stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 5.4 000/158] 5.4.80-rc1 review
@ 2020-11-23 12:20 Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 001/158] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
                   ` (161 more replies)
  0 siblings, 162 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable

This is the start of the stable review cycle for the 5.4.80 release.
There are 158 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.80-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 5.4.80-rc1

Quentin Perret <qperret@google.com>
    sched/fair: Fix overutilized update in enqueue_task_fair()

Charan Teja Reddy <charante@codeaurora.org>
    mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations

Gerald Schaefer <gerald.schaefer@linux.ibm.com>
    mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()

Muchun Song <songmuchun@bytedance.com>
    mm: memcg/slab: fix root memcg vmstats

Chen Yu <yu.c.chen@intel.com>
    x86/microcode/intel: Check patch signature before saving microcode for early loading

Mickaël Salaün <mic@linux.microsoft.com>
    seccomp: Set PF_SUPERPRIV when checking capability

Mickaël Salaün <mic@linux.microsoft.com>
    ptrace: Set PF_SUPERPRIV when checking capability

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers

Ville Syrjälä <ville.syrjala@linux.intel.com>
    drm/i915: Handle max_bpc==16

Alex Deucher <alexander.deucher@amd.com>
    drm/amd/display: Add missing pflip irq for dcn2.0

Chris Co <chrco@microsoft.com>
    Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected

Stefan Haberland <sth@linux.ibm.com>
    s390/dasd: fix null pointer dereference for ERP requests

Thomas Richter <tmricht@linux.ibm.com>
    s390/cpum_sf.c: fix file permission for cpum_sfb_size

Johannes Berg <johannes.berg@intel.com>
    mac80211: free sta in sta_info_insert_finish() on errors

Felix Fietkau <nbd@nbd.name>
    mac80211: minstrel: fix tx status processing corner case

Felix Fietkau <nbd@nbd.name>
    mac80211: minstrel: remove deferred sampling code

Max Filippov <jcmvbkbc@gmail.com>
    xtensa: disable preemption around cache alias management calls

Max Filippov <jcmvbkbc@gmail.com>
    xtensa: fix TLBTEMP area placement

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    regulator: workaround self-referent regulators

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    regulator: avoid resolve_supply() infinite recursion

Michał Mirosław <mirq-linux@rere.qmqm.pl>
    regulator: fix memory leak with repeated set_machine_constraints()

Sean Nyekjaer <sean@geanix.com>
    regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}

Lukas Wunner <lukas@wunner.de>
    spi: bcm2835aux: Fix use-after-free on unbind

Lukas Wunner <lukas@wunner.de>
    spi: npcm-fiu: Don't leak SPI master in probe error path

Lukas Wunner <lukas@wunner.de>
    spi: Introduce device-managed SPI controller allocation

Lukas Wunner <lukas@wunner.de>
    spi: lpspi: Fix use-after-free on unbind

Fabien Parent <fparent@baylibre.com>
    iio: adc: mediatek: fix unset field

Hans de Goede <hdegoede@redhat.com>
    iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode

Hans de Goede <hdegoede@redhat.com>
    iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum

Jan Kara <jack@suse.cz>
    ext4: fix bogus warning in ext4_update_dx_flag()

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    iio: light: fix kconfig dependency bug for VCNL4035

Brian O'Keefe <bokeefe@alum.wpi.edu>
    staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids

Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
    efivarfs: fix memory leak in efivarfs_create()

Hans de Goede <hdegoede@redhat.com>
    HID: logitech-dj: Fix an error in mse_bluetooth_descriptor

Fugang Duan <fugang.duan@nxp.com>
    tty: serial: imx: keep console clocks always on

Sam Nobs <samuel.nobs@taitradio.com>
    tty: serial: imx: fix potential deadlock

PeiSen Hou <pshou@realtek.com>
    ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)

Kailang Yang <kailang@realtek.com>
    ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button

Takashi Iwai <tiwai@suse.de>
    ALSA: mixart: Fix mutex deadlock

Takashi Sakamoto <o-takashi@sakamocchi.jp>
    ALSA: ctl: fix error path at adding user-defined element set

Joakim Tjernlund <joakim.tjernlund@infinera.com>
    ALSA: usb-audio: Add delay quirk for all Logitech USB devices

Dan Carpenter <dan.carpenter@oracle.com>
    ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()

Samuel Thibault <samuel.thibault@ens-lyon.org>
    speakup: Do not let the line discipline be used several times

Hans de Goede <hdegoede@redhat.com>
    HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver

Hans de Goede <hdegoede@redhat.com>
    HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad

Harry Cutts <hcutts@chromium.org>
    HID: logitech-hidpp: Add PID for MX Anywhere 2

Yicong Yang <yangyicong@hisilicon.com>
    libfs: fix error cast of negative value in simple_attr_write()

Arvind Sankar <nivedita@alum.mit.edu>
    efi/x86: Free efi_pgd with free_pages()

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Use truesize with sk_rmem_schedule()

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: On receive programs try to fast track SK_PASS ingress

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: revert "xfs: fix rmap key and record comparison functions"

Luo Meng <luomeng12@huawei.com>
    fail_function: Remove a redundant mutex unlock

Nishanth Menon <nm@ti.com>
    regulator: ti-abb: Fix array out of bound read access on the first transition

Yu Kuai <yukuai3@huawei.com>
    xfs: return corresponding errcode if xfs_initialize_perag() fail

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: strengthen rmap record flags checking

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: fix the minrecs logic when dealing with inode root child blocks

Jarkko Nikula <jarkko.nikula@linux.intel.com>
    can: m_can: process interrupt only when not runtime suspended

Marc Kleine-Budde <mkl@pengutronix.de>
    can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery

Zhenzhong Duan <zhenzhong.duan@gmail.com>
    iommu/vt-d: Avoid panic if iommu init fails in tboot system

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header

Jimmy Assarsson <extja@kvaser.com>
    can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits

Jimmy Assarsson <extja@kvaser.com>
    can: kvaser_pciefd: Fix KCAN bittiming limits

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect

John Fastabend <john.fastabend@gmail.com>
    bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made

Eli Cohen <elic@nvidia.com>
    net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled

Xiongfeng Wang <wangxiongfeng2@huawei.com>
    drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()

Zhang Qilong <zhangqilong3@huawei.com>
    MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu

Wang Hai <wanghai38@huawei.com>
    selftests/bpf: Fix error return code in run_getsockopt_test()

Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
    ASoC: qcom: lpass-platform: Fix memory leak

Faiz Abbas <faiz_abbas@ti.com>
    can: m_can: m_can_stop(): set device to software init mode before closing

Dan Murphy <dmurphy@ti.com>
    can: m_can: m_can_class_free_dev(): introduce new function

Wu Bo <wubo.oduw@gmail.com>
    can: m_can: m_can_handle_state_change(): fix state change

Marc Kleine-Budde <mkl@pengutronix.de>
    can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration

Marc Kleine-Budde <mkl@pengutronix.de>
    can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init()

Enric Balletbo i Serra <enric.balletbo@collabora.com>
    can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI

Zhang Qilong <zhangqilong3@huawei.com>
    can: flexcan: fix failure handling of pm_runtime_get_sync()

Colin Ian King <colin.king@canonical.com>
    can: peak_usb: fix potential integer overflow on shift of a int

Marc Kleine-Budde <mkl@pengutronix.de>
    can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()

Zhang Qilong <zhangqilong3@huawei.com>
    can: ti_hecc: Fix memleak in ti_hecc_probe

Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
    can: dev: can_restart(): post buffer from the right context

Anant Thazhemadam <anant.thazhemadam@gmail.com>
    can: af_can: prevent potential access of uninitialized member in canfd_rcv()

Anant Thazhemadam <anant.thazhemadam@gmail.com>
    can: af_can: prevent potential access of uninitialized member in can_rcv()

Yi-Hung Wei <yihung.wei@gmail.com>
    ip_tunnels: Set tunnel option flag when tunnel metadata is present

Wang Hai <wanghai38@huawei.com>
    tools, bpftool: Add missing close before bpftool net attach exit

Leo Yan <leo.yan@linaro.org>
    perf lock: Don't free "lock_seq_stat" if read_count isn't zero

Christoph Hellwig <hch@lst.de>
    RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs

Qinglang Miao <miaoqinglang@huawei.com>
    RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device()

Claire Chang <tientzu@chromium.org>
    rfkill: Fix use-after-free in rfkill_resume()

Necip Fazil Yildiran <fazilyildiran@gmail.com>
    Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER

Fabio Estevam <festevam@gmail.com>
    ARM: dts: imx50-evk: Fix the chip select 1 IOMUX

Lucas Stach <l.stach@pengutronix.de>
    arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point

Stephen Rothwell <sfr@canb.auug.org.au>
    swiotlb: using SIZE_MAX needs limits.h included

Sergey Matyukevich <geomatsi@gmail.com>
    arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy

Adam Ford <aford173@gmail.com>
    arm64: dts imx8mn: Remove non-existent USB OTG2

Nenad Peric <nperic@gmail.com>
    arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node

Randy Dunlap <rdunlap@infradead.org>
    MIPS: export has_transparent_hugepage() for modules

Dan Carpenter <dan.carpenter@oracle.com>
    Input: adxl34x - clean up a data type in adxl34x_probe()

Chen-Yu Tsai <wens@csie.org>
    arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY

Chen-Yu Tsai <wens@csie.org>
    Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"

Jernej Skrabec <jernej.skrabec@siol.net>
    ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node

Jernej Skrabec <jernej.skrabec@siol.net>
    arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node

Jernej Skrabec <jernej.skrabec@siol.net>
    arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node

Jernej Skrabec <jernej.skrabec@siol.net>
    arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node

Corentin Labbe <clabbe@baylibre.com>
    arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay

Clément Péron <peron.clem@gmail.com>
    arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay

Arvind Sankar <nivedita@alum.mit.edu>
    compiler.h: fix barrier_data() on clang

Paul Barker <pbarker@konsulko.com>
    hwmon: (pwm-fan) Fix RPM calculation

Zhang Qilong <zhangqilong3@huawei.com>
    gfs2: fix possible reference leak in gfs2_check_blk_type

Darrick J. Wong <darrick.wong@oracle.com>
    vfs: remove lockdep bogosity in __sb_start_write

Will Deacon <will@kernel.org>
    arm64: smp: Tell RCU about CPUs that fail to come online

Will Deacon <will@kernel.org>
    arm64: psci: Avoid printing in cpu_psci_cpu_die()

Will Deacon <will@kernel.org>
    arm64: errata: Fix handling of 1418040 with late CPU onlining

Hans de Goede <hdegoede@redhat.com>
    ACPI: button: Add DMI quirk for Medion Akoya E2228T

Aaron Lewis <aaronlewis@google.com>
    selftests: kvm: Fix the segment descriptor layout to match the actual layout

Can Guo <cang@codeaurora.org>
    scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()

Jianqun Xu <jay.xu@rock-chips.com>
    pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq

Joel Stanley <joel@jms.id.au>
    net: ftgmac100: Fix crash when removing driver

Joel Stanley <joel@jms.id.au>
    net/ncsi: Fix netlink registration

Filip Moc <dev@moc6.cz>
    net: usb: qmi_wwan: Set DTR quirk for MR400

Vladyslav Tarasiuk <vladyslavt@nvidia.com>
    net/mlx5: Disable QoS when min_rates on all VFs are zero

Michael Guralnik <michaelgur@nvidia.com>
    net/mlx5: Add handling of port type in rule deletion

Ryan Sharpelletti <sharpelletti@google.com>
    tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate

Xin Long <lucien.xin@gmail.com>
    sctp: change to hold/put transport for proto_unreach_timer

Zhang Changzhong <zhangchangzhong@huawei.com>
    qlcnic: fix error return code in qlcnic_83xx_restart_hw()

Zhang Changzhong <zhangchangzhong@huawei.com>
    qed: fix error return code in qed_iwarp_ll2_start()

Dongli Zhang <dongli.zhang@oracle.com>
    page_frag: Recover from memory pressure

Xie He <xie.he.0141@gmail.com>
    net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request

Vadim Fedorenko <vfedorenko@novek.ru>
    net/tls: fix corrupted data in recvmsg

Karsten Graul <kgraul@linux.ibm.com>
    net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()

Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
    net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup

Aya Levin <ayal@nvidia.com>
    net/mlx4_core: Fix init_hca fields offset

Martin Blumenstingl <martin.blumenstingl@googlemail.com>
    net: lantiq: Wait for the GPHY firmware to be ready

Paul Moore <paul@paul-moore.com>
    netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()

Paul Moore <paul@paul-moore.com>
    netlabel: fix our progress tracking in netlbl_unlabel_staticlist()

Florian Fainelli <f.fainelli@gmail.com>
    net: Have netpoll bring-up DSA management interface

Zhang Changzhong <zhangchangzhong@huawei.com>
    net: ethernet: ti: cpsw: fix error return code in cpsw_probe()

Tobias Waldekranz <tobias@waldekranz.com>
    net: dsa: mv88e6xxx: Avoid VTU corruption on 6097

Heiner Kallweit <hkallweit1@gmail.com>
    net: bridge: add missing counters to ndo_get_stats64 callback

Zhang Changzhong <zhangchangzhong@huawei.com>
    net: b44: fix error return code in b44_init_one()

Ido Schimmel <idosch@nvidia.com>
    mlxsw: core: Use variable timeout for EMAD retries

Sven Van Asbroeck <thesven73@gmail.com>
    lan743x: prevent entire kernel HANG on open, for some platforms

Sven Van Asbroeck <thesven73@gmail.com>
    lan743x: fix issue causing intermittent kernel log warnings

Zhang Qilong <zhangqilong3@huawei.com>
    ipv6: Fix error path to cancel the meseage

Wang Hai <wanghai38@huawei.com>
    inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()

Jeff Dike <jdike@akamai.com>
    Exempt multicast addresses from five-second neighbor lifetime

Wang Hai <wanghai38@huawei.com>
    devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()

Edwin Peer <edwin.peer@broadcom.com>
    bnxt_en: read EEPROM A2h address using page 0

Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    atm: nicstar: Unmap DMA on send error

Zhang Changzhong <zhangchangzhong@huawei.com>
    ah6: fix error return code in ah6_input()


-------------

Diffstat:

 Documentation/xtensa/mmu.rst                       |  9 ++-
 Makefile                                           |  4 +-
 arch/arm/boot/dts/imx50-evk.dts                    |  2 +-
 arch/arm/boot/dts/imx6qdl-udoo.dtsi                |  2 +-
 arch/arm/boot/dts/sun6i-a31-hummingbird.dts        |  2 +-
 arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts   |  2 +-
 arch/arm/boot/dts/sun7i-a20-cubietruck.dts         |  2 +-
 arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts       |  2 +-
 arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts   |  2 +-
 arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts    |  5 --
 arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts     |  2 +-
 arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts  |  2 +-
 arch/arm/boot/dts/sun9i-a80-cubieboard4.dts        |  2 +-
 arch/arm/boot/dts/sun9i-a80-optimus.dts            |  2 +-
 arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi      |  2 +-
 .../boot/dts/allwinner/sun50i-a64-bananapi-m64.dts |  2 +-
 .../boot/dts/allwinner/sun50i-a64-orangepi-win.dts |  2 +-
 .../boot/dts/allwinner/sun50i-a64-pine64-plus.dts  |  2 +-
 .../boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts  |  2 +-
 .../dts/allwinner/sun50i-h5-orangepi-prime.dts     |  2 +-
 .../boot/dts/allwinner/sun50i-h6-beelink-gs1.dts   |  2 +-
 .../boot/dts/allwinner/sun50i-h6-pine-h64.dts      |  2 +-
 arch/arm64/boot/dts/freescale/imx8mm.dtsi          |  2 +-
 arch/arm64/boot/dts/freescale/imx8mn.dtsi          | 30 -------
 arch/arm64/include/asm/cpufeature.h                |  2 +
 arch/arm64/kernel/process.c                        |  5 +-
 arch/arm64/kernel/psci.c                           |  5 +-
 arch/arm64/kernel/smp.c                            |  1 +
 arch/mips/alchemy/common/clock.c                   |  9 ++-
 arch/mips/mm/tlb-r4k.c                             |  1 +
 arch/s390/kernel/perf_cpum_sf.c                    |  2 +-
 arch/x86/kernel/cpu/microcode/intel.c              | 63 +++------------
 arch/x86/kernel/tboot.c                            |  3 -
 arch/x86/platform/efi/efi_64.c                     | 24 +++---
 arch/xtensa/include/asm/pgtable.h                  |  2 +-
 arch/xtensa/mm/cache.c                             | 14 ++++
 drivers/acpi/button.c                              | 13 ++-
 drivers/atm/nicstar.c                              |  2 +
 .../amd/display/dc/irq/dcn20/irq_service_dcn20.c   |  4 +-
 drivers/gpu/drm/i915/display/intel_display.c       |  3 +-
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c              |  1 +
 drivers/hid/hid-logitech-dj.c                      | 22 ++++-
 drivers/hid/hid-logitech-hidpp.c                   | 26 ++++++
 drivers/hv/hv.c                                    |  8 +-
 drivers/hwmon/pwm-fan.c                            | 16 ++--
 drivers/iio/accel/kxcjk-1013.c                     | 51 ++++++++++--
 drivers/iio/adc/mt6577_auxadc.c                    |  6 +-
 drivers/iio/light/Kconfig                          |  1 +
 drivers/infiniband/Kconfig                         |  3 +
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c     |  2 +-
 drivers/infiniband/sw/rdmavt/Kconfig               |  3 +-
 drivers/infiniband/sw/rxe/Kconfig                  |  2 +-
 drivers/infiniband/sw/siw/Kconfig                  |  1 +
 drivers/input/misc/adxl34x.c                       |  2 +-
 drivers/input/touchscreen/Kconfig                  |  1 +
 drivers/iommu/intel-iommu.c                        |  5 +-
 drivers/mmc/host/sdhci-pci-core.c                  | 13 ++-
 drivers/net/can/dev.c                              |  2 +-
 drivers/net/can/flexcan.c                          | 26 +++---
 drivers/net/can/kvaser_pciefd.c                    |  4 +-
 drivers/net/can/m_can/Kconfig                      |  3 +-
 drivers/net/can/m_can/m_can.c                      | 15 +++-
 drivers/net/can/m_can/m_can.h                      |  1 +
 drivers/net/can/m_can/tcan4x5x.c                   |  8 +-
 drivers/net/can/ti_hecc.c                          | 13 +--
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c  |  2 +-
 drivers/net/can/usb/mcba_usb.c                     |  4 +-
 drivers/net/can/usb/peak_usb/pcan_usb_core.c       |  4 +-
 drivers/net/dsa/lantiq_gswip.c                     | 11 +++
 drivers/net/dsa/mv88e6xxx/global1_vtu.c            | 59 +++++++++++---
 drivers/net/ethernet/broadcom/b44.c                |  3 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c  |  2 +-
 drivers/net/ethernet/faraday/ftgmac100.c           |  4 +
 drivers/net/ethernet/mellanox/mlx4/fw.c            |  6 +-
 drivers/net/ethernet/mellanox/mlx4/fw.h            |  4 +-
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c  | 19 +++--
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c  |  7 ++
 drivers/net/ethernet/mellanox/mlxsw/core.c         |  3 +-
 drivers/net/ethernet/microchip/lan743x_main.c      | 13 +--
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c        | 12 ++-
 .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c  |  3 +-
 .../net/ethernet/qualcomm/rmnet/rmnet_handlers.c   |  5 ++
 drivers/net/ethernet/ti/cpsw.c                     |  1 +
 drivers/net/geneve.c                               |  3 +-
 drivers/net/usb/qmi_wwan.c                         |  2 +-
 drivers/pinctrl/pinctrl-rockchip.c                 |  2 +
 drivers/regulator/core.c                           | 38 +++++----
 drivers/regulator/pfuze100-regulator.c             | 13 +--
 drivers/regulator/ti-abb-regulator.c               | 12 ++-
 drivers/s390/block/dasd.c                          |  6 ++
 drivers/scsi/ufs/ufshcd.c                          |  6 +-
 drivers/spi/spi-bcm2835aux.c                       | 21 ++---
 drivers/spi/spi-fsl-lpspi.c                        |  3 -
 drivers/spi/spi-npcm-fiu.c                         |  2 +-
 drivers/spi/spi.c                                  | 58 ++++++++++++-
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c       |  1 +
 drivers/staging/speakup/spk_ttyio.c                | 12 ++-
 drivers/tty/serial/imx.c                           | 30 +++----
 fs/efivarfs/super.c                                |  1 +
 fs/ext4/ext4.h                                     |  3 +-
 fs/gfs2/rgrp.c                                     | 10 +--
 fs/libfs.c                                         |  6 +-
 fs/super.c                                         | 33 +-------
 fs/xfs/libxfs/xfs_rmap_btree.c                     | 16 ++--
 fs/xfs/scrub/bmap.c                                |  8 +-
 fs/xfs/scrub/btree.c                               | 45 ++++++-----
 fs/xfs/xfs_mount.c                                 | 11 ++-
 include/drm/intel-gtt.h                            |  5 +-
 include/linux/compiler-clang.h                     |  5 --
 include/linux/compiler-gcc.h                       | 19 -----
 include/linux/compiler.h                           | 18 ++++-
 include/linux/intel-iommu.h                        |  2 +-
 include/linux/spi/spi.h                            | 19 +++++
 include/linux/swiotlb.h                            |  1 +
 include/net/ip_tunnels.h                           |  7 +-
 include/net/neighbour.h                            |  1 +
 kernel/fail_function.c                             |  5 +-
 kernel/ptrace.c                                    | 16 ++--
 kernel/rcu/tree.c                                  |  2 +-
 kernel/sched/fair.c                                |  3 +-
 kernel/seccomp.c                                   |  5 +-
 mm/huge_memory.c                                   |  9 +--
 mm/memcontrol.c                                    |  9 ++-
 mm/page_alloc.c                                    | 30 ++++++-
 net/bridge/br_device.c                             |  1 +
 net/can/af_can.c                                   | 38 ++++++---
 net/core/devlink.c                                 |  6 +-
 net/core/neighbour.c                               |  2 +
 net/core/netpoll.c                                 | 22 ++++-
 net/core/skmsg.c                                   | 94 +++++++++++++++++-----
 net/ipv4/arp.c                                     |  6 ++
 net/ipv4/inet_diag.c                               |  4 +-
 net/ipv4/tcp_bbr.c                                 |  2 +-
 net/ipv4/tcp_bpf.c                                 | 18 +++--
 net/ipv6/addrconf.c                                |  8 +-
 net/ipv6/ah6.c                                     |  3 +-
 net/ipv6/ndisc.c                                   |  7 ++
 net/mac80211/rc80211_minstrel.c                    | 27 ++-----
 net/mac80211/rc80211_minstrel.h                    |  1 -
 net/mac80211/sta_info.c                            | 14 +---
 net/ncsi/ncsi-manage.c                             |  5 --
 net/ncsi/ncsi-netlink.c                            | 22 +----
 net/ncsi/ncsi-netlink.h                            |  3 -
 net/netlabel/netlabel_unlabeled.c                  | 17 ++--
 net/rfkill/core.c                                  |  3 +
 net/sctp/input.c                                   |  4 +-
 net/sctp/sm_sideeffect.c                           |  4 +-
 net/sctp/transport.c                               |  2 +-
 net/smc/smc_ib.c                                   |  6 +-
 net/tls/tls_sw.c                                   |  2 +-
 net/x25/af_x25.c                                   |  1 +
 sound/core/control.c                               |  2 +-
 sound/firewire/fireworks/fireworks_transaction.c   |  4 +-
 sound/pci/hda/patch_realtek.c                      | 59 +++++++++++++-
 sound/pci/mixart/mixart_core.c                     |  5 +-
 sound/soc/qcom/lpass-platform.c                    |  5 +-
 sound/usb/quirks.c                                 | 10 +--
 tools/bpf/bpftool/net.c                            | 18 ++---
 tools/perf/builtin-lock.c                          |  2 +-
 .../selftests/bpf/prog_tests/sockopt_multi.c       |  3 +-
 .../selftests/kvm/include/x86_64/processor.h       |  2 +-
 tools/testing/selftests/kvm/lib/x86_64/processor.c |  3 +-
 162 files changed, 994 insertions(+), 577 deletions(-)



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 001/158] ah6: fix error return code in ah6_input()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 002/158] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong, Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ah6.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -588,7 +588,8 @@ static int ah6_input(struct xfrm_state *
 	memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
 	memset(ah->auth_data, 0, ahp->icv_trunc_len);
 
-	if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
+	err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
+	if (err)
 		goto out_free;
 
 	ip6h->priority    = 0;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 002/158] atm: nicstar: Unmap DMA on send error
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 001/158] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 003/158] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chas Williams,
	Sebastian Andrzej Siewior, Jakub Kicinski

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ]

The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case
push_scqe() fails to submit the `skb'. The memory of the `skb' is
released so only the DMA mapping is leaking.

Unmap the DMA mapping in case push_scqe() failed.

Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms")
Cc: Chas Williams <3chas3@gmail.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/atm/nicstar.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/atm/nicstar.c
+++ b/drivers/atm/nicstar.c
@@ -1706,6 +1706,8 @@ static int ns_send(struct atm_vcc *vcc,
 
 	if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
 		atomic_inc(&vcc->stats->tx_err);
+		dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
+				 DMA_TO_DEVICE);
 		dev_kfree_skb_any(skb);
 		return -EIO;
 	}



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 003/158] bnxt_en: read EEPROM A2h address using page 0
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 001/158] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 002/158] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 004/158] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Edwin Peer, Michael Chan, Jakub Kicinski

From: Edwin Peer <edwin.peer@broadcom.com>

[ Upstream commit 4260330b32b14330cfe427d568ac5f5b29b5be3d ]

The module eeprom address range returned by bnxt_get_module_eeprom()
should be 256 bytes of A0h address space, the lower half of the A2h
address space, and page 0 for the upper half of the A2h address space.

Fix the firmware call by passing page_number 0 for the A2h slave address
space.

Fixes: 42ee18fe4ca2 ("bnxt_en: Add Support for ETHTOOL_GMODULEINFO and ETHTOOL_GMODULEEEPRO")
Signed-off-by: Edwin Peer <edwin.peer@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
@@ -2584,7 +2584,7 @@ static int bnxt_get_module_eeprom(struct
 	/* Read A2 portion of the EEPROM */
 	if (length) {
 		start -= ETH_MODULE_SFF_8436_LEN;
-		rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 1,
+		rc = bnxt_read_sfp_module_eeprom_info(bp, I2C_DEV_ADDR_A2, 0,
 						      start, length, data);
 	}
 	return rc;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 004/158] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 003/158] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 005/158] Exempt multicast addresses from five-second neighbor lifetime Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Jakub Kicinski

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit 849920c703392957f94023f77ec89ca6cf119d43 ]

If sb_occ_port_pool_get() failed in devlink_nl_sb_port_pool_fill(),
msg should be canceled by genlmsg_cancel().

Fixes: df38dafd2559 ("devlink: implement shared buffer occupancy monitoring interface")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201113111622.11040-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/devlink.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -1144,7 +1144,7 @@ static int devlink_nl_sb_port_pool_fill(
 		err = ops->sb_occ_port_pool_get(devlink_port, devlink_sb->index,
 						pool_index, &cur, &max);
 		if (err && err != -EOPNOTSUPP)
-			return err;
+			goto sb_occ_get_failure;
 		if (!err) {
 			if (nla_put_u32(msg, DEVLINK_ATTR_SB_OCC_CUR, cur))
 				goto nla_put_failure;
@@ -1157,8 +1157,10 @@ static int devlink_nl_sb_port_pool_fill(
 	return 0;
 
 nla_put_failure:
+	err = -EMSGSIZE;
+sb_occ_get_failure:
 	genlmsg_cancel(msg, hdr);
-	return -EMSGSIZE;
+	return err;
 }
 
 static int devlink_nl_cmd_sb_port_pool_get_doit(struct sk_buff *skb,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 005/158] Exempt multicast addresses from five-second neighbor lifetime
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 004/158] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 006/158] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Dike, David Ahern, Jakub Kicinski

From: Jeff Dike <jdike@akamai.com>

[ Upstream commit 8cf8821e15cd553339a5b48ee555a0439c2b2742 ]

Commit 58956317c8de ("neighbor: Improve garbage collection")
guarantees neighbour table entries a five-second lifetime.  Processes
which make heavy use of multicast can fill the neighour table with
multicast addresses in five seconds.  At that point, neighbour entries
can't be GC-ed because they aren't five seconds old yet, the kernel
log starts to fill up with "neighbor table overflow!" messages, and
sends start to fail.

This patch allows multicast addresses to be thrown out before they've
lived out their five seconds.  This makes room for non-multicast
addresses and makes messages to all addresses more reliable in these
circumstances.

Fixes: 58956317c8de ("neighbor: Improve garbage collection")
Signed-off-by: Jeff Dike <jdike@akamai.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20201113015815.31397-1-jdike@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/neighbour.h |    1 +
 net/core/neighbour.c    |    2 ++
 net/ipv4/arp.c          |    6 ++++++
 net/ipv6/ndisc.c        |    7 +++++++
 4 files changed, 16 insertions(+)

--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h
@@ -204,6 +204,7 @@ struct neigh_table {
 	int			(*pconstructor)(struct pneigh_entry *);
 	void			(*pdestructor)(struct pneigh_entry *);
 	void			(*proxy_redo)(struct sk_buff *skb);
+	int			(*is_multicast)(const void *pkey);
 	bool			(*allow_add)(const struct net_device *dev,
 					     struct netlink_ext_ack *extack);
 	char			*id;
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -235,6 +235,8 @@ static int neigh_forced_gc(struct neigh_
 
 			write_lock(&n->lock);
 			if ((n->nud_state == NUD_FAILED) ||
+			    (tbl->is_multicast &&
+			     tbl->is_multicast(n->primary_key)) ||
 			    time_after(tref, n->updated))
 				remove = true;
 			write_unlock(&n->lock);
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -125,6 +125,7 @@ static int arp_constructor(struct neighb
 static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
 static void parp_redo(struct sk_buff *skb);
+static int arp_is_multicast(const void *pkey);
 
 static const struct neigh_ops arp_generic_ops = {
 	.family =		AF_INET,
@@ -156,6 +157,7 @@ struct neigh_table arp_tbl = {
 	.key_eq		= arp_key_eq,
 	.constructor	= arp_constructor,
 	.proxy_redo	= parp_redo,
+	.is_multicast	= arp_is_multicast,
 	.id		= "arp_cache",
 	.parms		= {
 		.tbl			= &arp_tbl,
@@ -928,6 +930,10 @@ static void parp_redo(struct sk_buff *sk
 	arp_process(dev_net(skb->dev), NULL, skb);
 }
 
+static int arp_is_multicast(const void *pkey)
+{
+	return ipv4_is_multicast(*((__be32 *)pkey));
+}
 
 /*
  *	Receive an arp request from the device layer.
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -81,6 +81,7 @@ static void ndisc_error_report(struct ne
 static int pndisc_constructor(struct pneigh_entry *n);
 static void pndisc_destructor(struct pneigh_entry *n);
 static void pndisc_redo(struct sk_buff *skb);
+static int ndisc_is_multicast(const void *pkey);
 
 static const struct neigh_ops ndisc_generic_ops = {
 	.family =		AF_INET6,
@@ -115,6 +116,7 @@ struct neigh_table nd_tbl = {
 	.pconstructor =	pndisc_constructor,
 	.pdestructor =	pndisc_destructor,
 	.proxy_redo =	pndisc_redo,
+	.is_multicast =	ndisc_is_multicast,
 	.allow_add  =   ndisc_allow_add,
 	.id =		"ndisc_cache",
 	.parms = {
@@ -1705,6 +1707,11 @@ static void pndisc_redo(struct sk_buff *
 	kfree_skb(skb);
 }
 
+static int ndisc_is_multicast(const void *pkey)
+{
+	return ipv6_addr_is_multicast((struct in6_addr *)pkey);
+}
+
 static bool ndisc_suppress_frag_ndisc(struct sk_buff *skb)
 {
 	struct inet6_dev *idev = __in6_dev_get(skb->dev);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 006/158] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 005/158] Exempt multicast addresses from five-second neighbor lifetime Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 007/158] ipv6: Fix error path to cancel the meseage Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai, Jakub Kicinski

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit e33de7c5317e2827b2ba6fd120a505e9eb727b05 ]

nlmsg_cancel() needs to be called in the error path of
inet_req_diag_fill to cancel the message.

Fixes: d545caca827b ("net: inet: diag: expose the socket mark to privileged processes.")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Link: https://lore.kernel.org/r/20201116082018.16496-1-wanghai38@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/inet_diag.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -388,8 +388,10 @@ static int inet_req_diag_fill(struct soc
 	r->idiag_inode	= 0;
 
 	if (net_admin && nla_put_u32(skb, INET_DIAG_MARK,
-				     inet_rsk(reqsk)->ir_mark))
+				     inet_rsk(reqsk)->ir_mark)) {
+		nlmsg_cancel(skb, nlh);
 		return -EMSGSIZE;
+	}
 
 	nlmsg_end(skb, nlh);
 	return 0;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 007/158] ipv6: Fix error path to cancel the meseage
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 006/158] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 008/158] lan743x: fix issue causing intermittent kernel log warnings Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong, Jakub Kicinski

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ceb736e1d45c253f5e86b185ca9b497cdd43063f ]

genlmsg_cancel() needs to be called in the error path of
inet6_fill_ifmcaddr and inet6_fill_ifacaddr to cancel
the message.

Fixes: 6ecf4c37eb3e ("ipv6: enable IFA_TARGET_NETNSID for RTM_GETADDR")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201112080950.1476302-1-zhangqilong3@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/addrconf.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4984,8 +4984,10 @@ static int inet6_fill_ifmcaddr(struct sk
 		return -EMSGSIZE;
 
 	if (args->netnsid >= 0 &&
-	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
+	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
+		nlmsg_cancel(skb, nlh);
 		return -EMSGSIZE;
+	}
 
 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
 	if (nla_put_in6_addr(skb, IFA_MULTICAST, &ifmca->mca_addr) < 0 ||
@@ -5016,8 +5018,10 @@ static int inet6_fill_ifacaddr(struct sk
 		return -EMSGSIZE;
 
 	if (args->netnsid >= 0 &&
-	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid))
+	    nla_put_s32(skb, IFA_TARGET_NETNSID, args->netnsid)) {
+		nlmsg_cancel(skb, nlh);
 		return -EMSGSIZE;
+	}
 
 	put_ifaddrmsg(nlh, 128, IFA_F_PERMANENT, scope, ifindex);
 	if (nla_put_in6_addr(skb, IFA_ANYCAST, &ifaca->aca_addr) < 0 ||



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 008/158] lan743x: fix issue causing intermittent kernel log warnings
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 007/158] ipv6: Fix error path to cancel the meseage Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 009/158] lan743x: prevent entire kernel HANG on open, for some platforms Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Van Asbroeck, Jakub Kicinski

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit e35df62e04cc6fc4b9d90d054732f138349ff9b1 ]

When running this chip on arm imx6, we intermittently observe
the following kernel warning in the log, especially when the
system is under high load:

[   50.119484] ------------[ cut here ]------------
[   50.124377] WARNING: CPU: 0 PID: 303 at kernel/softirq.c:169 __local_bh_enable_ip+0x100/0x184
[   50.132925] IRQs not enabled as expected
[   50.159250] CPU: 0 PID: 303 Comm: rngd Not tainted 5.7.8 #1
[   50.164837] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[   50.171395] [<c0111a38>] (unwind_backtrace) from [<c010be28>] (show_stack+0x10/0x14)
[   50.179162] [<c010be28>] (show_stack) from [<c05b9dec>] (dump_stack+0xac/0xd8)
[   50.186408] [<c05b9dec>] (dump_stack) from [<c0122e40>] (__warn+0xd0/0x10c)
[   50.193391] [<c0122e40>] (__warn) from [<c0123238>] (warn_slowpath_fmt+0x98/0xc4)
[   50.200892] [<c0123238>] (warn_slowpath_fmt) from [<c012b010>] (__local_bh_enable_ip+0x100/0x184)
[   50.209860] [<c012b010>] (__local_bh_enable_ip) from [<bf09ecbc>] (destroy_conntrack+0x48/0xd8 [nf_conntrack])
[   50.220038] [<bf09ecbc>] (destroy_conntrack [nf_conntrack]) from [<c0ac9b58>] (nf_conntrack_destroy+0x94/0x168)
[   50.230160] [<c0ac9b58>] (nf_conntrack_destroy) from [<c0a4aaa0>] (skb_release_head_state+0xa0/0xd0)
[   50.239314] [<c0a4aaa0>] (skb_release_head_state) from [<c0a4aadc>] (skb_release_all+0xc/0x24)
[   50.247946] [<c0a4aadc>] (skb_release_all) from [<c0a4b4cc>] (consume_skb+0x74/0x17c)
[   50.255796] [<c0a4b4cc>] (consume_skb) from [<c081a2dc>] (lan743x_tx_release_desc+0x120/0x124)
[   50.264428] [<c081a2dc>] (lan743x_tx_release_desc) from [<c081a98c>] (lan743x_tx_napi_poll+0x5c/0x18c)
[   50.273755] [<c081a98c>] (lan743x_tx_napi_poll) from [<c0a6b050>] (net_rx_action+0x118/0x4a4)
[   50.282306] [<c0a6b050>] (net_rx_action) from [<c0101364>] (__do_softirq+0x13c/0x53c)
[   50.290157] [<c0101364>] (__do_softirq) from [<c012b29c>] (irq_exit+0x150/0x17c)
[   50.297575] [<c012b29c>] (irq_exit) from [<c0196a08>] (__handle_domain_irq+0x60/0xb0)
[   50.305423] [<c0196a08>] (__handle_domain_irq) from [<c05d44fc>] (gic_handle_irq+0x4c/0x90)
[   50.313790] [<c05d44fc>] (gic_handle_irq) from [<c0100ed4>] (__irq_usr+0x54/0x80)
[   50.321287] Exception stack(0xecd99fb0 to 0xecd99ff8)
[   50.326355] 9fa0:                                     1cf1aa74 00000001 00000001 00000000
[   50.334547] 9fc0: 00000001 00000000 00000000 00000000 00000000 00000000 00004097 b6d17d14
[   50.342738] 9fe0: 00000001 b6d17c60 00000000 b6e71f94 800b0010 ffffffff
[   50.349364] irq event stamp: 2525027
[   50.352955] hardirqs last  enabled at (2525026): [<c0a6afec>] net_rx_action+0xb4/0x4a4
[   50.360892] hardirqs last disabled at (2525027): [<c0d6d2fc>] _raw_spin_lock_irqsave+0x1c/0x50
[   50.369517] softirqs last  enabled at (2524660): [<c01015b4>] __do_softirq+0x38c/0x53c
[   50.377446] softirqs last disabled at (2524693): [<c012b29c>] irq_exit+0x150/0x17c
[   50.385027] ---[ end trace c0b571db4bc8087d ]---

The driver is calling dev_kfree_skb() from code inside a spinlock,
where h/w interrupts are disabled. This is forbidden, as documented
in include/linux/netdevice.h. The correct function to use
dev_kfree_skb_irq(), or dev_kfree_skb_any().

Fix by using the correct dev_kfree_skb_xxx() functions:

in lan743x_tx_release_desc():
  called by lan743x_tx_release_completed_descriptors()
    called by in lan743x_tx_napi_poll()
    which holds a spinlock
  called by lan743x_tx_release_all_descriptors()
    called by lan743x_tx_close()
    which can-sleep
conclusion: use dev_kfree_skb_any()

in lan743x_tx_xmit_frame():
  which holds a spinlock
conclusion: use dev_kfree_skb_irq()

in lan743x_tx_close():
  which can-sleep
conclusion: use dev_kfree_skb()

in lan743x_rx_release_ring_element():
  called by lan743x_rx_close()
    which can-sleep
  called by lan743x_rx_open()
    which can-sleep
conclusion: use dev_kfree_skb()

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
Link: https://lore.kernel.org/r/20201112185949.11315-1-TheSven73@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -1242,13 +1242,13 @@ clean_up_data_descriptor:
 		goto clear_active;
 
 	if (!(buffer_info->flags & TX_BUFFER_INFO_FLAG_TIMESTAMP_REQUESTED)) {
-		dev_kfree_skb(buffer_info->skb);
+		dev_kfree_skb_any(buffer_info->skb);
 		goto clear_skb;
 	}
 
 	if (cleanup) {
 		lan743x_ptp_unrequest_tx_timestamp(tx->adapter);
-		dev_kfree_skb(buffer_info->skb);
+		dev_kfree_skb_any(buffer_info->skb);
 	} else {
 		ignore_sync = (buffer_info->flags &
 			       TX_BUFFER_INFO_FLAG_IGNORE_SYNC) != 0;
@@ -1558,7 +1558,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
 	if (required_number_of_descriptors >
 		lan743x_tx_get_avail_desc(tx)) {
 		if (required_number_of_descriptors > (tx->ring_size - 1)) {
-			dev_kfree_skb(skb);
+			dev_kfree_skb_irq(skb);
 		} else {
 			/* save to overflow buffer */
 			tx->overflow_skb = skb;
@@ -1591,7 +1591,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
 				   start_frame_length,
 				   do_timestamp,
 				   skb->ip_summed == CHECKSUM_PARTIAL)) {
-		dev_kfree_skb(skb);
+		dev_kfree_skb_irq(skb);
 		goto unlock;
 	}
 
@@ -1610,7 +1610,7 @@ static netdev_tx_t lan743x_tx_xmit_frame
 			 * frame assembler clean up was performed inside
 			 *	lan743x_tx_frame_add_fragment
 			 */
-			dev_kfree_skb(skb);
+			dev_kfree_skb_irq(skb);
 			goto unlock;
 		}
 	}



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 009/158] lan743x: prevent entire kernel HANG on open, for some platforms
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 008/158] lan743x: fix issue causing intermittent kernel log warnings Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 010/158] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Van Asbroeck, Jakub Kicinski

From: Sven Van Asbroeck <thesven73@gmail.com>

[ Upstream commit 796a2665ca3e91ebaba7222f76fd9a035714e2d8 ]

On arm imx6, when opening the chip's netdev, the whole Linux
kernel intermittently hangs/freezes.

This is caused by a bug in the driver code which tests if pcie
interrupts are working correctly, using the software interrupt:

1. open: enable the software interrupt
2. open: tell the chip to assert the software interrupt
3. open: wait for flag
4. ISR: acknowledge s/w interrupt, set flag
5. open: notice flag, disable the s/w interrupt, continue

Unfortunately the ISR only acknowledges the s/w interrupt, but
does not disable it. This will re-trigger the ISR in a tight
loop.

On some (lucky) platforms, open proceeds to disable the s/w
interrupt even while the ISR is 'spinning'. On arm imx6,
the spinning ISR does not allow open to proceed, resulting
in a hung Linux kernel.

Fix minimally by disabling the s/w interrupt in the ISR, which
will prevent it from spinning. This won't break anything because
the s/w interrupt is used as a one-shot interrupt.

Note that this is a minimal fix, overlooking many possible
cleanups, e.g.:
- lan743x_intr_software_isr() is completely redundant and reads
  INT_STS twice for no apparent reason
- disabling the s/w interrupt in lan743x_intr_test_isr() is now
  redundant, but harmless
- waiting on software_isr_flag can be converted from a sleeping
  poll loop to wait_event_timeout()

Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver")
Tested-by: Sven Van Asbroeck <thesven73@gmail.com> # arm imx6 lan7430
Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
Link: https://lore.kernel.org/r/20201112204741.12375-1-TheSven73@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_main.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/microchip/lan743x_main.c
+++ b/drivers/net/ethernet/microchip/lan743x_main.c
@@ -145,7 +145,8 @@ static void lan743x_intr_software_isr(vo
 
 	int_sts = lan743x_csr_read(adapter, INT_STS);
 	if (int_sts & INT_BIT_SW_GP_) {
-		lan743x_csr_write(adapter, INT_STS, INT_BIT_SW_GP_);
+		/* disable the interrupt to prevent repeated re-triggering */
+		lan743x_csr_write(adapter, INT_EN_CLR, INT_BIT_SW_GP_);
 		intr->software_isr_flag = 1;
 	}
 }



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 010/158] mlxsw: core: Use variable timeout for EMAD retries
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 009/158] lan743x: prevent entire kernel HANG on open, for some platforms Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 011/158] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Denis Yulevich, Ido Schimmel,
	Jiri Pirko, Jakub Kicinski

From: Ido Schimmel <idosch@nvidia.com>

[ Upstream commit 1f492eab67bced119a0ac7db75ef2047e29a30c6 ]

The driver sends Ethernet Management Datagram (EMAD) packets to the
device for configuration purposes and waits for up to 200ms for a reply.
A request is retried up to 5 times.

When the system is under heavy load, replies are not always processed in
time and EMAD transactions fail.

Make the process more robust to such delays by using exponential
backoff. First wait for up to 200ms, then retransmit and wait for up to
400ms and so on.

Fixes: caf7297e7ab5 ("mlxsw: core: Introduce support for asynchronous EMAD register access")
Reported-by: Denis Yulevich <denisyu@nvidia.com>
Tested-by: Denis Yulevich <denisyu@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlxsw/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -444,7 +444,8 @@ static void mlxsw_emad_trans_timeout_sch
 	if (trans->core->fw_flash_in_progress)
 		timeout = msecs_to_jiffies(MLXSW_EMAD_TIMEOUT_DURING_FW_FLASH_MS);
 
-	queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw, timeout);
+	queue_delayed_work(trans->core->emad_wq, &trans->timeout_dw,
+			   timeout << trans->retries);
 }
 
 static int mlxsw_emad_transmit(struct mlxsw_core *mlxsw_core,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 011/158] net: b44: fix error return code in b44_init_one()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 010/158] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 012/158] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Michael Chan, Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/broadcom/b44.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -2391,7 +2391,8 @@ static int b44_init_one(struct ssb_devic
 		goto err_out_free_dev;
 	}
 
-	if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
+	err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
+	if (err) {
 		dev_err(sdev->dev,
 			"Required 30BIT DMA mask unsupported by the system\n");
 		goto err_out_powerdown;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 012/158] net: bridge: add missing counters to ndo_get_stats64 callback
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 011/158] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 013/158] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiner Kallweit, Jakub Kicinski

From: Heiner Kallweit <hkallweit1@gmail.com>

[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]

In br_forward.c and br_input.c fields dev->stats.tx_dropped and
dev->stats.multicast are populated, but they are ignored in
ndo_get_stats64.

Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/bridge/br_device.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -214,6 +214,7 @@ static void br_get_stats64(struct net_de
 		sum.rx_packets += tmp.rx_packets;
 	}
 
+	netdev_stats_to_stats64(stats, &dev->stats);
 	stats->tx_bytes   = sum.tx_bytes;
 	stats->tx_packets = sum.tx_packets;
 	stats->rx_bytes   = sum.rx_bytes;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 013/158] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 012/158] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 014/158] net: ethernet: ti: cpsw: fix error return code in cpsw_probe() Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tobias Waldekranz, Jakub Kicinski

From: Tobias Waldekranz <tobias@waldekranz.com>

[ Upstream commit 92307069a96c07d9b6e74b96b79390e7cd7d2111 ]

As soon as you add the second port to a VLAN, all other port
membership configuration is overwritten with zeroes. The HW interprets
this as all ports being "unmodified members" of the VLAN.

In the simple case when all ports belong to the same VLAN, switching
will still work. But using multiple VLANs or trying to set multiple
ports as tagged members will not work.

On the 6352, doing a VTU GetNext op, followed by an STU GetNext op
will leave you with both the member- and state- data in the VTU/STU
data registers. But on the 6097 (which uses the same implementation),
the STU GetNext will override the information gathered from the VTU
GetNext.

Separate the two stages, parsing the result of the VTU GetNext before
doing the STU GetNext.

We opt to update the existing implementation for all applicable chips,
as opposed to creating a separate callback for 6097, because although
the previous implementation did work for (at least) 6352, the
datasheet does not mention the masking behavior.

Fixes: ef6fcea37f01 ("net: dsa: mv88e6xxx: get STU entry on VTU GetNext")
Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
Link: https://lore.kernel.org/r/20201112114335.27371-1-tobias@waldekranz.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/mv88e6xxx/global1_vtu.c |   59 ++++++++++++++++++++++++++------
 1 file changed, 49 insertions(+), 10 deletions(-)

--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
@@ -125,11 +125,9 @@ static int mv88e6xxx_g1_vtu_vid_write(st
  * Offset 0x08: VTU/STU Data Register 2
  * Offset 0x09: VTU/STU Data Register 3
  */
-
-static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
-				      struct mv88e6xxx_vtu_entry *entry)
+static int mv88e6185_g1_vtu_stu_data_read(struct mv88e6xxx_chip *chip,
+					  u16 *regs)
 {
-	u16 regs[3];
 	int i;
 
 	/* Read all 3 VTU/STU Data registers */
@@ -142,12 +140,45 @@ static int mv88e6185_g1_vtu_data_read(st
 			return err;
 	}
 
-	/* Extract MemberTag and PortState data */
+	return 0;
+}
+
+static int mv88e6185_g1_vtu_data_read(struct mv88e6xxx_chip *chip,
+				      struct mv88e6xxx_vtu_entry *entry)
+{
+	u16 regs[3];
+	int err;
+	int i;
+
+	err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
+	if (err)
+		return err;
+
+	/* Extract MemberTag data */
 	for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
 		unsigned int member_offset = (i % 4) * 4;
-		unsigned int state_offset = member_offset + 2;
 
 		entry->member[i] = (regs[i / 4] >> member_offset) & 0x3;
+	}
+
+	return 0;
+}
+
+static int mv88e6185_g1_stu_data_read(struct mv88e6xxx_chip *chip,
+				      struct mv88e6xxx_vtu_entry *entry)
+{
+	u16 regs[3];
+	int err;
+	int i;
+
+	err = mv88e6185_g1_vtu_stu_data_read(chip, regs);
+	if (err)
+		return err;
+
+	/* Extract PortState data */
+	for (i = 0; i < mv88e6xxx_num_ports(chip); ++i) {
+		unsigned int state_offset = (i % 4) * 4 + 2;
+
 		entry->state[i] = (regs[i / 4] >> state_offset) & 0x3;
 	}
 
@@ -349,6 +380,10 @@ int mv88e6185_g1_vtu_getnext(struct mv88
 		if (err)
 			return err;
 
+		err = mv88e6185_g1_stu_data_read(chip, entry);
+		if (err)
+			return err;
+
 		/* VTU DBNum[3:0] are located in VTU Operation 3:0
 		 * VTU DBNum[7:4] are located in VTU Operation 11:8
 		 */
@@ -374,16 +409,20 @@ int mv88e6352_g1_vtu_getnext(struct mv88
 		return err;
 
 	if (entry->valid) {
-		/* Fetch (and mask) VLAN PortState data from the STU */
-		err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
+		err = mv88e6185_g1_vtu_data_read(chip, entry);
 		if (err)
 			return err;
 
-		err = mv88e6185_g1_vtu_data_read(chip, entry);
+		err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
 		if (err)
 			return err;
 
-		err = mv88e6xxx_g1_vtu_fid_read(chip, entry);
+		/* Fetch VLAN PortState data from the STU */
+		err = mv88e6xxx_g1_vtu_stu_get(chip, entry);
+		if (err)
+			return err;
+
+		err = mv88e6185_g1_stu_data_read(chip, entry);
 		if (err)
 			return err;
 	}



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 014/158] net: ethernet: ti: cpsw: fix error return code in cpsw_probe()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 013/158] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 015/158] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong, Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 35f735c665114840dcd3142f41148d07870f51f7 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 83a8471ba255 ("net: ethernet: ti: cpsw: refactor probe to group common hw initialization")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605250173-18438-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/ti/cpsw.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2876,6 +2876,7 @@ static int cpsw_probe(struct platform_de
 				       CPSW_MAX_QUEUES, CPSW_MAX_QUEUES);
 	if (!ndev) {
 		dev_err(dev, "error allocating net_device\n");
+		ret = -ENOMEM;
 		goto clean_cpts;
 	}
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 015/158] net: Have netpoll bring-up DSA management interface
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 014/158] net: ethernet: ti: cpsw: fix error return code in cpsw_probe() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 016/158] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladimir Oltean, Florian Fainelli,
	Jakub Kicinski

From: Florian Fainelli <f.fainelli@gmail.com>

[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ]

DSA network devices rely on having their DSA management interface up and
running otherwise their ndo_open() will return -ENETDOWN. Without doing
this it would not be possible to use DSA devices as netconsole when
configured on the command line. These devices also do not utilize the
upper/lower linking so the check about the netpoll device having upper
is not going to be a problem.

The solution adopted here is identical to the one done for
net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled
master network devices"), with the network namespace scope being
restricted to that of the process configuring netpoll.

Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support")
Tested-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/core/netpoll.c |   22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -29,6 +29,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <linux/if_vlan.h>
+#include <net/dsa.h>
 #include <net/tcp.h>
 #include <net/udp.h>
 #include <net/addrconf.h>
@@ -637,15 +638,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
 
 int netpoll_setup(struct netpoll *np)
 {
-	struct net_device *ndev = NULL;
+	struct net_device *ndev = NULL, *dev = NULL;
+	struct net *net = current->nsproxy->net_ns;
 	struct in_device *in_dev;
 	int err;
 
 	rtnl_lock();
-	if (np->dev_name[0]) {
-		struct net *net = current->nsproxy->net_ns;
+	if (np->dev_name[0])
 		ndev = __dev_get_by_name(net, np->dev_name);
-	}
+
 	if (!ndev) {
 		np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
 		err = -ENODEV;
@@ -653,6 +654,19 @@ int netpoll_setup(struct netpoll *np)
 	}
 	dev_hold(ndev);
 
+	/* bring up DSA management network devices up first */
+	for_each_netdev(net, dev) {
+		if (!netdev_uses_dsa(dev))
+			continue;
+
+		err = dev_change_flags(dev, dev->flags | IFF_UP, NULL);
+		if (err < 0) {
+			np_err(np, "%s failed to open %s\n",
+			       np->dev_name, dev->name);
+			goto put;
+		}
+	}
+
 	if (netdev_master_upper_dev_get(ndev)) {
 		np_err(np, "%s is a slave device, aborting\n", np->dev_name);
 		err = -EBUSY;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 016/158] netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 015/158] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 017/158] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Paul Moore, Jakub Kicinski

From: Paul Moore <paul@paul-moore.com>

[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ]

The current NetLabel code doesn't correctly keep track of the netlink
dump state in some cases, in particular when multiple interfaces with
large configurations are loaded.  The problem manifests itself by not
reporting the full configuration to userspace, even though it is
loaded and active in the kernel.  This patch fixes this by ensuring
that the dump state is properly reset when necessary inside the
netlbl_unlabel_staticlist() function.

Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections")
Signed-off-by: Paul Moore <paul@paul-moore.com>
Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlabel/netlabel_unlabeled.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1165,12 +1165,13 @@ static int netlbl_unlabel_staticlist(str
 	struct netlbl_unlhsh_walk_arg cb_arg;
 	u32 skip_bkt = cb->args[0];
 	u32 skip_chain = cb->args[1];
-	u32 iter_bkt;
-	u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+	u32 skip_addr4 = cb->args[2];
+	u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
 	struct netlbl_unlhsh_iface *iface;
 	struct list_head *iter_list;
 	struct netlbl_af4list *addr4;
 #if IS_ENABLED(CONFIG_IPV6)
+	u32 skip_addr6 = cb->args[3];
 	struct netlbl_af6list *addr6;
 #endif
 
@@ -1181,7 +1182,7 @@ static int netlbl_unlabel_staticlist(str
 	rcu_read_lock();
 	for (iter_bkt = skip_bkt;
 	     iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
-	     iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
+	     iter_bkt++) {
 		iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
 		list_for_each_entry_rcu(iface, iter_list, list) {
 			if (!iface->valid ||
@@ -1189,7 +1190,7 @@ static int netlbl_unlabel_staticlist(str
 				continue;
 			netlbl_af4list_foreach_rcu(addr4,
 						   &iface->addr4_list) {
-				if (iter_addr4++ < cb->args[2])
+				if (iter_addr4++ < skip_addr4)
 					continue;
 				if (netlbl_unlabel_staticlist_gen(
 					      NLBL_UNLABEL_C_STATICLIST,
@@ -1202,10 +1203,12 @@ static int netlbl_unlabel_staticlist(str
 					goto unlabel_staticlist_return;
 				}
 			}
+			iter_addr4 = 0;
+			skip_addr4 = 0;
 #if IS_ENABLED(CONFIG_IPV6)
 			netlbl_af6list_foreach_rcu(addr6,
 						   &iface->addr6_list) {
-				if (iter_addr6++ < cb->args[3])
+				if (iter_addr6++ < skip_addr6)
 					continue;
 				if (netlbl_unlabel_staticlist_gen(
 					      NLBL_UNLABEL_C_STATICLIST,
@@ -1218,8 +1221,12 @@ static int netlbl_unlabel_staticlist(str
 					goto unlabel_staticlist_return;
 				}
 			}
+			iter_addr6 = 0;
+			skip_addr6 = 0;
 #endif /* IPv6 */
 		}
+		iter_chain = 0;
+		skip_chain = 0;
 	}
 
 unlabel_staticlist_return:



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 017/158] netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 016/158] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 018/158] net: lantiq: Wait for the GPHY firmware to be ready Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Paul Moore,
	James Morris, Jakub Kicinski

From: Paul Moore <paul@paul-moore.com>

[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ]

Static checking revealed that a previous fix to
netlbl_unlabel_staticlist() leaves a stack variable uninitialized,
this patches fixes that.

Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: James Morris <jamorris@linux.microsoft.com>
Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/netlabel/netlabel_unlabeled.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netlabel/netlabel_unlabeled.c
+++ b/net/netlabel/netlabel_unlabeled.c
@@ -1166,7 +1166,7 @@ static int netlbl_unlabel_staticlist(str
 	u32 skip_bkt = cb->args[0];
 	u32 skip_chain = cb->args[1];
 	u32 skip_addr4 = cb->args[2];
-	u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
+	u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
 	struct netlbl_unlhsh_iface *iface;
 	struct list_head *iter_list;
 	struct netlbl_af4list *addr4;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 018/158] net: lantiq: Wait for the GPHY firmware to be ready
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 017/158] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 019/158] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Martin Blumenstingl,
	Hauke Mehrtens, Florian Fainelli, Jakub Kicinski

From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>

[ Upstream commit 2a1828e378c1b5ba1ff283ed8f8c5cc37bb391dc ]

A user reports (slightly shortened from the original message):
  libphy: lantiq,xrx200-mdio: probed
  mdio_bus 1e108000.switch-mii: MDIO device at address 17 is missing.
  gswip 1e108000.switch lan: no phy at 2
  gswip 1e108000.switch lan: failed to connect to port 2: -19
  lantiq,xrx200-net 1e10b308.eth eth0: error -19 setting up slave phy

This is a single-port board using the internal Fast Ethernet PHY. The
user reports that switching to PHY scanning instead of configuring the
PHY within device-tree works around this issue.

The documentation for the standalone variant of the PHY11G (which is
probably very similar to what is used inside the xRX200 SoCs but having
the firmware burnt onto that standalone chip in the factory) states that
the PHY needs 300ms to be ready for MDIO communication after releasing
the reset.

Add a 300ms delay after initializing all GPHYs to ensure that the GPHY
firmware had enough time to initialize and to appear on the MDIO bus.
Unfortunately there is no (known) documentation on what the minimum time
to wait after releasing the reset on an internal PHY so play safe and
take the one for the external variant. Only wait after the last GPHY
firmware is loaded to not slow down the initialization too much (
xRX200 has two GPHYs but newer SoCs have at least three GPHYs).

Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Acked-by: Hauke Mehrtens <hauke@hauke-m.de>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20201115165757.552641-1-martin.blumenstingl@googlemail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/dsa/lantiq_gswip.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -26,6 +26,7 @@
  */
 
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/etherdevice.h>
 #include <linux/firmware.h>
 #include <linux/if_bridge.h>
@@ -1818,6 +1819,16 @@ static int gswip_gphy_fw_list(struct gsw
 		i++;
 	}
 
+	/* The standalone PHY11G requires 300ms to be fully
+	 * initialized and ready for any MDIO communication after being
+	 * taken out of reset. For the SoC-internal GPHY variant there
+	 * is no (known) documentation for the minimum time after a
+	 * reset. Use the same value as for the standalone variant as
+	 * some users have reported internal PHYs not being detected
+	 * without any delay.
+	 */
+	msleep(300);
+
 	return 0;
 
 remove_gphy:



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 019/158] net/mlx4_core: Fix init_hca fields offset
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 018/158] net: lantiq: Wait for the GPHY firmware to be ready Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 020/158] net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aya Levin, Moshe Shemesh,
	Eran Ben Elisha, Tariq Toukan, Jakub Kicinski

From: Aya Levin <ayal@nvidia.com>

[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ]

Slave function read the following capabilities from the wrong offset:
1. log_mc_entry_sz
2. fs_log_entry_sz
3. log_mc_hash_sz

Fix that by adjusting these capabilities offset to match firmware
layout.

Due to the wrong offset read, the following issues might occur:
1+2. Negative value reported at max_mcast_qp_attach.
3. Driver to init FW with multicast hash size of zero.

Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps")
Signed-off-by: Aya Levin <ayal@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx4/fw.c |    6 +++---
 drivers/net/ethernet/mellanox/mlx4/fw.h |    4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -1864,8 +1864,8 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
 #define	 INIT_HCA_LOG_RD_OFFSET		 (INIT_HCA_QPC_OFFSET + 0x77)
 #define INIT_HCA_MCAST_OFFSET		 0x0c0
 #define	 INIT_HCA_MC_BASE_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x00)
-#define	 INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
-#define	 INIT_HCA_LOG_MC_HASH_SZ_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x16)
+#define	 INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
+#define	 INIT_HCA_LOG_MC_HASH_SZ_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x17)
 #define  INIT_HCA_UC_STEERING_OFFSET	 (INIT_HCA_MCAST_OFFSET + 0x18)
 #define	 INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
 #define  INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN	0x6
@@ -1873,7 +1873,7 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
 #define  INIT_HCA_DRIVER_VERSION_SZ       0x40
 #define  INIT_HCA_FS_PARAM_OFFSET         0x1d0
 #define  INIT_HCA_FS_BASE_OFFSET          (INIT_HCA_FS_PARAM_OFFSET + 0x00)
-#define  INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x12)
+#define  INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x13)
 #define  INIT_HCA_FS_A0_OFFSET		  (INIT_HCA_FS_PARAM_OFFSET + 0x18)
 #define  INIT_HCA_FS_LOG_TABLE_SZ_OFFSET  (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
 #define  INIT_HCA_FS_ETH_BITS_OFFSET      (INIT_HCA_FS_PARAM_OFFSET + 0x21)
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -182,8 +182,8 @@ struct mlx4_init_hca_param {
 	u64 cmpt_base;
 	u64 mtt_base;
 	u64 global_caps;
-	u16 log_mc_entry_sz;
-	u16 log_mc_hash_sz;
+	u8 log_mc_entry_sz;
+	u8 log_mc_hash_sz;
 	u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
 	u8  log_num_qps;
 	u8  log_num_srqs;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 020/158] net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 019/158] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 021/158] net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sean Tranchetti,
	Subash Abhinov Kasiviswanathan, Jakub Kicinski

From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

[ Upstream commit fc70f5bf5e525dde81565f0a30d5e39168062eba ]

During rmnet unregistration, the real device rx_handler is first cleared
followed by the removal of rx_handler_data after the rcu synchronization.

Any packets in the receive path may observe that the rx_handler is NULL.
However, there is no check when dereferencing this value to use the
rmnet_port information.

This fixes following splat by adding the NULL check.

Unable to handle kernel NULL pointer dereference at virtual
address 000000000000000d
pc : rmnet_rx_handler+0x124/0x284
lr : rmnet_rx_handler+0x124/0x284
 rmnet_rx_handler+0x124/0x284
 __netif_receive_skb_core+0x758/0xd74
 __netif_receive_skb+0x50/0x17c
 process_backlog+0x15c/0x1b8
 napi_poll+0x88/0x284
 net_rx_action+0xbc/0x23c
 __do_softirq+0x20c/0x48c

Fixes: ceed73a2cf4a ("drivers: net: ethernet: qualcomm: rmnet: Initial implementation")
Signed-off-by: Sean Tranchetti <stranche@codeaurora.org>
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Link: https://lore.kernel.org/r/1605298325-3705-1-git-send-email-subashab@codeaurora.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
@@ -188,6 +188,11 @@ rx_handler_result_t rmnet_rx_handler(str
 
 	dev = skb->dev;
 	port = rmnet_get_port_rcu(dev);
+	if (unlikely(!port)) {
+		atomic_long_inc(&skb->dev->rx_nohandler);
+		kfree_skb(skb);
+		goto done;
+	}
 
 	switch (port->rmnet_mode) {
 	case RMNET_EPMODE_VND:



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 021/158] net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 020/158] net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 022/158] net/tls: fix corrupted data in recvmsg Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Karsten Graul, Jakub Kicinski

From: Karsten Graul <kgraul@linux.ibm.com>

[ Upstream commit 41a0be3f8f6be893860b991eb10c47fc3ee09d7f ]

Sparse complaints 3 times about:
net/smc/smc_ib.c:203:52: warning: incorrect type in argument 1 (different address spaces)
net/smc/smc_ib.c:203:52:    expected struct net_device const *dev
net/smc/smc_ib.c:203:52:    got struct net_device [noderef] __rcu *const ndev

Fix that by using the existing and validated ndev variable instead of
accessing attr->ndev directly.

Fixes: 5102eca9039b ("net/smc: Use rdma_read_gid_l2_fields to L2 fields")
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/smc/smc_ib.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/smc/smc_ib.c
+++ b/net/smc/smc_ib.c
@@ -191,9 +191,9 @@ int smc_ib_determine_gid(struct smc_ib_d
 		rcu_read_lock();
 		ndev = rdma_read_gid_attr_ndev_rcu(attr);
 		if (!IS_ERR(ndev) &&
-		    ((!vlan_id && !is_vlan_dev(attr->ndev)) ||
-		     (vlan_id && is_vlan_dev(attr->ndev) &&
-		      vlan_dev_vlan_id(attr->ndev) == vlan_id)) &&
+		    ((!vlan_id && !is_vlan_dev(ndev)) ||
+		     (vlan_id && is_vlan_dev(ndev) &&
+		      vlan_dev_vlan_id(ndev) == vlan_id)) &&
 		    attr->gid_type == IB_GID_TYPE_ROCE) {
 			rcu_read_unlock();
 			if (gid)



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 022/158] net/tls: fix corrupted data in recvmsg
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 021/158] net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 023/158] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vadim Fedorenko, Jakub Kicinski

From: Vadim Fedorenko <vfedorenko@novek.ru>

[ Upstream commit 3fe16edf6767decd640fa2654308bc64f8d656dc ]

If tcp socket has more data than Encrypted Handshake Message then
tls_sw_recvmsg will try to decrypt next record instead of returning
full control message to userspace as mentioned in comment. The next
message - usually Application Data - gets corrupted because it uses
zero copy for decryption that's why the data is not stored in skb
for next iteration. Revert check to not decrypt next record if
current is not Application Data.

Fixes: 692d7b5d1f91 ("tls: Fix recvmsg() to be able to peek across multiple records")
Signed-off-by: Vadim Fedorenko <vfedorenko@novek.ru>
Link: https://lore.kernel.org/r/1605413760-21153-1-git-send-email-vfedorenko@novek.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tls/tls_sw.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1907,7 +1907,7 @@ pick_next_record:
 			 * another message type
 			 */
 			msg->msg_flags |= MSG_EOR;
-			if (ctx->control != TLS_RECORD_TYPE_DATA)
+			if (control != TLS_RECORD_TYPE_DATA)
 				goto recv_end;
 		} else {
 			break;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 023/158] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 022/158] net/tls: fix corrupted data in recvmsg Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 024/158] page_frag: Recover from memory pressure Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Martin Schiller, Xie He, Jakub Kicinski

From: Xie He <xie.he.0141@gmail.com>

[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ]

The x25_disconnect function in x25_subr.c would decrease the refcount of
"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL.

However, the x25_rx_call_request function in af_x25.c, which is called
when we receive a connection request, does not increase the refcount when
it assigns the pointer.

Fix this issue by increasing the refcount of "struct x25_neigh" in
x25_rx_call_request.

This patch fixes frequent kernel crashes when using AF_X25 sockets.

Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/x25/af_x25.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -1044,6 +1044,7 @@ int x25_rx_call_request(struct sk_buff *
 	makex25->lci           = lci;
 	makex25->dest_addr     = dest_addr;
 	makex25->source_addr   = source_addr;
+	x25_neigh_hold(nb);
 	makex25->neighbour     = nb;
 	makex25->facilities    = facilities;
 	makex25->dte_facilities= dte_facilities;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 024/158] page_frag: Recover from memory pressure
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 023/158] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 025/158] qed: fix error return code in qed_iwarp_ll2_start() Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Wilcox (Oracle),
	Aruna Ramakrishna, Bert Barbe, Rama Nichanamatlu,
	Venkat Venkatsubra, Manjunath Patil, Joe Jin, SRINIVAS,
	Dongli Zhang, Vlastimil Babka, Eric Dumazet, Jakub Kicinski

From: Dongli Zhang <dongli.zhang@oracle.com>

[ Upstream commit d8c19014bba8f565d8a2f1f46b4e38d1d97bf1a7 ]

The ethernet driver may allocate skb (and skb->data) via napi_alloc_skb().
This ends up to page_frag_alloc() to allocate skb->data from
page_frag_cache->va.

During the memory pressure, page_frag_cache->va may be allocated as
pfmemalloc page. As a result, the skb->pfmemalloc is always true as
skb->data is from page_frag_cache->va. The skb will be dropped if the
sock (receiver) does not have SOCK_MEMALLOC. This is expected behaviour
under memory pressure.

However, once kernel is not under memory pressure any longer (suppose large
amount of memory pages are just reclaimed), the page_frag_alloc() may still
re-use the prior pfmemalloc page_frag_cache->va to allocate skb->data. As a
result, the skb->pfmemalloc is always true unless page_frag_cache->va is
re-allocated, even if the kernel is not under memory pressure any longer.

Here is how kernel runs into issue.

1. The kernel is under memory pressure and allocation of
PAGE_FRAG_CACHE_MAX_ORDER in __page_frag_cache_refill() will fail. Instead,
the pfmemalloc page is allocated for page_frag_cache->va.

2: All skb->data from page_frag_cache->va (pfmemalloc) will have
skb->pfmemalloc=true. The skb will always be dropped by sock without
SOCK_MEMALLOC. This is an expected behaviour.

3. Suppose a large amount of pages are reclaimed and kernel is not under
memory pressure any longer. We expect skb->pfmemalloc drop will not happen.

4. Unfortunately, page_frag_alloc() does not proactively re-allocate
page_frag_alloc->va and will always re-use the prior pfmemalloc page. The
skb->pfmemalloc is always true even kernel is not under memory pressure any
longer.

Fix this by freeing and re-allocating the page instead of recycling it.

Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Aruna Ramakrishna <aruna.ramakrishna@oracle.com>
Cc: Bert Barbe <bert.barbe@oracle.com>
Cc: Rama Nichanamatlu <rama.nichanamatlu@oracle.com>
Cc: Venkat Venkatsubra <venkat.x.venkatsubra@oracle.com>
Cc: Manjunath Patil <manjunath.b.patil@oracle.com>
Cc: Joe Jin <joe.jin@oracle.com>
Cc: SRINIVAS <srinivas.eeda@oracle.com>
Fixes: 79930f5892e1 ("net: do not deplete pfmemalloc reserve")
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20201115201029.11903-1-dongli.zhang@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -4910,6 +4910,11 @@ refill:
 		if (!page_ref_sub_and_test(page, nc->pagecnt_bias))
 			goto refill;
 
+		if (unlikely(nc->pfmemalloc)) {
+			free_the_page(page, compound_order(page));
+			goto refill;
+		}
+
 #if (PAGE_SIZE < PAGE_FRAG_CACHE_MAX_SIZE)
 		/* if size can vary use size else just use PAGE_SIZE */
 		size = nc->size;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 025/158] qed: fix error return code in qed_iwarp_ll2_start()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 024/158] page_frag: Recover from memory pressure Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 026/158] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong,
	Michal Kalderon ,
	Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit cb47d16ea21045c66eebbf5ed792e74a8537e27a ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 469981b17a4f ("qed: Add unaligned and packed packet processing")
Fixes: fcb39f6c10b2 ("qed: Add mpa buffer descriptors for storing and processing mpa fpdus")
Fixes: 1e28eaad07ea ("qed: Add iWARP support for fpdu spanned over more than two tcp packets")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Link: https://lore.kernel.org/r/1605532033-27373-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qed/qed_iwarp.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c
@@ -2742,14 +2742,18 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
 	iwarp_info->partial_fpdus = kcalloc((u16)p_hwfn->p_rdma_info->num_qps,
 					    sizeof(*iwarp_info->partial_fpdus),
 					    GFP_KERNEL);
-	if (!iwarp_info->partial_fpdus)
+	if (!iwarp_info->partial_fpdus) {
+		rc = -ENOMEM;
 		goto err;
+	}
 
 	iwarp_info->max_num_partial_fpdus = (u16)p_hwfn->p_rdma_info->num_qps;
 
 	iwarp_info->mpa_intermediate_buf = kzalloc(buff_size, GFP_KERNEL);
-	if (!iwarp_info->mpa_intermediate_buf)
+	if (!iwarp_info->mpa_intermediate_buf) {
+		rc = -ENOMEM;
 		goto err;
+	}
 
 	/* The mpa_bufs array serves for pending RX packets received on the
 	 * mpa ll2 that don't have place on the tx ring and require later
@@ -2759,8 +2763,10 @@ qed_iwarp_ll2_start(struct qed_hwfn *p_h
 	iwarp_info->mpa_bufs = kcalloc(data.input.rx_num_desc,
 				       sizeof(*iwarp_info->mpa_bufs),
 				       GFP_KERNEL);
-	if (!iwarp_info->mpa_bufs)
+	if (!iwarp_info->mpa_bufs) {
+		rc = -ENOMEM;
 		goto err;
+	}
 
 	INIT_LIST_HEAD(&iwarp_info->mpa_buf_pending_list);
 	INIT_LIST_HEAD(&iwarp_info->mpa_buf_list);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 026/158] qlcnic: fix error return code in qlcnic_83xx_restart_hw()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 025/158] qed: fix error return code in qed_iwarp_ll2_start() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 027/158] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Changzhong, Jakub Kicinski

From: Zhang Changzhong <zhangchangzhong@huawei.com>

[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
@@ -2251,7 +2251,8 @@ static int qlcnic_83xx_restart_hw(struct
 
 	/* Boot either flash image or firmware image from host file system */
 	if (qlcnic_load_fw_file == 1) {
-		if (qlcnic_83xx_load_fw_image_from_host(adapter))
+		err = qlcnic_83xx_load_fw_image_from_host(adapter);
+		if (err)
 			return err;
 	} else {
 		QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 027/158] sctp: change to hold/put transport for proto_unreach_timer
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 026/158] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 028/158] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hangbin Liu, Xin Long,
	Marcelo Ricardo Leitner, Jakub Kicinski

From: Xin Long <lucien.xin@gmail.com>

[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ]

A call trace was found in Hangbin's Codenomicon testing with debug kernel:

  [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp]
  [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0
  [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0
  [ 2616.191533] Call Trace:
  [ 2616.194265]  <IRQ>
  [ 2616.202068]  debug_check_no_obj_freed+0x25e/0x3f0
  [ 2616.207336]  slab_free_freelist_hook+0xeb/0x140
  [ 2616.220971]  kfree+0xd6/0x2c0
  [ 2616.224293]  rcu_do_batch+0x3bd/0xc70
  [ 2616.243096]  rcu_core+0x8b9/0xd00
  [ 2616.256065]  __do_softirq+0x23d/0xacd
  [ 2616.260166]  irq_exit+0x236/0x2a0
  [ 2616.263879]  smp_apic_timer_interrupt+0x18d/0x620
  [ 2616.269138]  apic_timer_interrupt+0xf/0x20
  [ 2616.273711]  </IRQ>

This is because it holds asoc when transport->proto_unreach_timer starts
and puts asoc when the timer stops, and without holding transport the
transport could be freed when the timer is still running.

So fix it by holding/putting transport instead for proto_unreach_timer
in transport, just like other timers in transport.

v1->v2:
  - Also use sctp_transport_put() for the "out_unlock:" path in
    sctp_generate_proto_unreach_event(), as Marcelo noticed.

Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/input.c         |    4 ++--
 net/sctp/sm_sideeffect.c |    4 ++--
 net/sctp/transport.c     |    2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -449,7 +449,7 @@ void sctp_icmp_proto_unreachable(struct
 		else {
 			if (!mod_timer(&t->proto_unreach_timer,
 						jiffies + (HZ/20)))
-				sctp_association_hold(asoc);
+				sctp_transport_hold(t);
 		}
 	} else {
 		struct net *net = sock_net(sk);
@@ -458,7 +458,7 @@ void sctp_icmp_proto_unreachable(struct
 			 "encountered!\n", __func__);
 
 		if (del_timer(&t->proto_unreach_timer))
-			sctp_association_put(asoc);
+			sctp_transport_put(t);
 
 		sctp_do_sm(net, SCTP_EVENT_T_OTHER,
 			   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -419,7 +419,7 @@ void sctp_generate_proto_unreach_event(s
 		/* Try again later.  */
 		if (!mod_timer(&transport->proto_unreach_timer,
 				jiffies + (HZ/20)))
-			sctp_association_hold(asoc);
+			sctp_transport_hold(transport);
 		goto out_unlock;
 	}
 
@@ -435,7 +435,7 @@ void sctp_generate_proto_unreach_event(s
 
 out_unlock:
 	bh_unlock_sock(sk);
-	sctp_association_put(asoc);
+	sctp_transport_put(transport);
 }
 
  /* Handle the timeout of the RE-CONFIG timer. */
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -133,7 +133,7 @@ void sctp_transport_free(struct sctp_tra
 
 	/* Delete the ICMP proto unreachable timer if it's active. */
 	if (del_timer(&transport->proto_unreach_timer))
-		sctp_association_put(transport->asoc);
+		sctp_transport_put(transport);
 
 	sctp_transport_put(transport);
 }



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 028/158] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 027/158] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 029/158] net/mlx5: Add handling of port type in rule deletion Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ryan Sharpelletti, Neal Cardwell,
	Soheil Hassas Yeganeh, Yuchung Cheng, Jakub Kicinski

From: Ryan Sharpelletti <sharpelletti@google.com>

[ Upstream commit 1b9e2a8c99a5c021041bfb2d512dc3ed92a94ffd ]

During loss recovery, retransmitted packets are forced to use TCP
timestamps to calculate the RTT samples, which have a millisecond
granularity. BBR is designed using a microsecond granularity. As a
result, multiple RTT samples could be truncated to the same RTT value
during loss recovery. This is problematic, as BBR will not enter
PROBE_RTT if the RTT sample is <= the current min_rtt sample, meaning
that if there are persistent losses, PROBE_RTT will constantly be
pushed off and potentially never re-entered. This patch makes sure
that BBR enters PROBE_RTT by checking if RTT sample is < the current
min_rtt sample, rather than <=.

The Netflix transport/TCP team discovered this bug in the Linux TCP
BBR code during lab tests.

Fixes: 0f8782ea1497 ("tcp_bbr: add BBR congestion control")
Signed-off-by: Ryan Sharpelletti <sharpelletti@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Link: https://lore.kernel.org/r/20201116174412.1433277-1-sharpelletti.kdev@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_bbr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/tcp_bbr.c
+++ b/net/ipv4/tcp_bbr.c
@@ -945,7 +945,7 @@ static void bbr_update_min_rtt(struct so
 	filter_expired = after(tcp_jiffies32,
 			       bbr->min_rtt_stamp + bbr_min_rtt_win_sec * HZ);
 	if (rs->rtt_us >= 0 &&
-	    (rs->rtt_us <= bbr->min_rtt_us ||
+	    (rs->rtt_us < bbr->min_rtt_us ||
 	     (filter_expired && !rs->is_ack_delayed))) {
 		bbr->min_rtt_us = rs->rtt_us;
 		bbr->min_rtt_stamp = tcp_jiffies32;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 029/158] net/mlx5: Add handling of port type in rule deletion
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 028/158] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 030/158] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Guralnik, Mark Bloch,
	Maor Gottlieb, Saeed Mahameed

From: Michael Guralnik <michaelgur@nvidia.com>

[ Upstream commit 8cbcc5ef2a281f6bb10099f4572a08cb765ffbf4 ]

Handle destruction of rules with port destination type to enable
full destruction of flow.

Without this handling of TX rules the deletion of these rules fails.
Dmesg of flow destruction failure:

[  203.714146] mlx5_core 0000:00:0b.0: mlx5_cmd_check:753:(pid 342): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x144b7a)
[  210.547387] ------------[ cut here ]------------
[  210.548663] refcount_t: decrement hit 0; leaking memory.
[  210.550651] WARNING: CPU: 4 PID: 342 at lib/refcount.c:31 refcount_warn_saturate+0x5c/0x110
[  210.550654] Modules linked in: mlx5_ib mlx5_core ib_ipoib rdma_ucm rdma_cm iw_cm ib_cm ib_umad ib_uverbs ib_core
[  210.550675] CPU: 4 PID: 342 Comm: test Not tainted 5.8.0-rc2+ #116
[  210.550678] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[  210.550680] RIP: 0010:refcount_warn_saturate+0x5c/0x110
[  210.550685] Code: c6 d1 1b 01 00 0f 84 ad 00 00 00 5b 5d c3 80 3d b5 d1 1b 01 00 75 f4 48 c7 c7 20 d1 15 82 c6 05 a5 d1 1b 01 01 e8 a7 eb af ff <0f> 0b eb dd 80 3d 99 d1 1b 01 00 75 d4 48 c7 c7 c0 cf 15 82 c6 05
[  210.550687] RSP: 0018:ffff8881642e77e8 EFLAGS: 00010282
[  210.550691] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000000000
[  210.550694] RDX: 0000000000000027 RSI: 0000000000000004 RDI: ffffed102c85ceef
[  210.550696] RBP: ffff888161720428 R08: ffffffff8124c10e R09: ffffed103243beae
[  210.550698] R10: ffff8881921df56b R11: ffffed103243bead R12: ffff8881841b4180
[  210.550701] R13: ffff888161720428 R14: ffff8881616d0000 R15: ffff888161720380
[  210.550704] FS:  00007fc27f025740(0000) GS:ffff888192000000(0000) knlGS:0000000000000000
[  210.550706] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  210.550708] CR2: 0000557e4b41a6a0 CR3: 0000000002415004 CR4: 0000000000360ea0
[  210.550711] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  210.550713] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  210.550715] Call Trace:
[  210.550717]  mlx5_del_flow_rules+0x484/0x490 [mlx5_core]
[  210.550720]  ? mlx5_cmd_set_fte+0xa80/0xa80 [mlx5_core]
[  210.550722]  mlx5_ib_destroy_flow+0x17f/0x280 [mlx5_ib]
[  210.550724]  uverbs_free_flow+0x4c/0x90 [ib_uverbs]
[  210.550726]  destroy_hw_idr_uobject+0x41/0xb0 [ib_uverbs]
[  210.550728]  uverbs_destroy_uobject+0xaa/0x390 [ib_uverbs]
[  210.550731]  __uverbs_cleanup_ufile+0x129/0x1b0 [ib_uverbs]
[  210.550733]  ? uverbs_destroy_uobject+0x390/0x390 [ib_uverbs]
[  210.550735]  uverbs_destroy_ufile_hw+0x78/0x190 [ib_uverbs]
[  210.550737]  ib_uverbs_close+0x36/0x140 [ib_uverbs]
[  210.550739]  __fput+0x181/0x380
[  210.550741]  task_work_run+0x88/0xd0
[  210.550743]  do_exit+0x5f6/0x13b0
[  210.550745]  ? sched_clock_cpu+0x30/0x140
[  210.550747]  ? is_current_pgrp_orphaned+0x70/0x70
[  210.550750]  ? lock_downgrade+0x360/0x360
[  210.550752]  ? mark_held_locks+0x1d/0x90
[  210.550754]  do_group_exit+0x8a/0x140
[  210.550756]  get_signal+0x20a/0xf50
[  210.550758]  do_signal+0x8c/0xbe0
[  210.550760]  ? hrtimer_nanosleep+0x1d8/0x200
[  210.550762]  ? nanosleep_copyout+0x50/0x50
[  210.550764]  ? restore_sigcontext+0x320/0x320
[  210.550766]  ? __hrtimer_init+0xf0/0xf0
[  210.550768]  ? timespec64_add_safe+0x150/0x150
[  210.550770]  ? mark_held_locks+0x1d/0x90
[  210.550772]  ? lockdep_hardirqs_on_prepare+0x14c/0x240
[  210.550774]  __prepare_exit_to_usermode+0x119/0x170
[  210.550776]  do_syscall_64+0x65/0x300
[  210.550778]  ? trace_hardirqs_off+0x10/0x120
[  210.550781]  ? mark_held_locks+0x1d/0x90
[  210.550783]  ? asm_sysvec_apic_timer_interrupt+0xa/0x20
[  210.550785]  ? lockdep_hardirqs_on+0x112/0x190
[  210.550787]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  210.550789] RIP: 0033:0x7fc27f1cd157
[  210.550791] Code: Bad RIP value.
[  210.550793] RSP: 002b:00007ffd4db27ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000023
[  210.550798] RAX: fffffffffffffdfc RBX: ffffffffffffff80 RCX: 00007fc27f1cd157
[  210.550800] RDX: 00007fc27f025740 RSI: 00007ffd4db27eb0 RDI: 00007ffd4db27eb0
[  210.550803] RBP: 0000000000000016 R08: 0000000000000000 R09: 000000000000000e
[  210.550805] R10: 00007ffd4db27dc7 R11: 0000000000000246 R12: 0000000000400c00
[  210.550808] R13: 00007ffd4db285f0 R14: 0000000000000000 R15: 0000000000000000
[  210.550809] irq event stamp: 49399
[  210.550812] hardirqs last  enabled at (49399): [<ffffffff81172d36>] console_unlock+0x556/0x6f0
[  210.550815] hardirqs last disabled at (49398): [<ffffffff81172897>] console_unlock+0xb7/0x6f0
[  210.550818] softirqs last  enabled at (48706): [<ffffffff81e0037b>] __do_softirq+0x37b/0x60c
[  210.550820] softirqs last disabled at (48697): [<ffffffff81c00e2f>] asm_call_on_stack+0xf/0x20
[  210.550822] ---[ end trace ad18c0e6fa846454 ]---
[  210.581862] mlx5_core 0000:00:0c.0: mlx5_destroy_flow_table:2132:(pid 342): Flow table 262150 wasn't destroyed, refcount > 1

Fixes: a7ee18bdee83 ("RDMA/mlx5: Allow creating a matcher for a NIC TX flow table")
Signed-off-by: Michael Guralnik <michaelgur@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Reviewed-by: Maor Gottlieb <maorg@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -496,6 +496,13 @@ static void del_sw_hw_rule(struct fs_nod
 		goto out;
 	}
 
+	if (rule->dest_attr.type == MLX5_FLOW_DESTINATION_TYPE_PORT &&
+	    --fte->dests_size) {
+		fte->modify_mask |= BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION);
+		fte->action.action &= ~MLX5_FLOW_CONTEXT_ACTION_ALLOW;
+		goto out;
+	}
+
 	if ((fte->action.action & MLX5_FLOW_CONTEXT_ACTION_FWD_DEST) &&
 	    --fte->dests_size) {
 		fte->modify_mask |=



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 030/158] net/mlx5: Disable QoS when min_rates on all VFs are zero
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 029/158] net/mlx5: Add handling of port type in rule deletion Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:20 ` [PATCH 5.4 031/158] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vladyslav Tarasiuk, Moshe Shemesh,
	Saeed Mahameed

From: Vladyslav Tarasiuk <vladyslavt@nvidia.com>

[ Upstream commit 470b74758260e4abc2508cf1614573c00a00465c ]

Currently when QoS is enabled for VF and any min_rate is configured,
the driver sets bw_share value to at least 1 and doesn’t allow to set
it to 0 to make minimal rate unlimited. It means there is always a
minimal rate configured for every VF, even if user tries to remove it.

In order to make QoS disable possible, check whether all vports have
configured min_rate = 0. If this is true, set their bw_share to 0 to
disable min_rate limitations.

Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate")
Signed-off-by: Vladyslav Tarasiuk <vladyslavt@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -2369,12 +2369,15 @@ static u32 calculate_vports_min_rate_div
 		max_guarantee = evport->info.min_rate;
 	}
 
-	return max_t(u32, max_guarantee / fw_max_bw_share, 1);
+	if (max_guarantee)
+		return max_t(u32, max_guarantee / fw_max_bw_share, 1);
+	return 0;
 }
 
-static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
+static int normalize_vports_min_rate(struct mlx5_eswitch *esw)
 {
 	u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
+	u32 divider = calculate_vports_min_rate_divider(esw);
 	struct mlx5_vport *evport;
 	u32 vport_max_rate;
 	u32 vport_min_rate;
@@ -2387,9 +2390,9 @@ static int normalize_vports_min_rate(str
 			continue;
 		vport_min_rate = evport->info.min_rate;
 		vport_max_rate = evport->info.max_rate;
-		bw_share = MLX5_MIN_BW_SHARE;
+		bw_share = 0;
 
-		if (vport_min_rate)
+		if (divider)
 			bw_share = MLX5_RATE_TO_BW_SHARE(vport_min_rate,
 							 divider,
 							 fw_max_bw_share);
@@ -2414,7 +2417,6 @@ int mlx5_eswitch_set_vport_rate(struct m
 	struct mlx5_vport *evport = mlx5_eswitch_get_vport(esw, vport);
 	u32 fw_max_bw_share;
 	u32 previous_min_rate;
-	u32 divider;
 	bool min_rate_supported;
 	bool max_rate_supported;
 	int err = 0;
@@ -2439,8 +2441,7 @@ int mlx5_eswitch_set_vport_rate(struct m
 
 	previous_min_rate = evport->info.min_rate;
 	evport->info.min_rate = min_rate;
-	divider = calculate_vports_min_rate_divider(esw);
-	err = normalize_vports_min_rate(esw, divider);
+	err = normalize_vports_min_rate(esw);
 	if (err) {
 		evport->info.min_rate = previous_min_rate;
 		goto unlock;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 031/158] net: usb: qmi_wwan: Set DTR quirk for MR400
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 030/158] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
@ 2020-11-23 12:20 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 032/158] net/ncsi: Fix netlink registration Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:20 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Filip Moc, Bjørn Mork, Jakub Kicinski

From: Filip Moc <dev@moc6.cz>

[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ]

LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set.

Signed-off-by: Filip Moc <dev@moc6.cz>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/usb/qmi_wwan.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1092,7 +1092,7 @@ static const struct usb_device_id produc
 	{QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
 	{QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
 	{QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
-	{QMI_FIXED_INTF(0x05c6, 0x9025, 4)},	/* Alcatel-sbell ASB TL131 TDD LTE  (China Mobile) */
+	{QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)},	/* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
 	{QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
 	{QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
 	{QMI_FIXED_INTF(0x05c6, 0x9031, 5)},



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 032/158] net/ncsi: Fix netlink registration
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-11-23 12:20 ` [PATCH 5.4 031/158] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 033/158] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Joel Stanley, Samuel Mendoza-Jonas,
	Jakub Kicinski

From: Joel Stanley <joel@jms.id.au>

[ Upstream commit 1922a46b8c18cb09d33e06a6cc2e43844ac1b9d0 ]

If a user unbinds and re-binds a NC-SI aware driver the kernel will
attempt to register the netlink interface at runtime. The structure is
marked __ro_after_init so registration fails spectacularly at this point.

 # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind
 # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/bind
  ftgmac100 1e660000.ethernet: Read MAC address 52:54:00:12:34:56 from chip
  ftgmac100 1e660000.ethernet: Using NCSI interface
  8<--- cut here ---
  Unable to handle kernel paging request at virtual address 80a8f858
  pgd = 8c768dd6
  [80a8f858] *pgd=80a0841e(bad)
  Internal error: Oops: 80d [#1] SMP ARM
  CPU: 0 PID: 116 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00003-gdd25b227ec1e #51
  Hardware name: Generic DT based system
  PC is at genl_register_family+0x1f8/0x6d4
  LR is at 0xff26ffff
  pc : [<8073f930>]    lr : [<ff26ffff>]    psr: 20000153
  sp : 8553bc80  ip : 81406244  fp : 8553bd04
  r10: 8085d12c  r9 : 80a8f73c  r8 : 85739000
  r7 : 00000017  r6 : 80a8f860  r5 : 80c8ab98  r4 : 80a8f858
  r3 : 00000000  r2 : 00000000  r1 : 81406130  r0 : 00000017
  Flags: nzCv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment none
  Control: 00c5387d  Table: 85524008  DAC: 00000051
  Process sh (pid: 116, stack limit = 0x1f1988d6)
 ...
  Backtrace:
  [<8073f738>] (genl_register_family) from [<80860ac0>] (ncsi_init_netlink+0x20/0x48)
   r10:8085d12c r9:80c8fb0c r8:85739000 r7:00000000 r6:81218000 r5:85739000
   r4:8121c000
  [<80860aa0>] (ncsi_init_netlink) from [<8085d740>] (ncsi_register_dev+0x1b0/0x210)
   r5:8121c400 r4:8121c000
  [<8085d590>] (ncsi_register_dev) from [<805a8060>] (ftgmac100_probe+0x6e0/0x778)
   r10:00000004 r9:80950228 r8:8115bc10 r7:8115ab00 r6:9eae2c24 r5:813b6f88
   r4:85739000
  [<805a7980>] (ftgmac100_probe) from [<805355ec>] (platform_drv_probe+0x58/0xa8)
   r9:80c76bb0 r8:00000000 r7:80cd4974 r6:80c76bb0 r5:8115bc10 r4:00000000
  [<80535594>] (platform_drv_probe) from [<80532d58>] (really_probe+0x204/0x514)
   r7:80cd4974 r6:00000000 r5:80cd4868 r4:8115bc10

Jakub pointed out that ncsi_register_dev is obviously broken, because
there is only one family so it would never work if there was more than
one ncsi netdev.

Fix the crash by registering the netlink family once on boot, and drop
the code to unregister it.

Fixes: 955dc68cb9b2 ("net/ncsi: Add generic netlink family")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Link: https://lore.kernel.org/r/20201112061210.914621-1-joel@jms.id.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ncsi/ncsi-manage.c  |    5 -----
 net/ncsi/ncsi-netlink.c |   22 +++-------------------
 net/ncsi/ncsi-netlink.h |    3 ---
 3 files changed, 3 insertions(+), 27 deletions(-)

--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -1667,9 +1667,6 @@ struct ncsi_dev *ncsi_register_dev(struc
 	ndp->ptype.dev = dev;
 	dev_add_pack(&ndp->ptype);
 
-	/* Set up generic netlink interface */
-	ncsi_init_netlink(dev);
-
 	return nd;
 }
 EXPORT_SYMBOL_GPL(ncsi_register_dev);
@@ -1826,8 +1823,6 @@ void ncsi_unregister_dev(struct ncsi_dev
 	list_del_rcu(&ndp->node);
 	spin_unlock_irqrestore(&ncsi_dev_lock, flags);
 
-	ncsi_unregister_netlink(nd->dev);
-
 	kfree(ndp);
 }
 EXPORT_SYMBOL_GPL(ncsi_unregister_dev);
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -766,24 +766,8 @@ static struct genl_family ncsi_genl_fami
 	.n_ops = ARRAY_SIZE(ncsi_ops),
 };
 
-int ncsi_init_netlink(struct net_device *dev)
+static int __init ncsi_init_netlink(void)
 {
-	int rc;
-
-	rc = genl_register_family(&ncsi_genl_family);
-	if (rc)
-		netdev_err(dev, "ncsi: failed to register netlink family\n");
-
-	return rc;
-}
-
-int ncsi_unregister_netlink(struct net_device *dev)
-{
-	int rc;
-
-	rc = genl_unregister_family(&ncsi_genl_family);
-	if (rc)
-		netdev_err(dev, "ncsi: failed to unregister netlink family\n");
-
-	return rc;
+	return genl_register_family(&ncsi_genl_family);
 }
+subsys_initcall(ncsi_init_netlink);
--- a/net/ncsi/ncsi-netlink.h
+++ b/net/ncsi/ncsi-netlink.h
@@ -22,7 +22,4 @@ int ncsi_send_netlink_err(struct net_dev
 			  struct nlmsghdr *nlhdr,
 			  int err);
 
-int ncsi_init_netlink(struct net_device *dev);
-int ncsi_unregister_netlink(struct net_device *dev);
-
 #endif /* __NCSI_NETLINK_H__ */



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 033/158] net: ftgmac100: Fix crash when removing driver
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 032/158] net/ncsi: Fix netlink registration Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 034/158] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joel Stanley, Jakub Kicinski

From: Joel Stanley <joel@jms.id.au>

[ Upstream commit 3d5179458d22dc0b4fdc724e4bed4231a655112a ]

When removing the driver we would hit BUG_ON(!list_empty(&dev->ptype_specific))
in net/core/dev.c due to still having the NC-SI packet handler
registered.

 # echo 1e660000.ethernet > /sys/bus/platform/drivers/ftgmac100/unbind
  ------------[ cut here ]------------
  kernel BUG at net/core/dev.c:10254!
  Internal error: Oops - BUG: 0 [#1] SMP ARM
  CPU: 0 PID: 115 Comm: sh Not tainted 5.10.0-rc3-next-20201111-00007-g02e0365710c4 #46
  Hardware name: Generic DT based system
  PC is at netdev_run_todo+0x314/0x394
  LR is at cpumask_next+0x20/0x24
  pc : [<806f5830>]    lr : [<80863cb0>]    psr: 80000153
  sp : 855bbd58  ip : 00000001  fp : 855bbdac
  r10: 80c03d00  r9 : 80c06228  r8 : 81158c54
  r7 : 00000000  r6 : 80c05dec  r5 : 80c05d18  r4 : 813b9280
  r3 : 813b9054  r2 : 8122c470  r1 : 00000002  r0 : 00000002
  Flags: Nzcv  IRQs on  FIQs off  Mode SVC_32  ISA ARM  Segment none
  Control: 00c5387d  Table: 85514008  DAC: 00000051
  Process sh (pid: 115, stack limit = 0x7cb5703d)
 ...
  Backtrace:
  [<806f551c>] (netdev_run_todo) from [<80707eec>] (rtnl_unlock+0x18/0x1c)
   r10:00000051 r9:854ed710 r8:81158c54 r7:80c76bb0 r6:81158c10 r5:8115b410
   r4:813b9000
  [<80707ed4>] (rtnl_unlock) from [<806f5db8>] (unregister_netdev+0x2c/0x30)
  [<806f5d8c>] (unregister_netdev) from [<805a8180>] (ftgmac100_remove+0x20/0xa8)
   r5:8115b410 r4:813b9000
  [<805a8160>] (ftgmac100_remove) from [<805355e4>] (platform_drv_remove+0x34/0x4c)

Fixes: bd466c3fb5a4 ("net/faraday: Support NCSI mode")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Link: https://lore.kernel.org/r/20201117024448.1170761-1-joel@jms.id.au
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/faraday/ftgmac100.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -1891,6 +1891,8 @@ static int ftgmac100_probe(struct platfo
 	return 0;
 
 err_ncsi_dev:
+	if (priv->ndev)
+		ncsi_unregister_dev(priv->ndev);
 err_register_netdev:
 	ftgmac100_destroy_mdio(netdev);
 err_setup_mdio:
@@ -1911,6 +1913,8 @@ static int ftgmac100_remove(struct platf
 	netdev = platform_get_drvdata(pdev);
 	priv = netdev_priv(netdev);
 
+	if (priv->ndev)
+		ncsi_unregister_dev(priv->ndev);
 	unregister_netdev(netdev);
 
 	clk_disable_unprepare(priv->clk);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 034/158] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 033/158] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 035/158] scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jianqun Xu, Heiko Stuebner,
	Kever Yang, Linus Walleij, Sasha Levin

From: Jianqun Xu <jay.xu@rock-chips.com>

[ Upstream commit 63fbf8013b2f6430754526ef9594f229c7219b1f ]

There need to enable pclk_gpio when do irq_create_mapping, since it will
do access to gpio controller.

Signed-off-by: Jianqun Xu <jay.xu@rock-chips.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Kever Yang<kever.yang@rock-chips.com>
Link: https://lore.kernel.org/r/20201013063731.3618-3-jay.xu@rock-chips.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/pinctrl/pinctrl-rockchip.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c
index 1bd8840e11a6e..930edfc32f597 100644
--- a/drivers/pinctrl/pinctrl-rockchip.c
+++ b/drivers/pinctrl/pinctrl-rockchip.c
@@ -2811,7 +2811,9 @@ static int rockchip_gpio_to_irq(struct gpio_chip *gc, unsigned offset)
 	if (!bank->domain)
 		return -ENXIO;
 
+	clk_enable(bank->clk);
 	virq = irq_create_mapping(bank->domain, offset);
+	clk_disable(bank->clk);
 
 	return (virq) ? : -ENXIO;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 035/158] scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 034/158] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 036/158] selftests: kvm: Fix the segment descriptor layout to match the actual layout Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hongwu Su, Stanley Chu, Bean Huo,
	Can Guo, Martin K. Petersen, Sasha Levin

From: Can Guo <cang@codeaurora.org>

[ Upstream commit da3fecb0040324c08f1587e5bff1f15f36be1872 ]

The scsi_block_reqs_cnt increased in ufshcd_hold() is supposed to be
decreased back in ufshcd_ungate_work() in a paired way. However, if
specific ufshcd_hold/release sequences are met, it is possible that
scsi_block_reqs_cnt is increased twice but only one ungate work is
queued. To make sure scsi_block_reqs_cnt is handled by ufshcd_hold() and
ufshcd_ungate_work() in a paired way, increase it only if queue_work()
returns true.

Link: https://lore.kernel.org/r/1604384682-15837-2-git-send-email-cang@codeaurora.org
Reviewed-by: Hongwu Su <hongwus@codeaurora.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Bean Huo <beanhuo@micron.com>
Signed-off-by: Can Guo <cang@codeaurora.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/ufs/ufshcd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index d538b3d4f74a5..0772327f87d93 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -1569,12 +1569,12 @@ int ufshcd_hold(struct ufs_hba *hba, bool async)
 		 */
 		/* fallthrough */
 	case CLKS_OFF:
-		ufshcd_scsi_block_requests(hba);
 		hba->clk_gating.state = REQ_CLKS_ON;
 		trace_ufshcd_clk_gating(dev_name(hba->dev),
 					hba->clk_gating.state);
-		queue_work(hba->clk_gating.clk_gating_workq,
-			   &hba->clk_gating.ungate_work);
+		if (queue_work(hba->clk_gating.clk_gating_workq,
+			       &hba->clk_gating.ungate_work))
+			ufshcd_scsi_block_requests(hba);
 		/*
 		 * fall through to check if we should wait for this
 		 * work to be done or not.
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 036/158] selftests: kvm: Fix the segment descriptor layout to match the actual layout
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 035/158] scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 037/158] ACPI: button: Add DMI quirk for Medion Akoya E2228T Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Aaron Lewis, Alexander Graf,
	Paolo Bonzini, Sasha Levin

From: Aaron Lewis <aaronlewis@google.com>

[ Upstream commit df11f7dd5834146defa448acba097e8d7703cc42 ]

Fix the layout of 'struct desc64' to match the layout described in the
SDM Vol 3, Chapter 3 "Protected-Mode Memory Management", section 3.4.5
"Segment Descriptors", Figure 3-8 "Segment Descriptor".  The test added
later in this series relies on this and crashes if this layout is not
correct.

Signed-off-by: Aaron Lewis <aaronlewis@google.com>
Reviewed-by: Alexander Graf <graf@amazon.com>
Message-Id: <20201012194716.3950330-2-aaronlewis@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/kvm/include/x86_64/processor.h | 2 +-
 tools/testing/selftests/kvm/lib/x86_64/processor.c     | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/kvm/include/x86_64/processor.h b/tools/testing/selftests/kvm/include/x86_64/processor.h
index ff234018219cf..aead07c24afcf 100644
--- a/tools/testing/selftests/kvm/include/x86_64/processor.h
+++ b/tools/testing/selftests/kvm/include/x86_64/processor.h
@@ -57,7 +57,7 @@ enum x86_register {
 struct desc64 {
 	uint16_t limit0;
 	uint16_t base0;
-	unsigned base1:8, s:1, type:4, dpl:2, p:1;
+	unsigned base1:8, type:4, s:1, dpl:2, p:1;
 	unsigned limit1:4, avl:1, l:1, db:1, g:1, base2:8;
 	uint32_t base3;
 	uint32_t zero1;
diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c
index 6698cb741e10a..7d8f7fc736467 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/processor.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c
@@ -446,11 +446,12 @@ static void kvm_seg_fill_gdt_64bit(struct kvm_vm *vm, struct kvm_segment *segp)
 	desc->limit0 = segp->limit & 0xFFFF;
 	desc->base0 = segp->base & 0xFFFF;
 	desc->base1 = segp->base >> 16;
-	desc->s = segp->s;
 	desc->type = segp->type;
+	desc->s = segp->s;
 	desc->dpl = segp->dpl;
 	desc->p = segp->present;
 	desc->limit1 = segp->limit >> 16;
+	desc->avl = segp->avl;
 	desc->l = segp->l;
 	desc->db = segp->db;
 	desc->g = segp->g;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 037/158] ACPI: button: Add DMI quirk for Medion Akoya E2228T
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 036/158] selftests: kvm: Fix the segment descriptor layout to match the actual layout Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 038/158] arm64: errata: Fix handling of 1418040 with late CPU onlining Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Rafael J. Wysocki,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit 7daaa06357bf7f1874b62bb1ea9d66a51d4e567e ]

The Medion Akoya E2228T's ACPI _LID implementation is quite broken,
it has the same issues as the one from the Medion Akoya E2215T:

1. For notifications it uses an ActiveLow Edge GpioInt, rather then
   an ActiveBoth one, meaning that the device is only notified when the
   lid is closed, not when it is opened.

2. Matching with this its _LID method simply always returns 0 (closed)

In order for the Linux LID code to work properly with this implementation,
the lid_init_state selection needs to be set to ACPI_BUTTON_LID_INIT_OPEN,
add a DMI quirk for this.

While working on this I also found out that the MD60### part of the model
number differs per country/batch while all of the E2215T and E2228T models
have this issue, so also remove the " MD60198" part from the E2215T quirk.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/acpi/button.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c
index 690bfe67e643d..ee7a7da276ddf 100644
--- a/drivers/acpi/button.c
+++ b/drivers/acpi/button.c
@@ -85,7 +85,18 @@ static const struct dmi_system_id lid_blacklst[] = {
 		 */
 		.matches = {
 			DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
-			DMI_MATCH(DMI_PRODUCT_NAME, "E2215T MD60198"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "E2215T"),
+		},
+		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
+	},
+	{
+		/*
+		 * Medion Akoya E2228T, notification of the LID device only
+		 * happens on close, not on open and _LID always returns closed.
+		 */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "E2228T"),
 		},
 		.driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_OPEN,
 	},
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 038/158] arm64: errata: Fix handling of 1418040 with late CPU onlining
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 037/158] ACPI: button: Add DMI quirk for Medion Akoya E2228T Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 039/158] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sai Prakash Ranjan, Stephen Boyd,
	Catalin Marinas, Mark Rutland, Suzuki K Poulose, Marc Zyngier,
	Will Deacon, Sasha Levin

From: Will Deacon <will@kernel.org>

[ Upstream commit f969f03888b9438fdb227b6460d99ede5737326d ]

In a surprising turn of events, it transpires that CPU capabilities
configured as ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE are never set as the
result of late-onlining. Therefore our handling of erratum 1418040 does
not get activated if it is not required by any of the boot CPUs, even
though we allow late-onlining of an affected CPU.

In order to get things working again, replace the cpus_have_const_cap()
invocation with an explicit check for the current CPU using
this_cpu_has_cap().

Cc: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Cc: Stephen Boyd <swboyd@chromium.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20201106114952.10032-1-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/include/asm/cpufeature.h | 2 ++
 arch/arm64/kernel/process.c         | 5 ++---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h
index 10d3048dec7c2..ccae05da98a7f 100644
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -262,6 +262,8 @@ extern struct arm64_ftr_reg arm64_ftr_reg_ctrel0;
 /*
  * CPU feature detected at boot time based on feature of one or more CPUs.
  * All possible conflicts for a late CPU are ignored.
+ * NOTE: this means that a late CPU with the feature will *not* cause the
+ * capability to be advertised by cpus_have_*cap()!
  */
 #define ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE		\
 	(ARM64_CPUCAP_SCOPE_LOCAL_CPU		|	\
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 10190c4b16dc4..7d7cfa128b71b 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -511,14 +511,13 @@ static void erratum_1418040_thread_switch(struct task_struct *prev,
 	bool prev32, next32;
 	u64 val;
 
-	if (!(IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) &&
-	      cpus_have_const_cap(ARM64_WORKAROUND_1418040)))
+	if (!IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040))
 		return;
 
 	prev32 = is_compat_thread(task_thread_info(prev));
 	next32 = is_compat_thread(task_thread_info(next));
 
-	if (prev32 == next32)
+	if (prev32 == next32 || !this_cpu_has_cap(ARM64_WORKAROUND_1418040))
 		return;
 
 	val = read_sysreg(cntkctl_el1);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 039/158] arm64: psci: Avoid printing in cpu_psci_cpu_die()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 038/158] arm64: errata: Fix handling of 1418040 with late CPU onlining Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 040/158] arm64: smp: Tell RCU about CPUs that fail to come online Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qian Cai, Paul E. McKenney,
	Catalin Marinas, Will Deacon, Sasha Levin

From: Will Deacon <will@kernel.org>

[ Upstream commit 891deb87585017d526b67b59c15d38755b900fea ]

cpu_psci_cpu_die() is called in the context of the dying CPU, which
will no longer be online or tracked by RCU. It is therefore not generally
safe to call printk() if the PSCI "cpu off" request fails, so remove the
pr_crit() invocation.

Cc: Qian Cai <cai@redhat.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Link: https://lore.kernel.org/r/20201106103602.9849-2-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/psci.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/arch/arm64/kernel/psci.c b/arch/arm64/kernel/psci.c
index 43ae4e0c968f6..62d2bda7adb80 100644
--- a/arch/arm64/kernel/psci.c
+++ b/arch/arm64/kernel/psci.c
@@ -66,7 +66,6 @@ static int cpu_psci_cpu_disable(unsigned int cpu)
 
 static void cpu_psci_cpu_die(unsigned int cpu)
 {
-	int ret;
 	/*
 	 * There are no known implementations of PSCI actually using the
 	 * power state field, pass a sensible default for now.
@@ -74,9 +73,7 @@ static void cpu_psci_cpu_die(unsigned int cpu)
 	u32 state = PSCI_POWER_STATE_TYPE_POWER_DOWN <<
 		    PSCI_0_2_POWER_STATE_TYPE_SHIFT;
 
-	ret = psci_ops.cpu_off(state);
-
-	pr_crit("unable to power off CPU%u (%d)\n", cpu, ret);
+	psci_ops.cpu_off(state);
 }
 
 static int cpu_psci_cpu_kill(unsigned int cpu)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 040/158] arm64: smp: Tell RCU about CPUs that fail to come online
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 039/158] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 041/158] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Qian Cai, Paul E. McKenney,
	Will Deacon, Sasha Levin

From: Will Deacon <will@kernel.org>

[ Upstream commit 04e613ded8c26489b3e0f9101b44462f780d1a35 ]

Commit ce3d31ad3cac ("arm64/smp: Move rcu_cpu_starting() earlier") ensured
that RCU is informed early about incoming CPUs that might end up calling
into printk() before they are online. However, if such a CPU fails the
early CPU feature compatibility checks in check_local_cpu_capabilities(),
then it will be powered off or parked without informing RCU, leading to
an endless stream of stalls:

  | rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
  | rcu:	2-O...: (0 ticks this GP) idle=002/1/0x4000000000000000 softirq=0/0 fqs=2593
  | (detected by 0, t=5252 jiffies, g=9317, q=136)
  | Task dump for CPU 2:
  | task:swapper/2       state:R  running task     stack:    0 pid:    0 ppid:     1 flags:0x00000028
  | Call trace:
  | ret_from_fork+0x0/0x30

Ensure that the dying CPU invokes rcu_report_dead() prior to being powered
off or parked.

Cc: Qian Cai <cai@redhat.com>
Cc: "Paul E. McKenney" <paulmck@kernel.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Suggested-by: Qian Cai <cai@redhat.com>
Link: https://lore.kernel.org/r/20201105222242.GA8842@willie-the-truck
Link: https://lore.kernel.org/r/20201106103602.9849-3-will@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/kernel/smp.c | 1 +
 kernel/rcu/tree.c       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index 426409e0d0713..987220ac4cfef 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -388,6 +388,7 @@ void cpu_die_early(void)
 
 	/* Mark this CPU absent */
 	set_cpu_present(cpu, 0);
+	rcu_report_dead(cpu);
 
 #ifdef CONFIG_HOTPLUG_CPU
 	update_cpu_boot_status(CPU_KILL_ME);
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index 62e59596a30a0..1b1d2b09efa9b 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -3157,7 +3157,6 @@ void rcu_cpu_starting(unsigned int cpu)
 	smp_mb(); /* Ensure RCU read-side usage follows above initialization. */
 }
 
-#ifdef CONFIG_HOTPLUG_CPU
 /*
  * The outgoing function has no further need of RCU, so remove it from
  * the rcu_node tree's ->qsmaskinitnext bit masks.
@@ -3197,6 +3196,7 @@ void rcu_report_dead(unsigned int cpu)
 	per_cpu(rcu_cpu_started, cpu) = 0;
 }
 
+#ifdef CONFIG_HOTPLUG_CPU
 /*
  * The outgoing CPU has just passed through the dying-idle state, and we
  * are being invoked from the CPU that was IPIed to continue the offline
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 041/158] vfs: remove lockdep bogosity in __sb_start_write
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 040/158] arm64: smp: Tell RCU about CPUs that fail to come online Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 042/158] gfs2: fix possible reference leak in gfs2_check_blk_type Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Christoph Hellwig,
	Jan Kara, Sasha Levin

From: Darrick J. Wong <darrick.wong@oracle.com>

[ Upstream commit 22843291efc986ce7722610073fcf85a39b4cb13 ]

__sb_start_write has some weird looking lockdep code that claims to
exist to handle nested freeze locking requests from xfs.  The code as
written seems broken -- if we think we hold a read lock on any of the
higher freeze levels (e.g. we hold SB_FREEZE_WRITE and are trying to
lock SB_FREEZE_PAGEFAULT), it converts a blocking lock attempt into a
trylock.

However, it's not correct to downgrade a blocking lock attempt to a
trylock unless the downgrading code or the callers are prepared to deal
with that situation.  Neither __sb_start_write nor its callers handle
this at all.  For example:

sb_start_pagefault ignores the return value completely, with the result
that if xfs_filemap_fault loses a race with a different thread trying to
fsfreeze, it will proceed without pagefault freeze protection (thereby
breaking locking rules) and then unlocks the pagefault freeze lock that
it doesn't own on its way out (thereby corrupting the lock state), which
leads to a system hang shortly afterwards.

Normally, this won't happen because our ownership of a read lock on a
higher freeze protection level blocks fsfreeze from grabbing a write
lock on that higher level.  *However*, if lockdep is offline,
lock_is_held_type unconditionally returns 1, which means that
percpu_rwsem_is_held returns 1, which means that __sb_start_write
unconditionally converts blocking freeze lock attempts into trylocks,
even when we *don't* hold anything that would block a fsfreeze.

Apparently this all held together until 5.10-rc1, when bugs in lockdep
caused lockdep to shut itself off early in an fstests run, and once
fstests gets to the "race writes with freezer" tests, kaboom.  This
might explain the long trail of vanishingly infrequent livelocks in
fstests after lockdep goes offline that I've never been able to
diagnose.

We could fix it by spinning on the trylock if wait==true, but AFAICT the
locking works fine if lockdep is not built at all (and I didn't see any
complaints running fstests overnight), so remove this snippet entirely.

NOTE: Commit f4b554af9931 in 2015 created the current weird logic (which
used to exist in a different form in commit 5accdf82ba25c from 2012) in
__sb_start_write.  XFS solved this whole problem in the late 2.6 era by
creating a variant of transactions (XFS_TRANS_NO_WRITECOUNT) that don't
grab intwrite freeze protection, thus making lockdep's solution
unnecessary.  The commit claims that Dave Chinner explained that the
trylock hack + comment could be removed, but nobody ever did.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/super.c | 33 ++++-----------------------------
 1 file changed, 4 insertions(+), 29 deletions(-)

diff --git a/fs/super.c b/fs/super.c
index a288cd60d2aed..877532baf513d 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1647,36 +1647,11 @@ EXPORT_SYMBOL(__sb_end_write);
  */
 int __sb_start_write(struct super_block *sb, int level, bool wait)
 {
-	bool force_trylock = false;
-	int ret = 1;
+	if (!wait)
+		return percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
 
-#ifdef CONFIG_LOCKDEP
-	/*
-	 * We want lockdep to tell us about possible deadlocks with freezing
-	 * but it's it bit tricky to properly instrument it. Getting a freeze
-	 * protection works as getting a read lock but there are subtle
-	 * problems. XFS for example gets freeze protection on internal level
-	 * twice in some cases, which is OK only because we already hold a
-	 * freeze protection also on higher level. Due to these cases we have
-	 * to use wait == F (trylock mode) which must not fail.
-	 */
-	if (wait) {
-		int i;
-
-		for (i = 0; i < level - 1; i++)
-			if (percpu_rwsem_is_held(sb->s_writers.rw_sem + i)) {
-				force_trylock = true;
-				break;
-			}
-	}
-#endif
-	if (wait && !force_trylock)
-		percpu_down_read(sb->s_writers.rw_sem + level-1);
-	else
-		ret = percpu_down_read_trylock(sb->s_writers.rw_sem + level-1);
-
-	WARN_ON(force_trylock && !ret);
-	return ret;
+	percpu_down_read(sb->s_writers.rw_sem + level-1);
+	return 1;
 }
 EXPORT_SYMBOL(__sb_start_write);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 042/158] gfs2: fix possible reference leak in gfs2_check_blk_type
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 041/158] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 043/158] hwmon: (pwm-fan) Fix RPM calculation Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Andreas Gruenbacher,
	Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit bc923818b190c8b63c91a47702969c8053574f5b ]

In the fail path of gfs2_check_blk_type, forgetting to call
gfs2_glock_dq_uninit will result in rgd_gh reference leak.

Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/gfs2/rgrp.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 3d5aa0c10a4c1..5d9d93ca0db70 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2574,13 +2574,13 @@ int gfs2_check_blk_type(struct gfs2_sbd *sdp, u64 no_addr, unsigned int type)
 
 	rbm.rgd = rgd;
 	error = gfs2_rbm_from_block(&rbm, no_addr);
-	if (WARN_ON_ONCE(error))
-		goto fail;
-
-	if (gfs2_testbit(&rbm, false) != type)
-		error = -ESTALE;
+	if (!WARN_ON_ONCE(error)) {
+		if (gfs2_testbit(&rbm, false) != type)
+			error = -ESTALE;
+	}
 
 	gfs2_glock_dq_uninit(&rgd_gh);
+
 fail:
 	return error;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 043/158] hwmon: (pwm-fan) Fix RPM calculation
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 042/158] gfs2: fix possible reference leak in gfs2_check_blk_type Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Barker, Guenter Roeck, Sasha Levin

From: Paul Barker <pbarker@konsulko.com>

[ Upstream commit fd8feec665fef840277515a5c2b9b7c3e3970fad ]

To convert the number of pulses counted into an RPM estimation, we need
to divide by the width of our measurement interval instead of
multiplying by it. If the width of the measurement interval is zero we
don't update the RPM value to avoid dividing by zero.

We also don't need to do 64-bit division, with 32-bits we can handle a
fan running at over 4 million RPM.

Signed-off-by: Paul Barker <pbarker@konsulko.com>
Link: https://lore.kernel.org/r/20201111164643.7087-1-pbarker@konsulko.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hwmon/pwm-fan.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 42ffd2e5182d5..c88ce77fe6763 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -54,16 +54,18 @@ static irqreturn_t pulse_handler(int irq, void *dev_id)
 static void sample_timer(struct timer_list *t)
 {
 	struct pwm_fan_ctx *ctx = from_timer(ctx, t, rpm_timer);
+	unsigned int delta = ktime_ms_delta(ktime_get(), ctx->sample_start);
 	int pulses;
-	u64 tmp;
 
-	pulses = atomic_read(&ctx->pulses);
-	atomic_sub(pulses, &ctx->pulses);
-	tmp = (u64)pulses * ktime_ms_delta(ktime_get(), ctx->sample_start) * 60;
-	do_div(tmp, ctx->pulses_per_revolution * 1000);
-	ctx->rpm = tmp;
+	if (delta) {
+		pulses = atomic_read(&ctx->pulses);
+		atomic_sub(pulses, &ctx->pulses);
+		ctx->rpm = (unsigned int)(pulses * 1000 * 60) /
+			(ctx->pulses_per_revolution * delta);
+
+		ctx->sample_start = ktime_get();
+	}
 
-	ctx->sample_start = ktime_get();
 	mod_timer(&ctx->rpm_timer, jiffies + HZ);
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 043/158] hwmon: (pwm-fan) Fix RPM calculation Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 18:31   ` Nick Desaulniers
  2020-11-23 12:21 ` [PATCH 5.4 045/158] arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  161 siblings, 1 reply; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Randy Dunlap,
	Andrew Morton, Nick Desaulniers, Kees Cook, Linus Torvalds,
	Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 ]

Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/compiler-clang.h |  5 -----
 include/linux/compiler-gcc.h   | 19 -------------------
 include/linux/compiler.h       | 18 ++++++++++++++++--
 3 files changed, 16 insertions(+), 26 deletions(-)

diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 333a6695a918c..9b89141604ed0 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -37,8 +37,3 @@
 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
 #endif
 
-/* The following are for compatibility with GCC, from compiler-gcc.h,
- * and may be redefined here because they should not be shared with other
- * compilers, like ICC.
- */
-#define barrier() __asm__ __volatile__("" : : : "memory")
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index e8579412ad214..d8fab3ecf5120 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -14,25 +14,6 @@
 # error Sorry, your compiler is too old - please upgrade it.
 #endif
 
-/* Optimization barrier */
-
-/* The "volatile" is due to gcc bugs */
-#define barrier() __asm__ __volatile__("": : :"memory")
-/*
- * This version is i.e. to prevent dead stores elimination on @ptr
- * where gcc and llvm may behave differently when otherwise using
- * normal barrier(): while gcc behavior gets along with a normal
- * barrier(), llvm needs an explicit input variable to be assumed
- * clobbered. The issue is as follows: while the inline asm might
- * access any memory it wants, the compiler could have fit all of
- * @ptr into memory registers instead, and since @ptr never escaped
- * from that, it proved that the inline asm wasn't touching any of
- * it. This version works well with both compilers, i.e. we're telling
- * the compiler that the inline asm absolutely may see the contents
- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
- */
-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
-
 /*
  * This macro obfuscates arithmetic on a variable address so that gcc
  * shouldn't recognize the original var, and make assumptions about it.
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 448c91bf543b7..f164a9b12813f 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -80,11 +80,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 
 /* Optimization barrier */
 #ifndef barrier
-# define barrier() __memory_barrier()
+/* The "volatile" is due to gcc bugs */
+# define barrier() __asm__ __volatile__("": : :"memory")
 #endif
 
 #ifndef barrier_data
-# define barrier_data(ptr) barrier()
+/*
+ * This version is i.e. to prevent dead stores elimination on @ptr
+ * where gcc and llvm may behave differently when otherwise using
+ * normal barrier(): while gcc behavior gets along with a normal
+ * barrier(), llvm needs an explicit input variable to be assumed
+ * clobbered. The issue is as follows: while the inline asm might
+ * access any memory it wants, the compiler could have fit all of
+ * @ptr into memory registers instead, and since @ptr never escaped
+ * from that, it proved that the inline asm wasn't touching any of
+ * it. This version works well with both compilers, i.e. we're telling
+ * the compiler that the inline asm absolutely may see the contents
+ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+ */
+# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
 #endif
 
 /* workaround for GCC PR82365 if needed */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 045/158] arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 046/158] arm64: dts: allwinner: Pine H64: " Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Clément Péron,
	Maxime Ripard, Chen-Yu Tsai, Sasha Levin

From: Clément Péron <peron.clem@gmail.com>

[ Upstream commit 97a38c1c213b162aa577299de698f39c18ba696b ]

Before the commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx
delay config"), the software overwrite for RX/TX delays of the RTL8211e
were not working properly and the Beelink GS1 had both RX/TX delay of RGMII
interface set using pull-up on the TXDLY and RXDLY pins.

Now that these delays are working properly they overwrite the HW
config and set this to 'rgmii' meaning no delay on both RX/TX.
This makes the ethernet of this board not working anymore.

Set the phy-mode to 'rgmii-id' meaning RGMII with RX/TX delays
in the device-tree to keep the correct configuration.

Fixes: 089bee8dd119 ("arm64: dts: allwinner: h6: Introduce Beelink GS1 board")
Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Link: https://lore.kernel.org/r/20201018172409.1754775-1-peron.clem@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
index 1d05d570142fa..0a04730960fcb 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-beelink-gs1.dts
@@ -83,7 +83,7 @@
 &emac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&ext_rgmii_pins>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&ext_rgmii_phy>;
 	phy-supply = <&reg_aldo2>;
 	status = "okay";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 046/158] arm64: dts: allwinner: Pine H64: Enable both RGMII RX/TX delay
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 045/158] arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 047/158] arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Corentin Labbe, Maxime Ripard, Sasha Levin

From: Corentin Labbe <clabbe@baylibre.com>

[ Upstream commit 419c65f5000a6c25597ea52488528d75b287cbd0 ]

Since commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e rx/tx delay config"),
the network is unusable on PineH64 model A.

This is due to phy-mode incorrectly set to rgmii instead of rgmii-id.

Fixes: 729e1ffcf47e ("arm64: allwinner: h6: add support for the Ethernet on Pine H64")
Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201019063449.33316-1-clabbe@baylibre.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
index 30102daf83cc6..3f2882b36616d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dts
@@ -66,7 +66,7 @@
 &emac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&ext_rgmii_pins>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&ext_rgmii_phy>;
 	phy-supply = <&reg_aldo2>;
 	allwinner,rx-delay-ps = <200>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 047/158] arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 046/158] arm64: dts: allwinner: Pine H64: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 048/158] arm64: dts: allwinner: a64: Pine64 Plus: " Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit d7cdff444579e6659459b2fe04340ebb27628d5e ]

RX/TX delay on OrangePi Win board is set on PHY. Reflect that in
ethernet node.

Fixes: 93d6a27cfcc0 ("arm64: dts: allwinner: a64: Orange Pi Win: Add Ethernet node")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201022185839.2779245-1-jernej.skrabec@siol.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
index 04446e4716c44..a0db02504b69e 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-orangepi-win.dts
@@ -129,7 +129,7 @@
 &emac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&rgmii_pins>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&ext_rgmii_phy>;
 	phy-supply = <&reg_gmac_3v3>;
 	status = "okay";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 048/158] arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 047/158] arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 049/158] arm64: dts: allwinner: h5: OrangePi PC2: " Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit 927f42fcc1b4f7d04a2ac5cf02f25612aa8923a4 ]

According to board schematic, PHY provides both, RX and TX delays.
However, according to "fix" Realtek provided for this board, only TX
delay should be provided by PHY.
Tests show that both variants work but TX only PHY delay works
slightly better.

Update ethernet node to reflect the fact that PHY provides TX delay.

Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201022211301.3548422-1-jernej.skrabec@siol.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
index d5b6e8159a335..5d0905f0f1c1d 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts
@@ -52,7 +52,7 @@
 &emac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&rgmii_pins>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-txid";
 	phy-handle = <&ext_rgmii_phy>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 049/158] arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 048/158] arm64: dts: allwinner: a64: Pine64 Plus: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 050/158] ARM: dts: sun8i: r40: bananapi-m2-ultra: " Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit b34bf9f6a623ddb82600a5ed5c644224122395e1 ]

RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
node.

Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201023184858.3272918-1-jernej.skrabec@siol.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
index e126c1c9f05ce..4d357b81b0c00 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts
@@ -157,7 +157,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_gmac_3v3>;
 	phy-handle = <&ext_rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 050/158] ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 049/158] arm64: dts: allwinner: h5: OrangePi PC2: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 051/158] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jernej Skrabec, Maxime Ripard, Sasha Levin

From: Jernej Skrabec <jernej.skrabec@siol.net>

[ Upstream commit b3eec3212e66ece33f69be0de98d54e67834e798 ]

Ethernet PHY on BananaPi M2 Ultra provides RX and TX delays. Fix
ethernet node to reflect that fact.

Fixes: c36fd5a48bd2 ("ARM: dts: sun8i: r40: bananapi-m2-ultra: Enable GMAC ethernet controller")
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Link: https://lore.kernel.org/r/20201025081949.783443-1-jernej.skrabec@siol.net
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
index ea15073f0c79c..7db89500f399c 100644
--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
+++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts
@@ -129,7 +129,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_dc1sw>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 051/158] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high"
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 050/158] ARM: dts: sun8i: r40: bananapi-m2-ultra: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 052/158] ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 8d80e2f00a42ef10b54e1b2d9e97314f8fd046c0 ]

This reverts commit 75ee680cbd2e4d0156b94f9fec50076361ab12f2.

Turns out the activity and link LEDs on the RJ45 port are active low,
just like on the Orange Pi PC.

Revert the commit that says otherwise.

Fixes: 75ee680cbd2e ("arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high")
Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-1-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
index 71fb732089397..babf4cf1b2f68 100644
--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
+++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts
@@ -53,11 +53,6 @@
 	};
 };
 
-&emac {
-	/* LEDs changed to active high on the plus */
-	/delete-property/ allwinner,leds-active-low;
-};
-
 &mmc1 {
 	vmmc-supply = <&reg_vcc3v3>;
 	bus-width = <4>;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 052/158] ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 051/158] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 053/158] ARM: dts: sun7i: cubietruck: " Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit e76724153f5b4539802cc21b2c6131058668a1c6 ]

The Ethernet PHY on the A31 Hummingbird has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: c220aec2bb79 ("ARM: dts: sun6i: Add Merrii A31 Hummingbird support")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-2-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun6i-a31-hummingbird.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
index 049e6ab3cf56c..73de34ae37fdc 100644
--- a/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
+++ b/arch/arm/boot/dts/sun6i-a31-hummingbird.dts
@@ -154,7 +154,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 053/158] ARM: dts: sun7i: cubietruck: Enable RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 052/158] ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 054/158] ARM: dts: sun7i: bananapi-m1-plus: " Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Emilio López, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 353c3de1303fc93032164402c0eb8550ecd6f154 ]

The Ethernet PHY on the Cubietruck has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 67073d97672d ("ARM: dts: sun7i: cubietruck: Enable the GMAC")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Tested-by: Emilio López <emilio@elopez.com.ar>
Reviewed-by: Emilio López <emilio@elopez.com.ar>
Link: https://lore.kernel.org/r/20201024162515.30032-3-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun7i-a20-cubietruck.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
index 8c8dee6ea461a..9109ca0919ade 100644
--- a/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
+++ b/arch/arm/boot/dts/sun7i-a20-cubietruck.dts
@@ -151,7 +151,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 054/158] ARM: dts: sun7i: bananapi-m1-plus: Enable RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 053/158] ARM: dts: sun7i: cubietruck: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 055/158] ARM: dts: sun8i: h3: orangepi-plus2e: " Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit f94f78bd93f567c022f594589dbeecdf59931365 ]

The Ethernet PHY on the Bananapi M1+ has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 04c85ecad32a ("ARM: dts: sun7i: Add dts file for Bananapi M1 Plus board")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-4-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
index 32d5d45a35c03..8945dbb114a2a 100644
--- a/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
+++ b/arch/arm/boot/dts/sun7i-a20-bananapi-m1-plus.dts
@@ -130,7 +130,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_gmac_3v3>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 055/158] ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 054/158] ARM: dts: sun7i: bananapi-m1-plus: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 056/158] ARM: dts: sun8i: a83t: Enable both " Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit e080ab31a0aa126b0a7e4f67f2b01b371b852c88 ]

The Ethernet PHY on the Orange Pi Plus 2E has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
Fixes: 7a78ef92cdc5 ("ARM: sun8i: h3: Enable EMAC with external PHY on Orange Pi Plus 2E")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-5-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
index 6dbf7b2e0c13c..b6ca45d18e511 100644
--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
+++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts
@@ -67,7 +67,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_gmac_3v3>;
 	phy-handle = <&ext_rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 056/158] ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 055/158] ARM: dts: sun8i: h3: orangepi-plus2e: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 057/158] ARM: dts: sun9i: " Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 57dbe558457bf4042169bc1f334e3b53a8480a1c ]

The Ethernet PHY on the Bananapi M3 and Cubietruck Plus have the RX
and TX delays enabled on the PHY, using pull-ups on the RXDLY and
TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 039359948a4b ("ARM: dts: sun8i: a83t: Enable Ethernet on two boards")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-6-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts     | 2 +-
 arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
index 9d34eabba1213..431f70234d364 100644
--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts
@@ -131,7 +131,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_sw>;
 	phy-handle = <&rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	allwinner,rx-delay-ps = <700>;
 	allwinner,tx-delay-ps = <700>;
 	status = "okay";
diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
index d9be511f054f0..d8326a5c681d4 100644
--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
+++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts
@@ -183,7 +183,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_dldo4>;
 	phy-handle = <&rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 057/158] ARM: dts: sun9i: Enable both RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 056/158] ARM: dts: sun8i: a83t: Enable both " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 058/158] ARM: dts: sunxi: bananapi-m2-plus: Enable " Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit b1064037e8ecf09d587b7b4966eebe0c362908e5 ]

The Ethernet PHY on the Cubieboard 4 and A80 Optimus have the RX
and TX delays enabled on the PHY, using pull-ups on the RXDLY and
TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 98048143b7f8 ("ARM: dts: sun9i: cubieboard4: Enable GMAC")
Fixes: bc9bd03a44f9 ("ARM: dts: sun9i: a80-optimus: Enable GMAC")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-7-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sun9i-a80-cubieboard4.dts | 2 +-
 arch/arm/boot/dts/sun9i-a80-optimus.dts     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
index d3b337b043a15..484b93df20cb6 100644
--- a/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
+++ b/arch/arm/boot/dts/sun9i-a80-cubieboard4.dts
@@ -129,7 +129,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_cldo1>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/sun9i-a80-optimus.dts b/arch/arm/boot/dts/sun9i-a80-optimus.dts
index bbc6335e56314..5c3580d712e40 100644
--- a/arch/arm/boot/dts/sun9i-a80-optimus.dts
+++ b/arch/arm/boot/dts/sun9i-a80-optimus.dts
@@ -124,7 +124,7 @@
 	pinctrl-names = "default";
 	pinctrl-0 = <&gmac_rgmii_pins>;
 	phy-handle = <&phy1>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-supply = <&reg_cldo1>;
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 058/158] ARM: dts: sunxi: bananapi-m2-plus: Enable RGMII RX/TX delay on Ethernet PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 057/158] ARM: dts: sun9i: " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 059/158] arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 3914160ffc0bf762d6d605d4b27036b7b89367ea ]

The Ethernet PHY on the Bananapi M2+ has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: 8c7ba536e709 ("ARM: sun8i: bananapi-m2-plus: Enable dwmac-sun8i")
Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)")
Fixes: aa8fee415f46 ("ARM: dts: sun8i: h3: Split out non-SoC-specific parts of Bananapi M2 Plus")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Tested-by: Jernej Skrabec <jernej.skrabec@siol.net>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-8-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
index 39263e74fbb53..8e5cb3b3fd686 100644
--- a/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
+++ b/arch/arm/boot/dts/sunxi-bananapi-m2-plus.dtsi
@@ -126,7 +126,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_gmac_3v3>;
 	phy-handle = <&ext_rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 
 	status = "okay";
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 059/158] arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 058/158] ARM: dts: sunxi: bananapi-m2-plus: Enable " Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 060/158] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chen-Yu Tsai, Maxime Ripard,
	Corentin Labbe, Jernej Skrabec, Sasha Levin

From: Chen-Yu Tsai <wens@csie.org>

[ Upstream commit 1a9a8910b2153cd3c4f3f2f8defcb853ead3b1fd ]

The Ethernet PHY on the Bananapi M64 has the RX and TX delays
enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins.

Fix the phy-mode description to correct reflect this so that the
implementation doesn't reconfigure the delays incorrectly. This
happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e
rx/tx delay config").

Fixes: e7295499903d ("arm64: allwinner: bananapi-m64: Enable dwmac-sun8i")
Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes")
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Tested-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201024162515.30032-10-wens@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
index 208373efee494..7d1e89e5b1ae4 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts
@@ -127,7 +127,7 @@
 &emac {
 	pinctrl-names = "default";
 	pinctrl-0 = <&rgmii_pins>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-handle = <&ext_rgmii_phy>;
 	phy-supply = <&reg_dc1sw>;
 	status = "okay";
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 060/158] Input: adxl34x - clean up a data type in adxl34x_probe()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 059/158] arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 061/158] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Michael Hennerich,
	Dmitry Torokhov, Sasha Levin

From: Dan Carpenter <dan.carpenter@oracle.com>

[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ]

The "revid" is used to store negative error codes so it should be an int
type.

Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michael Hennerich <michael.hennerich@analog.com>
Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/misc/adxl34x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c
index 5fe92d4ba3f0c..4cc4e8ff42b33 100644
--- a/drivers/input/misc/adxl34x.c
+++ b/drivers/input/misc/adxl34x.c
@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq,
 	struct input_dev *input_dev;
 	const struct adxl34x_platform_data *pdata;
 	int err, range, i;
-	unsigned char revid;
+	int revid;
 
 	if (!irq) {
 		dev_err(dev, "no IRQ?\n");
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 061/158] MIPS: export has_transparent_hugepage() for modules
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 060/158] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 062/158] arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kernel test robot, Randy Dunlap,
	Thomas Bogendoerfer, linux-mips, Dan Williams, Vishal Verma,
	Dave Jiang, linux-nvdimm, Hugh Dickins, Andrew Morton,
	Sasha Levin

From: Randy Dunlap <rdunlap@infradead.org>

[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ]

MIPS should export its local version of "has_transparent_hugepage"
so that loadable modules (dax) can use it.

Fixes this build error:
ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined!

Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Cc: linux-mips@vger.kernel.org
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: linux-nvdimm@lists.01.org
Cc: Hugh Dickins <hughd@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/mm/tlb-r4k.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c
index c13e46ced4252..60046445122b3 100644
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -437,6 +437,7 @@ int has_transparent_hugepage(void)
 	}
 	return mask == PM_HUGE_MASK;
 }
+EXPORT_SYMBOL(has_transparent_hugepage);
 
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE  */
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 062/158] arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 061/158] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 063/158] arm64: dts imx8mn: Remove non-existent USB OTG2 Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nenad Peric, Maxime Ripard,
	Jernej Skrabec, Sasha Levin

From: Nenad Peric <nperic@gmail.com>

[ Upstream commit 107954afc5df667da438644aa4982606663f9b17 ]

RX and TX delay are provided by ethernet PHY. Reflect that in ethernet
node.

Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes")
Signed-off-by: Nenad Peric <nperic@gmail.com>
Signed-off-by: Maxime Ripard <maxime@cerno.tech>
Acked-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://lore.kernel.org/r/20201028115817.68113-1-nperic@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
index d9b3ed257088a..f10340339007f 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts
@@ -164,7 +164,7 @@
 	pinctrl-0 = <&emac_rgmii_pins>;
 	phy-supply = <&reg_gmac_3v3>;
 	phy-handle = <&ext_rgmii_phy>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 063/158] arm64: dts imx8mn: Remove non-existent USB OTG2
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 062/158] arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 064/158] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Adam Ford, Krzysztof Kozlowski,
	Shawn Guo, Sasha Levin

From: Adam Ford <aford173@gmail.com>

[ Upstream commit cf5abb0132193767c07c83e06f91b777d22ba495 ]

According to the i.MX8MN TRM, there is only one OTG port.  The
address for OTG2 is reserved on Nano.

This patch removes the non-existent OTG2, usbphynop2, and the usbmisc2
nodes.

Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support")
Signed-off-by: Adam Ford <aford173@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mn.dtsi | 30 -----------------------
 1 file changed, 30 deletions(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mn.dtsi b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
index ac3a3b333efa6..546511b373d43 100644
--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
@@ -677,28 +677,6 @@
 				#index-cells = <1>;
 				reg = <0x32e40200 0x200>;
 			};
-
-			usbotg2: usb@32e50000 {
-				compatible = "fsl,imx8mn-usb", "fsl,imx7d-usb";
-				reg = <0x32e50000 0x200>;
-				interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>;
-				clocks = <&clk IMX8MN_CLK_USB1_CTRL_ROOT>;
-				clock-names = "usb1_ctrl_root_clk";
-				assigned-clocks = <&clk IMX8MN_CLK_USB_BUS>,
-						  <&clk IMX8MN_CLK_USB_CORE_REF>;
-				assigned-clock-parents = <&clk IMX8MN_SYS_PLL2_500M>,
-							 <&clk IMX8MN_SYS_PLL1_100M>;
-				fsl,usbphy = <&usbphynop2>;
-				fsl,usbmisc = <&usbmisc2 0>;
-				status = "disabled";
-			};
-
-			usbmisc2: usbmisc@32e50200 {
-				compatible = "fsl,imx8mn-usbmisc", "fsl,imx7d-usbmisc";
-				#index-cells = <1>;
-				reg = <0x32e50200 0x200>;
-			};
-
 		};
 
 		dma_apbh: dma-controller@33000000 {
@@ -747,12 +725,4 @@
 		assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
 		clock-names = "main_clk";
 	};
-
-	usbphynop2: usbphynop2 {
-		compatible = "usb-nop-xceiv";
-		clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
-		assigned-clocks = <&clk IMX8MN_CLK_USB_PHY_REF>;
-		assigned-clock-parents = <&clk IMX8MN_SYS_PLL1_100M>;
-		clock-names = "main_clk";
-	};
 };
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 064/158] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 063/158] arm64: dts imx8mn: Remove non-existent USB OTG2 Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 065/158] swiotlb: using SIZE_MAX needs limits.h included Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergey Matyukevich, Fabio Estevam,
	Shawn Guo, Sasha Levin

From: Sergey Matyukevich <geomatsi@gmail.com>

[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ]

Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the
KSZ9031 PHY") fixed micrel phy driver adding proper support for phy
modes. Adapt imx6q-udoo board phy settings : explicitly set required
delay configuration using "rgmii-id".

Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo")
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
index 776bfc77f89d0..16672cbada287 100644
--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi
@@ -98,7 +98,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	status = "okay";
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 065/158] swiotlb: using SIZE_MAX needs limits.h included
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 064/158] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 066/158] arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephen Rothwell, Michael S. Tsirkin,
	Sasha Levin

From: Stephen Rothwell <sfr@canb.auug.org.au>

[ Upstream commit f51778db088b2407ec177f2f4da0f6290602aa3f ]

After merging the drm-misc tree, linux-next build (arm
multi_v7_defconfig) failed like this:

In file included from drivers/gpu/drm/nouveau/nouveau_ttm.c:26:
include/linux/swiotlb.h: In function 'swiotlb_max_mapping_size':
include/linux/swiotlb.h:99:9: error: 'SIZE_MAX' undeclared (first use in this function)
   99 |  return SIZE_MAX;
      |         ^~~~~~~~
include/linux/swiotlb.h:7:1: note: 'SIZE_MAX' is defined in header '<stdint.h>'; did you forget to '#include <stdint.h>'?
    6 | #include <linux/init.h>
  +++ |+#include <stdint.h>
    7 | #include <linux/types.h>
include/linux/swiotlb.h:99:9: note: each undeclared identifier is reported only once for each function it appears in
   99 |  return SIZE_MAX;
      |         ^~~~~~~~

Caused by commit

  abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")

but only exposed by commit "drm/nouveu: fix swiotlb include"

Fix it by including linux/limits.h as appropriate.

Fixes: abe420bfae52 ("swiotlb: Introduce swiotlb_max_mapping_size()")
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Link: https://lore.kernel.org/r/20201102124327.2f82b2a7@canb.auug.org.au
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/linux/swiotlb.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
index cde3dc18e21a2..0a8fced6aaec4 100644
--- a/include/linux/swiotlb.h
+++ b/include/linux/swiotlb.h
@@ -5,6 +5,7 @@
 #include <linux/dma-direction.h>
 #include <linux/init.h>
 #include <linux/types.h>
+#include <linux/limits.h>
 
 struct device;
 struct page;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 066/158] arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 065/158] swiotlb: using SIZE_MAX needs limits.h included Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 067/158] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lucas Stach, Fabio Estevam,
	Shawn Guo, Sasha Levin

From: Lucas Stach <l.stach@pengutronix.de>

[ Upstream commit d19d2152ca055baf20339cfacbf039c2cfb8d936 ]

The datasheet for both the industrial and consumer variant of the
SoC lists a typical voltage of 0.95V for the 1.6GHz CPU operating
point.

Fixes: e85c9d0faa75 (arm64: dts: imx8mm: Add cpufreq properties)
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm64/boot/dts/freescale/imx8mm.dtsi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
index fde1849d36ca5..7b178a77cc712 100644
--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi
@@ -126,7 +126,7 @@
 
 		opp-1600000000 {
 			opp-hz = /bits/ 64 <1600000000>;
-			opp-microvolt = <900000>;
+			opp-microvolt = <950000>;
 			opp-supported-hw = <0xc>, <0x7>;
 			clock-latency-ns = <150000>;
 			opp-suspend;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 067/158] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 066/158] arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 068/158] Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo, Sasha Levin

From: Fabio Estevam <festevam@gmail.com>

[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ]

The SPI chip selects are represented as:

cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>;

, which means that they are used in GPIO function instead of native
SPI mode.

Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of
the native CSPI_SSI function.

Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board")
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/imx50-evk.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts
index a25da415cb02e..907339bc81e54 100644
--- a/arch/arm/boot/dts/imx50-evk.dts
+++ b/arch/arm/boot/dts/imx50-evk.dts
@@ -59,7 +59,7 @@
 				MX50_PAD_CSPI_MISO__CSPI_MISO		0x00
 				MX50_PAD_CSPI_MOSI__CSPI_MOSI		0x00
 				MX50_PAD_CSPI_SS0__GPIO4_11		0xc4
-				MX50_PAD_ECSPI1_MOSI__CSPI_SS1		0xf4
+				MX50_PAD_ECSPI1_MOSI__GPIO4_13		0x84
 			>;
 		};
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 068/158] Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 067/158] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 069/158] rfkill: Fix use-after-free in rfkill_resume() Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran,
	Jonathan Cameron, Dmitry Torokhov, Sasha Levin

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

[ Upstream commit 676650d007e06fddcf3fe38238251d71bd179641 ]

When TOUCHSCREEN_ADC is enabled and IIO_BUFFER is disabled, it results
in the following Kbuild warning:

WARNING: unmet direct dependencies detected for IIO_BUFFER_CB
  Depends on [n]: IIO [=y] && IIO_BUFFER [=n]
  Selected by [y]:
  - TOUCHSCREEN_ADC [=y] && !UML && INPUT [=y] && INPUT_TOUCHSCREEN [=y] && IIO [=y]

The reason is that TOUCHSCREEN_ADC selects IIO_BUFFER_CB without depending
on or selecting IIO_BUFFER while IIO_BUFFER_CB depends on IIO_BUFFER. This
can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: aa132ffb6b0a ("input: touchscreen: resistive-adc-touch: add generic resistive ADC touchscreen")
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Link: https://lore.kernel.org/r/20201102221504.541279-1-fazilyildiran@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/input/touchscreen/Kconfig | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig
index 46ad9090493bb..1e812a193ce7a 100644
--- a/drivers/input/touchscreen/Kconfig
+++ b/drivers/input/touchscreen/Kconfig
@@ -96,6 +96,7 @@ config TOUCHSCREEN_AD7879_SPI
 config TOUCHSCREEN_ADC
 	tristate "Generic ADC based resistive touchscreen"
 	depends on IIO
+	select IIO_BUFFER
 	select IIO_BUFFER_CB
 	help
 	  Say Y here if you want to use the generic ADC
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 069/158] rfkill: Fix use-after-free in rfkill_resume()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 068/158] Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 070/158] RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device() Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Claire Chang, Johannes Berg, Sasha Levin

From: Claire Chang <tientzu@chromium.org>

[ Upstream commit 94e2bd0b259ed39a755fdded47e6734acf1ce464 ]

If a device is getting removed or reprobed during resume, use-after-free
might happen. For example, h5_btrtl_resume() schedules a work queue for
device reprobing, which of course requires removal first.

If the removal happens in parallel with the device_resume() and wins the
race to acquire device_lock(), removal may remove the device from the PM
lists and all, but device_resume() is already running and will continue
when the lock can be acquired, thus calling rfkill_resume().

During this, if rfkill_set_block() is then called after the corresponding
*_unregister() and kfree() are called, there will be an use-after-free
in hci_rfkill_set_block():

BUG: KASAN: use-after-free in hci_rfkill_set_block+0x58/0xc0 [bluetooth]
...
Call trace:
  dump_backtrace+0x0/0x154
  show_stack+0x20/0x2c
  dump_stack+0xbc/0x12c
  print_address_description+0x88/0x4b0
  __kasan_report+0x144/0x168
  kasan_report+0x10/0x18
  check_memory_region+0x19c/0x1ac
  __kasan_check_write+0x18/0x24
  hci_rfkill_set_block+0x58/0xc0 [bluetooth]
  rfkill_set_block+0x9c/0x120
  rfkill_resume+0x34/0x70
  dpm_run_callback+0xf0/0x1f4
  device_resume+0x210/0x22c

Fix this by checking rfkill->registered in rfkill_resume(). device_del()
in rfkill_unregister() requires device_lock() and the whole rfkill_resume()
is also protected by the same lock via device_resume(), we can make sure
either the rfkill->registered is false before rfkill_resume() starts or the
rfkill device won't be unregistered before rfkill_resume() returns.

As async_resume() holds a reference to the device, at this level there can
be no use-after-free; only in the user that doesn't expect this scenario.

Fixes: 8589086f4efd ("Bluetooth: hci_h5: Turn off RTL8723BS on suspend, reprobe on resume")
Signed-off-by: Claire Chang <tientzu@chromium.org>
Link: https://lore.kernel.org/r/20201110084908.219088-1-tientzu@chromium.org
[edit commit message for clarity and add more info provided later]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rfkill/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 6c089320ae4f1..5bba7c36ac74f 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -876,6 +876,9 @@ static int rfkill_resume(struct device *dev)
 
 	rfkill->suspended = false;
 
+	if (!rfkill->registered)
+		return 0;
+
 	if (!rfkill->persistent) {
 		cur = !!(rfkill->state & RFKILL_BLOCK_SW);
 		rfkill_set_block(rfkill, cur);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 070/158] RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 069/158] rfkill: Fix use-after-free in rfkill_resume() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 071/158] RMDA/sw: Dont allow drivers using dma_virt_ops on highmem configs Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Qinglang Miao,
	Jason Gunthorpe, Sasha Levin

From: Qinglang Miao <miaoqinglang@huawei.com>

[ Upstream commit d035c3f6cdb8e5d5a17adcbb79d7453417a6077d ]

Fix missing kfree in pvrdma_register_device() when failure from
ib_device_set_netdev().

Fixes: 4b38da75e089 ("RDMA/drivers: Convert easy drivers to use ib_device_set_netdev()")
Link: https://lore.kernel.org/r/20201111032202.17925-1-miaoqinglang@huawei.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
index 780fd2dfc07eb..10e67283b9db7 100644
--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
@@ -266,7 +266,7 @@ static int pvrdma_register_device(struct pvrdma_dev *dev)
 	}
 	ret = ib_device_set_netdev(&dev->ib_dev, dev->netdev, 1);
 	if (ret)
-		return ret;
+		goto err_srq_free;
 	spin_lock_init(&dev->srq_tbl_lock);
 	rdma_set_device_sysfs_group(&dev->ib_dev, &pvrdma_attr_group);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 071/158] RMDA/sw: Dont allow drivers using dma_virt_ops on highmem configs
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 070/158] RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 072/158] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Jason Gunthorpe,
	Sasha Levin

From: Christoph Hellwig <hch@lst.de>

[ Upstream commit b1e678bf290db5a76f1b6a9f7c381310e03440d6 ]

dma_virt_ops requires that all pages have a kernel virtual address.
Introduce a INFINIBAND_VIRT_DMA Kconfig symbol that depends on !HIGHMEM
and make all three drivers depend on the new symbol.

Also remove the ARCH_DMA_ADDR_T_64BIT dependency, which has been obsolete
since commit 4965a68780c5 ("arch: define the ARCH_DMA_ADDR_T_64BIT config
symbol in lib/Kconfig")

Fixes: 551199aca1c3 ("lib/dma-virt: Add dma_virt_ops")
Link: https://lore.kernel.org/r/20201106181941.1878556-2-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/Kconfig           | 3 +++
 drivers/infiniband/sw/rdmavt/Kconfig | 3 ++-
 drivers/infiniband/sw/rxe/Kconfig    | 2 +-
 drivers/infiniband/sw/siw/Kconfig    | 1 +
 4 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index b44b1c322ec82..786ee0e4e8855 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -80,6 +80,9 @@ config INFINIBAND_ADDR_TRANS_CONFIGFS
 	  This allows the user to config the default GID type that the CM
 	  uses for each device, when initiaing new connections.
 
+config INFINIBAND_VIRT_DMA
+	def_bool !HIGHMEM
+
 if INFINIBAND_USER_ACCESS || !INFINIBAND_USER_ACCESS
 source "drivers/infiniband/hw/mthca/Kconfig"
 source "drivers/infiniband/hw/qib/Kconfig"
diff --git a/drivers/infiniband/sw/rdmavt/Kconfig b/drivers/infiniband/sw/rdmavt/Kconfig
index 1f2759c72108a..a297f13eb6664 100644
--- a/drivers/infiniband/sw/rdmavt/Kconfig
+++ b/drivers/infiniband/sw/rdmavt/Kconfig
@@ -1,7 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config INFINIBAND_RDMAVT
 	tristate "RDMA verbs transport library"
-	depends on X86_64 && ARCH_DMA_ADDR_T_64BIT
+	depends on INFINIBAND_VIRT_DMA
+	depends on X86_64
 	depends on PCI
 	select DMA_VIRT_OPS
 	---help---
diff --git a/drivers/infiniband/sw/rxe/Kconfig b/drivers/infiniband/sw/rxe/Kconfig
index d9bcfe7405888..71a773f607bbc 100644
--- a/drivers/infiniband/sw/rxe/Kconfig
+++ b/drivers/infiniband/sw/rxe/Kconfig
@@ -2,7 +2,7 @@
 config RDMA_RXE
 	tristate "Software RDMA over Ethernet (RoCE) driver"
 	depends on INET && PCI && INFINIBAND
-	depends on !64BIT || ARCH_DMA_ADDR_T_64BIT
+	depends on INFINIBAND_VIRT_DMA
 	select NET_UDP_TUNNEL
 	select CRYPTO_CRC32
 	select DMA_VIRT_OPS
diff --git a/drivers/infiniband/sw/siw/Kconfig b/drivers/infiniband/sw/siw/Kconfig
index b622fc62f2cd6..3450ba5081df5 100644
--- a/drivers/infiniband/sw/siw/Kconfig
+++ b/drivers/infiniband/sw/siw/Kconfig
@@ -1,6 +1,7 @@
 config RDMA_SIW
 	tristate "Software RDMA over TCP/IP (iWARP) driver"
 	depends on INET && INFINIBAND && LIBCRC32C
+	depends on INFINIBAND_VIRT_DMA
 	select DMA_VIRT_OPS
 	help
 	This driver implements the iWARP RDMA transport over
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 072/158] perf lock: Dont free "lock_seq_stat" if read_count isnt zero
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 071/158] RMDA/sw: Dont allow drivers using dma_virt_ops on highmem configs Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 073/158] tools, bpftool: Add missing close before bpftool net attach exit Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Leo Yan, Jiri Olsa,
	Arnaldo Carvalho de Melo, Sasha Levin

From: Leo Yan <leo.yan@linaro.org>

[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ]

When execute command "perf lock report", it hits failure and outputs log
as follows:

  perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed.
  Aborted

This is an imbalance issue.  The locking sequence structure
"lock_seq_stat" contains the reader counter and it is used to check if
the locking sequence is balance or not between acquiring and releasing.

If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero,
the "read_count" will be reset to zero when allocate a new structure at
the next time; thus it causes the wrong counting for reader and finally
results in imbalance issue.

To fix this issue, if detects "read_count" is not zero (means still have
read user in the locking sequence), goto the "end" tag to skip freeing
structure "lock_seq_stat".

Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence")
Signed-off-by: Leo Yan <leo.yan@linaro.org>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/perf/builtin-lock.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c
index 474dfd59d7eb2..d06665077dfe0 100644
--- a/tools/perf/builtin-lock.c
+++ b/tools/perf/builtin-lock.c
@@ -621,7 +621,7 @@ static int report_lock_release_event(struct evsel *evsel,
 	case SEQ_STATE_READ_ACQUIRED:
 		seq->read_count--;
 		BUG_ON(seq->read_count < 0);
-		if (!seq->read_count) {
+		if (seq->read_count) {
 			ls->nr_release++;
 			goto end;
 		}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 073/158] tools, bpftool: Add missing close before bpftool net attach exit
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 072/158] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 074/158] ip_tunnels: Set tunnel option flag when tunnel metadata is present Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang Hai, Daniel Borkmann, Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit 50431b45685b600fc2851a3f2b53e24643efe6d3 ]

progfd is created by prog_parse_fd() in do_attach() and before the latter
returns in case of success, the file descriptor should be closed.

Fixes: 04949ccc273e ("tools: bpftool: add net attach command to attach XDP on interface")
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20201113115152.53178-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/bpf/bpftool/net.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c
index 4f52d31516166..bb311ccc6c487 100644
--- a/tools/bpf/bpftool/net.c
+++ b/tools/bpf/bpftool/net.c
@@ -312,8 +312,8 @@ static int do_attach(int argc, char **argv)
 
 	ifindex = net_parse_dev(&argc, &argv);
 	if (ifindex < 1) {
-		close(progfd);
-		return -EINVAL;
+		err = -EINVAL;
+		goto cleanup;
 	}
 
 	if (argc) {
@@ -321,8 +321,8 @@ static int do_attach(int argc, char **argv)
 			overwrite = true;
 		} else {
 			p_err("expected 'overwrite', got: '%s'?", *argv);
-			close(progfd);
-			return -EINVAL;
+			err = -EINVAL;
+			goto cleanup;
 		}
 	}
 
@@ -330,17 +330,17 @@ static int do_attach(int argc, char **argv)
 	if (is_prefix("xdp", attach_type_strings[attach_type]))
 		err = do_attach_detach_xdp(progfd, attach_type, ifindex,
 					   overwrite);
-
-	if (err < 0) {
+	if (err) {
 		p_err("interface %s attach failed: %s",
 		      attach_type_strings[attach_type], strerror(-err));
-		return err;
+		goto cleanup;
 	}
 
 	if (json_output)
 		jsonw_null(json_wtr);
-
-	return 0;
+cleanup:
+	close(progfd);
+	return err;
 }
 
 static int do_detach(int argc, char **argv)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 074/158] ip_tunnels: Set tunnel option flag when tunnel metadata is present
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 073/158] tools, bpftool: Add missing close before bpftool net attach exit Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 075/158] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yi-Hung Wei, Jakub Kicinski, Sasha Levin

From: Yi-Hung Wei <yihung.wei@gmail.com>

[ Upstream commit 9c2e14b48119b39446031d29d994044ae958d8fc ]

Currently, we may set the tunnel option flag when the size of metadata
is zero.  For example, we set TUNNEL_GENEVE_OPT in the receive function
no matter the geneve option is present or not.  As this may result in
issues on the tunnel flags consumers, this patch fixes the issue.

Related discussion:
* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u

Fixes: 256c87c17c53 ("net: check tunnel option type in tunnel flags")
Signed-off-by: Yi-Hung Wei <yihung.wei@gmail.com>
Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/geneve.c     | 3 +--
 include/net/ip_tunnels.h | 7 ++++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index fcb7a6b4cc02a..c7ec3d24eabc8 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -221,8 +221,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs,
 	if (ip_tunnel_collect_metadata() || gs->collect_md) {
 		__be16 flags;
 
-		flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT |
-			(gnvh->oam ? TUNNEL_OAM : 0) |
+		flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) |
 			(gnvh->critical ? TUNNEL_CRIT_OPT : 0);
 
 		tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags,
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index af645604f3289..56deb2501e962 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -472,9 +472,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
 					   const void *from, int len,
 					   __be16 flags)
 {
-	memcpy(ip_tunnel_info_opts(info), from, len);
 	info->options_len = len;
-	info->key.tun_flags |= flags;
+	if (len > 0) {
+		memcpy(ip_tunnel_info_opts(info), from, len);
+		info->key.tun_flags |= flags;
+	}
 }
 
 static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate)
@@ -520,7 +522,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info,
 					   __be16 flags)
 {
 	info->options_len = 0;
-	info->key.tun_flags |= flags;
 }
 
 #endif /* CONFIG_INET */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 075/158] can: af_can: prevent potential access of uninitialized member in can_rcv()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 074/158] ip_tunnels: Set tunnel option flag when tunnel metadata is present Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 076/158] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+9bcb0c9409066696d3aa,
	Anant Thazhemadam, Marc Kleine-Budde, Sasha Levin

From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ]

In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this
uninitialized cfd->len is accessed nonetheless by pr_warn_once().

Fix this uninitialized variable access by checking cfd->len's validity
condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's
condition is checked, and appropriately modify the log messages that
are generated as well.
In case either of the required conditions fail, the skb is freed and
NET_RX_DROP is returned, same as before.

Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once")
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/can/af_can.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 128d37a4c2e0b..09d2329719c17 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -675,16 +675,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev,
 {
 	struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
 
-	if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU ||
-		     cfd->len > CAN_MAX_DLEN)) {
-		pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n",
+	if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) {
+		pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n",
+			     dev->type, skb->len);
+		goto free_skb;
+	}
+
+	/* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
+	if (unlikely(cfd->len > CAN_MAX_DLEN)) {
+		pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n",
 			     dev->type, skb->len, cfd->len);
-		kfree_skb(skb);
-		return NET_RX_DROP;
+		goto free_skb;
 	}
 
 	can_receive(skb, dev);
 	return NET_RX_SUCCESS;
+
+free_skb:
+	kfree_skb(skb);
+	return NET_RX_DROP;
 }
 
 static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 076/158] can: af_can: prevent potential access of uninitialized member in canfd_rcv()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 075/158] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 077/158] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+9bcb0c9409066696d3aa,
	Anant Thazhemadam, Marc Kleine-Budde, Sasha Levin

From: Anant Thazhemadam <anant.thazhemadam@gmail.com>

[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ]

In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this
uninitialized cfd->len is accessed nonetheless by pr_warn_once().

Fix this uninitialized variable access by checking cfd->len's validity
condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's
condition is checked, and appropriately modify the log messages that
are generated as well.
In case either of the required conditions fail, the skb is freed and
NET_RX_DROP is returned, same as before.

Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once")
Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com
Tested-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/can/af_can.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/net/can/af_can.c b/net/can/af_can.c
index 09d2329719c17..fd6ef6d26846f 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -701,16 +701,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev,
 {
 	struct canfd_frame *cfd = (struct canfd_frame *)skb->data;
 
-	if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU ||
-		     cfd->len > CANFD_MAX_DLEN)) {
-		pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n",
+	if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) {
+		pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n",
+			     dev->type, skb->len);
+		goto free_skb;
+	}
+
+	/* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */
+	if (unlikely(cfd->len > CANFD_MAX_DLEN)) {
+		pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n",
 			     dev->type, skb->len, cfd->len);
-		kfree_skb(skb);
-		return NET_RX_DROP;
+		goto free_skb;
 	}
 
 	can_receive(skb, dev);
 	return NET_RX_SUCCESS;
+
+free_skb:
+	kfree_skb(skb);
+	return NET_RX_DROP;
 }
 
 /* af_can protocol functions */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 077/158] can: dev: can_restart(): post buffer from the right context
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 076/158] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 078/158] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Loris Fauster,
	Alejandro Concepcion Rodriguez, Marc Kleine-Budde, Sasha Levin

From: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>

[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ]

netif_rx() is meant to be called from interrupt contexts. can_restart() may be
called by can_restart_work(), which is called from a worqueue, so it may run in
process context. Use netif_rx_ni() instead.

Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface")
Co-developed-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Loris Fauster <loris.fauster@ttcontrol.com>
Signed-off-by: Alejandro Concepcion Rodriguez <alejandro@acoro.eu>
Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu
[mkl: use netif_rx_ni() instead of netif_rx_any_context()]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 448d1548cca39..5b8791135de13 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -567,7 +567,7 @@ static void can_restart(struct net_device *dev)
 	}
 	cf->can_id |= CAN_ERR_RESTARTED;
 
-	netif_rx(skb);
+	netif_rx_ni(skb);
 
 	stats->rx_packets++;
 	stats->rx_bytes += cf->can_dlc;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 078/158] can: ti_hecc: Fix memleak in ti_hecc_probe
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 077/158] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 079/158] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Marc Kleine-Budde, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ]

In the error handling, we should goto the probe_exit_candev
to free ndev to prevent memory leak.

Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/ti_hecc.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index d3a7631eecaf2..d0a05fc5cc32f 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -873,7 +873,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
 	priv->base = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(priv->base)) {
 		dev_err(&pdev->dev, "hecc ioremap failed\n");
-		return PTR_ERR(priv->base);
+		err = PTR_ERR(priv->base);
+		goto probe_exit_candev;
 	}
 
 	/* handle hecc-ram memory */
@@ -886,7 +887,8 @@ static int ti_hecc_probe(struct platform_device *pdev)
 	priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(priv->hecc_ram)) {
 		dev_err(&pdev->dev, "hecc-ram ioremap failed\n");
-		return PTR_ERR(priv->hecc_ram);
+		err = PTR_ERR(priv->hecc_ram);
+		goto probe_exit_candev;
 	}
 
 	/* handle mbx memory */
@@ -899,13 +901,14 @@ static int ti_hecc_probe(struct platform_device *pdev)
 	priv->mbx = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(priv->mbx)) {
 		dev_err(&pdev->dev, "mbx ioremap failed\n");
-		return PTR_ERR(priv->mbx);
+		err = PTR_ERR(priv->mbx);
+		goto probe_exit_candev;
 	}
 
 	irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
 	if (!irq) {
 		dev_err(&pdev->dev, "No irq resource\n");
-		goto probe_exit;
+		goto probe_exit_candev;
 	}
 
 	priv->ndev = ndev;
@@ -969,7 +972,7 @@ probe_exit_release_clk:
 	clk_put(priv->clk);
 probe_exit_candev:
 	free_candev(ndev);
-probe_exit:
+
 	return err;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 079/158] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 078/158] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 080/158] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Remigiusz Kołłątaj,
	Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ]

The driver has to first fill the skb with data and then handle it to
can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before
sending the skb out via USB.

Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Cc: Remigiusz Kołłątaj <remigiusz.kollataj@mobica.com>
Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/mcba_usb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 21faa2ec46327..8f785c199e220 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -326,8 +326,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
 	if (!ctx)
 		return NETDEV_TX_BUSY;
 
-	can_put_echo_skb(skb, priv->netdev, ctx->ndx);
-
 	if (cf->can_id & CAN_EFF_FLAG) {
 		/* SIDH    | SIDL                 | EIDH   | EIDL
 		 * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0
@@ -357,6 +355,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb,
 	if (cf->can_id & CAN_RTR_FLAG)
 		usb_msg.dlc |= MCBA_DLC_RTR_MASK;
 
+	can_put_echo_skb(skb, priv->netdev, ctx->ndx);
+
 	err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx);
 	if (err)
 		goto xmit_failed;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 080/158] can: peak_usb: fix potential integer overflow on shift of a int
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 079/158] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 081/158] can: flexcan: fix failure handling of pm_runtime_get_sync() Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Colin Ian King, Marc Kleine-Budde,
	Sasha Levin

From: Colin Ian King <colin.king@canonical.com>

[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ]

The left shift of int 32 bit integer constant 1 is evaluated using 32 bit
arithmetic and then assigned to a signed 64 bit variable. In the case where
time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow.
Avoid this by shifting using the BIT_ULL macro instead.

Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index c844c6abe5fcd..f22089101cdda 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -156,7 +156,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
 		if (time_ref->ts_dev_1 < time_ref->ts_dev_2) {
 			/* case when event time (tsw) wraps */
 			if (ts < time_ref->ts_dev_1)
-				delta_ts = 1 << time_ref->adapter->ts_used_bits;
+				delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits);
 
 		/* Otherwise, sync time counter (ts_dev_2) has wrapped:
 		 * handle case when event time (tsn) hasn't.
@@ -168,7 +168,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time)
 		 *              tsn            ts
 		 */
 		} else if (time_ref->ts_dev_1 < ts) {
-			delta_ts = -(1 << time_ref->adapter->ts_used_bits);
+			delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits);
 		}
 
 		/* add delay between last sync and event timestamps */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 081/158] can: flexcan: fix failure handling of pm_runtime_get_sync()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 080/158] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 082/158] can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhang Qilong, Marc Kleine-Budde, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit b7ee5bc3e1006433601a058a6a7c24c5272635f4 ]

pm_runtime_get_sync() will increment pm usage at first and it will resume the
device later. If runtime of the device has error or device is in inaccessible
state(or other error state), resume operation will fail. If we do not call put
operation to decrease the reference, it will result in reference leak in the
two functions flexcan_get_berr_counter() and flexcan_open().

Moreover, this device cannot enter the idle state and always stay busy or other
non-idle state later. So we should fix it through adding
pm_runtime_put_noidle().

Fixes: ca10989632d88 ("can: flexcan: implement can Runtime PM")
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Link: https://lore.kernel.org/r/20201108083000.2599705-1-zhangqilong3@huawei.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/flexcan.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 130f3022d3396..b22cd8d14716a 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -614,8 +614,10 @@ static int flexcan_get_berr_counter(const struct net_device *dev,
 	int err;
 
 	err = pm_runtime_get_sync(priv->dev);
-	if (err < 0)
+	if (err < 0) {
+		pm_runtime_put_noidle(priv->dev);
 		return err;
+	}
 
 	err = __flexcan_get_berr_counter(dev, bec);
 
@@ -1282,8 +1284,10 @@ static int flexcan_open(struct net_device *dev)
 	int err;
 
 	err = pm_runtime_get_sync(priv->dev);
-	if (err < 0)
+	if (err < 0) {
+		pm_runtime_put_noidle(priv->dev);
 		return err;
+	}
 
 	err = open_candev(dev);
 	if (err)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 082/158] can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 081/158] can: flexcan: fix failure handling of pm_runtime_get_sync() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 083/158] can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init() Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Enric Balletbo i Serra, Dan Murphy,
	Marc Kleine-Budde, Sasha Levin

From: Enric Balletbo i Serra <enric.balletbo@collabora.com>

[ Upstream commit 3fcce133f0d9a50d3a23f8e2bc950197b4e03900 ]

regmap is a library function that gets selected by drivers that need it. No
driver modules should depend on it. Instead depends on SPI and select
REGMAP_SPI. Depending on REGMAP_SPI makes this driver only build if another
driver already selected REGMAP_SPI, as the symbol can't be selected through the
menu kernel configuration.

Signed-off-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Link: http://lore.kernel.org/r/20200413141013.506613-1-enric.balletbo@collabora.com
Reviewed-by: Dan Murphy <dmurphy@ti.com>
Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/Kconfig | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
index 1ff0b7fe81d6a..c10932a7f1fe3 100644
--- a/drivers/net/can/m_can/Kconfig
+++ b/drivers/net/can/m_can/Kconfig
@@ -16,7 +16,8 @@ config CAN_M_CAN_PLATFORM
 
 config CAN_M_CAN_TCAN4X5X
 	depends on CAN_M_CAN
-	depends on REGMAP_SPI
+	depends on SPI
+	select REGMAP_SPI
 	tristate "TCAN4X5X M_CAN device"
 	---help---
 	  Say Y here if you want support for Texas Instruments TCAN4x5x
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 083/158] can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 082/158] can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 084/158] can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Murphy, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit 1ff203badbbf1738027c8395d5b40b0d462b6e4d ]

This patch adds the missing error checking when initializing the regmap
interface fails.

Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
Cc: Dan Murphy <dmurphy@ti.com>
Link: http://lore.kernel.org/r/20201019154233.1262589-7-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/tcan4x5x.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
index b233756345f83..11c223a534887 100644
--- a/drivers/net/can/m_can/tcan4x5x.c
+++ b/drivers/net/can/m_can/tcan4x5x.c
@@ -467,6 +467,10 @@ static int tcan4x5x_can_probe(struct spi_device *spi)
 
 	priv->regmap = devm_regmap_init(&spi->dev, &tcan4x5x_bus,
 					&spi->dev, &tcan4x5x_regmap);
+	if (IS_ERR(priv->regmap)) {
+		ret = PTR_ERR(priv->regmap);
+		goto out_clk;
+	}
 
 	tcan4x5x_power_enable(priv->power, 1);
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 084/158] can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 083/158] can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 085/158] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Murphy, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit c81d0b6ca665477c761f227807010762630b089f ]

Change the order in tcan4x5x_can_remove() to be the exact inverse of
tcan4x5x_can_probe(). First m_can_class_unregister(), then power down the
device.

Fixes: 5443c226ba91 ("can: tcan4x5x: Add tcan4x5x driver to the kernel")
Cc: Dan Murphy <dmurphy@ti.com>
Link: http://lore.kernel.org/r/20201019154233.1262589-10-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/tcan4x5x.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/m_can/tcan4x5x.c b/drivers/net/can/m_can/tcan4x5x.c
index 11c223a534887..681bb861de05e 100644
--- a/drivers/net/can/m_can/tcan4x5x.c
+++ b/drivers/net/can/m_can/tcan4x5x.c
@@ -501,10 +501,10 @@ static int tcan4x5x_can_remove(struct spi_device *spi)
 {
 	struct tcan4x5x_priv *priv = spi_get_drvdata(spi);
 
-	tcan4x5x_power_enable(priv->power, 0);
-
 	m_can_class_unregister(priv->mcan_dev);
 
+	tcan4x5x_power_enable(priv->power, 0);
+
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 085/158] can: m_can: m_can_handle_state_change(): fix state change
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 084/158] can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 086/158] can: m_can: m_can_class_free_dev(): introduce new function Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wu Bo, Dan Murphy, Marc Kleine-Budde,
	Sasha Levin

From: Wu Bo <wubo.oduw@gmail.com>

[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ]

m_can_handle_state_change() is called with the new_state as an argument.

In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the
following code indicate that a CAN_STATE_ERROR_WARNING is handled.

This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING.

Signed-off-by: Wu Bo <wubo.oduw@gmail.com>
Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com
Cc: Dan Murphy <dmurphy@ti.com>
Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 562c8317e3aa8..20f025b4f6d4c 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -664,7 +664,7 @@ static int m_can_handle_state_change(struct net_device *dev,
 	unsigned int ecr;
 
 	switch (new_state) {
-	case CAN_STATE_ERROR_ACTIVE:
+	case CAN_STATE_ERROR_WARNING:
 		/* error warning state */
 		cdev->can.can_stats.error_warning++;
 		cdev->can.state = CAN_STATE_ERROR_WARNING;
@@ -693,7 +693,7 @@ static int m_can_handle_state_change(struct net_device *dev,
 	__m_can_get_berr_counter(dev, &bec);
 
 	switch (new_state) {
-	case CAN_STATE_ERROR_ACTIVE:
+	case CAN_STATE_ERROR_WARNING:
 		/* error warning state */
 		cf->can_id |= CAN_ERR_CRTL;
 		cf->data[1] = (bec.txerr > bec.rxerr) ?
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 086/158] can: m_can: m_can_class_free_dev(): introduce new function
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 085/158] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 087/158] can: m_can: m_can_stop(): set device to software init mode before closing Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Dan Murphy, Sasha Levin

From: Dan Murphy <dmurphy@ti.com>

[ Upstream commit a8c22f5b0c689a29f45ef4a110d09fd391debcbc ]

This patch creates a common function that peripherials can call to free the
netdev device when failures occur.

Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework")
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Dan Murphy <dmurphy@ti.com>
Link: http://lore.kernel.org/r/20200227183829.21854-2-dmurphy@ti.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 6 ++++++
 drivers/net/can/m_can/m_can.h | 1 +
 2 files changed, 7 insertions(+)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 20f025b4f6d4c..85e3df24e7bfb 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -1764,6 +1764,12 @@ out:
 }
 EXPORT_SYMBOL_GPL(m_can_class_allocate_dev);
 
+void m_can_class_free_dev(struct net_device *net)
+{
+	free_candev(net);
+}
+EXPORT_SYMBOL_GPL(m_can_class_free_dev);
+
 int m_can_class_register(struct m_can_classdev *m_can_dev)
 {
 	int ret;
diff --git a/drivers/net/can/m_can/m_can.h b/drivers/net/can/m_can/m_can.h
index 49f42b50627a1..b2699a7c99973 100644
--- a/drivers/net/can/m_can/m_can.h
+++ b/drivers/net/can/m_can/m_can.h
@@ -99,6 +99,7 @@ struct m_can_classdev {
 };
 
 struct m_can_classdev *m_can_class_allocate_dev(struct device *dev);
+void m_can_class_free_dev(struct net_device *net);
 int m_can_class_register(struct m_can_classdev *cdev);
 void m_can_class_unregister(struct m_can_classdev *cdev);
 int m_can_class_get_clocks(struct m_can_classdev *cdev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 087/158] can: m_can: m_can_stop(): set device to software init mode before closing
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 086/158] can: m_can: m_can_class_free_dev(): introduce new function Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 088/158] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Faiz Abbas, Dan Murphy,
	Marc Kleine-Budde, Sasha Levin

From: Faiz Abbas <faiz_abbas@ti.com>

[ Upstream commit a584e9bc1b7e88f24f8504886eafbe6c73d8a97c ]

There might be some requests pending in the buffer when the interface close
sequence occurs. In some devices, these pending requests might lead to the
module not shutting down properly when m_can_clk_stop() is called.

Therefore, move the device to init state before potentially powering it down.

Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support")
Signed-off-by: Faiz Abbas <faiz_abbas@ti.com>
Acked-by: Dan Murphy <dmurphy@ti.com>
Link: https://lore.kernel.org/r/20200825055442.16994-1-faiz_abbas@ti.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 85e3df24e7bfb..661db85d569ce 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -1366,6 +1366,9 @@ static void m_can_stop(struct net_device *dev)
 	/* disable all interrupts */
 	m_can_disable_all_interrupts(cdev);
 
+	/* Set init mode to disengage from the network */
+	m_can_config_endisable(cdev, true);
+
 	/* set the state as STOPPED */
 	cdev->can.state = CAN_STATE_STOPPED;
 }
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 088/158] ASoC: qcom: lpass-platform: Fix memory leak
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 087/158] can: m_can: m_can_stop(): set device to software init mode before closing Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 089/158] selftests/bpf: Fix error return code in run_getsockopt_test() Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pavel Machek, V Sujith Kumar Reddy,
	Srinivasa Rao Mandadapu, Mark Brown, Sasha Levin

From: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>

[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ]

lpass_pcm_data is not freed in error paths. Free it in
error paths to avoid memory leak.

Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage")
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: V Sujith Kumar Reddy <vsujithk@codeaurora.org>
Signed-off-by: Srinivasa Rao Mandadapu <srivasam@codeaurora.org>
Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/qcom/lpass-platform.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
index 9acaef81dd74c..b1981d84ac18c 100644
--- a/sound/soc/qcom/lpass-platform.c
+++ b/sound/soc/qcom/lpass-platform.c
@@ -73,8 +73,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
 	else
 		dma_ch = 0;
 
-	if (dma_ch < 0)
+	if (dma_ch < 0) {
+		kfree(data);
 		return dma_ch;
+	}
 
 	drvdata->substream[dma_ch] = substream;
 
@@ -95,6 +97,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
 	ret = snd_pcm_hw_constraint_integer(runtime,
 			SNDRV_PCM_HW_PARAM_PERIODS);
 	if (ret < 0) {
+		kfree(data);
 		dev_err(soc_runtime->dev, "setting constraints failed: %d\n",
 			ret);
 		return -EINVAL;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 089/158] selftests/bpf: Fix error return code in run_getsockopt_test()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 088/158] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 090/158] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Wang Hai,
	Daniel Borkmann, Sasha Levin

From: Wang Hai <wanghai38@huawei.com>

[ Upstream commit 2acc3c1bc8e98bc66b1badec42e9ea205b4fcdaa ]

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.

Fixes: 65b4414a05eb ("selftests/bpf: add sockopt test that exercises BPF_F_ALLOW_MULTI")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20201116101633.64627-1-wanghai38@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/bpf/prog_tests/sockopt_multi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
index 29188d6f5c8de..51fac975b3163 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockopt_multi.c
@@ -138,7 +138,8 @@ static int run_getsockopt_test(struct bpf_object *obj, int cg_parent,
 	 */
 
 	buf = 0x40;
-	if (setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1) < 0) {
+	err = setsockopt(sock_fd, SOL_IP, IP_TOS, &buf, 1);
+	if (err < 0) {
 		log_err("Failed to call setsockopt(IP_TOS)");
 		goto detach;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 090/158] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 089/158] selftests/bpf: Fix error return code in run_getsockopt_test() Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:21 ` [PATCH 5.4 091/158] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Zhang Qilong,
	Thomas Bogendoerfer, Sasha Levin

From: Zhang Qilong <zhangqilong3@huawei.com>

[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ]

If the clk_register fails, we should free h before
function returns to prevent memleak.

Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/mips/alchemy/common/clock.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c
index a95a894aceaf1..f0c8303371047 100644
--- a/arch/mips/alchemy/common/clock.c
+++ b/arch/mips/alchemy/common/clock.c
@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
 {
 	struct clk_init_data id;
 	struct clk_hw *h;
+	struct clk *clk;
 
 	h = kzalloc(sizeof(*h), GFP_KERNEL);
 	if (!h)
@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name,
 	id.ops = &alchemy_clkops_cpu;
 	h->init = &id;
 
-	return clk_register(NULL, h);
+	clk = clk_register(NULL, h);
+	if (IS_ERR(clk)) {
+		pr_err("failed to register clock\n");
+		kfree(h);
+	}
+
+	return clk;
 }
 
 /* AUXPLLs ************************************************************/
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 091/158] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 090/158] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
@ 2020-11-23 12:21 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 092/158] net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:21 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Xiongfeng Wang,
	Jernej Skrabec, Sasha Levin

From: Xiongfeng Wang <wangxiongfeng2@huawei.com>

[ Upstream commit 6654b57866b98230a270953dd34f67de17ab1708 ]

Fix to return a negative error code from the error handling case instead
of 0 in function sun8i_dw_hdmi_bind().

Fixes: b7c7436a5ff0 ("drm/sun4i: Implement A83T HDMI driver")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Xiongfeng Wang <wangxiongfeng2@huawei.com>
Reviewed-by: Jernej Skrabec <jernej.skrabec@siol.net>
Signed-off-by: Jernej Skrabec <jernej.skrabec@siol.net>
Link: https://patchwork.freedesktop.org/patch/msgid/1605488969-5211-1-git-send-email-wangxiongfeng2@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
index a44dca4b0219e..12fe241956213 100644
--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
+++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c
@@ -209,6 +209,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master,
 	phy_node = of_parse_phandle(dev->of_node, "phys", 0);
 	if (!phy_node) {
 		dev_err(dev, "Can't found PHY phandle\n");
+		ret = -EINVAL;
 		goto err_disable_clk_tmds;
 	}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 092/158] net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-11-23 12:21 ` [PATCH 5.4 091/158] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 093/158] bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eli Cohen, Roi Dayan, Saeed Mahameed,
	Sasha Levin

From: Eli Cohen <elic@nvidia.com>

[ Upstream commit 5b8631c7b21ca8bc039f0bc030048973b039e0d2 ]

Avoid calling mlx5_esw_modify_vport_rate() if qos is not enabled and
avoid unnecessary syndrome messages from firmware.

Fixes: fcb64c0f5640 ("net/mlx5: E-Switch, add ingress rate support")
Signed-off-by: Eli Cohen <elic@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
index d2d407ebe6872..009d383d83f4b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
@@ -1592,6 +1592,10 @@ int mlx5_esw_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num,
 	struct mlx5_vport *vport;
 
 	vport = mlx5_eswitch_get_vport(esw, vport_num);
+
+	if (!vport->qos.enabled)
+		return -EOPNOTSUPP;
+
 	MLX5_SET(scheduling_context, ctx, max_average_bw, rate_mbps);
 
 	return mlx5_modify_scheduling_element_cmd(esw->dev,
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 093/158] bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 092/158] net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 094/158] bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Daniel Borkmann,
	Jakub Sitnicki, Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit c9c89dcd872ea33327673fcb97398993a1f22736 ]

If copy_page_to_iter() fails or even partially completes, but with fewer
bytes copied than expected we currently reset sg.start and return EFAULT.
This proves problematic if we already copied data into the user buffer
before we return an error. Because we leave the copied data in the user
buffer and fail to unwind the scatterlist so kernel side believes data
has been copied and user side believes data has _not_ been received.

Expected behavior should be to return number of bytes copied and then
on the next read we need to return the error assuming its still there. This
can happen if we have a copy length spanning multiple scatterlist elements
and one or more complete before the error is hit.

The error is rare enough though that my normal testing with server side
programs, such as nginx, httpd, envoy, etc., I have never seen this. The
only reliable way to reproduce that I've found is to stream movies over
my browser for a day or so and wait for it to hang. Not very scientific,
but with a few extra WARN_ON()s in the code the bug was obvious.

When we review the errors from copy_page_to_iter() it seems we are hitting
a page fault from copy_page_to_iter_iovec() where the code checks
fault_in_pages_writeable(buf, copy) where buf is the user buffer. It
also seems typical server applications don't hit this case.

The other way to try and reproduce this is run the sockmap selftest tool
test_sockmap with data verification enabled, but it doesn't reproduce the
fault. Perhaps we can trigger this case artificially somehow from the
test tools. I haven't sorted out a way to do that yet though.

Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/160556566659.73229.15694973114605301063.stgit@john-XPS-13-9370
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ipv4/tcp_bpf.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index ad9f382027311..efd098b00104b 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -47,8 +47,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
 {
 	struct iov_iter *iter = &msg->msg_iter;
 	int peek = flags & MSG_PEEK;
-	int i, ret, copied = 0;
 	struct sk_msg *msg_rx;
+	int i, copied = 0;
 
 	msg_rx = list_first_entry_or_null(&psock->ingress_msg,
 					  struct sk_msg, list);
@@ -69,11 +69,9 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
 			page = sg_page(sge);
 			if (copied + copy > len)
 				copy = len - copied;
-			ret = copy_page_to_iter(page, sge->offset, copy, iter);
-			if (ret != copy) {
-				msg_rx->sg.start = i;
-				return -EFAULT;
-			}
+			copy = copy_page_to_iter(page, sge->offset, copy, iter);
+			if (!copy)
+				return copied ? copied : -EFAULT;
 
 			copied += copy;
 			if (likely(!peek)) {
@@ -88,6 +86,11 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
 						put_page(page);
 				}
 			} else {
+				/* Lets not optimize peek case if copy_page_to_iter
+				 * didn't copy the entire length lets just break.
+				 */
+				if (copy != sge->length)
+					return copied;
 				sk_msg_iter_var_next(i);
 			}
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 094/158] bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 093/158] bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 095/158] can: kvaser_pciefd: Fix KCAN bittiming limits Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Sitnicki, John Fastabend,
	Daniel Borkmann, Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit 36cd0e696a832a00247fca522034703566ac8885 ]

Fix sockmap sk_skb programs so that they observe sk_rcvbuf limits. This
allows users to tune SO_RCVBUF and sockmap will honor them.

We can refactor the if(charge) case out in later patches. But, keep this
fix to the point.

Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
Suggested-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/160556568657.73229.8404601585878439060.stgit@john-XPS-13-9370
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c   | 20 ++++++++++++++++----
 net/ipv4/tcp_bpf.c |  3 ++-
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 118cf1ace43a6..1f8e3445cd2f0 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -170,10 +170,12 @@ static int sk_msg_free_elem(struct sock *sk, struct sk_msg *msg, u32 i,
 	struct scatterlist *sge = sk_msg_elem(msg, i);
 	u32 len = sge->length;
 
-	if (charge)
-		sk_mem_uncharge(sk, len);
-	if (!msg->skb)
+	/* When the skb owns the memory we free it from consume_skb path. */
+	if (!msg->skb) {
+		if (charge)
+			sk_mem_uncharge(sk, len);
 		put_page(sg_page(sge));
+	}
 	memset(sge, 0, sizeof(*sge));
 	return len;
 }
@@ -403,6 +405,9 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
 	int copied = 0, num_sge;
 	struct sk_msg *msg;
 
+	if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
+		return -EAGAIN;
+
 	msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
 	if (unlikely(!msg))
 		return -EAGAIN;
@@ -418,7 +423,14 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
 		return num_sge;
 	}
 
-	sk_mem_charge(sk, skb->len);
+	/* This will transition ownership of the data from the socket where
+	 * the BPF program was run initiating the redirect to the socket
+	 * we will eventually receive this data on. The data will be released
+	 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
+	 * into user buffers.
+	 */
+	skb_set_owner_r(skb, sk);
+
 	copied = skb->len;
 	msg->sg.start = 0;
 	msg->sg.size = copied;
diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
index efd098b00104b..819255ee4e42d 100644
--- a/net/ipv4/tcp_bpf.c
+++ b/net/ipv4/tcp_bpf.c
@@ -77,7 +77,8 @@ int __tcp_bpf_recvmsg(struct sock *sk, struct sk_psock *psock,
 			if (likely(!peek)) {
 				sge->offset += copy;
 				sge->length -= copy;
-				sk_mem_uncharge(sk, copy);
+				if (!msg_rx->skb)
+					sk_mem_uncharge(sk, copy);
 				msg_rx->sg.size -= copy;
 
 				if (!sge->length) {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 095/158] can: kvaser_pciefd: Fix KCAN bittiming limits
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 094/158] bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 096/158] can: kvaser_usb: kvaser_usb_hydra: " Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jimmy Assarsson, Marc Kleine-Budde,
	Sasha Levin

From: Jimmy Assarsson <extja@kvaser.com>

[ Upstream commit 470e14c00c63752466ac44de392f584dfdddd82e ]

Use correct bittiming limits for the KCAN CAN controller.

Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices")
Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://lore.kernel.org/r/20201115163027.16851-1-jimmyassarsson@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/kvaser_pciefd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/can/kvaser_pciefd.c b/drivers/net/can/kvaser_pciefd.c
index 6f766918211a4..72acd1ba162d2 100644
--- a/drivers/net/can/kvaser_pciefd.c
+++ b/drivers/net/can/kvaser_pciefd.c
@@ -287,12 +287,12 @@ struct kvaser_pciefd_tx_packet {
 static const struct can_bittiming_const kvaser_pciefd_bittiming_const = {
 	.name = KVASER_PCIEFD_DRV_NAME,
 	.tseg1_min = 1,
-	.tseg1_max = 255,
+	.tseg1_max = 512,
 	.tseg2_min = 1,
 	.tseg2_max = 32,
 	.sjw_max = 16,
 	.brp_min = 1,
-	.brp_max = 4096,
+	.brp_max = 8192,
 	.brp_inc = 1,
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 096/158] can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 095/158] can: kvaser_pciefd: Fix KCAN bittiming limits Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 097/158] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jimmy Assarsson, Marc Kleine-Budde,
	Sasha Levin

From: Jimmy Assarsson <extja@kvaser.com>

[ Upstream commit d003868d7f8579838ed58b6429af91844039b6f8 ]

Use correct bittiming limits for the KCAN CAN controller.

Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family")
Signed-off-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://lore.kernel.org/r/20201115163027.16851-2-jimmyassarsson@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
index 7ab87a7587545..218fadc911558 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c
@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = {
 	.tseg2_max = 32,
 	.sjw_max = 16,
 	.brp_min = 1,
-	.brp_max = 4096,
+	.brp_max = 8192,
 	.brp_inc = 1,
 };
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 097/158] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 096/158] can: kvaser_usb: kvaser_usb_hydra: " Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 098/158] iommu/vt-d: Avoid panic if iommu init fails in tboot system Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Lu Baolu,
	Joerg Roedel, Sasha Levin

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

[ Upstream commit c7eb900f5f45eeab1ea1bed997a2a12d8b5907bc ]

Static analyzer is not happy about intel_iommu_gfx_mapped declaration:

.../drivers/iommu/intel/iommu.c:364:5: warning: symbol 'intel_iommu_gfx_mapped' was not declared. Should it be static?

Move its declaration to Intel IOMMU header file.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20200828161212.71294-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/drm/intel-gtt.h     | 5 +----
 include/linux/intel-iommu.h | 1 +
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/include/drm/intel-gtt.h b/include/drm/intel-gtt.h
index 71d81923e6b06..abfefaaf897a0 100644
--- a/include/drm/intel-gtt.h
+++ b/include/drm/intel-gtt.h
@@ -5,6 +5,7 @@
 #define	_DRM_INTEL_GTT_H
 
 #include <linux/agp_backend.h>
+#include <linux/intel-iommu.h>
 #include <linux/kernel.h>
 
 void intel_gtt_get(u64 *gtt_total,
@@ -33,8 +34,4 @@ void intel_gtt_clear_range(unsigned int first_entry, unsigned int num_entries);
 /* flag for GFDT type */
 #define AGP_USER_CACHED_MEMORY_GFDT (1 << 3)
 
-#ifdef CONFIG_INTEL_IOMMU
-extern int intel_iommu_gfx_mapped;
-#endif
-
 #endif
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index ed870da78326b..e54d51308f6f5 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -707,6 +707,7 @@ extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
 extern int dmar_disabled;
 extern int intel_iommu_enabled;
 extern int intel_iommu_tboot_noforce;
+extern int intel_iommu_gfx_mapped;
 #else
 static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
 {
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 098/158] iommu/vt-d: Avoid panic if iommu init fails in tboot system
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 097/158] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 099/158] can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zhenzhong Duan, Lukasz Hawrylko,
	Lu Baolu, Will Deacon, Sasha Levin

From: Zhenzhong Duan <zhenzhong.duan@gmail.com>

[ Upstream commit 4d213e76a359e540ca786ee937da7f35faa8e5f8 ]

"intel_iommu=off" command line is used to disable iommu but iommu is force
enabled in a tboot system for security reason.

However for better performance on high speed network device, a new option
"intel_iommu=tboot_noforce" is introduced to disable the force on.

By default kernel should panic if iommu init fail in tboot for security
reason, but it's unnecessory if we use "intel_iommu=tboot_noforce,off".

Fix the code setting force_on and move intel_iommu_tboot_noforce
from tboot code to intel iommu code.

Fixes: 7304e8f28bb2 ("iommu/vt-d: Correctly disable Intel IOMMU force on")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@gmail.com>
Tested-by: Lukasz Hawrylko <lukasz.hawrylko@linux.intel.com>
Acked-by: Lu Baolu <baolu.lu@linux.intel.com>
Link: https://lore.kernel.org/r/20201110071908.3133-1-zhenzhong.duan@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/kernel/tboot.c     | 3 ---
 drivers/iommu/intel-iommu.c | 5 +++--
 include/linux/intel-iommu.h | 1 -
 3 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c
index a49fe1dcb47e8..bded81591ad95 100644
--- a/arch/x86/kernel/tboot.c
+++ b/arch/x86/kernel/tboot.c
@@ -512,9 +512,6 @@ int tboot_force_iommu(void)
 	if (!tboot_enabled())
 		return 0;
 
-	if (intel_iommu_tboot_noforce)
-		return 1;
-
 	if (no_iommu || swiotlb || dmar_disabled)
 		pr_warning("Forcing Intel-IOMMU to enabled\n");
 
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 1147626f0d253..984c7a6ea4fe8 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -179,7 +179,7 @@ static int rwbf_quirk;
  * (used when kernel is launched w/ TXT)
  */
 static int force_on = 0;
-int intel_iommu_tboot_noforce;
+static int intel_iommu_tboot_noforce;
 static int no_platform_optin;
 
 #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry))
@@ -4927,7 +4927,8 @@ int __init intel_iommu_init(void)
 	 * Intel IOMMU is required for a TXT/tboot launch or platform
 	 * opt in, so enforce that.
 	 */
-	force_on = tboot_force_iommu() || platform_optin_force_iommu();
+	force_on = (!intel_iommu_tboot_noforce && tboot_force_iommu()) ||
+		    platform_optin_force_iommu();
 
 	if (iommu_init_mempool()) {
 		if (force_on)
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index e54d51308f6f5..6b559d25a84ee 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -706,7 +706,6 @@ extern int iommu_calculate_agaw(struct intel_iommu *iommu);
 extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
 extern int dmar_disabled;
 extern int intel_iommu_enabled;
-extern int intel_iommu_tboot_noforce;
 extern int intel_iommu_gfx_mapped;
 #else
 static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 099/158] can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 098/158] iommu/vt-d: Avoid panic if iommu init fails in tboot system Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 100/158] can: m_can: process interrupt only when not runtime suspended Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marc Kleine-Budde, Sasha Levin

From: Marc Kleine-Budde <mkl@pengutronix.de>

[ Upstream commit cd9f13c59461351d7a5fd07924264fb49b287359 ]

If the CAN controller goes into bus off, the do_set_mode() callback with
CAN_MODE_START can be used to recover the controller, which then calls
flexcan_chip_start(). If configured, this is done automatically by the
framework or manually by the user.

In flexcan_chip_start() there is an explicit call to
flexcan_transceiver_enable(), which does a regulator_enable() on the
transceiver regulator. This results in a net usage counter increase, as there
is no corresponding flexcan_transceiver_disable() in the bus off code path.
This further leads to the transceiver stuck enabled, even if the CAN interface
is shut down.

To fix this problem the
flexcan_transceiver_enable()/flexcan_transceiver_disable() are moved out of
flexcan_chip_start()/flexcan_chip_stop() into flexcan_open()/flexcan_close().

Fixes: e955cead0311 ("CAN: Add Flexcan CAN controller driver")
Link: https://lore.kernel.org/r/20201118150148.2664024-1-mkl@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/flexcan.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index b22cd8d14716a..1bd955e4c7d66 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -1202,14 +1202,10 @@ static int flexcan_chip_start(struct net_device *dev)
 		priv->write(reg_mecr, &regs->mecr);
 	}
 
-	err = flexcan_transceiver_enable(priv);
-	if (err)
-		goto out_chip_disable;
-
 	/* synchronize with the can bus */
 	err = flexcan_chip_unfreeze(priv);
 	if (err)
-		goto out_transceiver_disable;
+		goto out_chip_disable;
 
 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
 
@@ -1226,8 +1222,6 @@ static int flexcan_chip_start(struct net_device *dev)
 
 	return 0;
 
- out_transceiver_disable:
-	flexcan_transceiver_disable(priv);
  out_chip_disable:
 	flexcan_chip_disable(priv);
 	return err;
@@ -1257,7 +1251,6 @@ static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error)
 	priv->write(priv->reg_ctrl_default & ~FLEXCAN_CTRL_ERR_ALL,
 		    &regs->ctrl);
 
-	flexcan_transceiver_disable(priv);
 	priv->can.state = CAN_STATE_STOPPED;
 
 	return 0;
@@ -1293,10 +1286,14 @@ static int flexcan_open(struct net_device *dev)
 	if (err)
 		goto out_runtime_put;
 
-	err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
+	err = flexcan_transceiver_enable(priv);
 	if (err)
 		goto out_close;
 
+	err = request_irq(dev->irq, flexcan_irq, IRQF_SHARED, dev->name, dev);
+	if (err)
+		goto out_transceiver_disable;
+
 	priv->mb_size = sizeof(struct flexcan_mb) + CAN_MAX_DLEN;
 	priv->mb_count = (sizeof(priv->regs->mb[0]) / priv->mb_size) +
 			 (sizeof(priv->regs->mb[1]) / priv->mb_size);
@@ -1352,6 +1349,8 @@ static int flexcan_open(struct net_device *dev)
 	can_rx_offload_del(&priv->offload);
  out_free_irq:
 	free_irq(dev->irq, dev);
+ out_transceiver_disable:
+	flexcan_transceiver_disable(priv);
  out_close:
 	close_candev(dev);
  out_runtime_put:
@@ -1370,6 +1369,7 @@ static int flexcan_close(struct net_device *dev)
 
 	can_rx_offload_del(&priv->offload);
 	free_irq(dev->irq, dev);
+	flexcan_transceiver_disable(priv);
 
 	close_candev(dev);
 	pm_runtime_put(priv->dev);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 100/158] can: m_can: process interrupt only when not runtime suspended
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 099/158] can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 101/158] xfs: fix the minrecs logic when dealing with inode root child blocks Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jarkko Nikula, Marc Kleine-Budde,
	Sasha Levin

From: Jarkko Nikula <jarkko.nikula@linux.intel.com>

[ Upstream commit a1f634463aaf2c94dfa13001dbdea011303124cc ]

Avoid processing bogus interrupt statuses when the HW is runtime suspended and
the M_CAN_IR register read may get all bits 1's. Handler can be called if the
interrupt request is shared with other peripherals or at the end of free_irq().

Therefore check the runtime suspended status before processing.

Fixes: cdf8259d6573 ("can: m_can: Add PM Support")
Signed-off-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Link: https://lore.kernel.org/r/20200915134715.696303-1-jarkko.nikula@linux.intel.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/m_can/m_can.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 661db85d569ce..246fa2657d744 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -913,6 +913,8 @@ static irqreturn_t m_can_isr(int irq, void *dev_id)
 	struct net_device_stats *stats = &dev->stats;
 	u32 ir;
 
+	if (pm_runtime_suspended(cdev->dev))
+		return IRQ_NONE;
 	ir = m_can_read(cdev, M_CAN_IR);
 	if (!ir)
 		return IRQ_NONE;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 101/158] xfs: fix the minrecs logic when dealing with inode root child blocks
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 100/158] can: m_can: process interrupt only when not runtime suspended Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 102/158] xfs: strengthen rmap record flags checking Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Chandan Babu R,
	Christoph Hellwig, Sasha Levin

From: Darrick J. Wong <darrick.wong@oracle.com>

[ Upstream commit e95b6c3ef1311dd7b20467d932a24b6d0fd88395 ]

The comment and logic in xchk_btree_check_minrecs for dealing with
inode-rooted btrees isn't quite correct.  While the direct children of
the inode root are allowed to have fewer records than what would
normally be allowed for a regular ondisk btree block, this is only true
if there is only one child block and the number of records don't fit in
the inode root.

Fixes: 08a3a692ef58 ("xfs: btree scrub should check minrecs")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/scrub/btree.c | 45 ++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c
index f52a7b8256f96..debf392e05156 100644
--- a/fs/xfs/scrub/btree.c
+++ b/fs/xfs/scrub/btree.c
@@ -452,32 +452,41 @@ xchk_btree_check_minrecs(
 	int			level,
 	struct xfs_btree_block	*block)
 {
-	unsigned int		numrecs;
-	int			ok_level;
-
-	numrecs = be16_to_cpu(block->bb_numrecs);
+	struct xfs_btree_cur	*cur = bs->cur;
+	unsigned int		root_level = cur->bc_nlevels - 1;
+	unsigned int		numrecs = be16_to_cpu(block->bb_numrecs);
 
 	/* More records than minrecs means the block is ok. */
-	if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level))
+	if (numrecs >= cur->bc_ops->get_minrecs(cur, level))
 		return;
 
 	/*
-	 * Certain btree blocks /can/ have fewer than minrecs records.  Any
-	 * level greater than or equal to the level of the highest dedicated
-	 * btree block are allowed to violate this constraint.
-	 *
-	 * For a btree rooted in a block, the btree root can have fewer than
-	 * minrecs records.  If the btree is rooted in an inode and does not
-	 * store records in the root, the direct children of the root and the
-	 * root itself can have fewer than minrecs records.
+	 * For btrees rooted in the inode, it's possible that the root block
+	 * contents spilled into a regular ondisk block because there wasn't
+	 * enough space in the inode root.  The number of records in that
+	 * child block might be less than the standard minrecs, but that's ok
+	 * provided that there's only one direct child of the root.
 	 */
-	ok_level = bs->cur->bc_nlevels - 1;
-	if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE)
-		ok_level--;
-	if (level >= ok_level)
+	if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) &&
+	    level == cur->bc_nlevels - 2) {
+		struct xfs_btree_block	*root_block;
+		struct xfs_buf		*root_bp;
+		int			root_maxrecs;
+
+		root_block = xfs_btree_get_block(cur, root_level, &root_bp);
+		root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level);
+		if (be16_to_cpu(root_block->bb_numrecs) != 1 ||
+		    numrecs <= root_maxrecs)
+			xchk_btree_set_corrupt(bs->sc, cur, level);
 		return;
+	}
 
-	xchk_btree_set_corrupt(bs->sc, bs->cur, level);
+	/*
+	 * Otherwise, only the root level is allowed to have fewer than minrecs
+	 * records or keyptrs.
+	 */
+	if (level < root_level)
+		xchk_btree_set_corrupt(bs->sc, cur, level);
 }
 
 /*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 102/158] xfs: strengthen rmap record flags checking
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 101/158] xfs: fix the minrecs logic when dealing with inode root child blocks Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 103/158] xfs: return corresponding errcode if xfs_initialize_perag() fail Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Chandan Babu R,
	Christoph Hellwig, Sasha Levin

From: Darrick J. Wong <darrick.wong@oracle.com>

[ Upstream commit 498fe261f0d6d5189f8e11d283705dd97b474b54 ]

We always know the correct state of the rmap record flags (attr, bmbt,
unwritten) so check them by direct comparison.

Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Chandan Babu R <chandanrlinux@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/scrub/bmap.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c
index ec580c0d70fa3..52892f41eb2d8 100644
--- a/fs/xfs/scrub/bmap.c
+++ b/fs/xfs/scrub/bmap.c
@@ -218,13 +218,13 @@ xchk_bmap_xref_rmap(
 	 * which doesn't track unwritten state.
 	 */
 	if (owner != XFS_RMAP_OWN_COW &&
-	    irec->br_state == XFS_EXT_UNWRITTEN &&
-	    !(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
+	    !!(irec->br_state == XFS_EXT_UNWRITTEN) !=
+	    !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN))
 		xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
 				irec->br_startoff);
 
-	if (info->whichfork == XFS_ATTR_FORK &&
-	    !(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
+	if (!!(info->whichfork == XFS_ATTR_FORK) !=
+	    !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK))
 		xchk_fblock_xref_set_corrupt(info->sc, info->whichfork,
 				irec->br_startoff);
 	if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK)
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 103/158] xfs: return corresponding errcode if xfs_initialize_perag() fail
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 102/158] xfs: strengthen rmap record flags checking Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 104/158] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Yu Kuai, Darrick J. Wong,
	Sasha Levin

From: Yu Kuai <yukuai3@huawei.com>

[ Upstream commit 595189c25c28a55523354336bf24453242c81c15 ]

In xfs_initialize_perag(), if kmem_zalloc(), xfs_buf_hash_init(), or
radix_tree_preload() failed, the returned value 'error' is not set
accordingly.

Reported-as-fixing: 8b26c5825e02 ("xfs: handle ENOMEM correctly during initialisation of perag structures")
Fixes: 9b2471797942 ("xfs: cache unlinked pointers in an rhashtable")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/xfs_mount.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index ba5b6f3b2b88a..5a0ce0c2c4bbd 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -195,21 +195,26 @@ xfs_initialize_perag(
 		}
 
 		pag = kmem_zalloc(sizeof(*pag), KM_MAYFAIL);
-		if (!pag)
+		if (!pag) {
+			error = -ENOMEM;
 			goto out_unwind_new_pags;
+		}
 		pag->pag_agno = index;
 		pag->pag_mount = mp;
 		spin_lock_init(&pag->pag_ici_lock);
 		mutex_init(&pag->pag_ici_reclaim_lock);
 		INIT_RADIX_TREE(&pag->pag_ici_root, GFP_ATOMIC);
-		if (xfs_buf_hash_init(pag))
+
+		error = xfs_buf_hash_init(pag);
+		if (error)
 			goto out_free_pag;
 		init_waitqueue_head(&pag->pagb_wait);
 		spin_lock_init(&pag->pagb_lock);
 		pag->pagb_count = 0;
 		pag->pagb_tree = RB_ROOT;
 
-		if (radix_tree_preload(GFP_NOFS))
+		error = radix_tree_preload(GFP_NOFS);
+		if (error)
 			goto out_hash_destroy;
 
 		spin_lock(&mp->m_perag_lock);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 104/158] regulator: ti-abb: Fix array out of bound read access on the first transition
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 103/158] xfs: return corresponding errcode if xfs_initialize_perag() fail Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 105/158] fail_function: Remove a redundant mutex unlock Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naresh Kamboju, Arnd Bergmann,
	Nishanth Menon, Mark Brown, Sasha Levin

From: Nishanth Menon <nm@ti.com>

[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ]

At the start of driver initialization, we do not know what bias
setting the bootloader has configured the system for and we only know
for certain the very first time we do a transition.

However, since the initial value of the comparison index is -EINVAL,
this negative value results in an array out of bound access on the
very first transition.

Since we don't know what the setting is, we just set the bias
configuration as there is nothing to compare against. This prevents
the array out of bound access.

NOTE: Even though we could use a more relaxed check of "< 0" the only
valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+.

Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver")
Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Nishanth Menon <nm@ti.com>
Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/regulator/ti-abb-regulator.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c
index 89b9314d64c9d..016330f909c09 100644
--- a/drivers/regulator/ti-abb-regulator.c
+++ b/drivers/regulator/ti-abb-regulator.c
@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
 		return ret;
 	}
 
-	/* If data is exactly the same, then just update index, no change */
 	info = &abb->info[sel];
+	/*
+	 * When Linux kernel is starting up, we are'nt sure of the
+	 * Bias configuration that bootloader has configured.
+	 * So, we get to know the actual setting the first time
+	 * we are asked to transition.
+	 */
+	if (abb->current_info_idx == -EINVAL)
+		goto just_set_abb;
+
+	/* If data is exactly the same, then just update index, no change */
 	oinfo = &abb->info[abb->current_info_idx];
 	if (!memcmp(info, oinfo, sizeof(*info))) {
 		dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__,
@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel)
 		goto out;
 	}
 
+just_set_abb:
 	ret = ti_abb_set_opp(rdev, abb, info);
 
 out:
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 105/158] fail_function: Remove a redundant mutex unlock
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 104/158] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 106/158] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hulk Robot, Luo Meng,
	Masami Hiramatsu, Alexei Starovoitov, Sasha Levin

From: Luo Meng <luomeng12@huawei.com>

[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ]

Fix a mutex_unlock() issue where before copy_from_user() is
not called mutex_locked.

Fixes: 4b1a29a7f542 ("error-injection: Support fault injection framework")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Luo Meng <luomeng12@huawei.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/fail_function.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/fail_function.c b/kernel/fail_function.c
index 63b349168da72..b0b1ad93fa957 100644
--- a/kernel/fail_function.c
+++ b/kernel/fail_function.c
@@ -253,7 +253,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
 
 	if (copy_from_user(buf, buffer, count)) {
 		ret = -EFAULT;
-		goto out;
+		goto out_free;
 	}
 	buf[count] = '\0';
 	sym = strstrip(buf);
@@ -307,8 +307,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer,
 		ret = count;
 	}
 out:
-	kfree(buf);
 	mutex_unlock(&fei_lock);
+out_free:
+	kfree(buf);
 	return ret;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 106/158] xfs: revert "xfs: fix rmap key and record comparison functions"
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 105/158] fail_function: Remove a redundant mutex unlock Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 107/158] bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Sandeen, Darrick J. Wong,
	Eric Sandeen, Sasha Levin

From: Darrick J. Wong <darrick.wong@oracle.com>

[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ]

This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f.

Your maintainer committed a major braino in the rmap code by adding the
attr fork, bmbt, and unwritten extent usage bits into rmap record key
comparisons.  While XFS uses the usage bits *in the rmap records* for
cross-referencing metadata in xfs_scrub and xfs_repair, it only needs
the owner and offset information to distinguish between reverse mappings
of the same physical extent into the data fork of a file at multiple
offsets.  The other bits are not important for key comparisons for index
lookups, and never have been.

Eric Sandeen reports that this causes regressions in generic/299, so
undo this patch before it does more damage.

Reported-by: Eric Sandeen <sandeen@sandeen.net>
Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c
index 3780609c7860c..fc78efa52c94e 100644
--- a/fs/xfs/libxfs/xfs_rmap_btree.c
+++ b/fs/xfs/libxfs/xfs_rmap_btree.c
@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff(
 	else if (y > x)
 		return -1;
 
-	x = be64_to_cpu(kp->rm_offset);
-	y = xfs_rmap_irec_offset_pack(rec);
+	x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset));
+	y = rec->rm_offset;
 	if (x > y)
 		return 1;
 	else if (y > x)
@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys(
 	else if (y > x)
 		return -1;
 
-	x = be64_to_cpu(kp1->rm_offset);
-	y = be64_to_cpu(kp2->rm_offset);
+	x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset));
+	y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset));
 	if (x > y)
 		return 1;
 	else if (y > x)
@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder(
 		return 1;
 	else if (a > b)
 		return 0;
-	a = be64_to_cpu(k1->rmap.rm_offset);
-	b = be64_to_cpu(k2->rmap.rm_offset);
+	a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset));
+	b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset));
 	if (a <= b)
 		return 1;
 	return 0;
@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder(
 		return 1;
 	else if (a > b)
 		return 0;
-	a = be64_to_cpu(r1->rmap.rm_offset);
-	b = be64_to_cpu(r2->rmap.rm_offset);
+	a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset));
+	b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset));
 	if (a <= b)
 		return 1;
 	return 0;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 107/158] bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 106/158] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 108/158] bpf, sockmap: On receive programs try to fast track SK_PASS ingress Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Alexei Starovoitov,
	Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit cfea28f890cf292d5fe90680db64b68086ef25ba ]

For sk_skb case where skb_verdict program returns SK_PASS to continue to
pass packet up the stack, the memory limits were already checked before
enqueuing in skb_queue_tail from TCP side. So, lets remove the extra checks
here. The theory is if the TCP stack believes we have memory to receive
the packet then lets trust the stack and not double check the limits.

In fact the accounting here can cause a drop if sk_rmem_alloc has increased
after the stack accepted this packet, but before the duplicate check here.
And worse if this happens because TCP stack already believes the data has
been received there is no retransmit.

Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/160226857664.5692.668205469388498375.stgit@john-Precision-5820-Tower
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 1f8e3445cd2f0..605c48df7eb68 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -765,6 +765,7 @@ EXPORT_SYMBOL_GPL(sk_psock_tls_strp_read);
 static void sk_psock_verdict_apply(struct sk_psock *psock,
 				   struct sk_buff *skb, int verdict)
 {
+	struct tcp_skb_cb *tcp;
 	struct sock *sk_other;
 
 	switch (verdict) {
@@ -774,16 +775,12 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
 		    !sk_psock_test_state(psock, SK_PSOCK_TX_ENABLED)) {
 			goto out_free;
 		}
-		if (atomic_read(&sk_other->sk_rmem_alloc) <=
-		    sk_other->sk_rcvbuf) {
-			struct tcp_skb_cb *tcp = TCP_SKB_CB(skb);
 
-			tcp->bpf.flags |= BPF_F_INGRESS;
-			skb_queue_tail(&psock->ingress_skb, skb);
-			schedule_work(&psock->work);
-			break;
-		}
-		goto out_free;
+		tcp = TCP_SKB_CB(skb);
+		tcp->bpf.flags |= BPF_F_INGRESS;
+		skb_queue_tail(&psock->ingress_skb, skb);
+		schedule_work(&psock->work);
+		break;
 	case __SK_REDIRECT:
 		sk_psock_skb_redirect(skb);
 		break;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 108/158] bpf, sockmap: On receive programs try to fast track SK_PASS ingress
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 107/158] bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 109/158] bpf, sockmap: Use truesize with sk_rmem_schedule() Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Alexei Starovoitov,
	Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit 9ecbfb06a078c4911fb444203e8e41d93d22f886 ]

When we receive an skb and the ingress skb verdict program returns
SK_PASS we currently set the ingress flag and put it on the workqueue
so it can be turned into a sk_msg and put on the sk_msg ingress queue.
Then finally telling userspace with data_ready hook.

Here we observe that if the workqueue is empty then we can try to
convert into a sk_msg type and call data_ready directly without
bouncing through a workqueue. Its a common pattern to have a recv
verdict program for visibility that always returns SK_PASS. In this
case unless there is an ENOMEM error or we overrun the socket we
can avoid the workqueue completely only using it when we fall back
to error cases caused by memory pressure.

By doing this we eliminate another case where data may be dropped
if errors occur on memory limits in workqueue.

Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/160226859704.5692.12929678876744977669.stgit@john-Precision-5820-Tower
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 605c48df7eb68..4fad59ee3df0b 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -767,6 +767,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
 {
 	struct tcp_skb_cb *tcp;
 	struct sock *sk_other;
+	int err = -EIO;
 
 	switch (verdict) {
 	case __SK_PASS:
@@ -778,8 +779,20 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
 
 		tcp = TCP_SKB_CB(skb);
 		tcp->bpf.flags |= BPF_F_INGRESS;
-		skb_queue_tail(&psock->ingress_skb, skb);
-		schedule_work(&psock->work);
+
+		/* If the queue is empty then we can submit directly
+		 * into the msg queue. If its not empty we have to
+		 * queue work otherwise we may get OOO data. Otherwise,
+		 * if sk_psock_skb_ingress errors will be handled by
+		 * retrying later from workqueue.
+		 */
+		if (skb_queue_empty(&psock->ingress_skb)) {
+			err = sk_psock_skb_ingress(psock, skb);
+		}
+		if (err < 0) {
+			skb_queue_tail(&psock->ingress_skb, skb);
+			schedule_work(&psock->work);
+		}
 		break;
 	case __SK_REDIRECT:
 		sk_psock_skb_redirect(skb);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 109/158] bpf, sockmap: Use truesize with sk_rmem_schedule()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 108/158] bpf, sockmap: On receive programs try to fast track SK_PASS ingress Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 110/158] bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Borkman, John Fastabend,
	Jakub Sitnicki, Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit 70796fb751f1d34cc650e640572a174faf009cd4 ]

We use skb->size with sk_rmem_scheduled() which is not correct. Instead
use truesize to align with socket and tcp stack usage of sk_rmem_schedule.

Suggested-by: Daniel Borkman <daniel@iogearbox.net>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/160556570616.73229.17003722112077507863.stgit@john-XPS-13-9370
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 4fad59ee3df0b..ddb1b7d94c998 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -411,7 +411,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
 	msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
 	if (unlikely(!msg))
 		return -EAGAIN;
-	if (!sk_rmem_schedule(sk, skb, skb->len)) {
+	if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
 		kfree(msg);
 		return -EAGAIN;
 	}
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 110/158] bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 109/158] bpf, sockmap: Use truesize with sk_rmem_schedule() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 111/158] efi/x86: Free efi_pgd with free_pages() Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, John Fastabend, Daniel Borkmann,
	Jakub Sitnicki, Sasha Levin

From: John Fastabend <john.fastabend@gmail.com>

[ Upstream commit 6fa9201a898983da731fca068bb4b5c941537588 ]

If a socket redirects to itself and it is under memory pressure it is
possible to get a socket stuck so that recv() returns EAGAIN and the
socket can not advance for some time. This happens because when
redirecting a skb to the same socket we received the skb on we first
check if it is OK to enqueue the skb on the receiving socket by checking
memory limits. But, if the skb is itself the object holding the memory
needed to enqueue the skb we will keep retrying from kernel side
and always fail with EAGAIN. Then userspace will get a recv() EAGAIN
error if there are no skbs in the psock ingress queue. This will continue
until either some skbs get kfree'd causing the memory pressure to
reduce far enough that we can enqueue the pending packet or the
socket is destroyed. In some cases its possible to get a socket
stuck for a noticeable amount of time if the socket is only receiving
skbs from sk_skb verdict programs. To reproduce I make the socket
memory limits ridiculously low so sockets are always under memory
pressure. More often though if under memory pressure it looks like
a spurious EAGAIN error on user space side causing userspace to retry
and typically enough has moved on the memory side that it works.

To fix skip memory checks and skb_orphan if receiving on the same
sock as already assigned.

For SK_PASS cases this is easy, its always the same socket so we
can just omit the orphan/set_owner pair.

For backlog cases we need to check skb->sk and decide if the orphan
and set_owner pair are needed.

Fixes: 51199405f9672 ("bpf: skb_verdict, support SK_PASS on RX BPF path")
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://lore.kernel.org/bpf/160556572660.73229.12566203819812939627.stgit@john-XPS-13-9370
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/skmsg.c | 72 +++++++++++++++++++++++++++++++++++-------------
 1 file changed, 53 insertions(+), 19 deletions(-)

diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index ddb1b7d94c998..17cc1edd149cb 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -399,38 +399,38 @@ out:
 }
 EXPORT_SYMBOL_GPL(sk_msg_memcopy_from_iter);
 
-static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk,
+						  struct sk_buff *skb)
 {
-	struct sock *sk = psock->sk;
-	int copied = 0, num_sge;
 	struct sk_msg *msg;
 
 	if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf)
-		return -EAGAIN;
+		return NULL;
+
+	if (!sk_rmem_schedule(sk, skb, skb->truesize))
+		return NULL;
 
 	msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
 	if (unlikely(!msg))
-		return -EAGAIN;
-	if (!sk_rmem_schedule(sk, skb, skb->truesize)) {
-		kfree(msg);
-		return -EAGAIN;
-	}
+		return NULL;
 
 	sk_msg_init(msg);
-	num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
+	return msg;
+}
+
+static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb,
+					struct sk_psock *psock,
+					struct sock *sk,
+					struct sk_msg *msg)
+{
+	int num_sge = skb_to_sgvec(skb, msg->sg.data, 0, skb->len);
+	int copied;
+
 	if (unlikely(num_sge < 0)) {
 		kfree(msg);
 		return num_sge;
 	}
 
-	/* This will transition ownership of the data from the socket where
-	 * the BPF program was run initiating the redirect to the socket
-	 * we will eventually receive this data on. The data will be released
-	 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
-	 * into user buffers.
-	 */
-	skb_set_owner_r(skb, sk);
-
 	copied = skb->len;
 	msg->sg.start = 0;
 	msg->sg.size = copied;
@@ -442,6 +442,40 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
 	return copied;
 }
 
+static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb)
+{
+	struct sock *sk = psock->sk;
+	struct sk_msg *msg;
+
+	msg = sk_psock_create_ingress_msg(sk, skb);
+	if (!msg)
+		return -EAGAIN;
+
+	/* This will transition ownership of the data from the socket where
+	 * the BPF program was run initiating the redirect to the socket
+	 * we will eventually receive this data on. The data will be released
+	 * from skb_consume found in __tcp_bpf_recvmsg() after its been copied
+	 * into user buffers.
+	 */
+	skb_set_owner_r(skb, sk);
+	return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
+}
+
+/* Puts an skb on the ingress queue of the socket already assigned to the
+ * skb. In this case we do not need to check memory limits or skb_set_owner_r
+ * because the skb is already accounted for here.
+ */
+static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb)
+{
+	struct sk_msg *msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_ATOMIC);
+	struct sock *sk = psock->sk;
+
+	if (unlikely(!msg))
+		return -EAGAIN;
+	sk_msg_init(msg);
+	return sk_psock_skb_ingress_enqueue(skb, psock, sk, msg);
+}
+
 static int sk_psock_handle_skb(struct sk_psock *psock, struct sk_buff *skb,
 			       u32 off, u32 len, bool ingress)
 {
@@ -787,7 +821,7 @@ static void sk_psock_verdict_apply(struct sk_psock *psock,
 		 * retrying later from workqueue.
 		 */
 		if (skb_queue_empty(&psock->ingress_skb)) {
-			err = sk_psock_skb_ingress(psock, skb);
+			err = sk_psock_skb_ingress_self(psock, skb);
 		}
 		if (err < 0) {
 			skb_queue_tail(&psock->ingress_skb, skb);
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 111/158] efi/x86: Free efi_pgd with free_pages()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 110/158] bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 112/158] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arvind Sankar, Ard Biesheuvel, Sasha Levin

From: Arvind Sankar <nivedita@alum.mit.edu>

[ Upstream commit c2fe61d8be491ff8188edaf22e838f819999146b ]

Commit

  d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")

changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in
the error path it should be freed using free_pages() rather than
free_page().

Commit

    06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()")

fixed one instance of this, but missed another.

Move the freeing out-of-line to avoid code duplication and fix this bug.

Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD")
Link: https://lore.kernel.org/r/20201110163919.1134431-1-nivedita@alum.mit.edu
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/x86/platform/efi/efi_64.c | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index e39c930cfbd1e..5283978181103 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -217,28 +217,30 @@ int __init efi_alloc_page_tables(void)
 	gfp_mask = GFP_KERNEL | __GFP_ZERO;
 	efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER);
 	if (!efi_pgd)
-		return -ENOMEM;
+		goto fail;
 
 	pgd = efi_pgd + pgd_index(EFI_VA_END);
 	p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END);
-	if (!p4d) {
-		free_page((unsigned long)efi_pgd);
-		return -ENOMEM;
-	}
+	if (!p4d)
+		goto free_pgd;
 
 	pud = pud_alloc(&init_mm, p4d, EFI_VA_END);
-	if (!pud) {
-		if (pgtable_l5_enabled())
-			free_page((unsigned long) pgd_page_vaddr(*pgd));
-		free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
-		return -ENOMEM;
-	}
+	if (!pud)
+		goto free_p4d;
 
 	efi_mm.pgd = efi_pgd;
 	mm_init_cpumask(&efi_mm);
 	init_new_context(NULL, &efi_mm);
 
 	return 0;
+
+free_p4d:
+	if (pgtable_l5_enabled())
+		free_page((unsigned long)pgd_page_vaddr(*pgd));
+free_pgd:
+	free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER);
+fail:
+	return -ENOMEM;
 }
 
 /*
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 112/158] libfs: fix error cast of negative value in simple_attr_write()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 111/158] efi/x86: Free efi_pgd with free_pages() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 113/158] HID: logitech-hidpp: Add PID for MX Anywhere 2 Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yicong Yang, Andrew Morton, Al Viro,
	Linus Torvalds, Sasha Levin

From: Yicong Yang <yangyicong@hisilicon.com>

[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ]

The attr->set() receive a value of u64, but simple_strtoll() is used for
doing the conversion.  It will lead to the error cast if user inputs a
negative value.

Use kstrtoull() instead of simple_strtoll() to convert a string got from
the user to an unsigned value.  The former will return '-EINVAL' if it
gets a negetive value, but the latter can't handle the situation
correctly.  Make 'val' unsigned long long as what kstrtoull() takes,
this will eliminate the compile warning on no 64-bit architectures.

Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines")
Signed-off-by: Yicong Yang <yangyicong@hisilicon.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/libfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/fs/libfs.c b/fs/libfs.c
index 5fd9cc0e2ac9e..247b58a68240a 100644
--- a/fs/libfs.c
+++ b/fs/libfs.c
@@ -887,7 +887,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
 			  size_t len, loff_t *ppos)
 {
 	struct simple_attr *attr;
-	u64 val;
+	unsigned long long val;
 	size_t size;
 	ssize_t ret;
 
@@ -905,7 +905,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf,
 		goto out;
 
 	attr->set_buf[size] = '\0';
-	val = simple_strtoll(attr->set_buf, NULL, 0);
+	ret = kstrtoull(attr->set_buf, 0, &val);
+	if (ret)
+		goto out;
 	ret = attr->set(attr->data, val);
 	if (ret == 0)
 		ret = len; /* on success, claim we got the whole input */
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 113/158] HID: logitech-hidpp: Add PID for MX Anywhere 2
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 112/158] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 114/158] HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Harry Cutts, Peter Hutterer,
	Jiri Kosina, Sasha Levin

From: Harry Cutts <hcutts@chromium.org>

[ Upstream commit b59f38dbfd5d19eb7e03d8b639f0c0d385ba8cc5 ]

It seems that the PID 0x4072 was missing from the list Logitech gave me
for this mouse, as I found one with it in the wild (with which I tested
this patch).

Fixes: 4435ff2f09a2 ("HID: logitech: Enable high-resolution scrolling on Logitech mice")
Signed-off-by: Harry Cutts <hcutts@chromium.org>
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-hidpp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index 60cf806062821..c85070d631da5 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3741,6 +3741,7 @@ static const struct hid_device_id hidpp_devices[] = {
 	  LDJ_DEVICE(0x405e), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
 	{ /* Mouse Logitech MX Anywhere 2 */
 	  LDJ_DEVICE(0x404a), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
+	{ LDJ_DEVICE(0x4072), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
 	{ LDJ_DEVICE(0xb013), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
 	{ LDJ_DEVICE(0xb018), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
 	{ LDJ_DEVICE(0xb01f), .driver_data = HIDPP_QUIRK_HI_RES_SCROLL_X2121 },
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 114/158] HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 113/158] HID: logitech-hidpp: Add PID for MX Anywhere 2 Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 115/158] HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Benjamin Tissoires,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit ee5e58418a854755201eb4952b1230d873a457d5 ]

Some quad/bluetooth keyboards, such as the Dinovo Edge (Y-RAY81) have a
builtin touchpad. In this case when asking the receiver for paired devices,
we get only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD.

This means that we do not instantiate a second dj_hiddev for the mouse
(as we normally would) and thus there is no place for us to forward the
mouse input reports to, causing the touchpad part of the keyboard to not
work.

There is no way for us to detect these keyboards, so this commit adds
an array with device-ids for such keyboards and when a keyboard is on
this list it adds STD_MOUSE to the reports_supported bitmap for the
dj_hiddev created for the keyboard fixing the touchpad not working.

Using a list of device-ids for this is not ideal, but there are only
very few such keyboards so this should be fine. Besides the Dinovo Edge,
other known wireless Logitech keyboards with a builtin touchpad are:

* Dinovo Mini (TODO add its device-id to the list)
* K400 (uses a unifying receiver so is not affected)
* K600 (uses a unifying receiver so is not affected)

Cc: stable@vger.kernel.org
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-dj.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index bb50d6e7745bc..32e5391d98c35 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -866,11 +866,23 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
 	schedule_work(&djrcv_dev->work);
 }
 
+/*
+ * Some quad/bluetooth keyboards have a builtin touchpad in this case we see
+ * only 1 paired device with a device_type of REPORT_TYPE_KEYBOARD. For the
+ * touchpad to work we must also forward mouse input reports to the dj_hiddev
+ * created for the keyboard (instead of forwarding them to a second paired
+ * device with a device_type of REPORT_TYPE_MOUSE as we normally would).
+ */
+static const u16 kbd_builtin_touchpad_ids[] = {
+	0xb309, /* Dinovo Edge */
+};
+
 static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
 					    struct hidpp_event *hidpp_report,
 					    struct dj_workitem *workitem)
 {
 	struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
+	int i, id;
 
 	workitem->type = WORKITEM_TYPE_PAIRED;
 	workitem->device_type = hidpp_report->params[HIDPP_PARAM_DEVICE_INFO] &
@@ -882,6 +894,13 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
 		workitem->reports_supported |= STD_KEYBOARD | MULTIMEDIA |
 					       POWER_KEYS | MEDIA_CENTER |
 					       HIDPP;
+		id = (workitem->quad_id_msb << 8) | workitem->quad_id_lsb;
+		for (i = 0; i < ARRAY_SIZE(kbd_builtin_touchpad_ids); i++) {
+			if (id == kbd_builtin_touchpad_ids[i]) {
+				workitem->reports_supported |= STD_MOUSE;
+				break;
+			}
+		}
 		break;
 	case REPORT_TYPE_MOUSE:
 		workitem->reports_supported |= STD_MOUSE | HIDPP;
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 115/158] HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 114/158] HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 116/158] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Benjamin Tissoires,
	Sasha Levin

From: Hans de Goede <hdegoede@redhat.com>

[ Upstream commit b4c00e7976636f33a4f67eab436a11666c8afd60 ]

Some users are pairing the Dinovo keyboards with the MX5000 or MX5500
receivers, instead of with the Dinovo receivers. The receivers are
mostly the same (and the air protocol obviously is compatible) but
currently the Dinovo receivers are handled by hid-lg.c while the
MX5x00 receivers are handled by logitech-dj.c.

When using a Dinovo keyboard, with its builtin touchpad, through
logitech-dj.c then the touchpad stops working because when asking the
receiver for paired devices, we get only 1 paired device with
a device_type of REPORT_TYPE_KEYBOARD. And since we don't see a paired
mouse, we have nowhere to send mouse-events to, so we drop them.

Extend the existing fix for the Dinovo Edge for this to also cover the
Dinovo Mini keyboard and also add a mapping to logitech-hidpp for the
Media key on the Dinovo Mini, so that that keeps working too.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1811424
Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/hid/hid-logitech-dj.c    |  1 +
 drivers/hid/hid-logitech-hidpp.c | 25 +++++++++++++++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 32e5391d98c35..309e5df463d5c 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -875,6 +875,7 @@ static void logi_dj_recv_queue_notification(struct dj_receiver_dev *djrcv_dev,
  */
 static const u16 kbd_builtin_touchpad_ids[] = {
 	0xb309, /* Dinovo Edge */
+	0xb30c, /* Dinovo Mini */
 };
 
 static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev,
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index c85070d631da5..e49d36de07968 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -88,6 +88,8 @@ MODULE_PARM_DESC(disable_tap_to_click,
 #define HIDPP_CAPABILITY_BATTERY_MILEAGE	BIT(2)
 #define HIDPP_CAPABILITY_BATTERY_LEVEL_STATUS	BIT(3)
 
+#define lg_map_key_clear(c)  hid_map_usage_clear(hi, usage, bit, max, EV_KEY, (c))
+
 /*
  * There are two hidpp protocols in use, the first version hidpp10 is known
  * as register access protocol or RAP, the second version hidpp20 is known as
@@ -2768,6 +2770,26 @@ static int g920_get_config(struct hidpp_device *hidpp,
 	return g920_ff_set_autocenter(hidpp, data);
 }
 
+/* -------------------------------------------------------------------------- */
+/* Logitech Dinovo Mini keyboard with builtin touchpad                        */
+/* -------------------------------------------------------------------------- */
+#define DINOVO_MINI_PRODUCT_ID		0xb30c
+
+static int lg_dinovo_input_mapping(struct hid_device *hdev, struct hid_input *hi,
+		struct hid_field *field, struct hid_usage *usage,
+		unsigned long **bit, int *max)
+{
+	if ((usage->hid & HID_USAGE_PAGE) != HID_UP_LOGIVENDOR)
+		return 0;
+
+	switch (usage->hid & HID_USAGE) {
+	case 0x00d: lg_map_key_clear(KEY_MEDIA);	break;
+	default:
+		return 0;
+	}
+	return 1;
+}
+
 /* -------------------------------------------------------------------------- */
 /* HID++1.0 devices which use HID++ reports for their wheels                  */
 /* -------------------------------------------------------------------------- */
@@ -3003,6 +3025,9 @@ static int hidpp_input_mapping(struct hid_device *hdev, struct hid_input *hi,
 			field->application != HID_GD_MOUSE)
 		return m560_input_mapping(hdev, hi, field, usage, bit, max);
 
+	if (hdev->product == DINOVO_MINI_PRODUCT_ID)
+		return lg_dinovo_input_mapping(hdev, hi, field, usage, bit, max);
+
 	return 0;
 }
 
-- 
2.27.0




^ permalink raw reply related	[flat|nested] 167+ messages in thread

* [PATCH 5.4 116/158] speakup: Do not let the line discipline be used several times
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 115/158] HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 117/158] ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, 秦世松, Samuel Thibault

From: Samuel Thibault <samuel.thibault@ens-lyon.org>

commit d4122754442799187d5d537a9c039a49a67e57f1 upstream.

Speakup has only one speakup_tty variable to store the tty it is managing. This
makes sense since its codebase currently assumes that there is only one user who
controls the screen reading.

That however means that we have to forbid using the line discipline several
times, otherwise the second closure would try to free a NULL ldisc_data, leading to

general protection fault: 0000 [#1] SMP KASAN PTI
RIP: 0010:spk_ttyio_ldisc_close+0x2c/0x60
Call Trace:
 tty_ldisc_release+0xa2/0x340
 tty_release_struct+0x17/0xd0
 tty_release+0x9d9/0xcc0
 __fput+0x231/0x740
 task_work_run+0x12c/0x1a0
 do_exit+0x9b5/0x2230
 ? release_task+0x1240/0x1240
 ? __do_page_fault+0x562/0xa30
 do_group_exit+0xd5/0x2a0
 __x64_sys_exit_group+0x35/0x40
 do_syscall_64+0x89/0x2b0
 ? page_fault+0x8/0x30
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Cc: stable@vger.kernel.org
Reported-by: 秦世松 <qinshisong1205@gmail.com>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Tested-by: Shisong Qin <qinshisong1205@gmail.com>
Link: https://lore.kernel.org/r/20201110183541.fzgnlwhjpgqzjeth@function
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/speakup/spk_ttyio.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/staging/speakup/spk_ttyio.c
+++ b/drivers/staging/speakup/spk_ttyio.c
@@ -49,15 +49,25 @@ static int spk_ttyio_ldisc_open(struct t
 
 	if (!tty->ops->write)
 		return -EOPNOTSUPP;
+
+	mutex_lock(&speakup_tty_mutex);
+	if (speakup_tty) {
+		mutex_unlock(&speakup_tty_mutex);
+		return -EBUSY;
+	}
 	speakup_tty = tty;
 
 	ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL);
-	if (!ldisc_data)
+	if (!ldisc_data) {
+		speakup_tty = NULL;
+		mutex_unlock(&speakup_tty_mutex);
 		return -ENOMEM;
+	}
 
 	init_completion(&ldisc_data->completion);
 	ldisc_data->buf_free = true;
 	speakup_tty->disc_data = ldisc_data;
+	mutex_unlock(&speakup_tty_mutex);
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 117/158] ALSA: firewire: Clean up a locking issue in copy_resp_to_buf()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 116/158] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 118/158] ALSA: usb-audio: Add delay quirk for all Logitech USB devices Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Takashi Sakamoto,
	Takashi Iwai

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 02a9c6ee4183af2e438454c55098b828a96085fb upstream.

The spin_lock/unlock_irq() functions cannot be nested.  The problem is
that presumably we would want the IRQs to be re-enabled on the second
call the spin_unlock_irq() but instead it will be enabled at the first
call so IRQs will be enabled earlier than expected.

In this situation the copy_resp_to_buf() function is only called from
one function and it is called with IRQs disabled.  We can just use
the regular spin_lock/unlock() functions.

Fixes: 555e8a8f7f14 ("ALSA: fireworks: Add command/response functionality into hwdep interface")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201113101241.GB168908@mwanda
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/firewire/fireworks/fireworks_transaction.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/firewire/fireworks/fireworks_transaction.c
+++ b/sound/firewire/fireworks/fireworks_transaction.c
@@ -123,7 +123,7 @@ copy_resp_to_buf(struct snd_efw *efw, vo
 	t = (struct snd_efw_transaction *)data;
 	length = min_t(size_t, be32_to_cpu(t->length) * sizeof(u32), length);
 
-	spin_lock_irq(&efw->lock);
+	spin_lock(&efw->lock);
 
 	if (efw->push_ptr < efw->pull_ptr)
 		capacity = (unsigned int)(efw->pull_ptr - efw->push_ptr);
@@ -190,7 +190,7 @@ handle_resp_for_user(struct fw_card *car
 
 	copy_resp_to_buf(efw, data, length, rcode);
 end:
-	spin_unlock_irq(&instances_lock);
+	spin_unlock(&instances_lock);
 }
 
 static void



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 118/158] ALSA: usb-audio: Add delay quirk for all Logitech USB devices
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 117/158] ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 119/158] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joakim Tjernlund, Takashi Iwai

From: Joakim Tjernlund <joakim.tjernlund@infinera.com>

commit 54a2a3898f469a915510038fe84ef4f083131d3e upstream.

Found one more Logitech device, BCC950 ConferenceCam, which needs
the same delay here. This makes 3 out of 3 devices I have tried.

Therefore, add a delay for all Logitech devices as it does not hurt.

Signed-off-by: Joakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org> # 4.19.y, 5.4.y
Link: https://lore.kernel.org/r/20201117122803.24310-1-joakim.tjernlund@infinera.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/usb/quirks.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1604,13 +1604,13 @@ void snd_usb_ctl_msg_quirk(struct usb_de
 	    && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)
 		msleep(20);
 
-	/* Zoom R16/24, Logitech H650e/H570e, Jabra 550a, Kingston HyperX
-	 *  needs a tiny delay here, otherwise requests like get/set
-	 *  frequency return as failed despite actually succeeding.
+	/* Zoom R16/24, many Logitech(at least H650e/H570e/BCC950),
+	 * Jabra 550a, Kingston HyperX needs a tiny delay here,
+	 * otherwise requests like get/set frequency return
+	 * as failed despite actually succeeding.
 	 */
 	if ((chip->usb_id == USB_ID(0x1686, 0x00dd) ||
-	     chip->usb_id == USB_ID(0x046d, 0x0a46) ||
-	     chip->usb_id == USB_ID(0x046d, 0x0a56) ||
+	     USB_ID_VENDOR(chip->usb_id) == 0x046d  || /* Logitech */
 	     chip->usb_id == USB_ID(0x0b0e, 0x0349) ||
 	     chip->usb_id == USB_ID(0x0951, 0x16ad)) &&
 	    (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 119/158] ALSA: ctl: fix error path at adding user-defined element set
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 118/158] ALSA: usb-audio: Add delay quirk for all Logitech USB devices Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 120/158] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Sakamoto, Takashi Iwai

From: Takashi Sakamoto <o-takashi@sakamocchi.jp>

commit 95a793c3bc75cf888e0e641d656e7d080f487d8b upstream.

When processing request to add/replace user-defined element set, check
of given element identifier and decision of numeric identifier is done
in "__snd_ctl_add_replace()" helper function. When the result of check
is wrong, the helper function returns error code. The error code shall
be returned to userspace application.

Current implementation includes bug to return zero to userspace application
regardless of the result. This commit fixes the bug.

Cc: <stable@vger.kernel.org>
Fixes: e1a7bfe38079 ("ALSA: control: Fix race between adding and removing a user element")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20201113092043.16148-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/control.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1350,7 +1350,7 @@ static int snd_ctl_elem_add(struct snd_c
 
  unlock:
 	up_write(&card->controls_rwsem);
-	return 0;
+	return err;
 }
 
 static int snd_ctl_elem_add_user(struct snd_ctl_file *file,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 120/158] ALSA: mixart: Fix mutex deadlock
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 119/158] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 121/158] ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit d21b96c8ed2aea7e6b7bf4735e1d2503cfbf4072 upstream.

The code change for switching to non-atomic mode brought the
unexpected mutex deadlock in get_msg().  It converted the spinlock
with the existing mutex, but there were calls with the already holding
the mutex.  Since the only place that needs the extra lock is the code
path from snd_mixart_send_msg(), remove the mutex lock in get_msg()
and apply in the caller side for fixing the mutex deadlock.

Fixes: 8d3a8b5cb57d ("ALSA: mixart: Use nonatomic PCM ops")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201119121440.18945-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/mixart/mixart_core.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/sound/pci/mixart/mixart_core.c
+++ b/sound/pci/mixart/mixart_core.c
@@ -70,7 +70,6 @@ static int get_msg(struct mixart_mgr *mg
 	unsigned int i;
 #endif
 
-	mutex_lock(&mgr->msg_lock);
 	err = 0;
 
 	/* copy message descriptor from miXart to driver */
@@ -119,8 +118,6 @@ static int get_msg(struct mixart_mgr *mg
 	writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD));
 
  _clean_exit:
-	mutex_unlock(&mgr->msg_lock);
-
 	return err;
 }
 
@@ -258,7 +255,9 @@ int snd_mixart_send_msg(struct mixart_mg
 	resp.data = resp_data;
 	resp.size = max_resp_size;
 
+	mutex_lock(&mgr->msg_lock);
 	err = get_msg(mgr, &resp, msg_frame);
+	mutex_unlock(&mgr->msg_lock);
 
 	if( request->message_id != resp.message_id )
 		dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n");



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 121/158] ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 120/158] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 122/158] ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kailang Yang, Takashi Iwai

From: Kailang Yang <kailang@realtek.com>

commit 446b8185f0c39ac3faadbcd8ac156c50f2fd4ffe upstream.

Add supported for Lenovo ThinkPad Headset Button.
Thinkpad P1 Gen 3 (0x22c1)
Thinkpad X1 Extreme Gen 3 (0x22c2)

Signed-off-by: Kailang Yang <kailang@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/f39b11d00340408ca2ed2df9b4fc2a09@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6283,6 +6283,7 @@ enum {
 	ALC274_FIXUP_HP_MIC,
 	ALC274_FIXUP_HP_HEADSET_MIC,
 	ALC256_FIXUP_ASUS_HPE,
+	ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK,
 };
 
 static const struct hda_fixup alc269_fixups[] = {
@@ -7687,6 +7688,12 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC294_FIXUP_ASUS_HEADSET_MIC
 	},
+	[ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_headset_jack,
+		.chained = true,
+		.chain_id = ALC269_FIXUP_THINKPAD_ACPI
+	},
 };
 
 static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -7948,6 +7955,8 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
 	SND_PCI_QUIRK(0x17aa, 0x2292, "Thinkpad X1 Carbon 7th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
 	SND_PCI_QUIRK(0x17aa, 0x22be, "Thinkpad X1 Carbon 8th", ALC285_FIXUP_THINKPAD_HEADSET_JACK),
+	SND_PCI_QUIRK(0x17aa, 0x22c1, "Thinkpad P1 Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
+	SND_PCI_QUIRK(0x17aa, 0x22c2, "Thinkpad X1 Extreme Gen 3", ALC285_FIXUP_THINKPAD_NO_BASS_SPK_HEADSET_JACK),
 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
 	SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION),



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 122/158] ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220)
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 121/158] ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 123/158] tty: serial: imx: fix potential deadlock Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, PeiSen Hou, Takashi Iwai

From: PeiSen Hou <pshou@realtek.com>

commit b5acfe152abaa2721c9ca8aa67f941d7de55d24e upstream.

Fix "use as headset mic, without its own jack detect" problem.

[ Minor coding style fixes by tiwai ]

Signed-off-by: PeiSen Hou <pshou@realtek.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/481963e4a5694ff19f27ae1e283d79ad@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   50 +++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 49 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2513,13 +2513,23 @@ static const struct snd_pci_quirk alc882
 	SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
 	SND_PCI_QUIRK(0x1558, 0x9501, "Clevo P950HR", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x9506, "Clevo P955HQ", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x950A, "Clevo P955H[PR]", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x95e1, "Clevo P95xER", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x95e2, "Clevo P950ER", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x95e3, "Clevo P955[ER]T", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x95e4, "Clevo P955ER", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x95e5, "Clevo P955EE6", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x95e6, "Clevo P950R[CDF]", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x96e1, "Clevo P960[ER][CDFN]-K", ALC1220_FIXUP_CLEVO_P950),
 	SND_PCI_QUIRK(0x1558, 0x97e1, "Clevo P970[ER][CDFN]", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x97e2, "Clevo P970RC-M", ALC1220_FIXUP_CLEVO_P950),
+	SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x65d1, "Clevo PB51[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65d2, "Clevo PB51R[CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
-	SND_PCI_QUIRK(0x1558, 0x50d3, "Clevo PC50[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
+	SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x70d1, "Clevo PC70[ER][CDF]", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK(0x1558, 0x7714, "Clevo X170", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
 	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
@@ -7913,11 +7923,49 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1558, 0x1323, "Clevo N130ZU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x1325, "System76 Darter Pro (darp5)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x1401, "Clevo L140[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x1403, "Clevo N140CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x1404, "Clevo N150CU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x14a1, "Clevo L141MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x4018, "Clevo NV40M[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x4019, "Clevo NV40MZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x4020, "Clevo NV40MB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x40a1, "Clevo NL40GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x40c1, "Clevo NL40[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x40d1, "Clevo NL41DU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50a3, "Clevo NJ51GU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50b3, "Clevo NK50S[BEZ]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50b6, "Clevo NK50S5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50b8, "Clevo NK50SZ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50d5, "Clevo NP50D5", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50f0, "Clevo NH50A[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x50f3, "Clevo NH58DPQ", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x5101, "Clevo S510WU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x5157, "Clevo W517GU1", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x51a1, "Clevo NS50MU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x70a1, "Clevo NB70T[HJK]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8228, "Clevo NR40BU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8520, "Clevo NH50D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8521, "Clevo NH77D[CD]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8535, "Clevo NH50D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8536, "Clevo NH79D[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x8550, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+	SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8a20, "Clevo NH55DCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8a51, "Clevo NH70RCQ-Y", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x8d50, "Clevo NH55RCQ-M", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x951d, "Clevo N950T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x961d, "Clevo N960S[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0x971d, "Clevo N970T[CDF]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1558, 0xa500, "Clevo NL53RU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x17aa, 0x1036, "Lenovo P520", ALC233_FIXUP_LENOVO_MULTI_CODECS),
 	SND_PCI_QUIRK(0x17aa, 0x1048, "ThinkCentre Station", ALC283_FIXUP_HEADSET_MIC),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 123/158] tty: serial: imx: fix potential deadlock
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 122/158] ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 124/158] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Sam Nobs

From: Sam Nobs <samuel.nobs@taitradio.com>

commit 33f16855dcb973f745c51882d0e286601ff3be2b upstream.

Enabling the lock dependency validator has revealed
that the way spinlocks are used in the IMX serial
port could result in a deadlock.

Specifically, imx_uart_int() acquires a spinlock
without disabling the interrupts, meaning that another
interrupt could come along and try to acquire the same
spinlock, potentially causing the two to wait for each
other indefinitely.

Use spin_lock_irqsave() instead to disable interrupts
upon acquisition of the spinlock.

Fixes: c974991d2620 ("tty:serial:imx: use spin_lock instead of spin_lock_irqsave in isr")
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Sam Nobs <samuel.nobs@taitradio.com>
Link: https://lore.kernel.org/r/1604955006-9363-1-git-send-email-samuel.nobs@taitradio.com
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/imx.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -877,8 +877,14 @@ static irqreturn_t imx_uart_int(int irq,
 	struct imx_port *sport = dev_id;
 	unsigned int usr1, usr2, ucr1, ucr2, ucr3, ucr4;
 	irqreturn_t ret = IRQ_NONE;
+	unsigned long flags = 0;
 
-	spin_lock(&sport->port.lock);
+	/*
+	 * IRQs might not be disabled upon entering this interrupt handler,
+	 * e.g. when interrupt handlers are forced to be threaded. To support
+	 * this scenario as well, disable IRQs when acquiring the spinlock.
+	 */
+	spin_lock_irqsave(&sport->port.lock, flags);
 
 	usr1 = imx_uart_readl(sport, USR1);
 	usr2 = imx_uart_readl(sport, USR2);
@@ -946,7 +952,7 @@ static irqreturn_t imx_uart_int(int irq,
 		ret = IRQ_HANDLED;
 	}
 
-	spin_unlock(&sport->port.lock);
+	spin_unlock_irqrestore(&sport->port.lock, flags);
 
 	return ret;
 }



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 124/158] tty: serial: imx: keep console clocks always on
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 123/158] tty: serial: imx: fix potential deadlock Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 125/158] HID: logitech-dj: Fix an error in mse_bluetooth_descriptor Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Uwe Kleine-König, Fugang Duan

From: Fugang Duan <fugang.duan@nxp.com>

commit e67c139c488e84e7eae6c333231e791f0e89b3fb upstream.

For below code, there has chance to cause deadlock in SMP system:
Thread 1:
clk_enable_lock();
pr_info("debug message");
clk_enable_unlock();

Thread 2:
imx_uart_console_write()
	clk_enable()
		clk_enable_lock();

Thread 1:
Acuired clk enable_lock -> printk -> console_trylock_spinning
Thread 2:
console_unlock() -> imx_uart_console_write -> clk_disable -> Acquite clk enable_lock

So the patch is to keep console port clocks always on like
other console drivers.

Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check")
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Link: https://lore.kernel.org/r/20201111025136.29818-1-fugang.duan@nxp.com
Cc: stable <stable@vger.kernel.org>
[fix up build warning - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/imx.c |   20 +++-----------------
 1 file changed, 3 insertions(+), 17 deletions(-)

--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1942,16 +1942,6 @@ imx_uart_console_write(struct console *c
 	unsigned int ucr1;
 	unsigned long flags = 0;
 	int locked = 1;
-	int retval;
-
-	retval = clk_enable(sport->clk_per);
-	if (retval)
-		return;
-	retval = clk_enable(sport->clk_ipg);
-	if (retval) {
-		clk_disable(sport->clk_per);
-		return;
-	}
 
 	if (sport->port.sysrq)
 		locked = 0;
@@ -1987,9 +1977,6 @@ imx_uart_console_write(struct console *c
 
 	if (locked)
 		spin_unlock_irqrestore(&sport->port.lock, flags);
-
-	clk_disable(sport->clk_ipg);
-	clk_disable(sport->clk_per);
 }
 
 /*
@@ -2090,15 +2077,14 @@ imx_uart_console_setup(struct console *c
 
 	retval = uart_set_options(&sport->port, co, baud, parity, bits, flow);
 
-	clk_disable(sport->clk_ipg);
 	if (retval) {
-		clk_unprepare(sport->clk_ipg);
+		clk_disable_unprepare(sport->clk_ipg);
 		goto error_console;
 	}
 
-	retval = clk_prepare(sport->clk_per);
+	retval = clk_prepare_enable(sport->clk_per);
 	if (retval)
-		clk_unprepare(sport->clk_ipg);
+		clk_disable_unprepare(sport->clk_ipg);
 
 error_console:
 	return retval;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 125/158] HID: logitech-dj: Fix an error in mse_bluetooth_descriptor
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 124/158] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 126/158] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Benjamin Tissoires

From: Hans de Goede <hdegoede@redhat.com>

commit eec231e060fb79923c349f6e89f022b286f32c1e upstream.

Fix an error in the mouse / INPUT(2) descriptor used for quad/bt2.0 combo
receivers. Replace INPUT with INPUT (Data,Var,Abs) for the field for the
4 extra buttons which share their report-byte with the low-res hwheel.

This is likely a copy and paste error. I've verified that the new
0x81, 0x02 value matches both the mouse descriptor for the currently
supported MX5000 / MX5500 receivers, as well as the INPUT(2) mouse
descriptors for the Dinovo receivers for which support is being
worked on.

Cc: stable@vger.kernel.org
Fixes: f2113c3020ef ("HID: logitech-dj: add support for Logitech Bluetooth Mini-Receiver")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hid/hid-logitech-dj.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -328,7 +328,7 @@ static const char mse_bluetooth_descript
 	0x25, 0x01,		/*      LOGICAL_MAX (1)                 */
 	0x75, 0x01,		/*      REPORT_SIZE (1)                 */
 	0x95, 0x04,		/*      REPORT_COUNT (4)                */
-	0x81, 0x06,		/*      INPUT                           */
+	0x81, 0x02,		/*      INPUT (Data,Var,Abs)            */
 	0xC0,			/*    END_COLLECTION                    */
 	0xC0,			/*  END_COLLECTION                      */
 };



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 126/158] efivarfs: fix memory leak in efivarfs_create()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 125/158] HID: logitech-dj: Fix an error in mse_bluetooth_descriptor Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 127/158] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vamshi K Sthambamkadi, Ard Biesheuvel

From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>

commit fe5186cf12e30facfe261e9be6c7904a170bd822 upstream.

kmemleak report:
  unreferenced object 0xffff9b8915fcb000 (size 4096):
  comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s)
  hex dump (first 32 bytes):
    2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
    [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
    [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
    [<000000000ad0414f>] do_filp_open+0x91/0x100
    [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
    [<000000002a91be6d>] do_sys_open+0x46/0x80
    [<000000000a854999>] __x64_sys_openat+0x20/0x30
    [<00000000c50d89c9>] do_syscall_64+0x38/0x90
    [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

In efivarfs_create(), inode->i_private is setup with efivar_entry
object which is never freed.

Cc: <stable@vger.kernel.org>
Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com>
Link: https://lore.kernel.org/r/20201023115429.GA2479@cosmos
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/efivarfs/super.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -21,6 +21,7 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
+	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 127/158] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 126/158] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 128/158] iio: light: fix kconfig dependency bug for VCNL4035 Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brian OKeefe, Hans de Goede

From: Brian O'Keefe <bokeefe@alum.wpi.edu>

commit aee9dccc5b64e878cf1b18207436e73f66d74157 upstream.

Add 024c:0627 to the list of SDIO device-ids, based on hardware found in
the wild. This hardware exists on at least some Acer SW1-011 tablets.

Signed-off-by: Brian O'Keefe <bokeefe@alum.wpi.edu>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/b9e1523f-2ba7-fb82-646a-37f095b4440e@alum.wpi.edu
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8723bs/os_dep/sdio_intf.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
+++ b/drivers/staging/rtl8723bs/os_dep/sdio_intf.c
@@ -21,6 +21,7 @@ static const struct sdio_device_id sdio_
 	{ SDIO_DEVICE(0x024c, 0x0525), },
 	{ SDIO_DEVICE(0x024c, 0x0623), },
 	{ SDIO_DEVICE(0x024c, 0x0626), },
+	{ SDIO_DEVICE(0x024c, 0x0627), },
 	{ SDIO_DEVICE(0x024c, 0xb723), },
 	{ /* end: all zeroes */				},
 };



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 128/158] iio: light: fix kconfig dependency bug for VCNL4035
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 127/158] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 129/158] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Necip Fazil Yildiran, Jonathan Cameron

From: Necip Fazil Yildiran <fazilyildiran@gmail.com>

commit 44a146a44f656fc03d368c1b9248d29a128cd053 upstream.

When VCNL4035 is enabled and IIO_BUFFER is disabled, it results in the
following Kbuild warning:

WARNING: unmet direct dependencies detected for IIO_TRIGGERED_BUFFER
  Depends on [n]: IIO [=y] && IIO_BUFFER [=n]
  Selected by [y]:
  - VCNL4035 [=y] && IIO [=y] && I2C [=y]

The reason is that VCNL4035 selects IIO_TRIGGERED_BUFFER without depending
on or selecting IIO_BUFFER while IIO_TRIGGERED_BUFFER depends on
IIO_BUFFER. This can also fail building the kernel.

Honor the kconfig dependency to remove unmet direct dependency warnings
and avoid any potential build failures.

Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=209883
Link: https://lore.kernel.org/r/20201102223523.572461-1-fazilyildiran@gmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/light/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -485,6 +485,7 @@ config VCNL4000
 
 config VCNL4035
 	tristate "VCNL4035 combined ALS and proximity sensor"
+	select IIO_BUFFER
 	select IIO_TRIGGERED_BUFFER
 	select REGMAP_I2C
 	depends on I2C



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 129/158] ext4: fix bogus warning in ext4_update_dx_flag()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 128/158] iio: light: fix kconfig dependency bug for VCNL4035 Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 130/158] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Biggers, Eric Biggers, Jan Kara,
	Theodore Tso, stable

From: Jan Kara <jack@suse.cz>

commit f902b216501094495ff75834035656e8119c537f upstream.

The idea of the warning in ext4_update_dx_flag() is that we should warn
when we are clearing EXT4_INODE_INDEX on a filesystem with metadata
checksums enabled since after clearing the flag, checksums for internal
htree nodes will become invalid. So there's no need to warn (or actually
do anything) when EXT4_INODE_INDEX is not set.

Link: https://lore.kernel.org/r/20201118153032.17281-1-jack@suse.cz
Fixes: 48a34311953d ("ext4: fix checksum errors with indexed dirs")
Reported-by: Eric Biggers <ebiggers@kernel.org>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/ext4.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2496,7 +2496,8 @@ void ext4_insert_dentry(struct inode *in
 			struct ext4_filename *fname);
 static inline void ext4_update_dx_flag(struct inode *inode)
 {
-	if (!ext4_has_feature_dir_index(inode->i_sb)) {
+	if (!ext4_has_feature_dir_index(inode->i_sb) &&
+	    ext4_test_inode_flag(inode, EXT4_INODE_INDEX)) {
 		/* ext4_iget() should have caught this... */
 		WARN_ON_ONCE(ext4_has_feature_metadata_csum(inode->i_sb));
 		ext4_clear_inode_flag(inode, EXT4_INODE_INDEX);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 130/158] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 129/158] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 131/158] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Stable, Jonathan Cameron

From: Hans de Goede <hdegoede@redhat.com>

commit 11e94f28c3de35d5ad1ac6a242a5b30f4378991a upstream.

Replace the boolean is_smo8500_device variable with an acpi_type enum.

For now this can be either ACPI_GENERIC or ACPI_SMO8500, this is a
preparation patch for adding special handling for the KIOX010A ACPI HID,
which will add a ACPI_KIOX010A acpi_type to the introduced enum.

For stable as needed as precursor for next patch.

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-2-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/accel/kxcjk-1013.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -126,6 +126,11 @@ enum kx_chipset {
 	KX_MAX_CHIPS /* this must be last */
 };
 
+enum kx_acpi_type {
+	ACPI_GENERIC,
+	ACPI_SMO8500,
+};
+
 struct kxcjk1013_data {
 	struct i2c_client *client;
 	struct iio_trigger *dready_trig;
@@ -142,7 +147,7 @@ struct kxcjk1013_data {
 	bool motion_trigger_on;
 	int64_t timestamp;
 	enum kx_chipset chipset;
-	bool is_smo8500_device;
+	enum kx_acpi_type acpi_type;
 };
 
 enum kxcjk1013_axis {
@@ -1233,7 +1238,7 @@ static irqreturn_t kxcjk1013_data_rdy_tr
 
 static const char *kxcjk1013_match_acpi_device(struct device *dev,
 					       enum kx_chipset *chipset,
-					       bool *is_smo8500_device)
+					       enum kx_acpi_type *acpi_type)
 {
 	const struct acpi_device_id *id;
 
@@ -1242,7 +1247,7 @@ static const char *kxcjk1013_match_acpi_
 		return NULL;
 
 	if (strcmp(id->id, "SMO8500") == 0)
-		*is_smo8500_device = true;
+		*acpi_type = ACPI_SMO8500;
 
 	*chipset = (enum kx_chipset)id->driver_data;
 
@@ -1278,7 +1283,7 @@ static int kxcjk1013_probe(struct i2c_cl
 	} else if (ACPI_HANDLE(&client->dev)) {
 		name = kxcjk1013_match_acpi_device(&client->dev,
 						   &data->chipset,
-						   &data->is_smo8500_device);
+						   &data->acpi_type);
 	} else
 		return -ENODEV;
 
@@ -1296,7 +1301,7 @@ static int kxcjk1013_probe(struct i2c_cl
 	indio_dev->modes = INDIO_DIRECT_MODE;
 	indio_dev->info = &kxcjk1013_info;
 
-	if (client->irq > 0 && !data->is_smo8500_device) {
+	if (client->irq > 0 && data->acpi_type != ACPI_SMO8500) {
 		ret = devm_request_threaded_irq(&client->dev, client->irq,
 						kxcjk1013_data_rdy_trig_poll,
 						kxcjk1013_event_handler,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 131/158] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 130/158] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 132/158] iio: adc: mediatek: fix unset field Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hans de Goede, Stable,
	Jonathan Cameron, russianneuromancer

From: Hans de Goede <hdegoede@redhat.com>

commit e5b1032a656e9aa4c7a4df77cb9156a2a651a5f9 upstream.

Some 360 degree hinges (yoga) style 2-in-1 devices use 2 KXCJ91008-s
to allow the OS to determine the angle between the display and the base
of the device, so that the OS can determine if the 2-in-1 is in laptop
or in tablet-mode.

On Windows both accelerometers are read by a special HingeAngleService
process; and this process calls a DSM (Device Specific Method) on the
ACPI KIOX010A device node for the sensor in the display, to let the
embedded-controller (EC) know about the mode so that it can disable the
kbd and touchpad to avoid spurious input while folded into tablet-mode.

This notifying of the EC is problematic because sometimes the EC comes up
thinking that device is in tablet-mode and the kbd and touchpad do not
work. This happens for example on Irbis NB111 devices after a suspend /
resume cycle (after a complete battery drain / hard reset without having
booted Windows at least once). Other 2-in-1s which are likely affected
too are e.g. the Teclast F5 and F6 series.

The kxcjk-1013 driver may seem like a strange place to deal with this,
but since it is *the* driver for the ACPI KIOX010A device, it is also
the driver which has access to the ACPI handle needed by the DSM.

Add support for calling the DSM and on probe unconditionally tell the
EC that the device is laptop mode, fixing the kbd and touchpad sometimes
not working.

Fixes: 7f6232e69539 ("iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID")
Reported-and-tested-by: russianneuromancer <russianneuromancer@ya.ru>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201110133835.129080-3-hdegoede@redhat.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/accel/kxcjk-1013.c |   36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -129,6 +129,7 @@ enum kx_chipset {
 enum kx_acpi_type {
 	ACPI_GENERIC,
 	ACPI_SMO8500,
+	ACPI_KIOX010A,
 };
 
 struct kxcjk1013_data {
@@ -274,6 +275,32 @@ static const struct {
 			      {19163, 1, 0},
 			      {38326, 0, 1} };
 
+#ifdef CONFIG_ACPI
+enum kiox010a_fn_index {
+	KIOX010A_SET_LAPTOP_MODE = 1,
+	KIOX010A_SET_TABLET_MODE = 2,
+};
+
+static int kiox010a_dsm(struct device *dev, int fn_index)
+{
+	acpi_handle handle = ACPI_HANDLE(dev);
+	guid_t kiox010a_dsm_guid;
+	union acpi_object *obj;
+
+	if (!handle)
+		return -ENODEV;
+
+	guid_parse("1f339696-d475-4e26-8cad-2e9f8e6d7a91", &kiox010a_dsm_guid);
+
+	obj = acpi_evaluate_dsm(handle, &kiox010a_dsm_guid, 1, fn_index, NULL);
+	if (!obj)
+		return -EIO;
+
+	ACPI_FREE(obj);
+	return 0;
+}
+#endif
+
 static int kxcjk1013_set_mode(struct kxcjk1013_data *data,
 			      enum kxcjk1013_mode mode)
 {
@@ -351,6 +378,13 @@ static int kxcjk1013_chip_init(struct kx
 {
 	int ret;
 
+#ifdef CONFIG_ACPI
+	if (data->acpi_type == ACPI_KIOX010A) {
+		/* Make sure the kbd and touchpad on 2-in-1s using 2 KXCJ91008-s work */
+		kiox010a_dsm(&data->client->dev, KIOX010A_SET_LAPTOP_MODE);
+	}
+#endif
+
 	ret = i2c_smbus_read_byte_data(data->client, KXCJK1013_REG_WHO_AM_I);
 	if (ret < 0) {
 		dev_err(&data->client->dev, "Error reading who_am_i\n");
@@ -1248,6 +1282,8 @@ static const char *kxcjk1013_match_acpi_
 
 	if (strcmp(id->id, "SMO8500") == 0)
 		*acpi_type = ACPI_SMO8500;
+	else if (strcmp(id->id, "KIOX010A") == 0)
+		*acpi_type = ACPI_KIOX010A;
 
 	*chipset = (enum kx_chipset)id->driver_data;
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 132/158] iio: adc: mediatek: fix unset field
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 131/158] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 133/158] spi: lpspi: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Fabien Parent, Matthias Brugger,
	Stable, Jonathan Cameron

From: Fabien Parent <fparent@baylibre.com>

commit 15207a92e019803d62687455d8aa2ff9eb3dc82c upstream.

dev_comp field is used in a couple of places but it is never set. This
results in kernel oops when dereferencing a NULL pointer. Set the
`dev_comp` field correctly in the probe function.

Fixes: 6d97024dce23 ("iio: adc: mediatek: mt6577-auxadc, add mt6765 support")
Signed-off-by: Fabien Parent <fparent@baylibre.com>
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20201018194644.3366846-1-fparent@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/adc/mt6577_auxadc.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/iio/adc/mt6577_auxadc.c
+++ b/drivers/iio/adc/mt6577_auxadc.c
@@ -9,9 +9,9 @@
 #include <linux/err.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/of.h>
-#include <linux/of_device.h>
+#include <linux/mod_devicetable.h>
 #include <linux/platform_device.h>
+#include <linux/property.h>
 #include <linux/iopoll.h>
 #include <linux/io.h>
 #include <linux/iio/iio.h>
@@ -279,6 +279,8 @@ static int mt6577_auxadc_probe(struct pl
 		goto err_disable_clk;
 	}
 
+	adc_dev->dev_comp = device_get_match_data(&pdev->dev);
+
 	mutex_init(&adc_dev->lock);
 
 	mt6577_auxadc_mod_reg(adc_dev->reg_base + MT6577_AUXADC_MISC,



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 133/158] spi: lpspi: Fix use-after-free on unbind
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 132/158] iio: adc: mediatek: fix unset field Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 134/158] spi: Introduce device-managed SPI controller allocation Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Han Xu, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 4def49da620c84a682d9361d6bef0a97eed46fe0 upstream.

Normally the last reference on an spi_controller is released by
spi_unregister_controller().  In the case of the i.MX lpspi driver,
the spi_controller is registered with devm_spi_register_controller(),
so spi_unregister_controller() is invoked automatically after the driver
has unbound.

However the driver already releases the last reference in
fsl_lpspi_remove() through a gratuitous call to spi_master_put(),
causing a use-after-free when spi_unregister_controller() is
subsequently invoked by the devres framework.

Fix by dropping the superfluous spi_master_put().

Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.2+
Cc: Han Xu <han.xu@nxp.com>
Link: https://lore.kernel.org/r/ab3c0b18bd820501a12c85e440006e09ec0e275f.1604874488.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-fsl-lpspi.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/drivers/spi/spi-fsl-lpspi.c
+++ b/drivers/spi/spi-fsl-lpspi.c
@@ -973,9 +973,6 @@ static int fsl_lpspi_remove(struct platf
 				spi_controller_get_devdata(controller);
 
 	pm_runtime_disable(fsl_lpspi->dev);
-
-	spi_master_put(controller);
-
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 134/158] spi: Introduce device-managed SPI controller allocation
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 133/158] spi: lpspi: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 135/158] spi: npcm-fiu: Dont leak SPI master in probe error path Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 5e844cc37a5cbaa460e68f9a989d321d63088a89 upstream.

SPI driver probing currently comprises two steps, whereas removal
comprises only one step:

    spi_alloc_master()
    spi_register_controller()

    spi_unregister_controller()

That's because spi_unregister_controller() calls device_unregister()
instead of device_del(), thereby releasing the reference on the
spi_controller which was obtained by spi_alloc_master().

An SPI driver's private data is contained in the same memory allocation
as the spi_controller struct.  Thus, once spi_unregister_controller()
has been called, the private data is inaccessible.  But some drivers
need to access it after spi_unregister_controller() to perform further
teardown steps.

Introduce devm_spi_alloc_master() and devm_spi_alloc_slave(), which
release a reference on the spi_controller struct only after the driver
has unbound, thereby keeping the memory allocation accessible.  Change
spi_unregister_controller() to not release a reference if the
spi_controller was allocated by one of these new devm functions.

The present commit is small enough to be backportable to stable.
It allows fixing drivers which use the private data in their ->remove()
hook after it's been freed.  It also allows fixing drivers which neglect
to release a reference on the spi_controller in the probe error path.

Long-term, most SPI drivers shall be moved over to the devm functions
introduced herein.  The few that can't shall be changed in a treewide
commit to explicitly release the last reference on the controller.
That commit shall amend spi_unregister_controller() to no longer release
a reference, thereby completing the migration.

As a result, the behaviour will be less surprising and more consistent
with subsystems such as IIO, which also includes the private data in the
allocation of the generic iio_dev struct, but calls device_del() in
iio_device_unregister().

Signed-off-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/272bae2ef08abd21388c98e23729886663d19192.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi.c       |   58 +++++++++++++++++++++++++++++++++++++++++++++++-
 include/linux/spi/spi.h |   19 +++++++++++++++
 2 files changed, 76 insertions(+), 1 deletion(-)

--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2257,6 +2257,49 @@ struct spi_controller *__spi_alloc_contr
 }
 EXPORT_SYMBOL_GPL(__spi_alloc_controller);
 
+static void devm_spi_release_controller(struct device *dev, void *ctlr)
+{
+	spi_controller_put(*(struct spi_controller **)ctlr);
+}
+
+/**
+ * __devm_spi_alloc_controller - resource-managed __spi_alloc_controller()
+ * @dev: physical device of SPI controller
+ * @size: how much zeroed driver-private data to allocate
+ * @slave: whether to allocate an SPI master (false) or SPI slave (true)
+ * Context: can sleep
+ *
+ * Allocate an SPI controller and automatically release a reference on it
+ * when @dev is unbound from its driver.  Drivers are thus relieved from
+ * having to call spi_controller_put().
+ *
+ * The arguments to this function are identical to __spi_alloc_controller().
+ *
+ * Return: the SPI controller structure on success, else NULL.
+ */
+struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
+						   unsigned int size,
+						   bool slave)
+{
+	struct spi_controller **ptr, *ctlr;
+
+	ptr = devres_alloc(devm_spi_release_controller, sizeof(*ptr),
+			   GFP_KERNEL);
+	if (!ptr)
+		return NULL;
+
+	ctlr = __spi_alloc_controller(dev, size, slave);
+	if (ctlr) {
+		*ptr = ctlr;
+		devres_add(dev, ptr);
+	} else {
+		devres_free(ptr);
+	}
+
+	return ctlr;
+}
+EXPORT_SYMBOL_GPL(__devm_spi_alloc_controller);
+
 #ifdef CONFIG_OF
 static int of_spi_get_gpio_numbers(struct spi_controller *ctlr)
 {
@@ -2576,6 +2619,11 @@ int devm_spi_register_controller(struct
 }
 EXPORT_SYMBOL_GPL(devm_spi_register_controller);
 
+static int devm_spi_match_controller(struct device *dev, void *res, void *ctlr)
+{
+	return *(struct spi_controller **)res == ctlr;
+}
+
 static int __unregister(struct device *dev, void *null)
 {
 	spi_unregister_device(to_spi_device(dev));
@@ -2617,7 +2665,15 @@ void spi_unregister_controller(struct sp
 	list_del(&ctlr->list);
 	mutex_unlock(&board_lock);
 
-	device_unregister(&ctlr->dev);
+	device_del(&ctlr->dev);
+
+	/* Release the last reference on the controller if its driver
+	 * has not yet been converted to devm_spi_alloc_master/slave().
+	 */
+	if (!devres_find(ctlr->dev.parent, devm_spi_release_controller,
+			 devm_spi_match_controller, ctlr))
+		put_device(&ctlr->dev);
+
 	/* free bus id */
 	mutex_lock(&board_lock);
 	if (found == ctlr)
--- a/include/linux/spi/spi.h
+++ b/include/linux/spi/spi.h
@@ -663,6 +663,25 @@ static inline struct spi_controller *spi
 	return __spi_alloc_controller(host, size, true);
 }
 
+struct spi_controller *__devm_spi_alloc_controller(struct device *dev,
+						   unsigned int size,
+						   bool slave);
+
+static inline struct spi_controller *devm_spi_alloc_master(struct device *dev,
+							   unsigned int size)
+{
+	return __devm_spi_alloc_controller(dev, size, false);
+}
+
+static inline struct spi_controller *devm_spi_alloc_slave(struct device *dev,
+							  unsigned int size)
+{
+	if (!IS_ENABLED(CONFIG_SPI_SLAVE))
+		return NULL;
+
+	return __devm_spi_alloc_controller(dev, size, true);
+}
+
 extern int spi_register_controller(struct spi_controller *ctlr);
 extern int devm_spi_register_controller(struct device *dev,
 					struct spi_controller *ctlr);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 135/158] spi: npcm-fiu: Dont leak SPI master in probe error path
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 134/158] spi: Introduce device-managed SPI controller allocation Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 136/158] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tomer Maimon, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit 04a9cd51d3f3308a98cbc6adc07acb12fbade011 upstream.

If the calls to of_match_device(), of_alias_get_id(),
devm_ioremap_resource(), devm_regmap_init_mmio() or devm_clk_get()
fail on probe of the NPCM FIU SPI driver, the spi_controller struct is
erroneously not freed.

Fix by switching over to the new devm_spi_alloc_master() helper.

Fixes: ace55c411b11 ("spi: npcm-fiu: add NPCM FIU controller driver")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v5.4+: 5e844cc37a5c: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v5.4+
Cc: Tomer Maimon <tmaimon77@gmail.com>
Link: https://lore.kernel.org/r/a420c23a363a3bc9aa684c6e790c32a8af106d17.1605512876.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-npcm-fiu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/spi/spi-npcm-fiu.c
+++ b/drivers/spi/spi-npcm-fiu.c
@@ -680,7 +680,7 @@ static int npcm_fiu_probe(struct platfor
 	int ret;
 	int id;
 
-	ctrl = spi_alloc_master(dev, sizeof(*fiu));
+	ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
 	if (!ctrl)
 		return -ENOMEM;
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 136/158] spi: bcm2835aux: Fix use-after-free on unbind
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 135/158] spi: npcm-fiu: Dont leak SPI master in probe error path Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 137/158] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Mark Brown

From: Lukas Wunner <lukas@wunner.de>

commit e13ee6cc4781edaf8c7321bee19217e3702ed481 upstream.

bcm2835aux_spi_remove() accesses the driver's private data after calling
spi_unregister_master() even though that function releases the last
reference on the spi_master and thereby frees the private data.

Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.

Fixes: b9dd3f6d4172 ("spi: bcm2835aux: Fix controller unregister order")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: <stable@vger.kernel.org> # v4.4+: 123456789abc: spi: Introduce device-managed SPI controller allocation
Cc: <stable@vger.kernel.org> # v4.4+: b9dd3f6d4172: spi: bcm2835aux: Fix controller unregister order
Cc: <stable@vger.kernel.org> # v4.4+
Link: https://lore.kernel.org/r/b290b06357d0c0bdee9cecc539b840a90630f101.1605121038.git.lukas@wunner.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-bcm2835aux.c |   21 +++++++--------------
 1 file changed, 7 insertions(+), 14 deletions(-)

--- a/drivers/spi/spi-bcm2835aux.c
+++ b/drivers/spi/spi-bcm2835aux.c
@@ -494,7 +494,7 @@ static int bcm2835aux_spi_probe(struct p
 	unsigned long clk_hz;
 	int err;
 
-	master = spi_alloc_master(&pdev->dev, sizeof(*bs));
+	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
 	if (!master)
 		return -ENOMEM;
 
@@ -524,29 +524,24 @@ static int bcm2835aux_spi_probe(struct p
 
 	/* the main area */
 	bs->regs = devm_platform_ioremap_resource(pdev, 0);
-	if (IS_ERR(bs->regs)) {
-		err = PTR_ERR(bs->regs);
-		goto out_master_put;
-	}
+	if (IS_ERR(bs->regs))
+		return PTR_ERR(bs->regs);
 
 	bs->clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(bs->clk)) {
-		err = PTR_ERR(bs->clk);
 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
-		goto out_master_put;
+		return PTR_ERR(bs->clk);
 	}
 
 	bs->irq = platform_get_irq(pdev, 0);
-	if (bs->irq <= 0) {
-		err = bs->irq ? bs->irq : -ENODEV;
-		goto out_master_put;
-	}
+	if (bs->irq <= 0)
+		return bs->irq ? bs->irq : -ENODEV;
 
 	/* this also enables the HW block */
 	err = clk_prepare_enable(bs->clk);
 	if (err) {
 		dev_err(&pdev->dev, "could not prepare clock: %d\n", err);
-		goto out_master_put;
+		return err;
 	}
 
 	/* just checking if the clock returns a sane value */
@@ -581,8 +576,6 @@ static int bcm2835aux_spi_probe(struct p
 
 out_clk_disable:
 	clk_disable_unprepare(bs->clk);
-out_master_put:
-	spi_master_put(master);
 	return err;
 }
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 137/158] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200}
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 136/158] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 138/158] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sean Nyekjaer, Mark Brown

From: Sean Nyekjaer <sean@geanix.com>

commit 365ec8b61689bd64d6a61e129e0319bf71336407 upstream.

Limit the fsl,pfuze-support-disable-sw to the pfuze100 and pfuze200
variants.
When enabling fsl,pfuze-support-disable-sw and using a pfuze3000 or
pfuze3001, the driver would choose pfuze100_sw_disable_regulator_ops
instead of the newly introduced and correct pfuze3000_sw_regulator_ops.

Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Fixes: 6f1cf5257acc ("regualtor: pfuze100: correct sw1a/sw2 on pfuze3000")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201110174113.2066534-1-sean@geanix.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/pfuze100-regulator.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -833,11 +833,14 @@ static int pfuze100_regulator_probe(stru
 		 * the switched regulator till yet.
 		 */
 		if (pfuze_chip->flags & PFUZE_FLAG_DISABLE_SW) {
-			if (pfuze_chip->regulator_descs[i].sw_reg) {
-				desc->ops = &pfuze100_sw_disable_regulator_ops;
-				desc->enable_val = 0x8;
-				desc->disable_val = 0x0;
-				desc->enable_time = 500;
+			if (pfuze_chip->chip_id == PFUZE100 ||
+				pfuze_chip->chip_id == PFUZE200) {
+				if (pfuze_chip->regulator_descs[i].sw_reg) {
+					desc->ops = &pfuze100_sw_disable_regulator_ops;
+					desc->enable_val = 0x8;
+					desc->disable_val = 0x0;
+					desc->enable_time = 500;
+				}
 			}
 		}
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 138/158] regulator: fix memory leak with repeated set_machine_constraints()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 137/158] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 139/158] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michał Mirosław,
	Mark Brown, Ahmad Fatoum

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

commit 57a6ad482af256b2a13de14194fb8f67c1a65f10 upstream.

Fixed commit introduced a possible second call to
set_machine_constraints() and that allocates memory for
rdev->constraints. Move the allocation to the caller so
it's easier to manage and done once.

Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/78c3d4016cebc08d441aad18cb924b4e4d9cf9df.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |   29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1275,7 +1275,6 @@ static int _regulator_do_enable(struct r
 /**
  * set_machine_constraints - sets regulator constraints
  * @rdev: regulator source
- * @constraints: constraints to apply
  *
  * Allows platform initialisation code to define and constrain
  * regulator circuits e.g. valid voltage/current ranges, etc.  NOTE:
@@ -1283,21 +1282,11 @@ static int _regulator_do_enable(struct r
  * regulator operations to proceed i.e. set_voltage, set_current_limit,
  * set_mode.
  */
-static int set_machine_constraints(struct regulator_dev *rdev,
-	const struct regulation_constraints *constraints)
+static int set_machine_constraints(struct regulator_dev *rdev)
 {
 	int ret = 0;
 	const struct regulator_ops *ops = rdev->desc->ops;
 
-	if (constraints)
-		rdev->constraints = kmemdup(constraints, sizeof(*constraints),
-					    GFP_KERNEL);
-	else
-		rdev->constraints = kzalloc(sizeof(*constraints),
-					    GFP_KERNEL);
-	if (!rdev->constraints)
-		return -ENOMEM;
-
 	ret = machine_constraints_voltage(rdev, rdev->constraints);
 	if (ret != 0)
 		return ret;
@@ -5014,7 +5003,6 @@ struct regulator_dev *
 regulator_register(const struct regulator_desc *regulator_desc,
 		   const struct regulator_config *cfg)
 {
-	const struct regulation_constraints *constraints = NULL;
 	const struct regulator_init_data *init_data;
 	struct regulator_config *config = NULL;
 	static atomic_t regulator_no = ATOMIC_INIT(-1);
@@ -5153,14 +5141,23 @@ regulator_register(const struct regulato
 
 	/* set regulator constraints */
 	if (init_data)
-		constraints = &init_data->constraints;
+		rdev->constraints = kmemdup(&init_data->constraints,
+					    sizeof(*rdev->constraints),
+					    GFP_KERNEL);
+	else
+		rdev->constraints = kzalloc(sizeof(*rdev->constraints),
+					    GFP_KERNEL);
+	if (!rdev->constraints) {
+		ret = -ENOMEM;
+		goto wash;
+	}
 
 	if (init_data && init_data->supply_regulator)
 		rdev->supply_name = init_data->supply_regulator;
 	else if (regulator_desc->supply_name)
 		rdev->supply_name = regulator_desc->supply_name;
 
-	ret = set_machine_constraints(rdev, constraints);
+	ret = set_machine_constraints(rdev);
 	if (ret == -EPROBE_DEFER) {
 		/* Regulator might be in bypass mode and so needs its supply
 		 * to set the constraints */
@@ -5169,7 +5166,7 @@ regulator_register(const struct regulato
 		 * that is just being created */
 		ret = regulator_resolve_supply(rdev);
 		if (!ret)
-			ret = set_machine_constraints(rdev, constraints);
+			ret = set_machine_constraints(rdev);
 		else
 			rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
 				 ERR_PTR(ret));



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 139/158] regulator: avoid resolve_supply() infinite recursion
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 138/158] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 140/158] regulator: workaround self-referent regulators Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ahmad Fatoum,
	Michał Mirosław, Mark Brown

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

commit 4b639e254d3d4f15ee4ff2b890a447204cfbeea9 upstream.

When a regulator's name equals its supply's name the
regulator_resolve_supply() recurses indefinitely. Add a check
so that debugging the problem is easier. The "fixed" commit
just exposed the problem.

Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/c6171057cfc0896f950c4d8cb82df0f9f1b89ad9.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1800,6 +1800,12 @@ static int regulator_resolve_supply(stru
 		}
 	}
 
+	if (r == rdev) {
+		dev_err(dev, "Supply for %s (%s) resolved to itself\n",
+			rdev->desc->name, rdev->supply_name);
+		return -EINVAL;
+	}
+
 	/*
 	 * If the supply's parent device is not the same as the
 	 * regulator's parent device, then ensure the parent device



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 140/158] regulator: workaround self-referent regulators
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 139/158] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 141/158] xtensa: fix TLBTEMP area placement Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ahmad Fatoum,
	Michał Mirosław, Mark Brown

From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

commit f5c042b23f7429e5c2ac987b01a31c69059a978b upstream.

Workaround regulators whose supply name happens to be the same as its
own name. This fixes boards that used to work before the early supply
resolving was removed. The error message is left in place so that
offending drivers can be detected.

Fixes: aea6cb99703e ("regulator: resolve supply after creating regulator")
Cc: stable@vger.kernel.org
Reported-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Tested-by: Ahmad Fatoum <a.fatoum@pengutronix.de> # stpmic1
Link: https://lore.kernel.org/r/d703acde2a93100c3c7a81059d716c50ad1b1f52.1605226675.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1803,7 +1803,10 @@ static int regulator_resolve_supply(stru
 	if (r == rdev) {
 		dev_err(dev, "Supply for %s (%s) resolved to itself\n",
 			rdev->desc->name, rdev->supply_name);
-		return -EINVAL;
+		if (!have_full_constraints())
+			return -EINVAL;
+		r = dummy_regulator_rdev;
+		get_device(&r->dev);
 	}
 
 	/*



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 141/158] xtensa: fix TLBTEMP area placement
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 140/158] regulator: workaround self-referent regulators Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 142/158] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov

From: Max Filippov <jcmvbkbc@gmail.com>

commit 481535c5b41d191b22775a6873de5ec0e1cdced1 upstream.

fast_second_level_miss handler for the TLBTEMP area has an assumption
that page table directory entry for the TLBTEMP address range is 0. For
it to be true the TLBTEMP area must be aligned to 4MB boundary and not
share its 4MB region with anything that may use a page table. This is
not true currently: TLBTEMP shares space with vmalloc space which
results in the following kinds of runtime errors when
fast_second_level_miss loads page table directory entry for the vmalloc
space instead of fixing up the TLBTEMP area:

 Unable to handle kernel paging request at virtual address c7ff0e00
  pc = d0009275, ra = 90009478
 Oops: sig: 9 [#1] PREEMPT
 CPU: 1 PID: 61 Comm: kworker/u9:2 Not tainted 5.10.0-rc3-next-20201110-00007-g1fe4962fa983-dirty #58
 Workqueue: xprtiod xs_stream_data_receive_workfn
 a00: 90009478 d11e1dc0 c7ff0e00 00000020 c7ff0000 00000001 7f8b8107 00000000
 a08: 900c5992 d11e1d90 d0cc88b8 5506e97c 00000000 5506e97c d06c8074 d11e1d90
 pc: d0009275, ps: 00060310, depc: 00000014, excvaddr: c7ff0e00
 lbeg: d0009275, lend: d0009287 lcount: 00000003, sar: 00000010
 Call Trace:
   xs_stream_data_receive_workfn+0x43c/0x770
   process_one_work+0x1a1/0x324
   worker_thread+0x1cc/0x3c0
   kthread+0x10d/0x124
   ret_from_kernel_thread+0xc/0x18

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/xtensa/mmu.rst      |    9 ++++++---
 arch/xtensa/include/asm/pgtable.h |    2 +-
 2 files changed, 7 insertions(+), 4 deletions(-)

--- a/Documentation/xtensa/mmu.rst
+++ b/Documentation/xtensa/mmu.rst
@@ -82,7 +82,8 @@ Default MMUv2-compatible layout::
   +------------------+
   | VMALLOC area     |  VMALLOC_START            0xc0000000  128MB - 64KB
   +------------------+  VMALLOC_END
-  | Cache aliasing   |  TLBTEMP_BASE_1           0xc7ff0000  DCACHE_WAY_SIZE
+  +------------------+
+  | Cache aliasing   |  TLBTEMP_BASE_1           0xc8000000  DCACHE_WAY_SIZE
   | remap area 1     |
   +------------------+
   | Cache aliasing   |  TLBTEMP_BASE_2                       DCACHE_WAY_SIZE
@@ -124,7 +125,8 @@ Default MMUv2-compatible layout::
   +------------------+
   | VMALLOC area     |  VMALLOC_START            0xa0000000  128MB - 64KB
   +------------------+  VMALLOC_END
-  | Cache aliasing   |  TLBTEMP_BASE_1           0xa7ff0000  DCACHE_WAY_SIZE
+  +------------------+
+  | Cache aliasing   |  TLBTEMP_BASE_1           0xa8000000  DCACHE_WAY_SIZE
   | remap area 1     |
   +------------------+
   | Cache aliasing   |  TLBTEMP_BASE_2                       DCACHE_WAY_SIZE
@@ -167,7 +169,8 @@ Default MMUv2-compatible layout::
   +------------------+
   | VMALLOC area     |  VMALLOC_START            0x90000000  128MB - 64KB
   +------------------+  VMALLOC_END
-  | Cache aliasing   |  TLBTEMP_BASE_1           0x97ff0000  DCACHE_WAY_SIZE
+  +------------------+
+  | Cache aliasing   |  TLBTEMP_BASE_1           0x98000000  DCACHE_WAY_SIZE
   | remap area 1     |
   +------------------+
   | Cache aliasing   |  TLBTEMP_BASE_2                       DCACHE_WAY_SIZE
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -70,7 +70,7 @@
  */
 #define VMALLOC_START		(XCHAL_KSEG_CACHED_VADDR - 0x10000000)
 #define VMALLOC_END		(VMALLOC_START + 0x07FEFFFF)
-#define TLBTEMP_BASE_1		(VMALLOC_END + 1)
+#define TLBTEMP_BASE_1		(VMALLOC_START + 0x08000000)
 #define TLBTEMP_BASE_2		(TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
 #if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
 #define TLBTEMP_SIZE		(2 * DCACHE_WAY_SIZE)



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 142/158] xtensa: disable preemption around cache alias management calls
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 141/158] xtensa: fix TLBTEMP area placement Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 143/158] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov

From: Max Filippov <jcmvbkbc@gmail.com>

commit 3a860d165eb5f4d7cf0bf81ef6a5b5c5e1754422 upstream.

Although cache alias management calls set up and tear down TLB entries
and fast_second_level_miss is able to restore TLB entry should it be
evicted they absolutely cannot preempt each other because they use the
same TLBTEMP area for different purposes.
Disable preemption around all cache alias management calls to enforce
that.

Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/xtensa/mm/cache.c |   14 ++++++++++++++
 1 file changed, 14 insertions(+)

--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -71,8 +71,10 @@ static inline void kmap_invalidate_coher
 			kvaddr = TLBTEMP_BASE_1 +
 				(page_to_phys(page) & DCACHE_ALIAS_MASK);
 
+			preempt_disable();
 			__invalidate_dcache_page_alias(kvaddr,
 						       page_to_phys(page));
+			preempt_enable();
 		}
 	}
 }
@@ -157,6 +159,7 @@ void flush_dcache_page(struct page *page
 		if (!alias && !mapping)
 			return;
 
+		preempt_disable();
 		virt = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(virt, phys);
 
@@ -167,6 +170,7 @@ void flush_dcache_page(struct page *page
 
 		if (mapping)
 			__invalidate_icache_page_alias(virt, phys);
+		preempt_enable();
 	}
 
 	/* There shouldn't be an entry in the cache for this page anymore. */
@@ -200,8 +204,10 @@ void local_flush_cache_page(struct vm_ar
 	unsigned long phys = page_to_phys(pfn_to_page(pfn));
 	unsigned long virt = TLBTEMP_BASE_1 + (address & DCACHE_ALIAS_MASK);
 
+	preempt_disable();
 	__flush_invalidate_dcache_page_alias(virt, phys);
 	__invalidate_icache_page_alias(virt, phys);
+	preempt_enable();
 }
 EXPORT_SYMBOL(local_flush_cache_page);
 
@@ -228,11 +234,13 @@ update_mmu_cache(struct vm_area_struct *
 		unsigned long phys = page_to_phys(page);
 		unsigned long tmp;
 
+		preempt_disable();
 		tmp = TLBTEMP_BASE_1 + (phys & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(tmp, phys);
 		tmp = TLBTEMP_BASE_1 + (addr & DCACHE_ALIAS_MASK);
 		__flush_invalidate_dcache_page_alias(tmp, phys);
 		__invalidate_icache_page_alias(tmp, phys);
+		preempt_enable();
 
 		clear_bit(PG_arch_1, &page->flags);
 	}
@@ -266,7 +274,9 @@ void copy_to_user_page(struct vm_area_st
 
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+		preempt_disable();
 		__flush_invalidate_dcache_page_alias(t, phys);
+		preempt_enable();
 	}
 
 	/* Copy data */
@@ -281,9 +291,11 @@ void copy_to_user_page(struct vm_area_st
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
 
+		preempt_disable();
 		__flush_invalidate_dcache_range((unsigned long) dst, len);
 		if ((vma->vm_flags & VM_EXEC) != 0)
 			__invalidate_icache_page_alias(t, phys);
+		preempt_enable();
 
 	} else if ((vma->vm_flags & VM_EXEC) != 0) {
 		__flush_dcache_range((unsigned long)dst,len);
@@ -305,7 +317,9 @@ extern void copy_from_user_page(struct v
 
 	if (alias) {
 		unsigned long t = TLBTEMP_BASE_1 + (vaddr & DCACHE_ALIAS_MASK);
+		preempt_disable();
 		__flush_invalidate_dcache_page_alias(t, phys);
+		preempt_enable();
 	}
 
 	memcpy(dst, src, len);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 143/158] mac80211: minstrel: remove deferred sampling code
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 142/158] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 144/158] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg

From: Felix Fietkau <nbd@nbd.name>

commit 4fe40b8e1566dad04c87fbf299049a1d0d4bd58d upstream.

Deferring sampling attempts to the second stage has some bad interactions
with drivers that process the rate table in hardware and use the probe flag
to indicate probing packets (e.g. most mt76 drivers). On affected drivers
it can lead to probing not working at all.

If the link conditions turn worse, it might not be such a good idea to
do a lot of sampling for lower rates in this case.

Fix this by simply skipping the sample attempt instead of deferring it,
but keep the checks that would allow it to be sampled if it was skipped
too often, but only if it has less than 95% success probability.

Also ensure that IEEE80211_TX_CTL_RATE_CTRL_PROBE is set for all probing
packets.

Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-2-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/rc80211_minstrel.c |   25 ++++---------------------
 net/mac80211/rc80211_minstrel.h |    1 -
 2 files changed, 4 insertions(+), 22 deletions(-)

--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -283,12 +283,6 @@ minstrel_tx_status(void *priv, struct ie
 			mi->r[ndx].stats.success += success;
 	}
 
-	if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && (i >= 0))
-		mi->sample_packets++;
-
-	if (mi->sample_deferred > 0)
-		mi->sample_deferred--;
-
 	if (time_after(jiffies, mi->last_stats_update +
 				(mp->update_interval * HZ) / 1000))
 		minstrel_update_stats(mp, mi);
@@ -363,7 +357,7 @@ minstrel_get_rate(void *priv, struct iee
 		return;
 
 	delta = (mi->total_packets * sampling_ratio / 100) -
-			(mi->sample_packets + mi->sample_deferred / 2);
+			mi->sample_packets;
 
 	/* delta < 0: no sampling required */
 	prev_sample = mi->prev_sample;
@@ -372,7 +366,6 @@ minstrel_get_rate(void *priv, struct iee
 		return;
 
 	if (mi->total_packets >= 10000) {
-		mi->sample_deferred = 0;
 		mi->sample_packets = 0;
 		mi->total_packets = 0;
 	} else if (delta > mi->n_rates * 2) {
@@ -397,19 +390,8 @@ minstrel_get_rate(void *priv, struct iee
 	 * rate sampling method should be used.
 	 * Respect such rates that are not sampled for 20 interations.
 	 */
-	if (mrr_capable &&
-	    msr->perfect_tx_time > mr->perfect_tx_time &&
-	    msr->stats.sample_skipped < 20) {
-		/* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
-		 * packets that have the sampling rate deferred to the
-		 * second MRR stage. Increase the sample counter only
-		 * if the deferred sample rate was actually used.
-		 * Use the sample_deferred counter to make sure that
-		 * the sampling is not done in large bursts */
-		info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
-		rate++;
-		mi->sample_deferred++;
-	} else {
+	if (msr->perfect_tx_time < mr->perfect_tx_time ||
+	    msr->stats.sample_skipped >= 20) {
 		if (!msr->sample_limit)
 			return;
 
@@ -429,6 +411,7 @@ minstrel_get_rate(void *priv, struct iee
 
 	rate->idx = mi->r[ndx].rix;
 	rate->count = minstrel_get_retry_count(&mi->r[ndx], info);
+	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
 }
 
 
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -79,7 +79,6 @@ struct minstrel_sta_info {
 	u8 max_prob_rate;
 	unsigned int total_packets;
 	unsigned int sample_packets;
-	int sample_deferred;
 
 	unsigned int sample_row;
 	unsigned int sample_column;



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 144/158] mac80211: minstrel: fix tx status processing corner case
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 143/158] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 145/158] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Johannes Berg

From: Felix Fietkau <nbd@nbd.name>

commit b2911a84396f72149dce310a3b64d8948212c1b3 upstream.

Some drivers fill the status rate list without setting the rate index after
the final rate to -1. minstrel_ht already deals with this, but minstrel
doesn't, which causes it to get stuck at the lowest rate on these drivers.

Fix this by checking the count as well.

Cc: stable@vger.kernel.org
Fixes: cccf129f820e ("mac80211: add the 'minstrel' rate control algorithm")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Link: https://lore.kernel.org/r/20201111183359.43528-3-nbd@nbd.name
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/rc80211_minstrel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -270,7 +270,7 @@ minstrel_tx_status(void *priv, struct ie
 	success = !!(info->flags & IEEE80211_TX_STAT_ACK);
 
 	for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
-		if (ar[i].idx < 0)
+		if (ar[i].idx < 0 || !ar[i].count)
 			break;
 
 		ndx = rix_to_ndx(mi, ar[i].idx);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 145/158] mac80211: free sta in sta_info_insert_finish() on errors
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 144/158] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 146/158] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, syzbot+32c6c38c4812d22f2f0b,
	syzbot+4c81fe92e372d26c4246, syzbot+6a7fe9faf0d1d61bc24a,
	syzbot+abed06851c5ffe010921, syzbot+b7aeb9318541a1c709f1,
	syzbot+d5a9416c6cafe53b5dd0, Johannes Berg

From: Johannes Berg <johannes.berg@intel.com>

commit 7bc40aedf24d31d8bea80e1161e996ef4299fb10 upstream.

If sta_info_insert_finish() fails, we currently keep the station
around and free it only in the caller, but there's only one such
caller and it always frees it immediately.

As syzbot found, another consequence of this split is that we can
put things that sleep only into __cleanup_single_sta() and not in
sta_info_free(), but this is the only place that requires such of
sta_info_free() now.

Change this to free the station in sta_info_insert_finish(), in
which case we can still sleep. This will also let us unify the
cleanup code later.

Cc: stable@vger.kernel.org
Fixes: dcd479e10a05 ("mac80211: always wind down STA state")
Reported-by: syzbot+32c6c38c4812d22f2f0b@syzkaller.appspotmail.com
Reported-by: syzbot+4c81fe92e372d26c4246@syzkaller.appspotmail.com
Reported-by: syzbot+6a7fe9faf0d1d61bc24a@syzkaller.appspotmail.com
Reported-by: syzbot+abed06851c5ffe010921@syzkaller.appspotmail.com
Reported-by: syzbot+b7aeb9318541a1c709f1@syzkaller.appspotmail.com
Reported-by: syzbot+d5a9416c6cafe53b5dd0@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20201112112201.ee6b397b9453.I9c31d667a0ea2151441cc64ed6613d36c18a48e0@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/sta_info.c |   14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -688,7 +688,7 @@ static int sta_info_insert_finish(struct
  out_drop_sta:
 	local->num_sta--;
 	synchronize_net();
-	__cleanup_single_sta(sta);
+	cleanup_single_sta(sta);
  out_err:
 	mutex_unlock(&local->sta_mtx);
 	kfree(sinfo);
@@ -707,19 +707,13 @@ int sta_info_insert_rcu(struct sta_info
 
 	err = sta_info_insert_check(sta);
 	if (err) {
+		sta_info_free(local, sta);
 		mutex_unlock(&local->sta_mtx);
 		rcu_read_lock();
-		goto out_free;
+		return err;
 	}
 
-	err = sta_info_insert_finish(sta);
-	if (err)
-		goto out_free;
-
-	return 0;
- out_free:
-	sta_info_free(local, sta);
-	return err;
+	return sta_info_insert_finish(sta);
 }
 
 int sta_info_insert(struct sta_info *sta)



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 146/158] s390/cpum_sf.c: fix file permission for cpum_sfb_size
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 145/158] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 147/158] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Richter, Sumanth Korikkar,
	Heiko Carstens

From: Thomas Richter <tmricht@linux.ibm.com>

commit 78d732e1f326f74f240d416af9484928303d9951 upstream.

This file is installed by the s390 CPU Measurement sampling
facility device driver to export supported minimum and
maximum sample buffer sizes.
This file is read by lscpumf tool to display the details
of the device driver capabilities. The lscpumf tool might
be invoked by a non-root user. In this case it does not
print anything because the file contents can not be read.

Fix this by allowing read access for all users. Reading
the file contents is ok, changing the file contents is
left to the root user only.

For further reference and details see:
 [1] https://github.com/ibm-s390-tools/s390-tools/issues/97

Fixes: 69f239ed335a ("s390/cpum_sf: Dynamically extend the sampling buffer if overflows occur")
Cc: <stable@vger.kernel.org> # 3.14
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Sumanth Korikkar <sumanthk@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/kernel/perf_cpum_sf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -2217,4 +2217,4 @@ out:
 }
 
 arch_initcall(init_cpum_sampling_pmu);
-core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640);
+core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0644);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 147/158] s390/dasd: fix null pointer dereference for ERP requests
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 146/158] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 148/158] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Haberland, Jan Hoeppner, Jens Axboe

From: Stefan Haberland <sth@linux.ibm.com>

commit 6f117cb854a44a79898d844e6ae3fd23bd94e786 upstream.

When requeueing all requests on the device request queue to the blocklayer
we might get to an ERP (error recovery) request that is a copy of an
original CQR.

Those requests do not have blocklayer request information or a pointer to
the dasd_queue set. When trying to access those data it will lead to a
null pointer dereference in dasd_requeue_all_requests().

Fix by checking if the request is an ERP request that can simply be
ignored. The blocklayer request will be requeued by the original CQR that
is on the device queue right behind the ERP request.

Fixes: 9487cfd3430d ("s390/dasd: fix handling of internal requests")
Cc: <stable@vger.kernel.org> #4.16
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/block/dasd.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2980,6 +2980,12 @@ static int _dasd_requeue_request(struct
 
 	if (!block)
 		return -EINVAL;
+	/*
+	 * If the request is an ERP request there is nothing to requeue.
+	 * This will be done with the remaining original request.
+	 */
+	if (cqr->refers)
+		return 0;
 	spin_lock_irq(&cqr->dq->lock);
 	req = (struct request *) cqr->callback_data;
 	blk_mq_requeue_request(req, false);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 148/158] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 147/158] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 149/158] drm/amd/display: Add missing pflip irq for dcn2.0 Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chris Co, Andrea Parri (Microsoft), Wei Liu

From: Chris Co <chrco@microsoft.com>

commit 92e4dc8b05663d6539b1b8375f3b1cf7b204cfe9 upstream.

When invoking kexec() on a Linux guest running on a Hyper-V host, the
kernel panics.

    RIP: 0010:cpuhp_issue_call+0x137/0x140
    Call Trace:
    __cpuhp_remove_state_cpuslocked+0x99/0x100
    __cpuhp_remove_state+0x1c/0x30
    hv_kexec_handler+0x23/0x30 [hv_vmbus]
    hv_machine_shutdown+0x1e/0x30
    machine_shutdown+0x10/0x20
    kernel_kexec+0x6d/0x96
    __do_sys_reboot+0x1ef/0x230
    __x64_sys_reboot+0x1d/0x20
    do_syscall_64+0x6b/0x3d8
    entry_SYSCALL_64_after_hwframe+0x44/0xa9

This was due to hv_synic_cleanup() callback returning -EBUSY to
cpuhp_issue_call() when tearing down the VMBUS_CONNECT_CPU, even
if the vmbus_connection.conn_state = DISCONNECTED. hv_synic_cleanup()
should succeed in the case where vmbus_connection.conn_state
is DISCONNECTED.

Fix is to add an extra condition to test for
vmbus_connection.conn_state == CONNECTED on the VMBUS_CONNECT_CPU and
only return early if true. This way the kexec() path can still shut
everything down while preserving the initial behavior of preventing
CPU offlining on the VMBUS_CONNECT_CPU while the VM is running.

Fixes: 8a857c55420f29 ("Drivers: hv: vmbus: Always handle the VMBus messages on CPU0")
Signed-off-by: Chris Co <chrco@microsoft.com>
Reviewed-by: Andrea Parri (Microsoft) <parri.andrea@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201110190118.15596-1-chrco@linux.microsoft.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hv/hv.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -251,9 +251,13 @@ int hv_synic_cleanup(unsigned int cpu)
 
 	/*
 	 * Hyper-V does not provide a way to change the connect CPU once
-	 * it is set; we must prevent the connect CPU from going offline.
+	 * it is set; we must prevent the connect CPU from going offline
+	 * while the VM is running normally. But in the panic or kexec()
+	 * path where the vmbus is already disconnected, the CPU must be
+	 * allowed to shut down.
 	 */
-	if (cpu == VMBUS_CONNECT_CPU)
+	if (cpu == VMBUS_CONNECT_CPU &&
+	    vmbus_connection.conn_state == CONNECTED)
 		return -EBUSY;
 
 	/*



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 149/158] drm/amd/display: Add missing pflip irq for dcn2.0
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 148/158] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 150/158] drm/i915: Handle max_bpc==16 Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicholas Kazlauskas, Alex Deucher

From: Alex Deucher <alexander.deucher@amd.com>

commit 728321e53045d2668bf2b8627a8d61bc2c480d3b upstream.

If we have more than 4 displays we will run
into dummy irq calls or flip timout issues.

Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/amd/display/dc/irq/dcn20/irq_service_dcn20.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/amd/display/dc/irq/dcn20/irq_service_dcn20.c
+++ b/drivers/gpu/drm/amd/display/dc/irq/dcn20/irq_service_dcn20.c
@@ -299,8 +299,8 @@ irq_source_info_dcn20[DAL_IRQ_SOURCES_NU
 	pflip_int_entry(1),
 	pflip_int_entry(2),
 	pflip_int_entry(3),
-	[DC_IRQ_SOURCE_PFLIP5] = dummy_irq_entry(),
-	[DC_IRQ_SOURCE_PFLIP6] = dummy_irq_entry(),
+	pflip_int_entry(4),
+	pflip_int_entry(5),
 	[DC_IRQ_SOURCE_PFLIP_UNDERLAY0] = dummy_irq_entry(),
 	gpio_pad_int_entry(0),
 	gpio_pad_int_entry(1),



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 150/158] drm/i915: Handle max_bpc==16
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 149/158] drm/amd/display: Add missing pflip irq for dcn2.0 Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:22 ` [PATCH 5.4 151/158] mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ville Syrjälä,
	José Roberto de Souza, Rodrigo Vivi

From: Ville Syrjälä <ville.syrjala@linux.intel.com>

commit d2e3fce9ddafe689c6f7cb355f23560637e30b9d upstream.

EDID can declare the maximum supported bpc up to 16,
and apparently there are displays that do so. Currently
we assume 12 bpc is tha max. Fix the assumption and
toss in a MISSING_CASE() for any other value we don't
expect to see.

This fixes modesets with a display with EDID max bpc > 12.
Previously any modeset would just silently fail on platforms
that didn't otherwise limit this via the max_bpc property.
In particular we don't add the max_bpc property to HDMI
ports on gmch platforms, and thus we would see the raw
max_bpc coming from the EDID.

I suppose we could already adjust this to also allow 16bpc,
but seeing as no current platform supports that there is
little point.

Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2632
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20201110210447.27454-1-ville.syrjala@linux.intel.com
Reviewed-by: José Roberto de Souza <jose.souza@intel.com>
(cherry picked from commit 2ca5a7b85b0c2b97ef08afbd7799b022e29f192e)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/display/intel_display.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -11893,10 +11893,11 @@ compute_sink_pipe_bpp(const struct drm_c
 	case 10 ... 11:
 		bpp = 10 * 3;
 		break;
-	case 12:
+	case 12 ... 16:
 		bpp = 12 * 3;
 		break;
 	default:
+		MISSING_CASE(conn_state->max_bpc);
 		return -EINVAL;
 	}
 



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 151/158] mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 150/158] drm/i915: Handle max_bpc==16 Greg Kroah-Hartman
@ 2020-11-23 12:22 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 152/158] ptrace: Set PF_SUPERPRIV when checking capability Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:22 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Adrian Hunter, Ulf Hansson

From: Adrian Hunter <adrian.hunter@intel.com>

commit 60d53566100abde4acc5504b524bc97f89015690 upstream.

A UHS setting of SDR25 can give better results for High Speed mode.
This is because there is no setting corresponding to high speed.  Currently
SDHCI sets no value, which means zero which is also the setting for SDR12.
There was an attempt to change this in sdhci.c but it caused problems for
some drivers, so it was reverted and the change was made to sdhci-brcmstb
in commit 2fefc7c5f7d16e ("mmc: sdhci-brcmstb: Fix incorrect switch to HS
mode").  Several other drivers also do this.

Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org # v5.4+
Link: https://lore.kernel.org/r/20201112133656.20317-1-adrian.hunter@intel.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci-pci-core.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -669,6 +669,15 @@ static void sdhci_intel_set_power(struct
 	}
 }
 
+static void sdhci_intel_set_uhs_signaling(struct sdhci_host *host,
+					  unsigned int timing)
+{
+	/* Set UHS timing to SDR25 for High Speed mode */
+	if (timing == MMC_TIMING_MMC_HS || timing == MMC_TIMING_SD_HS)
+		timing = MMC_TIMING_UHS_SDR25;
+	sdhci_set_uhs_signaling(host, timing);
+}
+
 #define INTEL_HS400_ES_REG 0x78
 #define INTEL_HS400_ES_BIT BIT(0)
 
@@ -725,7 +734,7 @@ static const struct sdhci_ops sdhci_inte
 	.enable_dma		= sdhci_pci_enable_dma,
 	.set_bus_width		= sdhci_set_bus_width,
 	.reset			= sdhci_reset,
-	.set_uhs_signaling	= sdhci_set_uhs_signaling,
+	.set_uhs_signaling	= sdhci_intel_set_uhs_signaling,
 	.hw_reset		= sdhci_pci_hw_reset,
 };
 
@@ -735,7 +744,7 @@ static const struct sdhci_ops sdhci_inte
 	.enable_dma		= sdhci_pci_enable_dma,
 	.set_bus_width		= sdhci_set_bus_width,
 	.reset			= sdhci_cqhci_reset,
-	.set_uhs_signaling	= sdhci_set_uhs_signaling,
+	.set_uhs_signaling	= sdhci_intel_set_uhs_signaling,
 	.hw_reset		= sdhci_pci_hw_reset,
 	.irq			= sdhci_cqhci_irq,
 };



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 152/158] ptrace: Set PF_SUPERPRIV when checking capability
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-11-23 12:22 ` [PATCH 5.4 151/158] mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 153/158] seccomp: " Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Brauner, Eric Paris,
	Jann Horn, Kees Cook, Oleg Nesterov, Serge E. Hallyn,
	Tyler Hicks, Mickaël Salaün

From: Mickaël Salaün <mic@linux.microsoft.com>

commit cf23705244c947151179f929774fabf71e239eee upstream.

Commit 69f594a38967 ("ptrace: do not audit capability check when outputing
/proc/pid/stat") replaced the use of ns_capable() with
has_ns_capability{,_noaudit}() which doesn't set PF_SUPERPRIV.

Commit 6b3ad6649a4c ("ptrace: reintroduce usage of subjective credentials in
ptrace_has_cap()") replaced has_ns_capability{,_noaudit}() with
security_capable(), which doesn't set PF_SUPERPRIV neither.

Since commit 98f368e9e263 ("kernel: Add noaudit variant of ns_capable()"), a
new ns_capable_noaudit() helper is available.  Let's use it!

As a result, the signature of ptrace_has_cap() is restored to its original one.

Cc: Christian Brauner <christian.brauner@ubuntu.com>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Serge E. Hallyn <serge@hallyn.com>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: stable@vger.kernel.org
Fixes: 6b3ad6649a4c ("ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()")
Fixes: 69f594a38967 ("ptrace: do not audit capability check when outputing /proc/pid/stat")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-2-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/ptrace.c |   16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -264,17 +264,11 @@ static int ptrace_check_attach(struct ta
 	return ret;
 }
 
-static bool ptrace_has_cap(const struct cred *cred, struct user_namespace *ns,
-			   unsigned int mode)
+static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
 {
-	int ret;
-
 	if (mode & PTRACE_MODE_NOAUDIT)
-		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NOAUDIT);
-	else
-		ret = security_capable(cred, ns, CAP_SYS_PTRACE, CAP_OPT_NONE);
-
-	return ret == 0;
+		return ns_capable_noaudit(ns, CAP_SYS_PTRACE);
+	return ns_capable(ns, CAP_SYS_PTRACE);
 }
 
 /* Returns 0 on success, -errno on denial. */
@@ -326,7 +320,7 @@ static int __ptrace_may_access(struct ta
 	    gid_eq(caller_gid, tcred->sgid) &&
 	    gid_eq(caller_gid, tcred->gid))
 		goto ok;
-	if (ptrace_has_cap(cred, tcred->user_ns, mode))
+	if (ptrace_has_cap(tcred->user_ns, mode))
 		goto ok;
 	rcu_read_unlock();
 	return -EPERM;
@@ -345,7 +339,7 @@ ok:
 	mm = task->mm;
 	if (mm &&
 	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
-	     !ptrace_has_cap(cred, mm->user_ns, mode)))
+	     !ptrace_has_cap(mm->user_ns, mode)))
 	    return -EPERM;
 
 	return security_ptrace_access_check(task, mode);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 153/158] seccomp: Set PF_SUPERPRIV when checking capability
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 152/158] ptrace: Set PF_SUPERPRIV when checking capability Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 154/158] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jann Horn, Kees Cook, Tyler Hicks,
	Will Drewry, Mickaël Salaün

From: Mickaël Salaün <mic@linux.microsoft.com>

commit fb14528e443646dd3fd02df4437fcf5265b66baa upstream.

Replace the use of security_capable(current_cred(), ...) with
ns_capable_noaudit() which set PF_SUPERPRIV.

Since commit 98f368e9e263 ("kernel: Add noaudit variant of
ns_capable()"), a new ns_capable_noaudit() helper is available.  Let's
use it!

Cc: Jann Horn <jannh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: Will Drewry <wad@chromium.org>
Cc: stable@vger.kernel.org
Fixes: e2cfabdfd075 ("seccomp: add system call filtering using BPF")
Signed-off-by: Mickaël Salaün <mic@linux.microsoft.com>
Reviewed-by: Jann Horn <jannh@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201030123849.770769-3-mic@digikod.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/seccomp.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -37,7 +37,7 @@
 #include <linux/filter.h>
 #include <linux/pid.h>
 #include <linux/ptrace.h>
-#include <linux/security.h>
+#include <linux/capability.h>
 #include <linux/tracehook.h>
 #include <linux/uaccess.h>
 #include <linux/anon_inodes.h>
@@ -453,8 +453,7 @@ static struct seccomp_filter *seccomp_pr
 	 * behavior of privileged children.
 	 */
 	if (!task_no_new_privs(current) &&
-	    security_capable(current_cred(), current_user_ns(),
-				     CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) != 0)
+			!ns_capable_noaudit(current_user_ns(), CAP_SYS_ADMIN))
 		return ERR_PTR(-EACCES);
 
 	/* Allocate a new seccomp_filter */



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 154/158] x86/microcode/intel: Check patch signature before saving microcode for early loading
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 153/158] seccomp: " Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 155/158] mm: memcg/slab: fix root memcg vmstats Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chen Yu, Borislav Petkov

From: Chen Yu <yu.c.chen@intel.com>

commit 1a371e67dc77125736cc56d3a0893f06b75855b6 upstream.

Currently, scan_microcode() leverages microcode_matches() to check
if the microcode matches the CPU by comparing the family and model.
However, the processor stepping and flags of the microcode signature
should also be considered when saving a microcode patch for early
update.

Use find_matching_signature() in scan_microcode() and get rid of the
now-unused microcode_matches() which is a good cleanup in itself.

Complete the verification of the patch being saved for early loading in
save_microcode_patch() directly. This needs to be done there too because
save_mc_for_early() will call save_microcode_patch() too.

The second reason why this needs to be done is because the loader still
tries to support, at least hypothetically, mixed-steppings systems and
thus adds all patches to the cache that belong to the same CPU model
albeit with different steppings.

For example:

  microcode: CPU: sig=0x906ec, pf=0x2, rev=0xd6
  microcode: mc_saved[0]: sig=0x906e9, pf=0x2a, rev=0xd6, total size=0x19400, date = 2020-04-23
  microcode: mc_saved[1]: sig=0x906ea, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
  microcode: mc_saved[2]: sig=0x906eb, pf=0x2, rev=0xd6, total size=0x19400, date = 2020-04-23
  microcode: mc_saved[3]: sig=0x906ec, pf=0x22, rev=0xd6, total size=0x19000, date = 2020-04-27
  microcode: mc_saved[4]: sig=0x906ed, pf=0x22, rev=0xd6, total size=0x19400, date = 2020-04-23

The patch which is being saved for early loading, however, can only be
the one which fits the CPU this runs on so do the signature verification
before saving.

 [ bp: Do signature verification in save_microcode_patch()
       and rewrite commit message. ]

Fixes: ec400ddeff20 ("x86/microcode_intel_early.c: Early update ucode on Intel's CPU")
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=208535
Link: https://lkml.kernel.org/r/20201113015923.13960-1-yu.c.chen@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/microcode/intel.c |   63 +++++-----------------------------
 1 file changed, 10 insertions(+), 53 deletions(-)

--- a/arch/x86/kernel/cpu/microcode/intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
@@ -100,53 +100,6 @@ static int has_newer_microcode(void *mc,
 	return find_matching_signature(mc, csig, cpf);
 }
 
-/*
- * Given CPU signature and a microcode patch, this function finds if the
- * microcode patch has matching family and model with the CPU.
- *
- * %true - if there's a match
- * %false - otherwise
- */
-static bool microcode_matches(struct microcode_header_intel *mc_header,
-			      unsigned long sig)
-{
-	unsigned long total_size = get_totalsize(mc_header);
-	unsigned long data_size = get_datasize(mc_header);
-	struct extended_sigtable *ext_header;
-	unsigned int fam_ucode, model_ucode;
-	struct extended_signature *ext_sig;
-	unsigned int fam, model;
-	int ext_sigcount, i;
-
-	fam   = x86_family(sig);
-	model = x86_model(sig);
-
-	fam_ucode   = x86_family(mc_header->sig);
-	model_ucode = x86_model(mc_header->sig);
-
-	if (fam == fam_ucode && model == model_ucode)
-		return true;
-
-	/* Look for ext. headers: */
-	if (total_size <= data_size + MC_HEADER_SIZE)
-		return false;
-
-	ext_header   = (void *) mc_header + data_size + MC_HEADER_SIZE;
-	ext_sig      = (void *)ext_header + EXT_HEADER_SIZE;
-	ext_sigcount = ext_header->count;
-
-	for (i = 0; i < ext_sigcount; i++) {
-		fam_ucode   = x86_family(ext_sig->sig);
-		model_ucode = x86_model(ext_sig->sig);
-
-		if (fam == fam_ucode && model == model_ucode)
-			return true;
-
-		ext_sig++;
-	}
-	return false;
-}
-
 static struct ucode_patch *memdup_patch(void *data, unsigned int size)
 {
 	struct ucode_patch *p;
@@ -164,7 +117,7 @@ static struct ucode_patch *memdup_patch(
 	return p;
 }
 
-static void save_microcode_patch(void *data, unsigned int size)
+static void save_microcode_patch(struct ucode_cpu_info *uci, void *data, unsigned int size)
 {
 	struct microcode_header_intel *mc_hdr, *mc_saved_hdr;
 	struct ucode_patch *iter, *tmp, *p = NULL;
@@ -210,6 +163,9 @@ static void save_microcode_patch(void *d
 	if (!p)
 		return;
 
+	if (!find_matching_signature(p->data, uci->cpu_sig.sig, uci->cpu_sig.pf))
+		return;
+
 	/*
 	 * Save for early loading. On 32-bit, that needs to be a physical
 	 * address as the APs are running from physical addresses, before
@@ -344,13 +300,14 @@ scan_microcode(void *data, size_t size,
 
 		size -= mc_size;
 
-		if (!microcode_matches(mc_header, uci->cpu_sig.sig)) {
+		if (!find_matching_signature(data, uci->cpu_sig.sig,
+					     uci->cpu_sig.pf)) {
 			data += mc_size;
 			continue;
 		}
 
 		if (save) {
-			save_microcode_patch(data, mc_size);
+			save_microcode_patch(uci, data, mc_size);
 			goto next;
 		}
 
@@ -483,14 +440,14 @@ static void show_saved_mc(void)
  * Save this microcode patch. It will be loaded early when a CPU is
  * hot-added or resumes.
  */
-static void save_mc_for_early(u8 *mc, unsigned int size)
+static void save_mc_for_early(struct ucode_cpu_info *uci, u8 *mc, unsigned int size)
 {
 	/* Synchronization during CPU hotplug. */
 	static DEFINE_MUTEX(x86_cpu_microcode_mutex);
 
 	mutex_lock(&x86_cpu_microcode_mutex);
 
-	save_microcode_patch(mc, size);
+	save_microcode_patch(uci, mc, size);
 	show_saved_mc();
 
 	mutex_unlock(&x86_cpu_microcode_mutex);
@@ -934,7 +891,7 @@ static enum ucode_state generic_load_mic
 	 * permanent memory. So it will be loaded early when a CPU is hot added
 	 * or resumes.
 	 */
-	save_mc_for_early(new_mc, new_mc_size);
+	save_mc_for_early(uci, new_mc, new_mc_size);
 
 	pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n",
 		 cpu, new_rev, uci->cpu_sig.rev);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 155/158] mm: memcg/slab: fix root memcg vmstats
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 154/158] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 156/158] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Muchun Song, Andrew Morton,
	Shakeel Butt, Roman Gushchin, Johannes Weiner, David Rientjes,
	Michal Hocko, Vladimir Davydov, Christopher Lameter,
	Pekka Enberg, Joonsoo Kim, Vlastimil Babka, Yafang Shao,
	Chris Down, Linus Torvalds

From: Muchun Song <songmuchun@bytedance.com>

commit 8faeb1ffd79593c9cd8a2a80ecdda371e3b826cb upstream.

If we reparent the slab objects to the root memcg, when we free the slab
object, we need to update the per-memcg vmstats to keep it correct for
the root memcg.  Now this at least affects the vmstat of
NR_KERNEL_STACK_KB for !CONFIG_VMAP_STACK when the thread stack size is
smaller than the PAGE_SIZE.

David said:
 "I assume that without this fix that the root memcg's vmstat would
  always be inflated if we reparented"

Fixes: ec9f02384f60 ("mm: workingset: fix vmstat counters for shadow nodes")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Christopher Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Roman Gushchin <guro@fb.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Yafang Shao <laoar.shao@gmail.com>
Cc: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>	[5.3+]
Link: https://lkml.kernel.org/r/20201110031015.15715-1-songmuchun@bytedance.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/memcontrol.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -776,8 +776,13 @@ void __mod_lruvec_slab_state(void *p, en
 	rcu_read_lock();
 	memcg = memcg_from_slab_page(page);
 
-	/* Untracked pages have no memcg, no lruvec. Update only the node */
-	if (!memcg || memcg == root_mem_cgroup) {
+	/*
+	 * Untracked pages have no memcg, no lruvec. Update only the
+	 * node. If we reparent the slab objects to the root memcg,
+	 * when we free the slab object, we need to update the per-memcg
+	 * vmstats to keep it correct for the root memcg.
+	 */
+	if (!memcg) {
 		__mod_node_page_state(pgdat, idx, val);
 	} else {
 		lruvec = mem_cgroup_lruvec(pgdat, memcg);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 156/158] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 155/158] mm: memcg/slab: fix root memcg vmstats Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 157/158] mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Egorenkov, Gerald Schaefer,
	Andrew Morton, Andrea Arcangeli, Heiko Carstens, Linus Torvalds

From: Gerald Schaefer <gerald.schaefer@linux.ibm.com>

commit bfe8cc1db02ab243c62780f17fc57f65bde0afe1 upstream.

Alexander reported a syzkaller / KASAN finding on s390, see below for
complete output.

In do_huge_pmd_anonymous_page(), the pre-allocated pagetable will be
freed in some cases.  In the case of userfaultfd_missing(), this will
happen after calling handle_userfault(), which might have released the
mmap_lock.  Therefore, the following pte_free(vma->vm_mm, pgtable) will
access an unstable vma->vm_mm, which could have been freed or re-used
already.

For all architectures other than s390 this will go w/o any negative
impact, because pte_free() simply frees the page and ignores the
passed-in mm.  The implementation for SPARC32 would also access
mm->page_table_lock for pte_free(), but there is no THP support in
SPARC32, so the buggy code path will not be used there.

For s390, the mm->context.pgtable_list is being used to maintain the 2K
pagetable fragments, and operating on an already freed or even re-used
mm could result in various more or less subtle bugs due to list /
pagetable corruption.

Fix this by calling pte_free() before handle_userfault(), similar to how
it is already done in __do_huge_pmd_anonymous_page() for the WRITE /
non-huge_zero_page case.

Commit 6b251fc96cf2c ("userfaultfd: call handle_userfault() for
userfaultfd_missing() faults") actually introduced both, the
do_huge_pmd_anonymous_page() and also __do_huge_pmd_anonymous_page()
changes wrt to calling handle_userfault(), but only in the latter case
it put the pte_free() before calling handle_userfault().

  BUG: KASAN: use-after-free in do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
  Read of size 8 at addr 00000000962d6988 by task syz-executor.0/9334

  CPU: 1 PID: 9334 Comm: syz-executor.0 Not tainted 5.10.0-rc1-syzkaller-07083-g4c9720875573 #0
  Hardware name: IBM 3906 M04 701 (KVM/Linux)
  Call Trace:
    do_huge_pmd_anonymous_page+0xcda/0xd90 mm/huge_memory.c:744
    create_huge_pmd mm/memory.c:4256 [inline]
    __handle_mm_fault+0xe6e/0x1068 mm/memory.c:4480
    handle_mm_fault+0x288/0x748 mm/memory.c:4607
    do_exception+0x394/0xae0 arch/s390/mm/fault.c:479
    do_dat_exception+0x34/0x80 arch/s390/mm/fault.c:567
    pgm_check_handler+0x1da/0x22c arch/s390/kernel/entry.S:706
    copy_from_user_mvcos arch/s390/lib/uaccess.c:111 [inline]
    raw_copy_from_user+0x3a/0x88 arch/s390/lib/uaccess.c:174
    _copy_from_user+0x48/0xa8 lib/usercopy.c:16
    copy_from_user include/linux/uaccess.h:192 [inline]
    __do_sys_sigaltstack kernel/signal.c:4064 [inline]
    __s390x_sys_sigaltstack+0xc8/0x240 kernel/signal.c:4060
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Allocated by task 9334:
    slab_alloc_node mm/slub.c:2891 [inline]
    slab_alloc mm/slub.c:2899 [inline]
    kmem_cache_alloc+0x118/0x348 mm/slub.c:2904
    vm_area_dup+0x9c/0x2b8 kernel/fork.c:356
    __split_vma+0xba/0x560 mm/mmap.c:2742
    split_vma+0xca/0x108 mm/mmap.c:2800
    mlock_fixup+0x4ae/0x600 mm/mlock.c:550
    apply_vma_lock_flags+0x2c6/0x398 mm/mlock.c:619
    do_mlock+0x1aa/0x718 mm/mlock.c:711
    __do_sys_mlock2 mm/mlock.c:738 [inline]
    __s390x_sys_mlock2+0x86/0xa8 mm/mlock.c:728
    system_call+0xe0/0x28c arch/s390/kernel/entry.S:415

  Freed by task 9333:
    slab_free mm/slub.c:3142 [inline]
    kmem_cache_free+0x7c/0x4b8 mm/slub.c:3158
    __vma_adjust+0x7b2/0x2508 mm/mmap.c:960
    vma_merge+0x87e/0xce0 mm/mmap.c:1209
    userfaultfd_release+0x412/0x6b8 fs/userfaultfd.c:868
    __fput+0x22c/0x7a8 fs/file_table.c:281
    task_work_run+0x200/0x320 kernel/task_work.c:151
    tracehook_notify_resume include/linux/tracehook.h:188 [inline]
    do_notify_resume+0x100/0x148 arch/s390/kernel/signal.c:538
    system_call+0xe6/0x28c arch/s390/kernel/entry.S:416

  The buggy address belongs to the object at 00000000962d6948 which belongs to the cache vm_area_struct of size 200
  The buggy address is located 64 bytes inside of 200-byte region [00000000962d6948, 00000000962d6a10)
  The buggy address belongs to the page: page:00000000313a09fe refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x962d6 flags: 0x3ffff00000000200(slab)
  raw: 3ffff00000000200 000040000257e080 0000000c0000000c 000000008020ba00
  raw: 0000000000000000 000f001e00000000 ffffffff00000001 0000000096959501
  page dumped because: kasan: bad access detected
  page->mem_cgroup:0000000096959501

  Memory state around the buggy address:
   00000000962d6880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   00000000962d6900: 00 fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb
  >00000000962d6980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                        ^
   00000000962d6a00: fb fb fc fc fc fc fc fc fc fc 00 00 00 00 00 00
   00000000962d6a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ==================================================================

Fixes: 6b251fc96cf2c ("userfaultfd: call handle_userfault() for userfaultfd_missing() faults")
Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: <stable@vger.kernel.org>	[4.3+]
Link: https://lkml.kernel.org/r/20201110190329.11920-1-gerald.schaefer@linux.ibm.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/huge_memory.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -722,7 +722,6 @@ vm_fault_t do_huge_pmd_anonymous_page(st
 			transparent_hugepage_use_zero_page()) {
 		pgtable_t pgtable;
 		struct page *zero_page;
-		bool set;
 		vm_fault_t ret;
 		pgtable = pte_alloc_one(vma->vm_mm);
 		if (unlikely(!pgtable))
@@ -735,25 +734,25 @@ vm_fault_t do_huge_pmd_anonymous_page(st
 		}
 		vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
 		ret = 0;
-		set = false;
 		if (pmd_none(*vmf->pmd)) {
 			ret = check_stable_address_space(vma->vm_mm);
 			if (ret) {
 				spin_unlock(vmf->ptl);
+				pte_free(vma->vm_mm, pgtable);
 			} else if (userfaultfd_missing(vma)) {
 				spin_unlock(vmf->ptl);
+				pte_free(vma->vm_mm, pgtable);
 				ret = handle_userfault(vmf, VM_UFFD_MISSING);
 				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
 			} else {
 				set_huge_zero_page(pgtable, vma->vm_mm, vma,
 						   haddr, vmf->pmd, zero_page);
 				spin_unlock(vmf->ptl);
-				set = true;
 			}
-		} else
+		} else {
 			spin_unlock(vmf->ptl);
-		if (!set)
 			pte_free(vma->vm_mm, pgtable);
+		}
 		return ret;
 	}
 	gfp = alloc_hugepage_direct_gfpmask(vma);



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 157/158] mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 156/158] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 12:23 ` [PATCH 5.4 158/158] sched/fair: Fix overutilized update in enqueue_task_fair() Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Charan Teja Reddy, Andrew Morton,
	Vlastimil Babka, Vinayak Menon, Mel Gorman, Linus Torvalds,
	Ralph Siemsen

From: Charan Teja Reddy <charante@codeaurora.org>

commit f80b08fc44536a311a9f3182e50f318b79076425 upstream.

When boosting is enabled, it is observed that rate of atomic order-0
allocation failures are high due to the fact that free levels in the
system are checked with ->watermark_boost offset.  This is not a problem
for sleepable allocations but for atomic allocations which looks like
regression.

This problem is seen frequently on system setup of Android kernel running
on Snapdragon hardware with 4GB RAM size.  When no extfrag event occurred
in the system, ->watermark_boost factor is zero, thus the watermark
configurations in the system are:

   _watermark = (
          [WMARK_MIN] = 1272, --> ~5MB
          [WMARK_LOW] = 9067, --> ~36MB
          [WMARK_HIGH] = 9385), --> ~38MB
   watermark_boost = 0

After launching some memory hungry applications in Android which can cause
extfrag events in the system to an extent that ->watermark_boost can be
set to max i.e.  default boost factor makes it to 150% of high watermark.

   _watermark = (
          [WMARK_MIN] = 1272, --> ~5MB
          [WMARK_LOW] = 9067, --> ~36MB
          [WMARK_HIGH] = 9385), --> ~38MB
   watermark_boost = 14077, -->~57MB

With default system configuration, for an atomic order-0 allocation to
succeed, having free memory of ~2MB will suffice.  But boosting makes the
min_wmark to ~61MB thus for an atomic order-0 allocation to be successful
system should have minimum of ~23MB of free memory(from calculations of
zone_watermark_ok(), min = 3/4(min/2)).  But failures are observed despite
system is having ~20MB of free memory.  In the testing, this is
reproducible as early as first 300secs since boot and with furtherlowram
configurations(<2GB) it is observed as early as first 150secs since boot.

These failures can be avoided by excluding the ->watermark_boost in
watermark caluculations for atomic order-0 allocations.

[akpm@linux-foundation.org: fix comment grammar, reflow comment]
[charante@codeaurora.org: fix suggested by Mel Gorman]
  Link: http://lkml.kernel.org/r/31556793-57b1-1c21-1a9d-22674d9bd938@codeaurora.org

Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Vinayak Menon <vinmenon@codeaurora.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Link: http://lkml.kernel.org/r/1589882284-21010-1-git-send-email-charante@codeaurora.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 mm/page_alloc.c |   25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3484,7 +3484,8 @@ bool zone_watermark_ok(struct zone *z, u
 }
 
 static inline bool zone_watermark_fast(struct zone *z, unsigned int order,
-		unsigned long mark, int classzone_idx, unsigned int alloc_flags)
+				unsigned long mark, int classzone_idx,
+				unsigned int alloc_flags, gfp_t gfp_mask)
 {
 	long free_pages = zone_page_state(z, NR_FREE_PAGES);
 	long cma_pages = 0;
@@ -3505,8 +3506,23 @@ static inline bool zone_watermark_fast(s
 	if (!order && (free_pages - cma_pages) > mark + z->lowmem_reserve[classzone_idx])
 		return true;
 
-	return __zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
-					free_pages);
+	if (__zone_watermark_ok(z, order, mark, classzone_idx, alloc_flags,
+					free_pages))
+		return true;
+	/*
+	 * Ignore watermark boosting for GFP_ATOMIC order-0 allocations
+	 * when checking the min watermark. The min watermark is the
+	 * point where boosting is ignored so that kswapd is woken up
+	 * when below the low watermark.
+	 */
+	if (unlikely(!order && (gfp_mask & __GFP_ATOMIC) && z->watermark_boost
+		&& ((alloc_flags & ALLOC_WMARK_MASK) == WMARK_MIN))) {
+		mark = z->_watermark[WMARK_MIN];
+		return __zone_watermark_ok(z, order, mark, classzone_idx,
+					alloc_flags, free_pages);
+	}
+
+	return false;
 }
 
 bool zone_watermark_ok_safe(struct zone *z, unsigned int order,
@@ -3647,7 +3663,8 @@ retry:
 
 		mark = wmark_pages(zone, alloc_flags & ALLOC_WMARK_MASK);
 		if (!zone_watermark_fast(zone, order, mark,
-				       ac_classzone_idx(ac), alloc_flags)) {
+				       ac_classzone_idx(ac), alloc_flags,
+				       gfp_mask)) {
 			int ret;
 
 #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT



^ permalink raw reply	[flat|nested] 167+ messages in thread

* [PATCH 5.4 158/158] sched/fair: Fix overutilized update in enqueue_task_fair()
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 157/158] mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations Greg Kroah-Hartman
@ 2020-11-23 12:23 ` Greg Kroah-Hartman
  2020-11-23 20:54 ` [PATCH 5.4 000/158] 5.4.80-rc1 review Jon Hunter
                   ` (3 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 12:23 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rick Yiu, Quentin Perret,
	Peter Zijlstra (Intel),
	Vincent Guittot, Valentin Schneider

From: Quentin Perret <qperret@google.com>

commit 8e1ac4299a6e8726de42310d9c1379f188140c71 upstream.

enqueue_task_fair() attempts to skip the overutilized update for new
tasks as their util_avg is not accurate yet. However, the flag we check
to do so is overwritten earlier on in the function, which makes the
condition pretty much a nop.

Fix this by saving the flag early on.

Fixes: 2802bf3cd936 ("sched/fair: Add over-utilization/tipping point indicator")
Reported-by: Rick Yiu <rickyiu@google.com>
Signed-off-by: Quentin Perret <qperret@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Vincent Guittot <vincent.guittot@linaro.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20201112111201.2081902-1-qperret@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/sched/fair.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -5228,6 +5228,7 @@ enqueue_task_fair(struct rq *rq, struct
 	struct cfs_rq *cfs_rq;
 	struct sched_entity *se = &p->se;
 	int idle_h_nr_running = task_has_idle_policy(p);
+	int task_new = !(flags & ENQUEUE_WAKEUP);
 
 	/*
 	 * The code below (indirectly) updates schedutil which looks at
@@ -5299,7 +5300,7 @@ enqueue_throttle:
 		 * into account, but that is not straightforward to implement,
 		 * and the following generally works well enough in practice.
 		 */
-		if (flags & ENQUEUE_WAKEUP)
+		if (!task_new)
 			update_overutilized_status(rq);
 
 	}



^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang
  2020-11-23 12:21 ` [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
@ 2020-11-23 18:31   ` Nick Desaulniers
  2020-11-23 18:50     ` Greg Kroah-Hartman
  0 siblings, 1 reply; 167+ messages in thread
From: Nick Desaulniers @ 2020-11-23 18:31 UTC (permalink / raw)
  To: Arvind Sankar, Randy Dunlap
  Cc: LKML, Greg Kroah-Hartman, # 3.4.x, Andrew Morton, Kees Cook,
	Linus Torvalds, Sasha Levin, Palmer Dabbelt

Doesn't this depend on a v2 of
https://lore.kernel.org/lkml/fe040988-c076-8dec-8268-3fbaa8b39c0f@infradead.org/
? Oh, looks like v1 got picked up:
https://lore.kernel.org/lkml/mhng-8c56f671-512a-45e7-9c94-fa39a80451da@palmerdabbelt-glaptop1/.
Won't this break RISCV VDSO?

On Mon, Nov 23, 2020 at 4:35 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> From: Arvind Sankar <nivedita@alum.mit.edu>
>
> [ Upstream commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 ]
>
> Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
> mutually exclusive") neglected to copy barrier_data() from
> compiler-gcc.h into compiler-clang.h.
>
> The definition in compiler-gcc.h was really to work around clang's more
> aggressive optimization, so this broke barrier_data() on clang, and
> consequently memzero_explicit() as well.
>
> For example, this results in at least the memzero_explicit() call in
> lib/crypto/sha256.c:sha256_transform() being optimized away by clang.
>
> Fix this by moving the definition of barrier_data() into compiler.h.
>
> Also move the gcc/clang definition of barrier() into compiler.h,
> __memory_barrier() is icc-specific (and barrier() is already defined
> using it in compiler-intel.h) and doesn't belong in compiler.h.
>
> [rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]
>
> Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
> Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
> Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
> Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> Tested-by: Nick Desaulniers <ndesaulniers@google.com>
> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
> Reviewed-by: Kees Cook <keescook@chromium.org>
> Cc: <stable@vger.kernel.org>
> Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  include/linux/compiler-clang.h |  5 -----
>  include/linux/compiler-gcc.h   | 19 -------------------
>  include/linux/compiler.h       | 18 ++++++++++++++++--
>  3 files changed, 16 insertions(+), 26 deletions(-)
>
> diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
> index 333a6695a918c..9b89141604ed0 100644
> --- a/include/linux/compiler-clang.h
> +++ b/include/linux/compiler-clang.h
> @@ -37,8 +37,3 @@
>  #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
>  #endif
>
> -/* The following are for compatibility with GCC, from compiler-gcc.h,
> - * and may be redefined here because they should not be shared with other
> - * compilers, like ICC.
> - */
> -#define barrier() __asm__ __volatile__("" : : : "memory")
> diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
> index e8579412ad214..d8fab3ecf5120 100644
> --- a/include/linux/compiler-gcc.h
> +++ b/include/linux/compiler-gcc.h
> @@ -14,25 +14,6 @@
>  # error Sorry, your compiler is too old - please upgrade it.
>  #endif
>
> -/* Optimization barrier */
> -
> -/* The "volatile" is due to gcc bugs */
> -#define barrier() __asm__ __volatile__("": : :"memory")
> -/*
> - * This version is i.e. to prevent dead stores elimination on @ptr
> - * where gcc and llvm may behave differently when otherwise using
> - * normal barrier(): while gcc behavior gets along with a normal
> - * barrier(), llvm needs an explicit input variable to be assumed
> - * clobbered. The issue is as follows: while the inline asm might
> - * access any memory it wants, the compiler could have fit all of
> - * @ptr into memory registers instead, and since @ptr never escaped
> - * from that, it proved that the inline asm wasn't touching any of
> - * it. This version works well with both compilers, i.e. we're telling
> - * the compiler that the inline asm absolutely may see the contents
> - * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
> - */
> -#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
> -
>  /*
>   * This macro obfuscates arithmetic on a variable address so that gcc
>   * shouldn't recognize the original var, and make assumptions about it.
> diff --git a/include/linux/compiler.h b/include/linux/compiler.h
> index 448c91bf543b7..f164a9b12813f 100644
> --- a/include/linux/compiler.h
> +++ b/include/linux/compiler.h
> @@ -80,11 +80,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
>
>  /* Optimization barrier */
>  #ifndef barrier
> -# define barrier() __memory_barrier()
> +/* The "volatile" is due to gcc bugs */
> +# define barrier() __asm__ __volatile__("": : :"memory")
>  #endif
>
>  #ifndef barrier_data
> -# define barrier_data(ptr) barrier()
> +/*
> + * This version is i.e. to prevent dead stores elimination on @ptr
> + * where gcc and llvm may behave differently when otherwise using
> + * normal barrier(): while gcc behavior gets along with a normal
> + * barrier(), llvm needs an explicit input variable to be assumed
> + * clobbered. The issue is as follows: while the inline asm might
> + * access any memory it wants, the compiler could have fit all of
> + * @ptr into memory registers instead, and since @ptr never escaped
> + * from that, it proved that the inline asm wasn't touching any of
> + * it. This version works well with both compilers, i.e. we're telling
> + * the compiler that the inline asm absolutely may see the contents
> + * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
> + */
> +# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
>  #endif
>
>  /* workaround for GCC PR82365 if needed */
> --
> 2.27.0
>
>
>


-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang
  2020-11-23 18:31   ` Nick Desaulniers
@ 2020-11-23 18:50     ` Greg Kroah-Hartman
  2020-11-23 18:57       ` Nick Desaulniers
  0 siblings, 1 reply; 167+ messages in thread
From: Greg Kroah-Hartman @ 2020-11-23 18:50 UTC (permalink / raw)
  To: Nick Desaulniers
  Cc: Arvind Sankar, Randy Dunlap, LKML, # 3.4.x, Andrew Morton,
	Kees Cook, Linus Torvalds, Sasha Levin, Palmer Dabbelt

On Mon, Nov 23, 2020 at 10:31:10AM -0800, Nick Desaulniers wrote:
> Doesn't this depend on a v2 of
> https://lore.kernel.org/lkml/fe040988-c076-8dec-8268-3fbaa8b39c0f@infradead.org/
> ? Oh, looks like v1 got picked up:
> https://lore.kernel.org/lkml/mhng-8c56f671-512a-45e7-9c94-fa39a80451da@palmerdabbelt-glaptop1/.
> Won't this break RISCV VDSO?

Oops, let me drop this, I did so in the past for 5.9.y and it looks like
Sasha missed that and added the fixed patch to 5.4.y...

thanks,

greg k-h

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang
  2020-11-23 18:50     ` Greg Kroah-Hartman
@ 2020-11-23 18:57       ` Nick Desaulniers
  2020-12-11 20:25         ` Nick Desaulniers
  0 siblings, 1 reply; 167+ messages in thread
From: Nick Desaulniers @ 2020-11-23 18:57 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Arvind Sankar, Randy Dunlap, LKML, # 3.4.x, Andrew Morton,
	Kees Cook, Linus Torvalds, Sasha Levin, Palmer Dabbelt

On Mon, Nov 23, 2020 at 10:50 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> On Mon, Nov 23, 2020 at 10:31:10AM -0800, Nick Desaulniers wrote:
> > Doesn't this depend on a v2 of
> > https://lore.kernel.org/lkml/fe040988-c076-8dec-8268-3fbaa8b39c0f@infradead.org/
> > ? Oh, looks like v1 got picked up:
> > https://lore.kernel.org/lkml/mhng-8c56f671-512a-45e7-9c94-fa39a80451da@palmerdabbelt-glaptop1/.
> > Won't this break RISCV VDSO?
>
> Oops, let me drop this, I did so in the past for 5.9.y and it looks like
> Sasha missed that and added the fixed patch to 5.4.y...

No worries, I plan to email backports directly to stable with the
dependencies sorted out. Probably after Thanksgiving. Thanks Greg!

-- 
Thanks,
~Nick Desaulniers

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 000/158] 5.4.80-rc1 review
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-11-23 12:23 ` [PATCH 5.4 158/158] sched/fair: Fix overutilized update in enqueue_task_fair() Greg Kroah-Hartman
@ 2020-11-23 20:54 ` Jon Hunter
  2020-11-24  0:31 ` Shuah Khan
                   ` (2 subsequent siblings)
  161 siblings, 0 replies; 167+ messages in thread
From: Jon Hunter @ 2020-11-23 20:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	lkft-triage, pavel, stable, linux-tegra

On Mon, 23 Nov 2020 13:20:28 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.80 release.
> There are 158 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.80-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h

All tests passing for Tegra ...

Test results for stable-v5.4:
    15 builds:	15 pass, 0 fail
    26 boots:	26 pass, 0 fail
    56 tests:	56 pass, 0 fail

Linux version:	5.4.80-rc1-g0048695749b2
Boards tested:	tegra124-jetson-tk1, tegra186-p2771-0000,
                tegra194-p2972-0000, tegra20-ventana,
                tegra210-p2371-2180, tegra210-p3450-0000,
                tegra30-cardhu-a04

Tested-by: Jon Hunter <jonathanh@nvidia.com>

Jon

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 000/158] 5.4.80-rc1 review
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-11-23 20:54 ` [PATCH 5.4 000/158] 5.4.80-rc1 review Jon Hunter
@ 2020-11-24  0:31 ` Shuah Khan
  2020-11-24  2:14 ` Guenter Roeck
  2020-11-24  6:39 ` Naresh Kamboju
  161 siblings, 0 replies; 167+ messages in thread
From: Shuah Khan @ 2020-11-24  0:31 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, linux, shuah, patches, lkft-triage, pavel,
	stable, Shuah Khan

On 11/23/20 5:20 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.80 release.
> There are 158 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.80-rc1.gz
> or in the git tree and branch at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
> and the diffstat can be found below.
> 
> thanks,
> 
> greg k-h
> 

Compiled and booted on my test system. No dmesg regressions.

Tested-by: Shuah Khan <skhan@linuxfoundation.org>

thanks,
-- Shuah

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 000/158] 5.4.80-rc1 review
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-11-24  0:31 ` Shuah Khan
@ 2020-11-24  2:14 ` Guenter Roeck
  2020-11-24  6:39 ` Naresh Kamboju
  161 siblings, 0 replies; 167+ messages in thread
From: Guenter Roeck @ 2020-11-24  2:14 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, lkft-triage, pavel, stable

On Mon, Nov 23, 2020 at 01:20:28PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.4.80 release.
> There are 158 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
> 

Build results:
	total: 157 pass: 157 fail: 0
Qemu test results:
	total: 426 pass: 426 fail: 0

Tested-by: Guenter Roeck <linux@roeck-us.net>

Guenter

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 000/158] 5.4.80-rc1 review
  2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-11-24  2:14 ` Guenter Roeck
@ 2020-11-24  6:39 ` Naresh Kamboju
  161 siblings, 0 replies; 167+ messages in thread
From: Naresh Kamboju @ 2020-11-24  6:39 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
	Shuah Khan, patches, lkft-triage, pavel, linux-stable

On Mon, 23 Nov 2020 at 18:06, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.4.80 release.
> There are 158 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Nov 2020 12:17:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.80-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h


Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>

Summary
------------------------------------------------------------------------

kernel: 5.4.80-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-5.4.y
git commit: 0048695749b29788fab5e9fff442f5a5968290d3
git describe: v5.4.79-159-g0048695749b2
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.79-159-g0048695749b2

No regressions (compared to build v5.4.79)

No fixes (compared to build v5.4.79)


Ran 46177 total tests in the following environments and test suites.

Environments
--------------
- arc
- arm
- arm64
- dragonboard-410c
- hi6220-hikey
- i386
- juno-r2
- juno-r2-compat
- juno-r2-kasan
- mips
- nxp-ls2088
- powerpc
- qemu-arm-clang
- qemu-arm64-clang
- qemu-arm64-kasan
- qemu-x86_64-clang
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- riscv
- s390
- sh
- sparc
- x15
- x86
- x86-kasan

Test Suites
-----------
* build
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-commands-tests
* ltp-controllers-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-tracing-tests
* perf
* v4l2-compliance
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-sched-tests
* ltp-syscalls-tests
* network-basic-tests
* ltp-open-posix-tests
* kvm-unit-tests

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 167+ messages in thread

* Re: [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang
  2020-11-23 18:57       ` Nick Desaulniers
@ 2020-12-11 20:25         ` Nick Desaulniers
  0 siblings, 0 replies; 167+ messages in thread
From: Nick Desaulniers @ 2020-12-11 20:25 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Arvind Sankar, Randy Dunlap, LKML, # 3.4.x, Andrew Morton,
	Kees Cook, Linus Torvalds, Sasha Levin, Palmer Dabbelt

[-- Attachment #1: Type: text/plain, Size: 1150 bytes --]

On Mon, Nov 23, 2020 at 10:57 AM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Mon, Nov 23, 2020 at 10:50 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > On Mon, Nov 23, 2020 at 10:31:10AM -0800, Nick Desaulniers wrote:
> > > Doesn't this depend on a v2 of
> > > https://lore.kernel.org/lkml/fe040988-c076-8dec-8268-3fbaa8b39c0f@infradead.org/
> > > ? Oh, looks like v1 got picked up:
> > > https://lore.kernel.org/lkml/mhng-8c56f671-512a-45e7-9c94-fa39a80451da@palmerdabbelt-glaptop1/.
> > > Won't this break RISCV VDSO?
> >
> > Oops, let me drop this, I did so in the past for 5.9.y and it looks like
> > Sasha missed that and added the fixed patch to 5.4.y...
>
> No worries, I plan to email backports directly to stable with the
> dependencies sorted out. Probably after Thanksgiving. Thanks Greg!

Re-responding in this thread as well (sorry for the double post, looks
like lkml and stable are cc'ed on this at least and not on the other
thread, so with this we should have lore links FWIW).
Please see attached patches and notes
https://github.com/ClangBuiltLinux/linux/issues/1202.

--
Thanks,
~Nick Desaulniers

[-- Attachment #2: 3347acc6fcd4.4.19.patch.txt --]
[-- Type: text/plain, Size: 5659 bytes --]

From a553d52fc29dac36ef4ce6ecf05f20109d5b60ab Mon Sep 17 00:00:00 2001
From: Arvind Sankar <nivedita@alum.mit.edu>
Date: Fri, 13 Nov 2020 22:51:59 -0800
Subject: [PATCH] compiler.h: fix barrier_data() on clang

commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 upstream.

Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[nd: backport to account for missing
  commit e506ea451254a ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
  commit d08b9f0ca6605 ("scs: Add support for Clang's Shadow Call Stack (SCS)")
  commit a3f8a30f3f00 ("Compiler Attributes: use feature checks instead of version checks")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
---
 include/linux/compiler-clang.h |  1 -
 include/linux/compiler-gcc.h   | 19 -------------------
 include/linux/compiler.h       | 18 ++++++++++++++++--
 3 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index d756f2318efe..2d6e5e4bb5d9 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -39,7 +39,6 @@
  * and may be redefined here because they should not be shared with other
  * compilers, like ICC.
  */
-#define barrier() __asm__ __volatile__("" : : : "memory")
 #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
 #define __assume_aligned(a, ...)	\
 	__attribute__((__assume_aligned__(a, ## __VA_ARGS__)))
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 3ebee1ce6f98..14be09537109 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -14,25 +14,6 @@
 # error Sorry, your compiler is too old - please upgrade it.
 #endif
 
-/* Optimization barrier */
-
-/* The "volatile" is due to gcc bugs */
-#define barrier() __asm__ __volatile__("": : :"memory")
-/*
- * This version is i.e. to prevent dead stores elimination on @ptr
- * where gcc and llvm may behave differently when otherwise using
- * normal barrier(): while gcc behavior gets along with a normal
- * barrier(), llvm needs an explicit input variable to be assumed
- * clobbered. The issue is as follows: while the inline asm might
- * access any memory it wants, the compiler could have fit all of
- * @ptr into memory registers instead, and since @ptr never escaped
- * from that, it proved that the inline asm wasn't touching any of
- * it. This version works well with both compilers, i.e. we're telling
- * the compiler that the inline asm absolutely may see the contents
- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
- */
-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
-
 /*
  * This macro obfuscates arithmetic on a variable address so that gcc
  * shouldn't recognize the original var, and make assumptions about it.
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index fbb6490c1e09..6b6505e3b2c7 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -79,11 +79,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 
 /* Optimization barrier */
 #ifndef barrier
-# define barrier() __memory_barrier()
+/* The "volatile" is due to gcc bugs */
+# define barrier() __asm__ __volatile__("": : :"memory")
 #endif
 
 #ifndef barrier_data
-# define barrier_data(ptr) barrier()
+/*
+ * This version is i.e. to prevent dead stores elimination on @ptr
+ * where gcc and llvm may behave differently when otherwise using
+ * normal barrier(): while gcc behavior gets along with a normal
+ * barrier(), llvm needs an explicit input variable to be assumed
+ * clobbered. The issue is as follows: while the inline asm might
+ * access any memory it wants, the compiler could have fit all of
+ * @ptr into memory registers instead, and since @ptr never escaped
+ * from that, it proved that the inline asm wasn't touching any of
+ * it. This version works well with both compilers, i.e. we're telling
+ * the compiler that the inline asm absolutely may see the contents
+ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+ */
+# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
 #endif
 
 /* workaround for GCC PR82365 if needed */
-- 
2.29.2.576.ga3fc446d84-goog


[-- Attachment #3: 3347acc6fcd4.5.4.patch.txt --]
[-- Type: text/plain, Size: 5579 bytes --]

From c37da3a5a39ffbb36c9c01c469d315188036da3c Mon Sep 17 00:00:00 2001
From: Arvind Sankar <nivedita@alum.mit.edu>
Date: Fri, 13 Nov 2020 22:51:59 -0800
Subject: [PATCH] compiler.h: fix barrier_data() on clang

commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 upstream.

Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[nd: backport to account for missing
  commit e506ea451254a ("compiler.h: Split {READ,WRITE}_ONCE definitions out into rwonce.h")
  commit d08b9f0ca6605 ("scs: Add support for Clang's Shadow Call Stack (SCS)")]
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
---
 include/linux/compiler-clang.h |  6 ------
 include/linux/compiler-gcc.h   | 19 -------------------
 include/linux/compiler.h       | 18 ++++++++++++++++--
 3 files changed, 16 insertions(+), 27 deletions(-)

diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index 333a6695a918..0e06df20928c 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -36,9 +36,3 @@
     __has_builtin(__builtin_sub_overflow)
 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
 #endif
-
-/* The following are for compatibility with GCC, from compiler-gcc.h,
- * and may be redefined here because they should not be shared with other
- * compilers, like ICC.
- */
-#define barrier() __asm__ __volatile__("" : : : "memory")
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index e8579412ad21..d8fab3ecf512 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -14,25 +14,6 @@
 # error Sorry, your compiler is too old - please upgrade it.
 #endif
 
-/* Optimization barrier */
-
-/* The "volatile" is due to gcc bugs */
-#define barrier() __asm__ __volatile__("": : :"memory")
-/*
- * This version is i.e. to prevent dead stores elimination on @ptr
- * where gcc and llvm may behave differently when otherwise using
- * normal barrier(): while gcc behavior gets along with a normal
- * barrier(), llvm needs an explicit input variable to be assumed
- * clobbered. The issue is as follows: while the inline asm might
- * access any memory it wants, the compiler could have fit all of
- * @ptr into memory registers instead, and since @ptr never escaped
- * from that, it proved that the inline asm wasn't touching any of
- * it. This version works well with both compilers, i.e. we're telling
- * the compiler that the inline asm absolutely may see the contents
- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
- */
-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
-
 /*
  * This macro obfuscates arithmetic on a variable address so that gcc
  * shouldn't recognize the original var, and make assumptions about it.
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 448c91bf543b..f164a9b12813 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -80,11 +80,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 
 /* Optimization barrier */
 #ifndef barrier
-# define barrier() __memory_barrier()
+/* The "volatile" is due to gcc bugs */
+# define barrier() __asm__ __volatile__("": : :"memory")
 #endif
 
 #ifndef barrier_data
-# define barrier_data(ptr) barrier()
+/*
+ * This version is i.e. to prevent dead stores elimination on @ptr
+ * where gcc and llvm may behave differently when otherwise using
+ * normal barrier(): while gcc behavior gets along with a normal
+ * barrier(), llvm needs an explicit input variable to be assumed
+ * clobbered. The issue is as follows: while the inline asm might
+ * access any memory it wants, the compiler could have fit all of
+ * @ptr into memory registers instead, and since @ptr never escaped
+ * from that, it proved that the inline asm wasn't touching any of
+ * it. This version works well with both compilers, i.e. we're telling
+ * the compiler that the inline asm absolutely may see the contents
+ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+ */
+# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
 #endif
 
 /* workaround for GCC PR82365 if needed */
-- 
2.29.2.576.ga3fc446d84-goog


[-- Attachment #4: 3347acc6fcd4.5.9.patch.txt --]
[-- Type: text/plain, Size: 5785 bytes --]

From 18873004e5f22d32fa96c910768a59da71c9fc3b Mon Sep 17 00:00:00 2001
From: Arvind Sankar <nivedita@alum.mit.edu>
Date: Fri, 13 Nov 2020 22:51:59 -0800
Subject: [PATCH] compiler.h: fix barrier_data() on clang

commit 3347acc6fcd4ee71ad18a9ff9d9dac176b517329 upstream.

Commit 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h
mutually exclusive") neglected to copy barrier_data() from
compiler-gcc.h into compiler-clang.h.

The definition in compiler-gcc.h was really to work around clang's more
aggressive optimization, so this broke barrier_data() on clang, and
consequently memzero_explicit() as well.

For example, this results in at least the memzero_explicit() call in
lib/crypto/sha256.c:sha256_transform() being optimized away by clang.

Fix this by moving the definition of barrier_data() into compiler.h.

Also move the gcc/clang definition of barrier() into compiler.h,
__memory_barrier() is icc-specific (and barrier() is already defined
using it in compiler-intel.h) and doesn't belong in compiler.h.

[rdunlap@infradead.org: fix ALPHA builds when SMP is not enabled]

Link: https://lkml.kernel.org/r/20201101231835.4589-1-rdunlap@infradead.org
Fixes: 815f0ddb346c ("include/linux/compiler*.h: make compiler-*.h mutually exclusive")
Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20201014212631.207844-1-nivedita@alum.mit.edu
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
---
 include/asm-generic/barrier.h  |  1 +
 include/linux/compiler-clang.h |  6 ------
 include/linux/compiler-gcc.h   | 19 -------------------
 include/linux/compiler.h       | 18 ++++++++++++++++--
 4 files changed, 17 insertions(+), 27 deletions(-)

diff --git a/include/asm-generic/barrier.h b/include/asm-generic/barrier.h
index 798027bb89be..640f09479bdf 100644
--- a/include/asm-generic/barrier.h
+++ b/include/asm-generic/barrier.h
@@ -13,6 +13,7 @@
 
 #ifndef __ASSEMBLY__
 
+#include <linux/compiler.h>
 #include <asm/rwonce.h>
 
 #ifndef nop
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index cee0c728d39a..04c0a5a717f7 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -52,12 +52,6 @@
 #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
 #endif
 
-/* The following are for compatibility with GCC, from compiler-gcc.h,
- * and may be redefined here because they should not be shared with other
- * compilers, like ICC.
- */
-#define barrier() __asm__ __volatile__("" : : : "memory")
-
 #if __has_feature(shadow_call_stack)
 # define __noscs	__attribute__((__no_sanitize__("shadow-call-stack")))
 #endif
diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
index 3017ebd40054..4a4019776368 100644
--- a/include/linux/compiler-gcc.h
+++ b/include/linux/compiler-gcc.h
@@ -15,25 +15,6 @@
 # error Sorry, your compiler is too old - please upgrade it.
 #endif
 
-/* Optimization barrier */
-
-/* The "volatile" is due to gcc bugs */
-#define barrier() __asm__ __volatile__("": : :"memory")
-/*
- * This version is i.e. to prevent dead stores elimination on @ptr
- * where gcc and llvm may behave differently when otherwise using
- * normal barrier(): while gcc behavior gets along with a normal
- * barrier(), llvm needs an explicit input variable to be assumed
- * clobbered. The issue is as follows: while the inline asm might
- * access any memory it wants, the compiler could have fit all of
- * @ptr into memory registers instead, and since @ptr never escaped
- * from that, it proved that the inline asm wasn't touching any of
- * it. This version works well with both compilers, i.e. we're telling
- * the compiler that the inline asm absolutely may see the contents
- * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
- */
-#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
-
 /*
  * This macro obfuscates arithmetic on a variable address so that gcc
  * shouldn't recognize the original var, and make assumptions about it.
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 6810d80acb0b..a7b6d72d5116 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -80,11 +80,25 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 
 /* Optimization barrier */
 #ifndef barrier
-# define barrier() __memory_barrier()
+/* The "volatile" is due to gcc bugs */
+# define barrier() __asm__ __volatile__("": : :"memory")
 #endif
 
 #ifndef barrier_data
-# define barrier_data(ptr) barrier()
+/*
+ * This version is i.e. to prevent dead stores elimination on @ptr
+ * where gcc and llvm may behave differently when otherwise using
+ * normal barrier(): while gcc behavior gets along with a normal
+ * barrier(), llvm needs an explicit input variable to be assumed
+ * clobbered. The issue is as follows: while the inline asm might
+ * access any memory it wants, the compiler could have fit all of
+ * @ptr into memory registers instead, and since @ptr never escaped
+ * from that, it proved that the inline asm wasn't touching any of
+ * it. This version works well with both compilers, i.e. we're telling
+ * the compiler that the inline asm absolutely may see the contents
+ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495
+ */
+# define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory")
 #endif
 
 /* workaround for GCC PR82365 if needed */
-- 
2.29.2.576.ga3fc446d84-goog


^ permalink raw reply related	[flat|nested] 167+ messages in thread

end of thread, other threads:[~2020-12-11 21:31 UTC | newest]

Thread overview: 167+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-23 12:20 [PATCH 5.4 000/158] 5.4.80-rc1 review Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 001/158] ah6: fix error return code in ah6_input() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 002/158] atm: nicstar: Unmap DMA on send error Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 003/158] bnxt_en: read EEPROM A2h address using page 0 Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 004/158] devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 005/158] Exempt multicast addresses from five-second neighbor lifetime Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 006/158] inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 007/158] ipv6: Fix error path to cancel the meseage Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 008/158] lan743x: fix issue causing intermittent kernel log warnings Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 009/158] lan743x: prevent entire kernel HANG on open, for some platforms Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 010/158] mlxsw: core: Use variable timeout for EMAD retries Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 011/158] net: b44: fix error return code in b44_init_one() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 012/158] net: bridge: add missing counters to ndo_get_stats64 callback Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 013/158] net: dsa: mv88e6xxx: Avoid VTU corruption on 6097 Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 014/158] net: ethernet: ti: cpsw: fix error return code in cpsw_probe() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 015/158] net: Have netpoll bring-up DSA management interface Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 016/158] netlabel: fix our progress tracking in netlbl_unlabel_staticlist() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 017/158] netlabel: fix an uninitialized warning " Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 018/158] net: lantiq: Wait for the GPHY firmware to be ready Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 019/158] net/mlx4_core: Fix init_hca fields offset Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 020/158] net: qualcomm: rmnet: Fix incorrect receive packet handling during cleanup Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 021/158] net/smc: fix direct access to ib_gid_addr->ndev in smc_ib_determine_gid() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 022/158] net/tls: fix corrupted data in recvmsg Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 023/158] net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 024/158] page_frag: Recover from memory pressure Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 025/158] qed: fix error return code in qed_iwarp_ll2_start() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 026/158] qlcnic: fix error return code in qlcnic_83xx_restart_hw() Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 027/158] sctp: change to hold/put transport for proto_unreach_timer Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 028/158] tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 029/158] net/mlx5: Add handling of port type in rule deletion Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 030/158] net/mlx5: Disable QoS when min_rates on all VFs are zero Greg Kroah-Hartman
2020-11-23 12:20 ` [PATCH 5.4 031/158] net: usb: qmi_wwan: Set DTR quirk for MR400 Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 032/158] net/ncsi: Fix netlink registration Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 033/158] net: ftgmac100: Fix crash when removing driver Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 034/158] pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 035/158] scsi: ufs: Fix unbalanced scsi_block_reqs_cnt caused by ufshcd_hold() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 036/158] selftests: kvm: Fix the segment descriptor layout to match the actual layout Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 037/158] ACPI: button: Add DMI quirk for Medion Akoya E2228T Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 038/158] arm64: errata: Fix handling of 1418040 with late CPU onlining Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 039/158] arm64: psci: Avoid printing in cpu_psci_cpu_die() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 040/158] arm64: smp: Tell RCU about CPUs that fail to come online Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 041/158] vfs: remove lockdep bogosity in __sb_start_write Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 042/158] gfs2: fix possible reference leak in gfs2_check_blk_type Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 043/158] hwmon: (pwm-fan) Fix RPM calculation Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 044/158] compiler.h: fix barrier_data() on clang Greg Kroah-Hartman
2020-11-23 18:31   ` Nick Desaulniers
2020-11-23 18:50     ` Greg Kroah-Hartman
2020-11-23 18:57       ` Nick Desaulniers
2020-12-11 20:25         ` Nick Desaulniers
2020-11-23 12:21 ` [PATCH 5.4 045/158] arm64: dts: allwinner: beelink-gs1: Enable both RGMII RX/TX delay Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 046/158] arm64: dts: allwinner: Pine H64: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 047/158] arm64: dts: allwinner: a64: OrangePi Win: Fix ethernet node Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 048/158] arm64: dts: allwinner: a64: Pine64 Plus: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 049/158] arm64: dts: allwinner: h5: OrangePi PC2: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 050/158] ARM: dts: sun8i: r40: bananapi-m2-ultra: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 051/158] Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high" Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 052/158] ARM: dts: sun6i: a31-hummingbird: Enable RGMII RX/TX delay on Ethernet PHY Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 053/158] ARM: dts: sun7i: cubietruck: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 054/158] ARM: dts: sun7i: bananapi-m1-plus: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 055/158] ARM: dts: sun8i: h3: orangepi-plus2e: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 056/158] ARM: dts: sun8i: a83t: Enable both " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 057/158] ARM: dts: sun9i: " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 058/158] ARM: dts: sunxi: bananapi-m2-plus: Enable " Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 059/158] arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on PHY Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 060/158] Input: adxl34x - clean up a data type in adxl34x_probe() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 061/158] MIPS: export has_transparent_hugepage() for modules Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 062/158] arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 063/158] arm64: dts imx8mn: Remove non-existent USB OTG2 Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 064/158] arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 065/158] swiotlb: using SIZE_MAX needs limits.h included Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 066/158] arm64: dts: imx8mm: fix voltage for 1.6GHz CPU operating point Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 067/158] ARM: dts: imx50-evk: Fix the chip select 1 IOMUX Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 068/158] Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 069/158] rfkill: Fix use-after-free in rfkill_resume() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 070/158] RDMA/pvrdma: Fix missing kfree() in pvrdma_register_device() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 071/158] RMDA/sw: Dont allow drivers using dma_virt_ops on highmem configs Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 072/158] perf lock: Dont free "lock_seq_stat" if read_count isnt zero Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 073/158] tools, bpftool: Add missing close before bpftool net attach exit Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 074/158] ip_tunnels: Set tunnel option flag when tunnel metadata is present Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 075/158] can: af_can: prevent potential access of uninitialized member in can_rcv() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 076/158] can: af_can: prevent potential access of uninitialized member in canfd_rcv() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 077/158] can: dev: can_restart(): post buffer from the right context Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 078/158] can: ti_hecc: Fix memleak in ti_hecc_probe Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 079/158] can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 080/158] can: peak_usb: fix potential integer overflow on shift of a int Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 081/158] can: flexcan: fix failure handling of pm_runtime_get_sync() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 082/158] can: tcan4x5x: replace depends on REGMAP_SPI with depends on SPI Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 083/158] can: tcan4x5x: tcan4x5x_can_probe(): add missing error checking for devm_regmap_init() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 084/158] can: tcan4x5x: tcan4x5x_can_remove(): fix order of deregistration Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 085/158] can: m_can: m_can_handle_state_change(): fix state change Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 086/158] can: m_can: m_can_class_free_dev(): introduce new function Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 087/158] can: m_can: m_can_stop(): set device to software init mode before closing Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 088/158] ASoC: qcom: lpass-platform: Fix memory leak Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 089/158] selftests/bpf: Fix error return code in run_getsockopt_test() Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 090/158] MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu Greg Kroah-Hartman
2020-11-23 12:21 ` [PATCH 5.4 091/158] drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 092/158] net/mlx5: E-Switch, Fail mlx5_esw_modify_vport_rate if qos disabled Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 093/158] bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 094/158] bpf, sockmap: Ensure SO_RCVBUF memory is observed on ingress redirect Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 095/158] can: kvaser_pciefd: Fix KCAN bittiming limits Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 096/158] can: kvaser_usb: kvaser_usb_hydra: " Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 097/158] iommu/vt-d: Move intel_iommu_gfx_mapped to Intel IOMMU header Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 098/158] iommu/vt-d: Avoid panic if iommu init fails in tboot system Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 099/158] can: flexcan: flexcan_chip_start(): fix erroneous flexcan_transceiver_enable() during bus-off recovery Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 100/158] can: m_can: process interrupt only when not runtime suspended Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 101/158] xfs: fix the minrecs logic when dealing with inode root child blocks Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 102/158] xfs: strengthen rmap record flags checking Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 103/158] xfs: return corresponding errcode if xfs_initialize_perag() fail Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 104/158] regulator: ti-abb: Fix array out of bound read access on the first transition Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 105/158] fail_function: Remove a redundant mutex unlock Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 106/158] xfs: revert "xfs: fix rmap key and record comparison functions" Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 107/158] bpf, sockmap: Skb verdict SK_PASS to self already checked rmem limits Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 108/158] bpf, sockmap: On receive programs try to fast track SK_PASS ingress Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 109/158] bpf, sockmap: Use truesize with sk_rmem_schedule() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 110/158] bpf, sockmap: Avoid returning unneeded EAGAIN when redirecting to self Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 111/158] efi/x86: Free efi_pgd with free_pages() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 112/158] libfs: fix error cast of negative value in simple_attr_write() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 113/158] HID: logitech-hidpp: Add PID for MX Anywhere 2 Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 114/158] HID: logitech-dj: Handle quad/bluetooth keyboards with a builtin trackpad Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 115/158] HID: logitech-dj: Fix Dinovo Mini when paired with a MX5x00 receiver Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 116/158] speakup: Do not let the line discipline be used several times Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 117/158] ALSA: firewire: Clean up a locking issue in copy_resp_to_buf() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 118/158] ALSA: usb-audio: Add delay quirk for all Logitech USB devices Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 119/158] ALSA: ctl: fix error path at adding user-defined element set Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 120/158] ALSA: mixart: Fix mutex deadlock Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 121/158] ALSA: hda/realtek - Add supported for Lenovo ThinkPad Headset Button Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 122/158] ALSA: hda/realtek: Add some Clove SSID in the ALC293(ALC1220) Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 123/158] tty: serial: imx: fix potential deadlock Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 124/158] tty: serial: imx: keep console clocks always on Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 125/158] HID: logitech-dj: Fix an error in mse_bluetooth_descriptor Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 126/158] efivarfs: fix memory leak in efivarfs_create() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 127/158] staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 128/158] iio: light: fix kconfig dependency bug for VCNL4035 Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 129/158] ext4: fix bogus warning in ext4_update_dx_flag() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 130/158] iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 131/158] iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 132/158] iio: adc: mediatek: fix unset field Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 133/158] spi: lpspi: Fix use-after-free on unbind Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 134/158] spi: Introduce device-managed SPI controller allocation Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 135/158] spi: npcm-fiu: Dont leak SPI master in probe error path Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 136/158] spi: bcm2835aux: Fix use-after-free on unbind Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 137/158] regulator: pfuze100: limit pfuze-support-disable-sw to pfuze{100,200} Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 138/158] regulator: fix memory leak with repeated set_machine_constraints() Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 139/158] regulator: avoid resolve_supply() infinite recursion Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 140/158] regulator: workaround self-referent regulators Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 141/158] xtensa: fix TLBTEMP area placement Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 142/158] xtensa: disable preemption around cache alias management calls Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 143/158] mac80211: minstrel: remove deferred sampling code Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 144/158] mac80211: minstrel: fix tx status processing corner case Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 145/158] mac80211: free sta in sta_info_insert_finish() on errors Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 146/158] s390/cpum_sf.c: fix file permission for cpum_sfb_size Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 147/158] s390/dasd: fix null pointer dereference for ERP requests Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 148/158] Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 149/158] drm/amd/display: Add missing pflip irq for dcn2.0 Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 150/158] drm/i915: Handle max_bpc==16 Greg Kroah-Hartman
2020-11-23 12:22 ` [PATCH 5.4 151/158] mmc: sdhci-pci: Prefer SDR25 timing for High Speed mode for BYT-based Intel controllers Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 152/158] ptrace: Set PF_SUPERPRIV when checking capability Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 153/158] seccomp: " Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 154/158] x86/microcode/intel: Check patch signature before saving microcode for early loading Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 155/158] mm: memcg/slab: fix root memcg vmstats Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 156/158] mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 157/158] mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations Greg Kroah-Hartman
2020-11-23 12:23 ` [PATCH 5.4 158/158] sched/fair: Fix overutilized update in enqueue_task_fair() Greg Kroah-Hartman
2020-11-23 20:54 ` [PATCH 5.4 000/158] 5.4.80-rc1 review Jon Hunter
2020-11-24  0:31 ` Shuah Khan
2020-11-24  2:14 ` Guenter Roeck
2020-11-24  6:39 ` Naresh Kamboju

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).