, feel free to do the same for 
everything that I'm involved in by the MAINTAINERS file, or we can start 
with x86/kvm via the generic x86 entries.

Thanks,

Paolo


^ permalink raw reply	[flat|nested] 383+ messages in thread

end of thread, other threads:[~2021-09-22  6:21 UTC | newest]

Thread overview: 383+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-13 13:10 [PATCH 5.14 000/334] 5.14.4-rc1 review Greg Kroah-Hartman
2021-09-13 13:10 ` [PATCH 5.14 001/334] locking/mutex: Fix HANDOFF condition Greg Kroah-Hartman
2021-09-13 13:10 ` [PATCH 5.14 002/334] regmap: fix the offset of register error log Greg Kroah-Hartman
2021-09-13 13:10 ` [PATCH 5.14 003/334] regulator: tps65910: Silence deferred probe error Greg Kroah-Hartman
2021-09-13 13:10 ` [PATCH 5.14 004/334] crypto: mxs-dcp - Check for DMA mapping errors Greg Kroah-Hartman
2021-09-13 13:10 ` [PATCH 5.14 005/334] sched/deadline: Fix reset_on_fork reporting of DL tasks Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 006/334] power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 007/334] crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 008/334] sched/deadline: Fix missing clock update in migrate_task_rq_dl() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 009/334] rcu/tree: Handle VM stoppage in stall detection Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 010/334] EDAC/mce_amd: Do not load edac_mce_amd module on guests Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 011/334] posix-cpu-timers: Force next expiration recalc after itimer reset Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 012/334] hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 013/334] hrtimer: Ensure timerfd notification for HIGHRES=n Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 014/334] udf: Check LVID earlier Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 015/334] udf: Fix iocharset=utf8 mount option Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 016/334] isofs: joliet: " Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 017/334] bcache: add proper error unwinding in bcache_device_init Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 018/334] nbd: add the check to prevent overflow in __nbd_ioctl() Greg Kroah-Hartman
2021-09-13 16:22   ` Naresh Kamboju
2021-09-13 17:58     ` Greg Kroah-Hartman
2021-09-13 18:39       ` Nick Desaulniers
2021-09-13 19:53         ` Nick Desaulniers
2021-09-13 19:57           ` Sedat Dilek
2021-09-13 20:02             ` Nick Desaulniers
2021-09-13 20:10               ` Linus Torvalds
2021-09-13 20:16                 ` Nick Desaulniers
2021-09-13 20:36                   ` Nick Desaulniers
2021-09-13 20:42                   ` Linus Torvalds
2021-09-13 20:50                     ` Nick Desaulniers
2021-09-13 21:13                       ` Nick Desaulniers
2021-09-13 21:15                         ` Nick Desaulniers
2021-09-13 23:00                           ` Linus Torvalds
2021-09-13 23:23                             ` Nick Desaulniers
2021-09-14  2:13                               ` libaokun (A)
2021-09-14  3:30                                 ` Nick Desaulniers
2021-09-14  8:14                                 ` David Laight
2021-09-13 13:11 ` [PATCH 5.14 019/334] blk-throtl: optimize IOPS throttle for large IO scenarios Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 020/334] nvme-tcp: dont update queue count when failing to set io queues Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 021/334] nvme-rdma: " Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 022/334] nvmet: pass back cntlid on successful completion Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 023/334] power: supply: smb347-charger: Add missing pin control activation Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 024/334] power: supply: max17042_battery: fix typo in MAx17042_TOFF Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 025/334] s390/cio: add dev_busid sysfs entry for each subchannel Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 026/334] s390/zcrypt: fix wrong offset index for APKA master key valid state Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 027/334] libata: fix ata_host_start() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 028/334] sched/topology: Skip updating masks for non-online nodes Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 029/334] crypto: omap - Fix inconsistent locking of device lists Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 030/334] crypto: qat - do not ignore errors from enable_vf2pf_comms() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 031/334] crypto: qat - handle both source of interrupt in VF ISR Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 032/334] crypto: qat - fix reuse of completion variable Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 033/334] crypto: qat - fix naming for init/shutdown VF to PF notifications Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 034/334] crypto: qat - do not export adf_iov_putmsg() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 035/334] crypto: hisilicon/sec - fix the abnormal exiting process Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 036/334] crypto: hisilicon/sec - modify the hardware endian configuration Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 037/334] crypto: tcrypt - Fix missing return value check Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 038/334] fcntl: fix potential deadlocks for &fown_struct.lock Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 039/334] fcntl: fix potential deadlock for &fasync_struct.fa_lock Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 040/334] udf_get_extendedattr() had no boundary checks Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 041/334] io-wq: remove GFP_ATOMIC allocation off schedule out path Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 042/334] s390/kasan: fix large PMD pages address alignment check Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 043/334] s390/pci: fix misleading rc in clp_set_pci_fn() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 044/334] s390/debug: keep debug data on resize Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 045/334] s390/debug: fix debug area life cycle Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 046/334] s390/ap: fix state machine hang after failure to enable irq Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 047/334] s390/smp: enable DAT before CPU restart callback is called Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 048/334] sched/debug: Dont update sched_domain debug directories before sched_debug_init() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 049/334] power: supply: cw2015: use dev_err_probe to allow deferred probe Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 050/334] m68k: emu: Fix invalid free in nfeth_cleanup() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 051/334] crypto: x86/aes-ni - add missing error checks in XTS code Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 052/334] crypto: ecc - handle unaligned input buffer in ecc_swap_digits Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 053/334] sched/numa: Fix is_core_idle() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 054/334] sched: Fix UCLAMP_FLAG_IDLE setting Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 055/334] rcu: Fix to include first blocked task in stall warning Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 056/334] rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 057/334] m68k: Fix invalid RMW_INSNS on CPUs that lack CAS Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 058/334] block: return ELEVATOR_DISCARD_MERGE if possible Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 059/334] spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 060/334] spi: spi-pic32: " Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 061/334] genirq/timings: Fix error return code in irq_timings_test_irqs() Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 062/334] irqchip/loongson-pch-pic: Improve edge triggered interrupt support Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 063/334] lib/mpi: use kcalloc in mpi_resize Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 064/334] clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel Greg Kroah-Hartman
2021-09-13 13:11 ` [PATCH 5.14 065/334] nbd: do del_gendisk() asynchronously for NBD_DESTROY_ON_DISCONNECT Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 066/334] block: nbd: add sanity check for first_minor Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 067/334] spi: coldfire-qspi: Use clk_disable_unprepare in the remove function Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 068/334] irqchip/apple-aic: Fix irq_disable from within irq handlers Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 069/334] irqchip/gic-v3: Fix priority comparison when non-secure priorities are used Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 070/334] crypto: qat - use proper type for vf_mask Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 071/334] m68k: Fix asm register constraints for atomic ops Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 072/334] certs: Trigger creation of RSA module signing key if its not an RSA key Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 073/334] tpm: ibmvtpm: Avoid error message when process gets signal while waiting Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 074/334] EDAC/i10nm: Fix NVDIMM detection Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 075/334] x86/mce: Defer processing of early errors Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 076/334] spi: davinci: invoke chipselect callback Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 077/334] blk-crypto: fix check for too-large dun_bytes Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 078/334] regulator: vctrl: Use locked regulator_get_voltage in probe path Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 079/334] regulator: vctrl: Avoid lockdep warning in enable/disable ops Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 080/334] spi: sprd: Fix the wrong WDG_LOAD_VAL Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 081/334] spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 082/334] drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init() Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 083/334] drm/gma500: Fix end of loop tests for list_for_each_entry Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 084/334] ASoC: mediatek: mt8192:Fix Unbalanced pm_runtime_enable in mt8192_afe_pcm_dev_probe Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 085/334] ASoC: mediatek: mt8183: Fix Unbalanced pm_runtime_enable in mt8183_afe_pcm_dev_probe Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 086/334] ASoC: tlv320aic32x4: Fix TAS2505/TAS2521 channel count Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 087/334] media: atmel: atmel-sama5d2-isc: fix YUYV format Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 088/334] media: TDA1997x: enable EDID support Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 089/334] leds: is31fl32xx: Fix missing error code in is31fl32xx_parse_dt() Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 090/334] soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 091/334] media: cxd2880-spi: Fix an error handling path Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 092/334] drm/of: free the right object Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 093/334] bpf: Fix a typo of reuseport map in bpf.h Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 094/334] bpf: Fix potential memleak and UAF in the verifier Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 095/334] drm/of: free the iterator object on failure Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 096/334] gve: fix the wrong AdminQ buffer overflow check Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 097/334] libbpf: Fix the possible memory leak on error Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 098/334] ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 099/334] ARM: dts: everest: Add phase corrections for eMMC Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 100/334] arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 101/334] i40e: improve locking of mac_filter_hash Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 102/334] arm64: dts: qcom: sc7180: Set adau wakeup delay to 80 ms Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 103/334] soc: qcom: rpmhpd: Use corner in power_off Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 104/334] libbpf: Fix removal of inner map in bpf_object__create_map Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 105/334] gfs2: Fix memory leak of object lsi on error return path Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 106/334] arm64: dts: qcom: sm8250: fix usb2 qmp phy node Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 107/334] bpf, selftests: Fix test_maps now that sockmap supports UDP Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 108/334] firmware: fix theoretical UAF race with firmware cache and resume Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 109/334] driver core: Fix error return code in really_probe() Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 110/334] ionic: cleanly release devlink instance Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 111/334] media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 112/334] media: dvb-usb: fix uninit-value in vp702x_read_mac_addr Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 113/334] media: dvb-usb: Fix error handling in dvb_usb_i2c_init Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 114/334] net: usb: asix: ax88772: add missing stop Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 115/334] media: go7007: fix memory leak in go7007_usb_probe Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 116/334] media: go7007: remove redundant initialization Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 117/334] media: v4l2-subdev: fix some NULL vs IS_ERR() checks Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 118/334] media: rockchip/rga: fix error handling in probe Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 119/334] media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 120/334] media: atomisp: fix the uninitialized use and rename "retvalue" Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 121/334] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 122/334] Bluetooth: btusb: Fix a unspported condition to set available debug features Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 123/334] 6lowpan: iphc: Fix an off-by-one check of array index Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 124/334] drm/amdgpu/acp: Make PM domain really work Greg Kroah-Hartman
2021-09-13 13:12 ` [PATCH 5.14 125/334] drm/amd/pm: Fix a bug communicating with the SMU (v5) Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 126/334] tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 127/334] ARM: dts: meson8: Use a higher default GPU clock frequency Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 128/334] ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 129/334] ARM: dts: meson8b: mxq: " Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 130/334] ARM: dts: meson8b: ec100: " Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 131/334] net/mlx5e: Prohibit inner indir TIRs in IPoIB Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 132/334] net/mlx5e: Block LRO if firmware asks for tunneled LRO Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 133/334] cgroup/cpuset: Fix a partition bug with hotplug Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 134/334] drm: mxsfb: Enable recovery on underflow Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 135/334] drm: mxsfb: Increase number of outstanding requests on V4 and newer HW Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 136/334] drm: mxsfb: Clear FIFO_CLEAR bit Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 137/334] net: cipso: fix warnings in netlbl_cipsov4_add_std Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 138/334] net: ti: am65-cpsw-nuss: fix wrong devlink release order Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 139/334] drm: rcar-du: Dont put reference to drm_device in rcar_du_remove() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 140/334] Bluetooth: mgmt: Fix wrong opcode in the response for add_adv cmd Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 141/334] drm/amd/pm: Fix a bug in semaphore double-lock Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 142/334] lib/test_scanf: Handle n_bits == 0 in random tests Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 143/334] libbpf: Return non-null error on failures in libbpf_find_prog_btf_id() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 144/334] tools: Free BTF objects at various locations Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 145/334] arm64: dts: renesas: hihope-rzg2-ex: Add EtherAVB internal rx delay Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 146/334] devlink: Break parameter notification sequence to be before/after unload/load driver Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 147/334] drm/bridge: ti-sn65dsi86: Dont read EDID blob over DDC Greg Kroah-Hartman
2021-09-13 13:57   ` Doug Anderson
2021-09-13 16:09     ` Greg Kroah-Hartman
2021-09-13 16:31       ` Doug Anderson
2021-09-14 16:27         ` Greg Kroah-Hartman
2021-09-14 17:02           ` Sasha Levin
2021-09-14 17:24           ` Doug Anderson
2021-09-14 17:34             ` Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 148/334] drm/bridge: ti-sn65dsi86: Improve probe errors with dev_err_probe() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 149/334] drm/bridge: ti-sn65dsi86: Wrap panel with panel-bridge Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 150/334] drm/bridge: ti-sn65dsi86: Fix power off sequence Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 151/334] drm/bridge: ti-sn65dsi86: Add some 100 us delays Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 152/334] net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 153/334] i2c: highlander: add IRQ check Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 154/334] leds: lgm-sso: Put fwnode in any case during ->probe() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 155/334] leds: lgm-sso: Dont spam logs when probe is deferred Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 156/334] leds: lt3593: Put fwnode in any case during ->probe() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 157/334] leds: rt8515: " Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 158/334] leds: trigger: audio: Add an activate callback to ensure the initial brightness is set Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 159/334] media: em28xx-input: fix refcount bug in em28xx_usb_disconnect Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 160/334] media: omap3isp: Fix missing unlock in isp_subdev_notifier_complete() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 161/334] media: venus: hfi: fix return value check in sys_get_prop_image_version() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 162/334] media: venus: venc: Fix potential null pointer dereference on pointer fmt Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 163/334] media: venus: helper: do not set constrained parameters for UBWC Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 164/334] soc: mmsys: mediatek: add mask to mmsys routes Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 165/334] PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 166/334] PCI: PM: Enable PME if it can be signaled from D3cold Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 167/334] bpf, samples: Add missing mprog-disable to xdp_redirect_cpus optstring Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 168/334] soc: qcom: smsm: Fix missed interrupts if state changes while masked Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 169/334] net: dsa: build tag_8021q.c as part of DSA core Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 170/334] net: dsa: tag_sja1105: optionally build as module when switch driver is module if PTP is enabled Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 171/334] debugfs: Return error during {full/open}_proxy_open() on rmmod Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 172/334] Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 173/334] arm64: dts: qcom: sc7280: Fixup the cpufreq node Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 174/334] arm64: dts: qcom: sm8350: fix IPA interconnects Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 175/334] drm: bridge: it66121: Check drm_bridge_attach retval Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 176/334] net: ti: am65-cpsw-nuss: fix RX IRQ state after .ndo_stop() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 177/334] net: dsa: stop syncing the bridge mcast_router attribute at join time Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 178/334] net: dsa: mt7530: remove the .port_set_mrouter implementation Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 179/334] net: dsa: dont disable multicast flooding to the CPU even without an IGMP querier Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 180/334] PM: EM: Increase energy calculation precision Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 181/334] selftests/bpf: Fix bpf-iter-tcp4 test to print correctly the dest IP Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 182/334] leds: lgm-sso: Propagate error codes from callee to caller Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 183/334] drm/msm: Fix error return code in msm_drm_init() Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 184/334] drm/msm/mdp4: refactor HW revision detection into read_mdp_hw_revision Greg Kroah-Hartman
2021-09-13 13:13 ` [PATCH 5.14 185/334] drm/msm/mdp4: move HW revision detection to earlier phase Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 186/334] drm/msm/dp: update is_connected status base on sink count at dp_pm_resume() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 187/334] drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 188/334] arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7 Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 189/334] counter: 104-quad-8: Return error when invalid mode during ceiling_write Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 190/334] cgroup/cpuset: Miscellaneous code cleanup Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 191/334] cgroup/cpuset: Fix violation of cpuset locking rule Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 192/334] ASoC: Intel: Fix platform ID matching Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 193/334] Bluetooth: fix repeated calls to sco_sock_kill Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 194/334] drm/msm/dsi: Fix some reference counted resource leaks Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 195/334] drm/msm/dp: replug event is converted into an unplug followed by an plug events Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 196/334] net/mlx5: Fix unpublish devlink parameters Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 197/334] ASoC: rt5682: Properly turn off regulators if wrong device ID Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 198/334] drm/bridge: ti-sn65dsi86: Avoid creating multiple connectors Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 199/334] usb: dwc3: meson-g12a: add IRQ check Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 200/334] usb: dwc3: qcom: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 201/334] usb: gadget: udc: at91: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 202/334] usb: gadget: udc: s3c2410: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 203/334] mac80211: remove unnecessary NULL check in ieee80211_register_hw() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 204/334] usb: misc: brcmstb-usb-pinmap: add IRQ check Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 205/334] usb: phy: fsl-usb: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 206/334] usb: phy: twl6030: add IRQ checks Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 207/334] usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 208/334] selftests/bpf: Fix test_core_autosize on big-endian machines Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 209/334] devlink: Clear whole devlink_flash_notify struct Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 210/334] samples: pktgen: add missing IPv6 option to pktgen scripts Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 211/334] net: stmmac: fix INTR TBU status affecting irq count statistic Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 212/334] Bluetooth: Move shutdown callback before flushing tx and rx queue Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 213/334] PM: cpu: Make notifier chain use a raw_spinlock_t Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 214/334] usb: host: ohci-tmio: add IRQ check Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 215/334] usb: phy: tahvo: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 216/334] libbpf: Re-build libbpf.so when libbpf.map changes Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 217/334] mac80211: Fix insufficient headroom issue for AMSDU Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 218/334] locking/local_lock: Add missing owner initialization Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 219/334] lockd: Fix invalid lockowner cast after vfs_test_lock Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 220/334] SUNRPC: Fix a NULL pointer deref in trace_svc_stats_latency() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 221/334] nfsd4: Fix forced-expiry locking Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 222/334] arm64: dts: marvell: armada-37xx: Extend PCIe MEM space Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 223/334] clk: staging: correct reference to config IOMEM to config HAS_IOMEM Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 224/334] i2c: synquacer: fix deferred probing Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 225/334] hwmon: (pmbus/bpa-rs600) Dont use rated limits as warn limits Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 226/334] hwmon: remove amd_energy driver in Makefile Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 227/334] ASoC: fsl_rpmsg: Check -EPROBE_DEFER for getting clocks Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 228/334] firmware: raspberrypi: Fix a leak in rpi_firmware_get() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 229/334] usb: gadget: mv_u3d: request_irq() after initializing UDC Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 230/334] mm/swap: consider max pages in iomap_swapfile_add_extent Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 231/334] lkdtm: replace SCSI_DISPATCH_CMD with SCSI_QUEUE_RQ Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 232/334] Bluetooth: add timeout sanity check to hci_inquiry Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 233/334] i2c: iop3xx: fix deferred probing Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 234/334] i2c: s3c2410: fix IRQ check Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 235/334] i2c: hix5hd2: " Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 236/334] gfs2: init system threads before freeze lock Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 237/334] drm/exynos: g2d: fix missing unlock on error in g2d_runqueue_worker() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 238/334] rsi: fix error code in rsi_load_9116_firmware() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 239/334] rsi: fix an error code in rsi_probe() Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 240/334] octeontx2-af: cn10k: Fix SDP base channel number Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 241/334] octeontx2-pf: send correct vlan priority mask to npc_install_flow_req Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 242/334] octeontx2-af: Check capability flag while freeing ipolicer memory Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 243/334] octeontx2-pf: Dont install VLAN offload rule if netdev is down Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 244/334] octeontx2-pf: Fix algorithm index in MCAM rules with RSS action Greg Kroah-Hartman
2021-09-13 13:14 ` [PATCH 5.14 245/334] octeontx2-af: cn10k: Use FLIT0 register instead of FLIT1 Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 246/334] m68k: coldfire: return success for clk_enable(NULL) Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 247/334] ASoC: Intel: kbl_da7219_max98927: Fix format selection for max98373 Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 248/334] ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 249/334] ASoC: Intel: Skylake: Fix module resource and format selection Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 250/334] mmc: sdhci: Fix issue with uninitialized dma_slave_config Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 251/334] mmc: dw_mmc: " Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 252/334] mmc: moxart: " Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 253/334] ASoC: wm_adsp: Put debugfs_remove_recursive back in Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 254/334] bpf: Fix possible out of bound write in narrow load handling Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 255/334] hv_utils: Set the maximum packet size for VSS driver to the length of the receive buffer Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 256/334] CIFS: Fix a potencially linear read overflow Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 257/334] i2c: mt65xx: fix IRQ check Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 258/334] i2c: xlp9xx: fix main " Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 259/334] octeontx2-pf: cn10k: Fix error return code in otx2_set_flowkey_cfg() Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 260/334] usb: ehci-orion: Handle errors of clk_prepare_enable() in probe Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 261/334] usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 262/334] usb: bdc: Fix a resource leak in the error handling path of bdc_probe() Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 263/334] tty: serial: fsl_lpuart: fix the wrong mapbase value Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 264/334] ASoC: wcd9335: Fix a double irq free in the remove function Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 265/334] ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 266/334] ASoC: wcd9335: Disable irq on slave ports in the remove function Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 267/334] iwlwifi: skip first element in the WTAS ACPI table Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 268/334] net/mlx5: Lag, fix multipath lag activation Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 269/334] net/mlx5: Remove all auxiliary devices at the unregister event Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 270/334] net/mlx5e: Fix possible use-after-free deleting fdb rule Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 271/334] net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 272/334] net/mlx5e: Use correct eswitch for stack devices with lag Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 273/334] misc/pvpanic: fix set driver data Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 274/334] ice: fix Tx queue iteration for Tx timestamp enablement Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 275/334] ice: add lock around Tx timestamp tracker flush Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 276/334] ice: restart periodic outputs around time changes Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 277/334] ice: Only lock to update netdev dev_addr Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 278/334] net: phy: marvell10g: fix broken PHY interrupts for anyone after us in the driver probe list Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 279/334] ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point() Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 280/334] ALSA: usb-audio: Add lowlatency module option Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 281/334] atlantic: Fix driver resume flow Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 282/334] bcma: Fix memory leak for internally-handled cores Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 283/334] brcmfmac: pcie: fix oops on failure to resume and reprobe Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 284/334] ipv6: make exception cache less predictible Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 285/334] ipv4: " Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 286/334] net: qrtr: make checks in qrtr_endpoint_post() stricter Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 287/334] sch_htb: Fix inconsistency when leaf qdisc creation fails Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 288/334] net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 289/334] net: qualcomm: fix QCA7000 checksum handling Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 290/334] octeontx2-af: Fix loop in free and unmap counter Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 291/334] octeontx2-af: Fix mailbox errors in nix_rss_flowkey_cfg Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 292/334] octeontx2-af: Fix static code analyzer reported issues Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 293/334] octeontx2-af: Set proper errorcode for IPv4 checksum errors Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 294/334] ipv4: fix endianness issue in inet_rtm_getroute_build_skb() Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 295/334] ASoC: rt5682: Remove unused variable in rt5682_i2c_remove() Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 296/334] iwlwifi Add support for ax201 in Samsung Galaxy Book Flex2 Alpha Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 297/334] f2fs: guarantee to write dirty data when enabling checkpoint back Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 298/334] time: Handle negative seconds correctly in timespec64_to_ns() Greg Kroah-Hartman
2021-09-15 19:00   ` Arnd Bergmann
2021-09-16  9:12     ` Greg Kroah-Hartman
     [not found]     ` <AM0PR01MB5410E0963A0AF9A525509DB2EEDC9@AM0PR01MB5410.eurprd01.prod.exchangelabs.com>
2021-09-16 20:57       ` Arnd Bergmann
2021-09-16 22:38         ` Thomas Gleixner
2021-09-16 22:32     ` Thomas Gleixner
2021-09-16 22:53       ` Thomas Gleixner
2021-09-17  7:31       ` Arnd Bergmann
2021-09-17  8:25         ` Greg Kroah-Hartman
2021-09-17  8:25       ` Greg Kroah-Hartman
2021-09-17 10:38         ` Thomas Gleixner
2021-09-17 15:20           ` Greg Kroah-Hartman
2021-09-17 19:29             ` Thomas Gleixner
2021-09-18 15:46               ` Greg Kroah-Hartman
2021-09-20 14:31                 ` Sasha Levin
2021-09-21 19:20                   ` Sasha Levin
2021-09-21 20:27                     ` Thomas Gleixner
2021-09-22  6:20                       ` Paolo Bonzini
2021-09-13 13:15 ` [PATCH 5.14 299/334] auxdisplay: hd44780: Fix oops on module unloading Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 300/334] io_uring: limit fixed table size by RLIMIT_NOFILE Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 301/334] io_uring: IORING_OP_WRITE needs hash_reg_file set Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 302/334] io_uring: io_uring_complete() trace should take an integer Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 303/334] io_uring: fail links of cancelled timeouts Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 304/334] bio: fix page leak bio_add_hw_page failure Greg Kroah-Hartman
2021-09-13 13:15 ` [PATCH 5.14 305/334] raid1: ensure write behind bio has less than BIO_MAX_VECS sectors Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 306/334] cifs: Do not leak EDEADLK to dgetents64 for STATUS_USER_SESSION_DELETED Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 307/334] smb3: fix posix extensions mount option Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 308/334] tty: Fix data race between tiocsti() and flush_to_ldisc() Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 309/334] perf/x86/intel/uncore: Fix IIO cleanup mapping procedure for SNR/ICX Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 310/334] Revert "KVM: x86: mmu: Add guest physical address check in translate_gpa()" Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 311/334] KVM: s390: index kvm->arch.idle_mask by vcpu_idx Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 312/334] KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 313/334] KVM: x86: clamp host mapping level to max_level in kvm_mmu_max_mapping_level Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 314/334] KVM: x86/mmu: Avoid collision with !PRESENT SPTEs in TDP MMU lpage stats Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 315/334] KVM: VMX: avoid running vmx_handle_exit_irqoff in case of emulation Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 316/334] KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 317/334] KVM: arm64: Unregister HYP sections from kmemleak in protected mode Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 318/334] KVM: arm64: vgic: Resample HW pending state on deactivation Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 319/334] ARM: dts: at91: add pinctrl-{names, 0} for all gpios Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 320/334] io-wq: check max_worker limits if a worker transitions bound state Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 321/334] md/raid10: Remove unnecessary rcu_dereference in raid10_handle_discard Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 322/334] char: tpm: Kconfig: remove bad i2c cr50 select Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 323/334] fuse: truncate pagecache on atomic_o_trunc Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 325/334] fuse: wait for writepages in syncfs Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 326/334] IMA: remove -Wmissing-prototypes warning Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 327/334] IMA: remove the dependency on CRYPTO_MD5 Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 328/334] fbmem: dont allow too huge resolutions Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 329/334] ACPI: PRM: Find PRMT table before parsing it Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 330/334] RDMA/mlx5: Fix number of allocated XLT entries Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 331/334] bootconfig: Fix missing return check of xbc_node_compose_key function Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 332/334] backlight: pwm_bl: Improve bootloader/kernel device handover Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 333/334] parisc: Fix unaligned-access crash in bootloader Greg Kroah-Hartman
2021-09-13 13:16 ` [PATCH 5.14 334/334] clk: kirkwood: Fix a clocking boot regression Greg Kroah-Hartman
2021-09-13 18:00 ` [PATCH 5.14 000/334] 5.14.4-rc1 review Naresh Kamboju
2021-09-13 18:13 ` Florian Fainelli
2021-09-13 19:12 ` Fox Chen
2021-09-13 20:06 ` Shuah Khan
2021-09-14  9:23 ` Naresh Kamboju
2021-09-14 15:57 ` Guenter Roeck
2021-09-14 16:08 ` Justin Forbes

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).