stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 4.4 000/312] 4.4.223-rc1 review
@ 2020-05-08 12:29 Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 001/312] mwifiex: fix PCIe register information for 8997 chipset Greg Kroah-Hartman
                   ` (313 more replies)
  0 siblings, 314 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuah, patches,
	ben.hutchings, lkft-triage, stable

This is the start of the stable review cycle for the 4.4.223 release.
There are 312 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.223-rc1.gz
or in the git tree and branch at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.223-rc1

Thomas Pedersen <thomas@adapt-ip.com>
    mac80211: add ieee80211_is_any_nullfunc()

Takashi Iwai <tiwai@suse.de>
    ALSA: hda: Match both PCI ID and SSID for driver blacklist

Jere Leppänen <jere.leppanen@nokia.com>
    sctp: Fix SHUTDOWN CTSN Ack in the peer restart case

Herbert Xu <herbert@gondor.apana.org.au>
    macvlan: Fix potential use-after free for broadcasts

Florian Fainelli <f.fainelli@gmail.com>
    net: ep93xx_eth: Do not crash unloading module

Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
    net: skbuff: Remove errornous length validation in skb_vlan_pop()

Ivan Vecera <ivecera@redhat.com>
    bna: add missing per queue ethtool stat

Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
    bridge: Fix problems around fdb entries pointing to the bridge device

Arend Van Spriel <arend.vanspriel@broadcom.com>
    brcmfmac: restore stopping netdev queue when bus clogs up

Jaap Jan Meijer <jjmeijer88@gmail.com>
    brcmfmac: add fallback for devices that do not report per-chain values

Laxman Dewangan <ldewangan@nvidia.com>
    pinctrl: tegra: Correctly check the supported configuration

Mans Rullgard <mans@mansr.com>
    ata: sata_dwc_460ex: remove incorrect locking

Neil Armstrong <narmstrong@baylibre.com>
    net: ethernet: davinci_emac: Fix platform_data overwrite

Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
    cxl: Fix DAR check & use REGION_ID instead of opencoding

Javier Martinez Canillas <javier@osg.samsung.com>
    regulator: Try to resolve regulators supplies on registration

Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    at803x: fix reset handling

Vivien Didelot <vivien.didelot@savoirfairelinux.com>
    net: dsa: mv88e6xxx: fix port VLAN maps

Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
    regulator: core: Rely on regulator_dev_release to free constraints

Nicolas Schichan <nschichan@freebox.fr>
    net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    ovs/vxlan: fix rtnl notifications on iface deletion

Florian Fainelli <f.fainelli@gmail.com>
    net: ethoc: Fix early error paths

pravin shelar <pshelar@ovn.org>
    net: vxlan: lwt: Fix vxlan local traffic.

Arnd Bergmann <arnd@arndb.de>
    mvpp2: use correct size for memset

Geert Uytterhoeven <geert+renesas@glider.be>
    ravb: Add missing free_irq() call to ravb_close()

Cyrille Pitchen <cyrille.pitchen@atmel.com>
    net: macb: replace macb_writel() call by queue_writel() to update queue ISR

Jisheng Zhang <jszhang@marvell.com>
    net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats

David Ahern <dsa@cumulusnetworks.com>
    net: icmp_route_lookup should use rt dev to determine L3 domain

Krzysztof Kozlowski <k.kozlowski@samsung.com>
    hwrng: exynos - Disable runtime PM on driver unbind

Sabrina Dubroca <sd@queasysnail.net>
    l2tp: fix use-after-free during module unload

xypron.glpk@gmx.de <xypron.glpk@gmx.de>
    net: ehea: avoid null pointer dereference

Vivien Didelot <vivien.didelot@savoirfairelinux.com>
    net: dsa: mv88e6xxx: enable SA learning on DSA ports

Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
    net: bridge: don't increment tx_dropped in br_do_proxy_arp

Johan Hovold <johan@kernel.org>
    net: hns: fix device reference leaks

Johan Hovold <johan@kernel.org>
    net: ethernet: ti: cpsw: fix secondary-emac probe error path

Johan Hovold <johan@kernel.org>
    net: ethernet: ti: cpsw: fix device and of_node leaks

Andrew Lunn <andrew@lunn.ch>
    net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented

Neil Armstrong <narmstrong@baylibre.com>
    net: ethernet: davinci_emac: Fix devioctl while in fixed link

Florian Fainelli <f.fainelli@gmail.com>
    bnxt_en: Remove locking around txr->dev_state

Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    net: axienet: Fix return value check in axienet_probe()

Eric Dumazet <edumazet@google.com>
    qdisc: fix a module refcount leak in qdisc_create_dflt()

Eric Dumazet <edumazet@google.com>
    bnxt: add a missing rcu synchronization

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    ovs/geneve: fix rtnl notifications on iface deletion

Johan Hovold <johan@kernel.org>
    net: ethernet: stmmac: dwmac-generic: fix probe error path

Eric Dumazet <edumazet@google.com>
    fq_codel: return non zero qlen in class dumps

Johan Hovold <johan@kernel.org>
    net: ethernet: stmmac: dwmac-rk: fix probe error path

Mathias Krause <minipli@googlemail.com>
    rtnl: reset calcit fptr in rtnl_unregister()

Johan Hovold <johan@kernel.org>
    net: ethernet: stmmac: dwmac-sti: fix probe error path

Florian Fainelli <f.fainelli@gmail.com>
    et131x: Fix logical vs bitwise check in et131x_tx_timeout()

David Ahern <dsa@cumulusnetworks.com>
    net: icmp6_send should use dst dev to determine L3 domain

Wei Yongjun <weiyongjun1@huawei.com>
    tipc: fix the error handling in tipc_udp_enable()

Eric Dumazet <edumazet@google.com>
    macvtap: segmented packet is consumed

Wei Yongjun <weiyj.lk@gmail.com>
    net: macb: add missing free_netdev() on error in macb_probe()

Jiri Benc <jbenc@redhat.com>
    cxgbi: fix uninitialized flowi6

Florian Fainelli <f.fainelli@gmail.com>
    net: bcmsysport: Device stats are unsigned long

Bert Kenward <bkenward@solarflare.com>
    sfc: clear napi_hash state when copying channels

Andrew Rybchenko <Andrew.Rybchenko@oktetlabs.ru>
    sfc: fix potential stack corruption from running past stat bitmask

Jiri Benc <jbenc@redhat.com>
    gre: reject GUE and FOU in collect metadata mode

Jiri Benc <jbenc@redhat.com>
    gre: build header correctly for collect metadata tunnels

Jiri Benc <jbenc@redhat.com>
    gre: do not assign header_ops in collect metadata mode

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    ovs/gre: fix rtnl notifications on iface deletion

Eric Dumazet <edumazet@google.com>
    net: bcmgenet: device stats are unsigned long

Petri Gynther <pgynther@google.com>
    net: bcmgenet: fix skb_len in bcmgenet_xmit_single()

Hariprasad Shenai <hariprasad@chelsio.com>
    cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled

Simon Horman <simon.horman@netronome.com>
    openvswitch: update checksum in {push,pop}_mpls

Addy Ke <addy.ke@rock-chips.com>
    spi: rockchip: modify DMA max burst to 1

Peter Ujfalusi <peter.ujfalusi@ti.com>
    dmaengine: edma: Add probe callback to edma_tptc_driver

Tahsin Erdogan <tahsin@google.com>
    dm: fix second blk_delay_queue() parameter to be in msec units not jiffies

Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
    blk-mq: fix undefined behaviour in order_to_size()

Junxiao Bi <junxiao.bi@oracle.com>
    gfs2: fix flock panic issue

Vivien Didelot <vivien.didelot@savoirfairelinux.com>
    net: dsa: mv88e6xxx: unlock DSA and CPU ports

Viresh Kumar <viresh.kumar@linaro.org>
    Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"

Marcin Nowakowski <marcin.nowakowski@imgtec.com>
    MIPS: perf: Remove incorrect odd/even counter handling for I6400

Tobias Jungel <tobias.jungel@gmail.com>
    bonding: fix length of actor system

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ALSA: fm801: Initialize chip after IRQ handler is registered

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Fix backchannel allocation of extra rpcrdma_reps

Eric Dumazet <edumazet@google.com>
    mlx4: do not call napi_schedule() without care

David Ahern <dsahern@kernel.org>
    ipv4: Fix table id reference in fib_sync_down_addr

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    vti6: fix input path

Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
    net: Don't delete routes in different VRFs

David Ahern <dsa@cumulusnetworks.com>
    net: vrf: Fix dst reference counting

Marcin Niestroj <m.niestroj@grinn-global.com>
    power_supply: tps65217-charger: Fix NULL deref during property export

Liu Xiang <liu.xiang6@zte.com.cn>
    power: bq27xxx_battery: Fix bq27541 AveragePower register address

Sasha Levin <sasha.levin@oracle.com>
    power: test_power: correctly handle empty writes

H. Nikolaus Schaller <hns@goldelico.com>
    power: bq27xxx: fix register numbers of bq27500

H. Nikolaus Schaller <hns@goldelico.com>
    power: bq27xxx: fix reading for bq27000 and bq27010

Peter Zijlstra <peterz@infradead.org>
    sched/preempt: Fix preempt_count manipulations

Eric Dumazet <edumazet@google.com>
    pkt_sched: fq: use proper locking in fq_dump_stats()

Hadar Hen Zion <hadarh@mellanox.com>
    net_sched: flower: Avoid dissection of unmasked keys

Peter Zijlstra <peterz@infradead.org>
    sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion

Elad Raz <eladr@mellanox.com>
    mlxsw: switchx2: Fix ethernet port initialization

Yotam Gigi <yotamg@mellanox.com>
    mlxsw: switchx2: Fix misuse of hard_header_len

Moshe Shemesh <moshe@mellanox.com>
    net/mlx4_core: Fix QUERY FUNC CAP flags

Jack Morgenstein <jackm@dev.mellanox.co.il>
    net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering

Jack Morgenstein <jackm@dev.mellanox.co.il>
    net/mlx4_en: Fix potential deadlock in port statistics flow

Jack Morgenstein <jackm@dev.mellanox.co.il>
    net/mlx4_core: Do not access comm channel if it has not yet been initialized

Erez Shitrit <erezsh@mellanox.com>
    net/mlx4_en: Process all completions in RX rings after port goes up

Jack Morgenstein <jackm@dev.mellanox.co.il>
    net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec

Alex Vesker <valex@mellanox.com>
    net/mlx4_core: Check device state before unregistering it

Kamal Heib <kamalh@mellanox.com>
    net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill

Tariq Toukan <tariqt@mellanox.com>
    net/mlx4_core: Fix access to uninitialized index

Eran Ben Elisha <eranbe@mellanox.com>
    net/mlx4_core: Fix potential corruption in counters database

Daniel Borkmann <daniel@iogearbox.net>
    bpf: fix map not being uncharged during map creation failure

Alexei Starovoitov <ast@fb.com>
    bpf, trace: check event type in bpf_perf_event_read

Zi Shen Lim <zlim.lnx@gmail.com>
    arm64: bpf: jit JMP_JSET_{X,K}

Daniel Borkmann <daniel@iogearbox.net>
    cls_bpf: reset class and reuse major in da

Laura Abbott <labbott@redhat.com>
    clk: xgene: Don't call __pa on ioremaped address

Dong Aisheng <aisheng.dong@nxp.com>
    clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit

Maxime Ripard <maxime.ripard@free-electrons.com>
    clk: multiplier: Prevent the multiplier from under / over flowing

Tero Kristo <t-kristo@ti.com>
    clk: ti: omap3+: dpll: use non-locking version of clk_get_rate

Brian Norris <computersforpeace@gmail.com>
    clk: gpio: handle error codes for of_clk_get_parent_count()

Arnd Bergmann <arnd@arndb.de>
    clk: st: avoid uninitialized variable use

Pablo Neira <pablo@netfilter.org>
    udp: restore UDPlite many-cast delivery

Liping Zhang <zlpnobody@gmail.com>
    netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it

Liping Zhang <zlpnobody@gmail.com>
    netfilter: nf_tables: destroy the set if fail to add transaction

Liping Zhang <zlpnobody@gmail.com>
    netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled

Liping Zhang <liping.zhang@spreadtrum.com>
    netfilter: nf_tables: fix a wrong check to skip the inactive rules

David Ahern <dsa@cumulusnetworks.com>
    net: ipv6: Fix processing of RAs in presence of VRF

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    ipv6: add missing netconf notif when 'all' is updated

Eric Dumazet <edumazet@google.com>
    ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()

Hannes Frederic Sowa <hannes@stressinduktion.org>
    ipv6: fix checksum annotation in udp6_csum_init

David Ahern <dsa@cumulusnetworks.com>
    net: vrf: Fix dev refcnt leak due to IPv6 prefix route

Eric Dumazet <edumazet@google.com>
    ipv4: accept u8 in IP_TOS ancillary data

Eric Dumazet <edumazet@google.com>
    ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()

Hannes Frederic Sowa <hannes@stressinduktion.org>
    ipv4: fix checksum annotation in udp4_csum_init

Alexander Duyck <aduyck@mirantis.com>
    flow_dissector: Check for IP fragmentation even if not using IPv4 address

Alexander Duyck <alexander.h.duyck@intel.com>
    ipv4: Fix memory leak in exception case for splitting tries

Douglas Miller <dougmill@linux.vnet.ibm.com>
    be2net: Don't leak iomapped memory on removal.

Stefan Wahren <stefan.wahren@i2se.com>
    pinctrl: bcm2835: Fix memory leak in error path

Vince Hsu <vince.h@nvidia.com>
    memory/tegra: Add number of TLB lines for Tegra124

Bart Van Assche <bart.vanassche@sandisk.com>
    target: Fix a memory leak in target_dev_lba_map_store()

Dan Carpenter <dan.carpenter@oracle.com>
    qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()

Dan Carpenter <dan.carpenter@oracle.com>
    qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()

Dan Carpenter <dan.carpenter@oracle.com>
    qede: uninitialized variable in qede_start_xmit()

Dan Carpenter <dan.carpenter@oracle.com>
    i40e: fix an uninitialized variable bug

Dan Carpenter <dan.carpenter@oracle.com>
    power: ipaq-micro-battery: freeing the wrong variable

Dan Carpenter <dan.carpenter@oracle.com>
    ethernet: micrel: fix some error codes

Dan Carpenter <dan.carpenter@oracle.com>
    mfd: lp8788-irq: Uninitialized variable in irq handler

Dan Carpenter <dan.carpenter@oracle.com>
    net: moxa: fix an error code

Dan Carpenter <dan.carpenter@oracle.com>
    VFIO: platform: reset: fix a warning message condition

Dan Carpenter <dan.carpenter@oracle.com>
    ath9k_htc: check for underflow in ath9k_htc_rx_msg()

Dan Carpenter <dan.carpenter@oracle.com>
    cx23885: uninitialized variable in cx23885_av_work_handler()

Dan Carpenter <dan.carpenter@oracle.com>
    am437x-vpfe: fix an uninitialized variable bug

Alexey Khoroshilov <khoroshilov@ispras.ru>
    lirc_imon: do not leave imon_probe() with mutex held

Russell King <rmk+kernel@arm.linux.org.uk>
    rc: allow rc modules to be loaded if rc-main is not a module

Doug Berger <opendmb@gmail.com>
    net: systemport: suppress warnings on failed Rx SKB allocations

Doug Berger <opendmb@gmail.com>
    net: bcmgenet: suppress warnings on failed Rx SKB allocations

Nathan Chancellor <natechancellor@gmail.com>
    lib/mpi: Fix building for powerpc with clang

Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
    scripts/config: allow colons in option strings for sed

Ronnie Sahlberg <lsahlber@redhat.com>
    cifs: protect updating server->dstaddr with a spinlock

Xiyu Yang <xiyuyang19@fudan.edu.cn>
    wimax/i2400m: Fix potential urb refcnt leak

Tyler Hicks <tyhicks@linux.microsoft.com>
    selftests/ipc: Fix test failure seen after initial test run

YueHaibing <yuehaibing@huawei.com>
    iio:ad7797: Use correct attribute_group

Dan Carpenter <dan.carpenter@oracle.com>
    mdio-sun4i: oops in error handling in probe

Robin Murphy <robin.murphy@arm.com>
    iommu/dma: Respect IOMMU aperture when allocating

David Rivshin <drivshin@allworx.com>
    drivers: net: cpsw: don't ignore phy-mode if phy-handle is used

Johan Hovold <johan@kernel.org>
    net: dsa: slave: fix of-node leak and phy priority

Roosen Henri <Henri.Roosen@ginzinger.com>
    phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.

Johan Hovold <johan@kernel.org>
    of_mdio: fix node leak in of_phy_register_fixed_link error path

Florian Fainelli <f.fainelli@gmail.com>
    net: phy: bcm7xxx: Fix shadow mode 2 disabling

Florian Fainelli <f.fainelli@gmail.com>
    net: phy: Fix phy_mac_interrupt()

Florian Fainelli <f.fainelli@gmail.com>
    net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS

Dan Carpenter <dan.carpenter@oracle.com>
    NFC: nci: memory leak in nci_core_conn_create()

Chuck Lever <chuck.lever@oracle.com>
    sunrpc: Update RPCBIND_MAXNETIDLEN

Xin Long <lucien.xin@gmail.com>
    sctp: fix the transports round robin issue when init is retransmitted

Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
    powerpc/book3s: Fix MCE console messages for unrecoverable MCE.

Michael Neuling <mikey@neuling.org>
    powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()

Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
    perf tools: Fix perf regs mask generation

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci: Fix regression setting power on Trats2 board

Nicholas Mc Guire <hofrat@osadl.org>
    mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type

Douglas Anderson <dianders@chromium.org>
    mmc: dw_mmc: rockchip: Set the drive phase properly

Douglas Anderson <dianders@chromium.org>
    clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"

Olof Johansson <olof@lixom.net>
    mmc: block: return error on failed mmc_blk_get()

Chuanxiao Dong <chuanxiao.dong@intel.com>
    mmc: debugfs: correct wrong voltage value

Russell King <rmk+kernel@arm.linux.org.uk>
    mmc: sd: limit SD card power limit according to cards capabilities

Jisheng Zhang <jszhang@marvell.com>
    mmc: sdhci: restore behavior when setting VDD via external regulator

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"

Maciej S. Szmigiero <mail@maciej.szmigiero.name>
    ASoC: fsl_ssi: mark SACNT register volatile

Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    ASoC: tegra_alc5632: check return value

Dan Carpenter <dan.carpenter@oracle.com>
    ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()

Robert Jarzmik <robert.jarzmik@free.fr>
    mtd: nand: pxa3xx_nand: fix dmaengine initialization

Boris Brezillon <boris.brezillon@free-electrons.com>
    mtd: nand: denali: add missing nand_release() call in denali_remove()

Eric Dumazet <edumazet@google.com>
    net: get rid of an signed integer overflow in ip_idents_reserve()

Chuck Lever <chuck.lever@oracle.com>
    NFS: Fix an LOCK/OPEN race when unlinking an open file

Ilan Peer <ilan.peer@intel.com>
    mac80211: Fix BW upgrade for TDLS peers

Arik Nemtsov <arik@wizery.com>
    mac80211: TDLS: change BW calculation for WIDER_BW peers

Arik Nemtsov <arik@wizery.com>
    mac80211: TDLS: always downgrade invalid chandefs

Johannes Berg <johannes.berg@intel.com>
    mac80211: fix mgmt-tx abort cookie and leak

Ilan Tayari <ilant@mellanox.com>
    xfrm: Fix memory leak of aead algorithm name

Mathias Krause <minipli@googlemail.com>
    xfrm_user: propagate sec ctx allocation errors

Alexey Kodanev <alexey.kodanev@oracle.com>
    net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key

Philipp Zabel <p.zabel@pengutronix.de>
    Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree

Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Input: gpio-keys - fix check for disabling unsupported keys

Dan Carpenter <dan.carpenter@oracle.com>
    Btrfs: clean up an error code in btrfs_init_space_info()

William Breathitt Gray <vilhelm.gray@gmail.com>
    isa: Call isa_bus_init before dependent ISA bus drivers register

Olaf Hering <olaf@aepfle.de>
    Drivers: hv: utils: use memdup_user in hvt_op_write

Krzysztof Kozlowski <k.kozlowski@samsung.com>
    serial: samsung: Fix possible out of bounds access on non-DT platform

Stephen Boyd <stephen.boyd@linaro.org>
    tty: serial: msm: Support more bauds

Simon Wunderlich <sw@simonwunderlich.de>
    batman-adv: replace WARN with rate limited output on non-existing VLAN

Sven Eckelmann <sven@open-mesh.com>
    batman-adv: Fix lockdep annotation of batadv_tlv_container_remove

David Ahern <dsa@cumulusnetworks.com>
    net: ipv6: tcp reset, icmp need to consider L3 domain

Sowmini Varadhan <sowmini.varadhan@oracle.com>
    RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock

Eric Dumazet <edumazet@google.com>
    tcp: do not set rtt_min to 1

Johannes Weiner <hannes@cmpxchg.org>
    net: tcp_memcontrol: properly detect ancestor socket pressure

Yotam Gigi <yotamg@mellanox.com>
    mlxsw: spectrum: Fix misuse of hard_header_len

Ido Schimmel <idosch@mellanox.com>
    mlxsw: spectrum: Indicate support for autonegotiation

Nogah Frankel <nogahf@mellanox.com>
    mlxsw: spectrum: Don't count internal TX header bytes to stats

Ido Schimmel <idosch@mellanox.com>
    mlxsw: spectrum: Disable learning according to STP state

Ido Schimmel <idosch@mellanox.com>
    mlxsw: spectrum: Don't forward packets when STP state is DISABLED

Honggang Li <honli@redhat.com>
    RDMA/cxgb3: device driver frees DMA memory with different size

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: xprt_rdma_free() must not release backchannel reqs

Chuck Lever <chuck.lever@oracle.com>
    xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)

Dan Carpenter <dan.carpenter@oracle.com>
    xprtrdma: checking for NULL instead of IS_ERR()

Raja Mani <rmani@qti.qualcomm.com>
    ath10k: free cached fw bin contents when get board id fails

Boris Brezillon <boris.brezillon@free-electrons.com>
    mtd: nand: fix ONFI parameter page layout

Eric Dumazet <edumazet@google.com>
    bonding: prevent out of bound accesses

Johan Hovold <johan@kernel.org>
    phy: fix device reference leaks

phil.turnbull@oracle.com <phil.turnbull@oracle.com>
    irda: Free skb on irda_accept error path.

Jiri Kosina <jkosina@suse.cz>
    btrfs: cleaner_kthread() doesn't need explicit freeze

WANG Cong <xiyou.wangcong@gmail.com>
    sch_tbf: update backlog as well

WANG Cong <xiyou.wangcong@gmail.com>
    sch_sfb: keep backlog updated with qlen

WANG Cong <xiyou.wangcong@gmail.com>
    sch_qfq: keep backlog updated with qlen

WANG Cong <xiyou.wangcong@gmail.com>
    sch_prio: update backlog as well

WANG Cong <xiyou.wangcong@gmail.com>
    sch_hfsc: always keep backlog updated

WANG Cong <xiyou.wangcong@gmail.com>
    sch_drr: update backlog as well

WANG Cong <xiyou.wangcong@gmail.com>
    net_sched: keep backlog updated with qlen

Matthew Finlay <matt@mellanox.com>
    net/mlx5e: Copy all L2 headers into inline segment

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Fix pci error recovery flow

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Add timeout handle to commands with callback

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Fix potential deadlock in command mode change

Daniel Jurgens <danielj@mellanox.com>
    net/mlx5: Fix wait_vital for VFs and remove fixed sleep

Mohamad Haj Yahia <mohamad@mellanox.com>
    net/mlx5: Avoid calling sleeping function by the health poll thread

Wang Sheng-Hui <shhuiw@foxmail.com>
    net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create

Eli Cohen <eli@mellanox.com>
    net/mlx5e: Fix blue flame quota logic

Majd Dibbiny <majd@mellanox.com>
    net/mlx5: Fix masking of reserved bits in XRCD number

Majd Dibbiny <majd@mellanox.com>
    net/mlx5: Fix the size of modify QP mailbox

Rana Shahout <ranas@mellanox.com>
    net/mlx5e: Fix MLX5E_100BASE_T define

Eran Ben Elisha <eranbe@mellanox.com>
    IB/mlx5: Fix FW version diaplay in sysfs

Or Gerlitz <ogerlitz@mellanox.com>
    net/mlx5: Make command timeout way shorter

Leon Romanovsky <leon@leon.nu>
    IB/mlx5: Fix RC transport send queue overhead computation

Noa Osherovich <noaos@mellanox.com>
    net/mlx5: Avoid passing dma address 0 to firmware

Peter Griffin <peter.griffin@linaro.org>
    c8sectpfe: Rework firmware loading mechanism

Brian Norris <computersforpeace@gmail.com>
    firmware: actually return NULL on failed request_firmware_nowait()

Alexey Kardashevskiy <aik@ozlabs.ru>
    powerpc/pci/of: Parse unassigned resources

Alexander Duyck <aduyck@mirantis.com>
    GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU

Nicolas Dichtel <nicolas.dichtel@6wind.com>
    ovs/gre,geneve: fix error path when creating an iface

Matan Barak <matanb@mellanox.com>
    IB/mlx4: Initialize hop_limit when creating address handle

Ido Schimmel <idosch@mellanox.com>
    mlxsw: Treat local port 64 as valid

Franky Lin <franky.lin@broadcom.com>
    brcmfmac: add eth_type_trans back for PCIe full dongle

Alex Williamson <alex.williamson@redhat.com>
    vfio/pci: Allow VPD short read

Bjorn Helgaas <bhelgaas@google.com>
    alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO

Daniel Jurgens <danielj@mellanox.com>
    net/mlx4_core: Implement pci_resume callback

Bjorn Helgaas <bhelgaas@google.com>
    PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()

Ido Schimmel <idosch@mellanox.com>
    mlxsw: pci: Correctly determine if descriptor queue is full

Daniel Jurgens <danielj@mellanox.com>
    net/mlx4_core: Do not BUG_ON during reset when PCI is offline

Willem de Bruijn <willemb@google.com>
    dccp: limit sk_filter trim to payload

Chin-Ran Lo <crlo@marvell.com>
    Bluetooth: btmrvl: fix hung task warning dump

Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    iwlwifi: set max firmware version of 7265 to 17

Amitkumar Karwar <akarwar@marvell.com>
    mwifiex: add missing check for PCIe8997 chipset

chunfan chen <jeffc@marvell.com>
    mwifiex: fix IBSS data path issue.

Vegard Nossum <vegard.nossum@oracle.com>
    xfrm: fix crash in XFRM_MSG_GETSA netlink handler

Pablo Neira Ayuso <pablo@netfilter.org>
    netfilter: nfnetlink: use original skbuff when acking batches

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ALSA: fm801: detect FM-only card earlier

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ALSA: fm801: propagate TUNER_ONLY bit when autodetected

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ALSA: fm801: explicitly free IRQ line

Dan Carpenter <dan.carpenter@oracle.com>
    x86/apic/uv: Silence a shift wrapping warning

Jan Beulich <JBeulich@suse.com>
    x86/LDT: Print the real LDT base address

Stephane Eranian <eranian@google.com>
    perf/x86: Fix filter_events() bug with event mappings

Suman Anna <s-anna@ti.com>
    ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence

Heinrich Schuchardt <xypron.glpk@gmx.de>
    ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile

Heinrich Schuchardt <xypron.glpk@gmx.de>
    ARM: dts: kirkwood: use unique machine name for ds112

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl

Roger Shimizu <rogershimizu@gmail.com>
    ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl

Arnd Bergmann <arnd@arndb.de>
    ARM: imx: select SRC for i.MX7

Geert Uytterhoeven <geert+renesas@glider.be>
    ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz

Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
    mips/panic: replace smp_send_stop() with kdump friendly version in panic path

James Hogan <james.hogan@imgtec.com>
    MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO

Dan Carpenter <dan.carpenter@oracle.com>
    MIPS: RM7000: Double locking bug in rm7k_tc_disable()

Daniel Borkmann <daniel@iogearbox.net>
    bpf, mips: fix off-by-one in ctx offset allocation

Dan Carpenter <dan.carpenter@oracle.com>
    MIPS: Octeon: Off by one in octeon_irq_gpio_map()

James Hogan <james.hogan@imgtec.com>
    MIPS: c-r4k: Fix protected_writeback_scache_line for EVA

James Hogan <james.hogan@imgtec.com>
    MIPS: SMP: Update cpu_foreign_map on CPU disable

James Hogan <james.hogan@imgtec.com>
    MIPS: KVM: Fix translation of MFC0 ErrCtl

James Hogan <james.hogan@imgtec.com>
    MIPS: Fix little endian microMIPS MSA encodings

James Hogan <james.hogan@imgtec.com>
    MIPS: Fix 64-bit HTW configuration

James Hogan <james.hogan@imgtec.com>
    MIPS: perf: Fix I6400 event numbers

Paul Burton <paul.burton@imgtec.com>
    MIPS: math-emu: Fix m{add,sub}.s shifts

Paul Burton <paul.burton@imgtec.com>
    MIPS: Fix BC1{EQ,NE}Z return offset calculation

Paul Burton <paul.burton@imgtec.com>
    MIPS: math-emu: Fix BC1{EQ,NE}Z emulation

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435

James Hogan <james.hogan@imgtec.com>
    MIPS: Fix HTW config on XPA kernel without LPA enabled

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: Pretty print BMIPS5200 processor name

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: BMIPS5000 has I cache filing from D cache

Matt Redfearn <matt.redfearn@imgtec.com>
    MIPS: scall: Handle seccomp filters which redirect syscalls

Paul Burton <paul.burton@imgtec.com>
    MIPS: smp-cps: Stop printing EJTAG exceptions to UART

Florian Fainelli <f.fainelli@gmail.com>
    MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200

James Hogan <james.hogan@imgtec.com>
    MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]

Jaedon Shin <jaedon.shin@gmail.com>
    MIPS: Fix macro typo

Felipe Balbi <felipe.balbi@linux.intel.com>
    usb: gadget: udc: core: don't starve DMA resources

Iago Abal <mail@iagoabal.eu>
    usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    usb: gadged: pch_udc: get rid of redundant assignments

Krzysztof Opasiak <k.opasiak@samsung.com>
    usb: gadget: f_acm: Fix configfs attr name

Ben Hutchings <ben@decadent.org.uk>
    staging: rtl8192u: Fix crash due to pointers being "confusing"

Vasily Averin <vvs@virtuozzo.com>
    drm/qxl: qxl_release leak in qxl_draw_dirty_fb()

Vasily Averin <vvs@virtuozzo.com>
    drm/qxl: qxl_release use after free

Amitkumar Karwar <akarwar@marvell.com>
    mwifiex: fix PCIe register information for 8997 chipset


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/alpha/kernel/pci-sysfs.c                      |   4 +-
 arch/arm/boot/dts/Makefile                         |   1 +
 arch/arm/boot/dts/kirkwood-ds112.dts               |   2 +-
 arch/arm/boot/dts/kirkwood-lswvl.dts               |  25 +--
 arch/arm/boot/dts/kirkwood-lswxl.dts               |  31 ++--
 arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts   |  39 ++++-
 arch/arm/boot/dts/r8a7740-armadillo800eva.dts      |   2 +-
 arch/arm/mach-imx/Kconfig                          |   1 +
 arch/arm/mach-omap2/omap_hwmod.c                   |  12 +-
 arch/arm64/net/bpf_jit_comp.c                      |   1 +
 arch/mips/boot/dts/brcm/bcm7435.dtsi               |   2 +-
 arch/mips/cavium-octeon/octeon-irq.c               |   2 +-
 arch/mips/cavium-octeon/setup.c                    |  14 ++
 arch/mips/cavium-octeon/smp.c                      |   1 +
 arch/mips/include/asm/asmmacro.h                   |  99 ++++++------
 arch/mips/include/asm/elf.h                        |   1 +
 arch/mips/include/asm/kexec.h                      |   1 +
 arch/mips/include/asm/msa.h                        |  21 +--
 arch/mips/include/asm/r4kcache.h                   |   4 +
 arch/mips/include/asm/smp.h                        |   2 +
 arch/mips/include/uapi/asm/auxvec.h                |   2 +
 arch/mips/kernel/bmips_vec.S                       |   9 +-
 arch/mips/kernel/branch.c                          |  18 +--
 arch/mips/kernel/cps-vec.S                         |   1 -
 arch/mips/kernel/cpu-probe.c                       |   5 +-
 arch/mips/kernel/crash.c                           |  18 ++-
 arch/mips/kernel/machine_kexec.c                   |   1 +
 arch/mips/kernel/perf_event_mipsxx.c               |  60 ++++++-
 arch/mips/kernel/ptrace.c                          |   3 -
 arch/mips/kernel/scall32-o32.S                     |  11 +-
 arch/mips/kernel/scall64-64.S                      |   3 +-
 arch/mips/kernel/scall64-n32.S                     |  14 +-
 arch/mips/kernel/scall64-o32.S                     |  14 +-
 arch/mips/kernel/setup.c                           |   2 +-
 arch/mips/kernel/smp-bmips.c                       |   1 +
 arch/mips/kernel/smp-cps.c                         |   1 +
 arch/mips/kernel/smp.c                             |   2 +-
 arch/mips/kvm/dyntrans.c                           |   2 +-
 arch/mips/loongson64/loongson-3/smp.c              |   1 +
 arch/mips/math-emu/cp1emu.c                        |  11 +-
 arch/mips/math-emu/ieee754sp.c                     |   3 +-
 arch/mips/math-emu/ieee754sp.h                     |  16 +-
 arch/mips/math-emu/sp_add.c                        |   6 +-
 arch/mips/math-emu/sp_maddf.c                      |  13 +-
 arch/mips/math-emu/sp_sub.c                        |   6 +-
 arch/mips/mm/c-r4k.c                               |  13 +-
 arch/mips/mm/sc-rm7k.c                             |   2 +-
 arch/mips/mm/tlbex.c                               |  16 +-
 arch/mips/net/bpf_jit.c                            |   2 +-
 arch/powerpc/kernel/mce.c                          |   3 +-
 arch/powerpc/kernel/pci_of_scan.c                  |  12 +-
 arch/powerpc/kernel/tm.S                           |   3 +-
 arch/powerpc/platforms/powernv/opal.c              |   1 +
 arch/x86/kernel/apic/x2apic_uv_x.c                 |   4 +-
 arch/x86/kernel/cpu/perf_event.c                   |  11 +-
 arch/x86/kernel/process_64.c                       |   2 +-
 block/blk-mq.c                                     |   2 +-
 drivers/acpi/acpi_lpss.c                           |   8 +-
 drivers/ata/sata_dwc_460ex.c                       |   4 +-
 drivers/base/firmware_class.c                      |   8 +-
 drivers/base/isa.c                                 |   2 +-
 drivers/bluetooth/btmrvl_sdio.c                    |   3 +-
 drivers/char/hw_random/exynos-rng.c                |   9 ++
 drivers/clk/clk-gpio.c                             |   6 +-
 drivers/clk/clk-multiplier.c                       |  20 ++-
 drivers/clk/clk-xgene.c                            |  10 +-
 drivers/clk/imx/clk-pllv3.c                        |   8 +-
 drivers/clk/rockchip/clk-mmc-phase.c               |  11 --
 drivers/clk/st/clkgen-fsyn.c                       |  17 +-
 drivers/clk/ti/dpll3xxx.c                          |   3 +-
 drivers/cpufreq/cpufreq.c                          |   5 -
 drivers/dma/edma.c                                 |   6 +
 drivers/gpu/drm/qxl/qxl_cmd.c                      |   5 +-
 drivers/gpu/drm/qxl/qxl_display.c                  |   6 +-
 drivers/gpu/drm/qxl/qxl_draw.c                     |  13 +-
 drivers/gpu/drm/qxl/qxl_ioctl.c                    |   5 +-
 drivers/hv/hv_utils_transport.c                    |   9 +-
 drivers/iio/adc/ad7793.c                           |   2 +-
 drivers/infiniband/hw/cxgb3/cxio_hal.c             |   2 +-
 drivers/infiniband/hw/mlx4/ah.c                    |   1 +
 drivers/infiniband/hw/mlx5/main.c                  |   2 +-
 drivers/infiniband/hw/mlx5/qp.c                    |  12 +-
 drivers/input/keyboard/gpio_keys.c                 |  29 +++-
 drivers/input/touchscreen/edt-ft5x06.c             |  18 ++-
 drivers/iommu/dma-iommu.c                          |  11 +-
 drivers/md/dm.c                                    |   2 +-
 drivers/media/pci/cx23885/cx23885-av.c             |   2 +-
 drivers/media/platform/am437x/am437x-vpfe.c        |   2 +-
 .../media/platform/sti/c8sectpfe/c8sectpfe-core.c  |  65 +++-----
 drivers/media/rc/rc-main.c                         |   2 +-
 drivers/memory/tegra/tegra124.c                    |   1 +
 drivers/mfd/lp8788-irq.c                           |   2 +-
 drivers/misc/cxl/fault.c                           |   2 +-
 drivers/mmc/card/block.c                           |   4 +-
 drivers/mmc/core/debugfs.c                         |   2 +-
 drivers/mmc/core/sd.c                              |  20 ++-
 drivers/mmc/host/dw_mmc-rockchip.c                 |  64 ++++++++
 drivers/mmc/host/moxart-mmc.c                      |   5 +-
 drivers/mmc/host/sdhci-pxav3.c                     |  22 +++
 drivers/mmc/host/sdhci.c                           |  44 +++--
 drivers/mmc/host/sdhci.h                           |   4 +
 drivers/mtd/nand/denali.c                          |  11 +-
 drivers/mtd/nand/pxa3xx_nand.c                     |   2 +-
 drivers/net/bonding/bond_3ad.c                     |  11 +-
 drivers/net/bonding/bond_alb.c                     |   7 +-
 drivers/net/bonding/bond_netlink.c                 |   3 +-
 drivers/net/dsa/mv88e6xxx.c                        |   9 +-
 drivers/net/ethernet/agere/et131x.c                |   2 +-
 drivers/net/ethernet/broadcom/bcmsysport.c         |   5 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   6 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c     |  11 +-
 drivers/net/ethernet/brocade/bna/bnad_ethtool.c    |   7 +-
 drivers/net/ethernet/cadence/macb.c                |   4 +-
 drivers/net/ethernet/chelsio/cxgb4/sge.c           |   2 +-
 drivers/net/ethernet/chelsio/cxgb4vf/sge.c         |   2 +-
 drivers/net/ethernet/cirrus/ep93xx_eth.c           |   4 +
 drivers/net/ethernet/emulex/benet/be.h             |   1 +
 drivers/net/ethernet/emulex/benet/be_main.c        |   4 +
 drivers/net/ethernet/ethoc.c                       |  10 +-
 drivers/net/ethernet/hisilicon/hns/hnae.c          |   8 +-
 drivers/net/ethernet/ibm/ehea/ehea_main.c          |   9 +-
 drivers/net/ethernet/intel/i40e/i40e_hmc.c         |   2 +-
 drivers/net/ethernet/marvell/mv643xx_eth.c         |   4 +-
 drivers/net/ethernet/marvell/mvneta.c              |  11 +-
 drivers/net/ethernet/marvell/mvpp2.c               |   2 +-
 drivers/net/ethernet/mellanox/mlx4/catas.c         |  11 +-
 drivers/net/ethernet/mellanox/mlx4/cmd.c           |   9 ++
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c     |  28 +++-
 drivers/net/ethernet/mellanox/mlx4/en_port.c       |   4 +-
 drivers/net/ethernet/mellanox/mlx4/fw.c            |   5 +-
 drivers/net/ethernet/mellanox/mlx4/fw.h            |   2 +-
 drivers/net/ethernet/mellanox/mlx4/intf.c          |   3 +
 drivers/net/ethernet/mellanox/mlx4/main.c          |  39 +++--
 drivers/net/ethernet/mellanox/mlx4/mcg.c           |  11 +-
 drivers/net/ethernet/mellanox/mlx4/mlx4.h          |   5 +-
 drivers/net/ethernet/mellanox/mlx4/port.c          |  13 +-
 .../net/ethernet/mellanox/mlx4/resource_tracker.c  |  10 +-
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c      | 117 ++++++++------
 drivers/net/ethernet/mellanox/mlx5/core/en.h       |   2 +-
 .../net/ethernet/mellanox/mlx5/core/en_ethtool.c   |   8 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c    |   7 +-
 drivers/net/ethernet/mellanox/mlx5/core/health.c   |  11 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |  84 +++++-----
 .../net/ethernet/mellanox/mlx5/core/pagealloc.c    |  26 ++-
 drivers/net/ethernet/mellanox/mlx5/core/qp.c       |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/wq.c       |  15 +-
 drivers/net/ethernet/mellanox/mlxsw/pci.c          |   2 +-
 drivers/net/ethernet/mellanox/mlxsw/port.h         |   2 +-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |  11 +-
 .../ethernet/mellanox/mlxsw/spectrum_switchdev.c   |   4 +-
 drivers/net/ethernet/mellanox/mlxsw/switchx2.c     |   3 +-
 drivers/net/ethernet/micrel/ks8842.c               |  10 +-
 drivers/net/ethernet/moxa/moxart_ether.c           |   4 +-
 drivers/net/ethernet/qlogic/qede/qede_main.c       |   2 +-
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c     |   2 +-
 .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c   |   8 +-
 drivers/net/ethernet/renesas/ravb_main.c           |   2 +
 drivers/net/ethernet/sfc/ef10.c                    |   3 +-
 drivers/net/ethernet/sfc/efx.c                     |   3 +
 .../net/ethernet/stmicro/stmmac/dwmac-generic.c    |  12 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c     |  11 +-
 drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c    |  11 +-
 drivers/net/ethernet/ti/cpsw-phy-sel.c             |   3 +
 drivers/net/ethernet/ti/cpsw.c                     |  14 +-
 drivers/net/ethernet/ti/davinci_emac.c             |   7 +-
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c  |   4 +-
 drivers/net/geneve.c                               |  14 +-
 drivers/net/macvlan.c                              |  10 +-
 drivers/net/macvtap.c                              |   2 +-
 drivers/net/phy/at803x.c                           |   6 +-
 drivers/net/phy/bcm7xxx.c                          |   2 +-
 drivers/net/phy/mdio-sun4i.c                       |   4 +-
 drivers/net/phy/micrel.c                           |  12 +-
 drivers/net/phy/phy.c                              |  46 +++---
 drivers/net/phy/phy_device.c                       |   2 +
 drivers/net/vrf.c                                  | 177 ++-------------------
 drivers/net/vxlan.c                                |  62 +++++---
 drivers/net/wimax/i2400m/usb-fw.c                  |   1 +
 drivers/net/wireless/ath/ath10k/core.c             |   2 +-
 drivers/net/wireless/ath/ath9k/htc_hst.c           |   2 +-
 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c |  16 ++
 drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c |  22 ++-
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c   |   2 +
 drivers/net/wireless/iwlwifi/iwl-7000.c            |   2 +-
 drivers/net/wireless/mwifiex/pcie.h                |   9 +-
 drivers/net/wireless/mwifiex/sta_event.c           |  10 +-
 drivers/net/wireless/mwifiex/wmm.c                 |   6 +-
 drivers/of/of_mdio.c                               |   5 +-
 drivers/pci/pci-sysfs.c                            |   7 +-
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |   2 +-
 drivers/pinctrl/pinctrl-tegra.c                    |   2 +-
 drivers/power/bq27xxx_battery.c                    |  20 ++-
 drivers/power/ipaq_micro_battery.c                 |   2 +-
 drivers/power/test_power.c                         |   2 +
 drivers/power/tps65217_charger.c                   |   6 +-
 drivers/regulator/core.c                           |  38 +++--
 drivers/scsi/cxgbi/libcxgbi.c                      |   1 +
 drivers/spi/spi-rockchip.c                         |  12 +-
 drivers/staging/media/lirc/lirc_imon.c             |   2 +
 drivers/staging/rtl8192u/r8192U_core.c             |   4 +-
 drivers/target/target_core_configfs.c              |   6 +-
 drivers/tty/serial/msm_serial.c                    |  99 ++++++++----
 drivers/tty/serial/samsung.c                       |   4 +-
 drivers/usb/gadget/function/f_acm.c                |   4 +-
 drivers/usb/gadget/udc/pch_udc.c                   |  30 ++--
 drivers/usb/gadget/udc/udc-core.c                  |   2 +-
 drivers/vfio/pci/vfio_pci_config.c                 |   3 +-
 .../vfio/platform/reset/vfio_platform_amdxgbe.c    |   2 +-
 fs/btrfs/disk-io.c                                 |   2 +-
 fs/btrfs/extent-tree.c                             |   2 +-
 fs/cifs/connect.c                                  |   2 +
 fs/gfs2/file.c                                     |   5 +-
 fs/nfs/nfs4proc.c                                  |   4 +
 include/asm-generic/preempt.h                      |   4 +-
 include/linux/cpufreq.h                            |   4 -
 include/linux/ieee80211.h                          |   9 ++
 include/linux/mlx5/driver.h                        |   3 +-
 include/linux/mlx5/qp.h                            |   1 +
 include/linux/mtd/nand.h                           |   4 +-
 include/linux/netdevice.h                          |   5 +-
 include/linux/sunrpc/msg_prot.h                    |   4 +-
 include/net/bonding.h                              |   7 +-
 include/net/ip6_fib.h                              |   2 +
 include/net/ip6_route.h                            |   3 +
 include/net/ip_fib.h                               |   3 +-
 include/net/route.h                                |   3 +
 include/net/sch_generic.h                          |   5 +-
 include/net/sock.h                                 |  18 ++-
 include/net/xfrm.h                                 |   4 +-
 kernel/bpf/syscall.c                               |   4 +-
 kernel/sched/fair.c                                |  27 ++--
 kernel/trace/bpf_trace.c                           |   4 +
 lib/mpi/longlong.h                                 |  34 ++--
 net/batman-adv/main.c                              |   2 +-
 net/batman-adv/translation-table.c                 |   6 +-
 net/bridge/br_fdb.c                                |  52 +++---
 net/bridge/br_input.c                              |   7 +-
 net/core/dev.c                                     |   1 +
 net/core/flow_dissector.c                          |  17 +-
 net/core/rtnetlink.c                               |   1 +
 net/core/skbuff.c                                  |  10 +-
 net/core/sock.c                                    |   7 +-
 net/dccp/ipv4.c                                    |   2 +-
 net/dccp/ipv6.c                                    |   2 +-
 net/dsa/slave.c                                    |   7 +-
 net/ipv4/devinet.c                                 |  12 +-
 net/ipv4/fib_frontend.c                            |   3 +-
 net/ipv4/fib_semantics.c                           |   8 +-
 net/ipv4/fib_trie.c                                |   4 +-
 net/ipv4/fou.c                                     |   6 +
 net/ipv4/gre_offload.c                             |   8 +
 net/ipv4/icmp.c                                    |   4 +-
 net/ipv4/ip_gre.c                                  |  46 ++++--
 net/ipv4/ip_sockglue.c                             |   7 +-
 net/ipv4/netfilter/nft_dup_ipv4.c                  |   6 +-
 net/ipv4/route.c                                   |  17 +-
 net/ipv4/tcp_input.c                               |   5 +-
 net/ipv4/udp.c                                     |  13 +-
 net/ipv6/addrconf.c                                |  21 ++-
 net/ipv6/icmp.c                                    |   5 +-
 net/ipv6/ip6_checksum.c                            |   7 +-
 net/ipv6/ip6_vti.c                                 |   4 +-
 net/ipv6/ip6mr.c                                   |  13 +-
 net/ipv6/netfilter/nft_dup_ipv6.c                  |   6 +-
 net/ipv6/route.c                                   |  75 ++++++---
 net/ipv6/tcp_ipv6.c                                |   7 +-
 net/ipv6/udp.c                                     |   6 +-
 net/ipv6/xfrm6_input.c                             |  15 +-
 net/ipv6/xfrm6_tunnel.c                            |   2 +-
 net/irda/af_irda.c                                 |   5 +-
 net/l2tp/l2tp_core.c                               |   3 +
 net/mac80211/ieee80211_i.h                         |   4 +
 net/mac80211/mlme.c                                |   2 +-
 net/mac80211/offchannel.c                          |   5 +-
 net/mac80211/rx.c                                  |   8 +-
 net/mac80211/status.c                              |   5 +-
 net/mac80211/tdls.c                                |  43 ++++-
 net/mac80211/tx.c                                  |   2 +-
 net/mac80211/vht.c                                 |  30 +++-
 net/netfilter/nf_tables_api.c                      |   4 +-
 net/netfilter/nf_tables_core.c                     |   2 +-
 net/netfilter/nfnetlink.c                          |   6 +-
 net/netfilter/nft_dynset.c                         |   3 +
 net/nfc/nci/core.c                                 |   6 +-
 net/openvswitch/actions.c                          |  20 ++-
 net/rds/tcp.c                                      |   2 +-
 net/rds/tcp_listen.c                               |  40 +++--
 net/sched/cls_bpf.c                                |  13 +-
 net/sched/cls_flower.c                             |  28 ++--
 net/sched/sch_drr.c                                |   4 +
 net/sched/sch_fq.c                                 |  32 ++--
 net/sched/sch_fq_codel.c                           |   2 +-
 net/sched/sch_generic.c                            |  11 +-
 net/sched/sch_hfsc.c                               |  12 +-
 net/sched/sch_prio.c                               |   4 +
 net/sched/sch_qfq.c                                |   3 +
 net/sched/sch_sfb.c                                |   3 +
 net/sched/sch_tbf.c                                |   4 +
 net/sctp/associola.c                               |   2 +-
 net/sctp/sm_make_chunk.c                           |   6 +-
 net/sctp/transport.c                               |   2 +-
 net/sunrpc/xprtrdma/backchannel.c                  |  22 +--
 net/sunrpc/xprtrdma/transport.c                    |   3 +
 net/sunrpc/xprtrdma/verbs.c                        |  41 ++---
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   2 +-
 net/tipc/udp_media.c                               |   5 +-
 net/xfrm/xfrm_input.c                              |  14 +-
 net/xfrm/xfrm_state.c                              |   1 +
 net/xfrm/xfrm_user.c                               |  15 +-
 scripts/config                                     |   5 +-
 sound/pci/fm801.c                                  |  71 +++++----
 sound/pci/hda/hda_intel.c                          |   9 +-
 sound/soc/fsl/fsl_ssi.c                            |   8 +-
 sound/soc/intel/atom/sst/sst_stream.c              |   2 +-
 sound/soc/tegra/tegra_alc5632.c                    |  12 +-
 tools/perf/util/perf_regs.c                        |   8 +-
 tools/testing/selftests/ipc/msgque.c               |   2 +-
 318 files changed, 2119 insertions(+), 1364 deletions(-)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 001/312] mwifiex: fix PCIe register information for 8997 chipset
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 002/312] drm/qxl: qxl_release use after free Greg Kroah-Hartman
                   ` (312 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Amitkumar Karwar, Shengzhen Li, Kalle Valo

From: Amitkumar Karwar <akarwar@marvell.com>

commit ce0c58d998410fb91c63a70e749e98bb0e67eb67 upstream.

This patch corrects some information in mwifiex_pcie_card_reg()
structure for 8997 chipset

Fixes: 6d85ef00d9dfe ("mwifiex: add support for 8997 chipset")
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Shengzhen Li <szli@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/pcie.h |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -210,17 +210,17 @@ static const struct mwifiex_pcie_card_re
 	.cmdrsp_addr_lo = PCIE_SCRATCH_4_REG,
 	.cmdrsp_addr_hi = PCIE_SCRATCH_5_REG,
 	.tx_rdptr = 0xC1A4,
-	.tx_wrptr = 0xC1A8,
-	.rx_rdptr = 0xC1A8,
+	.tx_wrptr = 0xC174,
+	.rx_rdptr = 0xC174,
 	.rx_wrptr = 0xC1A4,
 	.evt_rdptr = PCIE_SCRATCH_10_REG,
 	.evt_wrptr = PCIE_SCRATCH_11_REG,
 	.drv_rdy = PCIE_SCRATCH_12_REG,
 	.tx_start_ptr = 16,
 	.tx_mask = 0x0FFF0000,
-	.tx_wrap_mask = 0x01FF0000,
+	.tx_wrap_mask = 0x1FFF0000,
 	.rx_mask = 0x00000FFF,
-	.rx_wrap_mask = 0x000001FF,
+	.rx_wrap_mask = 0x00001FFF,
 	.tx_rollover_ind = BIT(28),
 	.rx_rollover_ind = BIT(12),
 	.evt_rollover_ind = MWIFIEX_BD_FLAG_EVT_ROLLOVER_IND,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 002/312] drm/qxl: qxl_release use after free
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 001/312] mwifiex: fix PCIe register information for 8997 chipset Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 003/312] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() Greg Kroah-Hartman
                   ` (311 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vasily Averin, Gerd Hoffmann

From: Vasily Averin <vvs@virtuozzo.com>

commit 933db73351d359f74b14f4af095808260aff11f9 upstream.

qxl_release should not be accesses after qxl_push_*_ring_release() calls:
userspace driver can process submitted command quickly, move qxl_release
into release_ring, generate interrupt and trigger garbage collector.

It can lead to crashes in qxl driver or trigger memory corruption
in some kmalloc-192 slab object

Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() +
qxl_push_{cursor,command}_ring_release() calls to close that race window.

cc: stable@vger.kernel.org
Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d32419d9071@virtuozzo.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/qxl/qxl_cmd.c     |    5 ++---
 drivers/gpu/drm/qxl/qxl_display.c |    6 +++---
 drivers/gpu/drm/qxl/qxl_draw.c    |    8 ++++----
 drivers/gpu/drm/qxl/qxl_ioctl.c   |    5 +----
 4 files changed, 10 insertions(+), 14 deletions(-)

--- a/drivers/gpu/drm/qxl/qxl_cmd.c
+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
@@ -529,8 +529,8 @@ int qxl_hw_surface_alloc(struct qxl_devi
 	/* no need to add a release to the fence for this surface bo,
 	   since it is only released when we ask to destroy the surface
 	   and it would never signal otherwise */
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
 
 	surf->hw_surf_alloc = true;
 	spin_lock(&qdev->surf_id_idr_lock);
@@ -572,9 +572,8 @@ int qxl_hw_surface_dealloc(struct qxl_de
 	cmd->surface_id = id;
 	qxl_release_unmap(qdev, release, &cmd->release_info);
 
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
-
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false);
 
 	return 0;
 }
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -292,8 +292,8 @@ qxl_hide_cursor(struct qxl_device *qdev)
 	cmd->type = QXL_CURSOR_HIDE;
 	qxl_release_unmap(qdev, release, &cmd->release_info);
 
-	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 	return 0;
 }
 
@@ -390,8 +390,8 @@ static int qxl_crtc_cursor_set2(struct d
 	cmd->u.set.visible = 1;
 	qxl_release_unmap(qdev, release, &cmd->release_info);
 
-	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 
 	/* finish with the userspace bo */
 	ret = qxl_bo_reserve(user_bo, false);
@@ -450,8 +450,8 @@ static int qxl_crtc_cursor_move(struct d
 	cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y;
 	qxl_release_unmap(qdev, release, &cmd->release_info);
 
-	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false);
 
 	return 0;
 }
--- a/drivers/gpu/drm/qxl/qxl_draw.c
+++ b/drivers/gpu/drm/qxl/qxl_draw.c
@@ -245,8 +245,8 @@ void qxl_draw_opaque_fb(const struct qxl
 		qxl_bo_physical_address(qdev, dimage->bo, 0);
 	qxl_release_unmap(qdev, release, &drawable->release_info);
 
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 
 out_free_palette:
 	if (palette_bo)
@@ -385,8 +385,8 @@ void qxl_draw_dirty_fb(struct qxl_device
 	}
 	qxl_bo_kunmap(clips_bo);
 
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 
 out_release_backoff:
 	if (ret)
@@ -436,8 +436,8 @@ void qxl_draw_copyarea(struct qxl_device
 	drawable->u.copy_bits.src_pos.y = sy;
 	qxl_release_unmap(qdev, release, &drawable->release_info);
 
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 
 out_free_release:
 	if (ret)
@@ -480,8 +480,8 @@ void qxl_draw_fill(struct qxl_draw_fill
 
 	qxl_release_unmap(qdev, release, &drawable->release_info);
 
-	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 	qxl_release_fence_buffer_objects(release);
+	qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false);
 
 out_free_release:
 	if (ret)
--- a/drivers/gpu/drm/qxl/qxl_ioctl.c
+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
@@ -257,11 +257,8 @@ static int qxl_process_single_command(st
 			apply_surf_reloc(qdev, &reloc_info[i]);
 	}
 
+	qxl_release_fence_buffer_objects(release);
 	ret = qxl_push_command_ring_release(qdev, release, cmd->type, true);
-	if (ret)
-		qxl_release_backoff_reserve_list(release);
-	else
-		qxl_release_fence_buffer_objects(release);
 
 out_free_bos:
 out_free_release:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 003/312] drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 001/312] mwifiex: fix PCIe register information for 8997 chipset Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 002/312] drm/qxl: qxl_release use after free Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 004/312] staging: rtl8192u: Fix crash due to pointers being "confusing" Greg Kroah-Hartman
                   ` (310 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vasily Averin, Gerd Hoffmann

From: Vasily Averin <vvs@virtuozzo.com>

commit 85e9b88af1e6164f19ec71381efd5e2bcfc17620 upstream.

ret should be changed to release allocated struct qxl_release

Cc: stable@vger.kernel.org
Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b7153c3d4@virtuozzo.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/gpu/drm/qxl/qxl_draw.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/qxl/qxl_draw.c
+++ b/drivers/gpu/drm/qxl/qxl_draw.c
@@ -352,9 +352,10 @@ void qxl_draw_dirty_fb(struct qxl_device
 		goto out_release_backoff;
 
 	rects = drawable_set_clipping(qdev, drawable, num_clips, clips_bo);
-	if (!rects)
+	if (!rects) {
+		ret = -EINVAL;
 		goto out_release_backoff;
-
+	}
 	drawable = (struct qxl_drawable *)qxl_release_map(qdev, release);
 
 	drawable->clip.type = SPICE_CLIP_TYPE_RECTS;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 004/312] staging: rtl8192u: Fix crash due to pointers being "confusing"
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (2 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 003/312] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 005/312] usb: gadget: f_acm: Fix configfs attr name Greg Kroah-Hartman
                   ` (309 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ben Hutchings

From: Ben Hutchings <ben@decadent.org.uk>

commit c3f463484bdd0acd15abd5f92399041f79592d06 upstream.

There's no net_device stashed in skb->cb, there's a net_device * there.

To make it *really* clear, also change the write of the dev pointer
into skb->cb from a memcpy() to an assignment.

Fixes: 3fe563249374 ("staging: rtl8192u: r8192U_core.c: Cleaning up ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8192u/r8192U_core.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1050,7 +1050,7 @@ static void rtl8192_hard_data_xmit(struc
 
 	spin_lock_irqsave(&priv->tx_lock, flags);
 
-	memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev));
+	*(struct net_device **)(skb->cb) = dev;
 	tcb_desc->bTxEnableFwCalcDur = 1;
 	skb_push(skb, priv->ieee80211->tx_headroom);
 	ret = rtl8192_tx(dev, skb);
@@ -1092,7 +1092,7 @@ static int rtl8192_hard_start_xmit(struc
 static void rtl8192_tx_isr(struct urb *tx_urb)
 {
 	struct sk_buff *skb = (struct sk_buff *)tx_urb->context;
-	struct net_device *dev = (struct net_device *)(skb->cb);
+	struct net_device *dev = *(struct net_device **)(skb->cb);
 	struct r8192_priv *priv = NULL;
 	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
 	u8  queue_index = tcb_desc->queue_index;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 005/312] usb: gadget: f_acm: Fix configfs attr name
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (3 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 004/312] staging: rtl8192u: Fix crash due to pointers being "confusing" Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 006/312] usb: gadged: pch_udc: get rid of redundant assignments Greg Kroah-Hartman
                   ` (308 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Krzysztof Opasiak,
	Felipe Balbi

From: Krzysztof Opasiak <k.opasiak@samsung.com>

commit 0561f77e2db9e72dc32e4f82b56fca8ba6b31171 upstream.

Correct attribute name is port_num not num.

Fixes: ea6bd6b ("usb-gadget/f_acm: use per-attribute show and store methods")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Krzysztof Opasiak <k.opasiak@samsung.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_acm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -779,10 +779,10 @@ static ssize_t f_acm_port_num_show(struc
 	return sprintf(page, "%u\n", to_f_serial_opts(item)->port_num);
 }
 
-CONFIGFS_ATTR_RO(f_acm_port_, num);
+CONFIGFS_ATTR_RO(f_acm_, port_num);
 
 static struct configfs_attribute *acm_attrs[] = {
-	&f_acm_port_attr_num,
+	&f_acm_attr_port_num,
 	NULL,
 };
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 006/312] usb: gadged: pch_udc: get rid of redundant assignments
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (4 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 005/312] usb: gadget: f_acm: Fix configfs attr name Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 007/312] usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock Greg Kroah-Hartman
                   ` (307 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Felipe Balbi

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 6b968737c3efe7cdaa5407afec972cd7c7d3ca35 upstream.

It seems there are leftovers of some assignments which are not used
anymore.  Compiler even warns us about:

drivers/usb/gadget/udc/pch_udc.c:2022:22: warning: variable ‘dev’ set \
but not used [-Wunused-but-set-variable]

drivers/usb/gadget/udc/pch_udc.c:2639:9: warning: variable ‘ret’ set \
but not used [-Wunused-but-set-variable]

Remove them and shut compiler about.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/pch_udc.c |   18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1731,14 +1731,12 @@ static int pch_udc_pcd_ep_enable(struct
 static int pch_udc_pcd_ep_disable(struct usb_ep *usbep)
 {
 	struct pch_udc_ep	*ep;
-	struct pch_udc_dev	*dev;
 	unsigned long	iflags;
 
 	if (!usbep)
 		return -EINVAL;
 
 	ep = container_of(usbep, struct pch_udc_ep, ep);
-	dev = ep->dev;
 	if ((usbep->name == ep0_string) || !ep->ep.desc)
 		return -EINVAL;
 
@@ -1769,12 +1767,10 @@ static struct usb_request *pch_udc_alloc
 	struct pch_udc_request		*req;
 	struct pch_udc_ep		*ep;
 	struct pch_udc_data_dma_desc	*dma_desc;
-	struct pch_udc_dev		*dev;
 
 	if (!usbep)
 		return NULL;
 	ep = container_of(usbep, struct pch_udc_ep, ep);
-	dev = ep->dev;
 	req = kzalloc(sizeof *req, gfp);
 	if (!req)
 		return NULL;
@@ -1947,12 +1943,10 @@ static int pch_udc_pcd_dequeue(struct us
 {
 	struct pch_udc_ep	*ep;
 	struct pch_udc_request	*req;
-	struct pch_udc_dev	*dev;
 	unsigned long		flags;
 	int ret = -EINVAL;
 
 	ep = container_of(usbep, struct pch_udc_ep, ep);
-	dev = ep->dev;
 	if (!usbep || !usbreq || (!ep->ep.desc && ep->num))
 		return ret;
 	req = container_of(usbreq, struct pch_udc_request, req);
@@ -1984,14 +1978,12 @@ static int pch_udc_pcd_dequeue(struct us
 static int pch_udc_pcd_set_halt(struct usb_ep *usbep, int halt)
 {
 	struct pch_udc_ep	*ep;
-	struct pch_udc_dev	*dev;
 	unsigned long iflags;
 	int ret;
 
 	if (!usbep)
 		return -EINVAL;
 	ep = container_of(usbep, struct pch_udc_ep, ep);
-	dev = ep->dev;
 	if (!ep->ep.desc && !ep->num)
 		return -EINVAL;
 	if (!ep->dev->driver || (ep->dev->gadget.speed == USB_SPEED_UNKNOWN))
@@ -2029,14 +2021,12 @@ static int pch_udc_pcd_set_halt(struct u
 static int pch_udc_pcd_set_wedge(struct usb_ep *usbep)
 {
 	struct pch_udc_ep	*ep;
-	struct pch_udc_dev	*dev;
 	unsigned long iflags;
 	int ret;
 
 	if (!usbep)
 		return -EINVAL;
 	ep = container_of(usbep, struct pch_udc_ep, ep);
-	dev = ep->dev;
 	if (!ep->ep.desc && !ep->num)
 		return -EINVAL;
 	if (!ep->dev->driver || (ep->dev->gadget.speed == USB_SPEED_UNKNOWN))
@@ -2646,7 +2636,7 @@ static void pch_udc_svc_enum_interrupt(s
 static void pch_udc_svc_intf_interrupt(struct pch_udc_dev *dev)
 {
 	u32 reg, dev_stat = 0;
-	int i, ret;
+	int i;
 
 	dev_stat = pch_udc_read_device_status(dev);
 	dev->cfg_data.cur_intf = (dev_stat & UDC_DEVSTS_INTF_MASK) >>
@@ -2675,7 +2665,7 @@ static void pch_udc_svc_intf_interrupt(s
 	}
 	dev->stall = 0;
 	spin_lock(&dev->lock);
-	ret = dev->driver->setup(&dev->gadget, &dev->setup_data);
+	dev->driver->setup(&dev->gadget, &dev->setup_data);
 	spin_unlock(&dev->lock);
 }
 
@@ -2686,7 +2676,7 @@ static void pch_udc_svc_intf_interrupt(s
  */
 static void pch_udc_svc_cfg_interrupt(struct pch_udc_dev *dev)
 {
-	int i, ret;
+	int i;
 	u32 reg, dev_stat = 0;
 
 	dev_stat = pch_udc_read_device_status(dev);
@@ -2712,7 +2702,7 @@ static void pch_udc_svc_cfg_interrupt(st
 
 	/* call gadget zero with setup data received */
 	spin_lock(&dev->lock);
-	ret = dev->driver->setup(&dev->gadget, &dev->setup_data);
+	dev->driver->setup(&dev->gadget, &dev->setup_data);
 	spin_unlock(&dev->lock);
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 007/312] usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (5 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 006/312] usb: gadged: pch_udc: get rid of redundant assignments Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:29 ` [PATCH 4.4 008/312] usb: gadget: udc: core: dont starve DMA resources Greg Kroah-Hartman
                   ` (306 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Iago Abal, Felipe Balbi

From: Iago Abal <mail@iagoabal.eu>

commit 1d23d16a88e6c8143b07339435ba061b131ebb8c upstream.

The above commit reordered spin_lock/unlock and now `&dev->lock' is acquired
(rather than released) before calling `dev->driver->disconnect',
`dev->driver->setup', `dev->driver->suspend', `usb_gadget_giveback_request', and
`usb_gadget_udc_reset'.

But this *may* not be the right way to fix the problem pointed by d3cb25a12138.

Note that the other usb/gadget/udc drivers do release the lock before calling
these functions. There are also inconsistencies within pch_udc.c, where
`dev->driver->disconnect' is called while holding `&dev->lock' in lines 613 and
1184, but not in line 2739.

Finally, commit d3cb25a12138 may have introduced several potential deadlocks.

For instance, EBA (https://github.com/models-team/eba) reports:

    Double lock in drivers/usb/gadget/udc/pch_udc.c
    first at 2791: spin_lock(& dev->lock); [pch_udc_isr]
    second at 2694: spin_lock(& dev->lock); [pch_udc_svc_cfg_interrupt]
        after calling from 2793: pch_udc_dev_isr(dev, dev_intr);
        after calling from 2724: pch_udc_svc_cfg_interrupt(dev);

Similarly, other potential deadlocks are 2791 -> 2793 -> 2721 -> 2657; and
2791 -> 2793 -> 2711 -> 2573 -> 1499 -> 1480.

Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
Signed-off-by: Iago Abal <mail@iagoabal.eu>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/pch_udc.c |   16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1488,11 +1488,11 @@ static void complete_req(struct pch_udc_
 		req->dma_mapped = 0;
 	}
 	ep->halted = 1;
-	spin_lock(&dev->lock);
+	spin_unlock(&dev->lock);
 	if (!ep->in)
 		pch_udc_ep_clear_rrdy(ep);
 	usb_gadget_giveback_request(&ep->ep, &req->req);
-	spin_unlock(&dev->lock);
+	spin_lock(&dev->lock);
 	ep->halted = halted;
 }
 
@@ -2583,9 +2583,9 @@ static void pch_udc_svc_ur_interrupt(str
 		empty_req_queue(ep);
 	}
 	if (dev->driver) {
-		spin_lock(&dev->lock);
-		usb_gadget_udc_reset(&dev->gadget, dev->driver);
 		spin_unlock(&dev->lock);
+		usb_gadget_udc_reset(&dev->gadget, dev->driver);
+		spin_lock(&dev->lock);
 	}
 }
 
@@ -2664,9 +2664,9 @@ static void pch_udc_svc_intf_interrupt(s
 		dev->ep[i].halted = 0;
 	}
 	dev->stall = 0;
-	spin_lock(&dev->lock);
-	dev->driver->setup(&dev->gadget, &dev->setup_data);
 	spin_unlock(&dev->lock);
+	dev->driver->setup(&dev->gadget, &dev->setup_data);
+	spin_lock(&dev->lock);
 }
 
 /**
@@ -2701,9 +2701,9 @@ static void pch_udc_svc_cfg_interrupt(st
 	dev->stall = 0;
 
 	/* call gadget zero with setup data received */
-	spin_lock(&dev->lock);
-	dev->driver->setup(&dev->gadget, &dev->setup_data);
 	spin_unlock(&dev->lock);
+	dev->driver->setup(&dev->gadget, &dev->setup_data);
+	spin_lock(&dev->lock);
 }
 
 /**



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 008/312] usb: gadget: udc: core: dont starve DMA resources
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (6 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 007/312] usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock Greg Kroah-Hartman
@ 2020-05-08 12:29 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 009/312] MIPS: Fix macro typo Greg Kroah-Hartman
                   ` (305 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:29 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Balbi

From: Felipe Balbi <felipe.balbi@linux.intel.com>

commit 23fd537c9508fb6e3b93ddf23982f51afc087781 upstream.

Always unmap all SG entries as required by DMA API

Fixes: a698908d3b3b ("usb: gadget: add generic map/unmap request utilities")
Cc: <stable@vger.kernel.org> # v3.4+
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/udc/udc-core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -97,7 +97,7 @@ void usb_gadget_unmap_request(struct usb
 		return;
 
 	if (req->num_mapped_sgs) {
-		dma_unmap_sg(gadget->dev.parent, req->sg, req->num_mapped_sgs,
+		dma_unmap_sg(gadget->dev.parent, req->sg, req->num_sgs,
 				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
 		req->num_mapped_sgs = 0;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 009/312] MIPS: Fix macro typo
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (7 preceding siblings ...)
  2020-05-08 12:29 ` [PATCH 4.4 008/312] usb: gadget: udc: core: dont starve DMA resources Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 010/312] MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] Greg Kroah-Hartman
                   ` (304 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jaedon Shin, Alexander Sverdlin,
	Jonas Gorski, Masahiro Yamada, Paul Burton, Aaro Koskinen,
	linux-mips, Ralf Baechle

From: Jaedon Shin <jaedon.shin@gmail.com>

commit 2549cc967ebb4043f3507b55e3dc579f44d3b516 upstream.

Change the CONFIG_MIPS_CMDLINE_EXTEND to CONFIG_MIPS_CMDLINE_DTB_EXTEND
to resolve the EXTEND_WITH_PROM macro.

Signed-off-by: Jaedon Shin <jaedon.shin@gmail.com>
Fixes: 2024972ef533 ("MIPS: Make the kernel arguments from dtb available")
Reviewed-by: Alexander Sverdlin <alexander.svedlin@gmail.com>
Cc: Jonas Gorski <jogo@openwrt.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Aaro Koskinen <aaro.koskinen@nokia.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/11909/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/setup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -695,7 +695,7 @@ static void __init request_crashkernel(s
 
 #define USE_PROM_CMDLINE	IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER)
 #define USE_DTB_CMDLINE		IS_ENABLED(CONFIG_MIPS_CMDLINE_FROM_DTB)
-#define EXTEND_WITH_PROM	IS_ENABLED(CONFIG_MIPS_CMDLINE_EXTEND)
+#define EXTEND_WITH_PROM	IS_ENABLED(CONFIG_MIPS_CMDLINE_DTB_EXTEND)
 
 static void __init arch_mem_init(char **cmdline_p)
 {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 010/312] MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (8 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 009/312] MIPS: Fix macro typo Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 011/312] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 Greg Kroah-Hartman
                   ` (303 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, linux-mips, Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 555fae60b2bbb2d6282d82c5321d3adfa85b22ae upstream.

The cp0_tcstatus member of struct pt_regs was removed along with the
rest of SMTC in v3.16, commit b633648c5ad3 ("MIPS: MT: Remove SMTC
support"), however recent uprobes support in v4.3 added back a reference
to it in the regoffset_table[] in ptrace.c. Remove it.

Signed-off-by: James Hogan <james.hogan@imgtec.com>
Fixes: 40e084a506eb ("MIPS: Add uprobes support.")
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/11920/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/ptrace.c |    3 ---
 1 file changed, 3 deletions(-)

--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -670,9 +670,6 @@ static const struct pt_regs_offset regof
 	REG_OFFSET_NAME(c0_badvaddr, cp0_badvaddr),
 	REG_OFFSET_NAME(c0_cause, cp0_cause),
 	REG_OFFSET_NAME(c0_epc, cp0_epc),
-#ifdef CONFIG_MIPS_MT_SMTC
-	REG_OFFSET_NAME(c0_tcstatus, cp0_tcstatus),
-#endif
 #ifdef CONFIG_CPU_CAVIUM_OCTEON
 	REG_OFFSET_NAME(mpl0, mpl[0]),
 	REG_OFFSET_NAME(mpl1, mpl[1]),



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 011/312] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (9 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 010/312] MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 012/312] MIPS: smp-cps: Stop printing EJTAG exceptions to UART Greg Kroah-Hartman
                   ` (302 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, john, cernekee,
	jogo, jaedon.shin, jfraser, pgynther, dragan.stancevic,
	linux-mips, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit cbbda6e7c9c3e4532bd70a73ff9d5e6655c894dc upstream.

BMIPS5000 have a PrID value of 0x5A00 and BMIPS5200 have a PrID value of
0x5B00, which, masked with 0x5A00, returns 0x5A00. Update all conditionals on
the PrID to cover both variants since we are going to need this to enable
BMIPS5200 SMP. The existing check, masking with 0xFF00 would not cover
BMIPS5200 at all.

Fixes: 68e6a78373a6d ("MIPS: BMIPS: Add PRId for BMIPS5200 (Whirlwind)")
Fixes: 6465460c92a85 ("MIPS: BMIPS: change compile time checks to runtime checks")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: john@phrozen.org
Cc: cernekee@gmail.com
Cc: jogo@openwrt.org
Cc: jaedon.shin@gmail.com
Cc: jfraser@broadcom.com
Cc: pgynther@google.com
Cc: dragan.stancevic@gmail.com
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/12279/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/bmips_vec.S |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/arch/mips/kernel/bmips_vec.S
+++ b/arch/mips/kernel/bmips_vec.S
@@ -93,7 +93,8 @@ NESTED(bmips_reset_nmi_vec, PT_SIZE, sp)
 #if defined(CONFIG_CPU_BMIPS5000)
 	mfc0	k0, CP0_PRID
 	li	k1, PRID_IMP_BMIPS5000
-	andi	k0, 0xff00
+	/* mask with PRID_IMP_BMIPS5000 to cover both variants */
+	andi	k0, PRID_IMP_BMIPS5000
 	bne	k0, k1, 1f
 
 	/* if we're not on core 0, this must be the SMP boot signal */
@@ -166,10 +167,12 @@ bmips_smp_entry:
 2:
 #endif /* CONFIG_CPU_BMIPS4350 || CONFIG_CPU_BMIPS4380 */
 #if defined(CONFIG_CPU_BMIPS5000)
-	/* set exception vector base */
+	/* mask with PRID_IMP_BMIPS5000 to cover both variants */
 	li	k1, PRID_IMP_BMIPS5000
+	andi	k0, PRID_IMP_BMIPS5000
 	bne	k0, k1, 3f
 
+	/* set exception vector base */
 	la	k0, ebase
 	lw	k0, 0(k0)
 	mtc0	k0, $15, 1
@@ -263,6 +266,8 @@ LEAF(bmips_enable_xks01)
 #endif /* CONFIG_CPU_BMIPS4380 */
 #if defined(CONFIG_CPU_BMIPS5000)
 	li	t1, PRID_IMP_BMIPS5000
+	/* mask with PRID_IMP_BMIPS5000 to cover both variants */
+	andi	t2, PRID_IMP_BMIPS5000
 	bne	t2, t1, 2f
 
 	mfc0	t0, $22, 5



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 012/312] MIPS: smp-cps: Stop printing EJTAG exceptions to UART
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (10 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 011/312] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 013/312] MIPS: scall: Handle seccomp filters which redirect syscalls Greg Kroah-Hartman
                   ` (301 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Burton, linux-mips, Ralf Baechle

From: Paul Burton <paul.burton@imgtec.com>

commit 6609ccdc852f7bfbfa54300dd5b3cd89eb4ced6f upstream.

When CONFIG_MIPS_CPS_NS16550 is enabled, some register state is dumped
to the UART when an exception is taken via the BEV on secondary cores.
EJTAG exceptions are architecturally expected to be handled by the BEV
even when Status.BEV is 0. This effectively means that if userland
executes an sdbbp instruction on a secondary core then the kernel dumps
register state to the UART even though the exception is perfectly normal
& expected. Prevent this by simply not dumping information to the UART
for EJTAG exceptions.

Fixes: 609cf6f2291a ("MIPS: CPS: Early debug using an ns16550-compatible UART")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/12341/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/cps-vec.S |    1 -
 1 file changed, 1 deletion(-)

--- a/arch/mips/kernel/cps-vec.S
+++ b/arch/mips/kernel/cps-vec.S
@@ -245,7 +245,6 @@ LEAF(excep_intex)
 
 .org 0x480
 LEAF(excep_ejtag)
-	DUMP_EXCEP("EJTAG")
 	PTR_LA	k0, ejtag_debug_handler
 	jr	k0
 	 nop



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 013/312] MIPS: scall: Handle seccomp filters which redirect syscalls
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (11 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 012/312] MIPS: smp-cps: Stop printing EJTAG exceptions to UART Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 014/312] MIPS: BMIPS: BMIPS5000 has I cache filing from D cache Greg Kroah-Hartman
                   ` (300 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matt Redfearn, Kees Cook,
	Eric B Munson, James Hogan, Andrew Morton, linux-mips,
	IMG-MIPSLinuxKerneldevelopers, Ralf Baechle

From: Matt Redfearn <matt.redfearn@imgtec.com>

commit a400bed6d105c23d3673f763596e4b85de14e41a upstream.

Commit d218af78492a ("MIPS: scall: Always run the seccomp syscall
filters") modified the syscall code to always call the seccomp filters,
but missed the case where a filter may redirect the syscall, as
revealed by the seccomp_bpf self test.

The syscall path now restores the syscall from the stack after the
filter rather than saving it locally. Syscall number checking and
syscall function table lookup is done after the filter may have run such
that redirected syscalls are also checked, and executed.

The regular path of syscall number checking and pointer lookup is also
made more consistent between ABIs with scall64-64.S being the reference.

With this patch in place, the seccomp_bpf self test now passes
TRACE_syscall.syscall_redirected and TRACE_syscall.syscall_dropped on
all MIPS ABIs.

Fixes: d218af78492a ("MIPS: scall: Always run the seccomp syscall filters")
Signed-off-by: Matt Redfearn <matt.redfearn@imgtec.com>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Eric B Munson <emunson@akamai.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mips@linux-mips.org
Cc: IMG-MIPSLinuxKerneldevelopers@imgtec.com
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/12916/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/scall32-o32.S |   11 +++++------
 arch/mips/kernel/scall64-64.S  |    3 +--
 arch/mips/kernel/scall64-n32.S |   14 +++++++++-----
 arch/mips/kernel/scall64-o32.S |   14 +++++++++-----
 4 files changed, 24 insertions(+), 18 deletions(-)

--- a/arch/mips/kernel/scall32-o32.S
+++ b/arch/mips/kernel/scall32-o32.S
@@ -35,7 +35,6 @@ NESTED(handle_sys, PT_SIZE, sp)
 
 	lw	t1, PT_EPC(sp)		# skip syscall on return
 
-	subu	v0, v0, __NR_O32_Linux	# check syscall number
 	addiu	t1, 4			# skip to next instruction
 	sw	t1, PT_EPC(sp)
 
@@ -89,6 +88,7 @@ loads_done:
 	and	t0, t1
 	bnez	t0, syscall_trace_entry # -> yes
 syscall_common:
+	subu	v0, v0, __NR_O32_Linux	# check syscall number
 	sltiu	t0, v0, __NR_O32_Linux_syscalls + 1
 	beqz	t0, illegal_syscall
 
@@ -118,24 +118,23 @@ o32_syscall_exit:
 
 syscall_trace_entry:
 	SAVE_STATIC
-	move	s0, v0
 	move	a0, sp
 
 	/*
 	 * syscall number is in v0 unless we called syscall(__NR_###)
 	 * where the real syscall number is in a0
 	 */
-	addiu	a1, v0,  __NR_O32_Linux
-	bnez	v0, 1f /* __NR_syscall at offset 0 */
+	move	a1, v0
+	subu	t2, v0,  __NR_O32_Linux
+	bnez	t2, 1f /* __NR_syscall at offset 0 */
 	lw	a1, PT_R4(sp)
 
 1:	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
-	move	v0, s0			# restore syscall
-
 	RESTORE_STATIC
+	lw	v0, PT_R2(sp)		# Restore syscall (maybe modified)
 	lw	a0, PT_R4(sp)		# Restore argument registers
 	lw	a1, PT_R5(sp)
 	lw	a2, PT_R6(sp)
--- a/arch/mips/kernel/scall64-64.S
+++ b/arch/mips/kernel/scall64-64.S
@@ -82,15 +82,14 @@ n64_syscall_exit:
 
 syscall_trace_entry:
 	SAVE_STATIC
-	move	s0, v0
 	move	a0, sp
 	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
-	move	v0, s0
 	RESTORE_STATIC
+	ld	v0, PT_R2(sp)		# Restore syscall (maybe modified)
 	ld	a0, PT_R4(sp)		# Restore argument registers
 	ld	a1, PT_R5(sp)
 	ld	a2, PT_R6(sp)
--- a/arch/mips/kernel/scall64-n32.S
+++ b/arch/mips/kernel/scall64-n32.S
@@ -42,9 +42,6 @@ NESTED(handle_sysn32, PT_SIZE, sp)
 #endif
 	beqz	t0, not_n32_scall
 
-	dsll	t0, v0, 3		# offset into table
-	ld	t2, (sysn32_call_table - (__NR_N32_Linux * 8))(t0)
-
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
 	li	t1, _TIF_WORK_SYSCALL_ENTRY
@@ -53,6 +50,9 @@ NESTED(handle_sysn32, PT_SIZE, sp)
 	bnez	t0, n32_syscall_trace_entry
 
 syscall_common:
+	dsll	t0, v0, 3		# offset into table
+	ld	t2, (sysn32_call_table - (__NR_N32_Linux * 8))(t0)
+
 	jalr	t2			# Do The Real Thing (TM)
 
 	li	t0, -EMAXERRNO - 1	# error?
@@ -71,21 +71,25 @@ syscall_common:
 
 n32_syscall_trace_entry:
 	SAVE_STATIC
-	move	s0, t2
 	move	a0, sp
 	move	a1, v0
 	jal	syscall_trace_enter
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
-	move	t2, s0
 	RESTORE_STATIC
+	ld	v0, PT_R2(sp)		# Restore syscall (maybe modified)
 	ld	a0, PT_R4(sp)		# Restore argument registers
 	ld	a1, PT_R5(sp)
 	ld	a2, PT_R6(sp)
 	ld	a3, PT_R7(sp)
 	ld	a4, PT_R8(sp)
 	ld	a5, PT_R9(sp)
+
+	dsubu	t2, v0, __NR_N32_Linux	# check (new) syscall number
+	sltiu   t0, t2, __NR_N32_Linux_syscalls + 1
+	beqz	t0, not_n32_scall
+
 	j	syscall_common
 
 1:	j	syscall_exit
--- a/arch/mips/kernel/scall64-o32.S
+++ b/arch/mips/kernel/scall64-o32.S
@@ -52,9 +52,6 @@ NESTED(handle_sys, PT_SIZE, sp)
 	sll	a2, a2, 0
 	sll	a3, a3, 0
 
-	dsll	t0, v0, 3		# offset into table
-	ld	t2, (sys32_call_table - (__NR_O32_Linux * 8))(t0)
-
 	sd	a3, PT_R26(sp)		# save a3 for syscall restarting
 
 	/*
@@ -88,6 +85,9 @@ loads_done:
 	bnez	t0, trace_a_syscall
 
 syscall_common:
+	dsll	t0, v0, 3		# offset into table
+	ld	t2, (sys32_call_table - (__NR_O32_Linux * 8))(t0)
+
 	jalr	t2			# Do The Real Thing (TM)
 
 	li	t0, -EMAXERRNO - 1	# error?
@@ -112,7 +112,6 @@ trace_a_syscall:
 	sd	a6, PT_R10(sp)
 	sd	a7, PT_R11(sp)		# For indirect syscalls
 
-	move	s0, t2			# Save syscall pointer
 	move	a0, sp
 	/*
 	 * absolute syscall number is in v0 unless we called syscall(__NR_###)
@@ -133,8 +132,8 @@ trace_a_syscall:
 
 	bltz	v0, 1f			# seccomp failed? Skip syscall
 
-	move	t2, s0
 	RESTORE_STATIC
+	ld	v0, PT_R2(sp)		# Restore syscall (maybe modified)
 	ld	a0, PT_R4(sp)		# Restore argument registers
 	ld	a1, PT_R5(sp)
 	ld	a2, PT_R6(sp)
@@ -143,6 +142,11 @@ trace_a_syscall:
 	ld	a5, PT_R9(sp)
 	ld	a6, PT_R10(sp)
 	ld	a7, PT_R11(sp)		# For indirect syscalls
+
+	dsubu	t0, v0, __NR_O32_Linux	# check (new) syscall number
+	sltiu	t0, t0, __NR_O32_Linux_syscalls + 1
+	beqz	t0, not_o32_scall
+
 	j	syscall_common
 
 1:	j	syscall_exit



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 014/312] MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (12 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 013/312] MIPS: scall: Handle seccomp filters which redirect syscalls Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 015/312] MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier Greg Kroah-Hartman
                   ` (299 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, linux-mips, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit c130d2fd3d59fbd5d269f7d5827bd4ed1d94aec6 upstream.

BMIPS5000 and BMIPS52000 processors have their I-cache filling from the
D-cache. Since BMIPS_GENERIC does not provide (yet) a
cpu-feature-overrides.h file, this was not set anywhere, so make sure
the R4K cache detection takes care of that.

Fixes: d74b0172e4e2c ("MIPS: BMIPS: Add special cache handling in c-r4k.c")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13010/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/c-r4k.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1308,6 +1308,10 @@ static void probe_pcache(void)
 		c->icache.flags |= MIPS_CACHE_IC_F_DC;
 		break;
 
+	case CPU_BMIPS5000:
+		c->icache.flags |= MIPS_CACHE_IC_F_DC;
+		break;
+
 	case CPU_LOONGSON2:
 		/*
 		 * LOONGSON2 has 4 way icache, but when using indexed cache op,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 015/312] MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (13 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 014/312] MIPS: BMIPS: BMIPS5000 has I cache filing from D cache Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 016/312] MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache Greg Kroah-Hartman
                   ` (298 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, linux-mips, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit 73c4ca047f440c79f545bc6133e3033f754cd239 upstream.

BMIPS5000 and BMIPS5200 processor have no D cache aliases, and this is
properly handled by the per-CPU override added at the end of
r4k_cache_init(), the problem is that the output of probe_pcache()
disagrees with that, since this is too late:

Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes

With the change moved earlier, we now have a consistent output with the
settings we are intending to have:

Primary instruction cache 32kB, VIPT, 4-way, linesize 64 bytes.
Primary data cache 32kB, 4-way, VIPT, no aliases, linesize 32 bytes

Fixes: d74b0172e4e2c ("MIPS: BMIPS: Add special cache handling in c-r4k.c")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13011/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/c-r4k.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1310,6 +1310,8 @@ static void probe_pcache(void)
 
 	case CPU_BMIPS5000:
 		c->icache.flags |= MIPS_CACHE_IC_F_DC;
+		/* Cache aliases are handled in hardware; allow HIGHMEM */
+		c->dcache.flags &= ~MIPS_CACHE_ALIASES;
 		break;
 
 	case CPU_LOONGSON2:
@@ -1749,8 +1751,6 @@ void r4k_cache_init(void)
 		flush_icache_range = (void *)b5k_instruction_hazard;
 		local_flush_icache_range = (void *)b5k_instruction_hazard;
 
-		/* Cache aliases are handled in hardware; allow HIGHMEM */
-		current_cpu_data.dcache.flags &= ~MIPS_CACHE_ALIASES;
 
 		/* Optimization: an L2 flush implicitly flushes the L1 */
 		current_cpu_data.options |= MIPS_CPU_INCLUSIVE_CACHES;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 016/312] MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (14 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 015/312] MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 017/312] MIPS: BMIPS: Pretty print BMIPS5200 processor name Greg Kroah-Hartman
                   ` (297 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, linux-mips, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit f675843ddfdfdf467d08cc922201614a149e439e upstream.

local_r4k___flush_cache_all() is missing a special check for BMIPS5000
processors, we need to blast the S-cache, just like other MTI processors
since we have an inclusive cache. We also need an additional __sync() to
make sure this is completed.

Fixes: d74b0172e4e2c ("MIPS: BMIPS: Add special cache handling in c-r4k.c")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13012/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/c-r4k.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -447,6 +447,11 @@ static inline void local_r4k___flush_cac
 		r4k_blast_scache();
 		break;
 
+	case CPU_BMIPS5000:
+		r4k_blast_scache();
+		__sync();
+		break;
+
 	default:
 		r4k_blast_dcache();
 		r4k_blast_icache();



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 017/312] MIPS: BMIPS: Pretty print BMIPS5200 processor name
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (15 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 016/312] MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 018/312] MIPS: Fix HTW config on XPA kernel without LPA enabled Greg Kroah-Hartman
                   ` (296 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, linux-mips, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit 37808d62afcdc420d98875c4b514c178d56f6815 upstream.

Just to ease debugging of multiplatform kernel, make sure we print
"Broadcom BMIPS5200" for the BMIPS5200 implementation instead of
Broadcom BMIPS5000.

Fixes: 68e6a78373a6d ("MIPS: BMIPS: Add PRId for BMIPS5200 (Whirlwind)")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13014/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/cpu-probe.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -1284,7 +1284,10 @@ static inline void cpu_probe_broadcom(st
 	case PRID_IMP_BMIPS5000:
 	case PRID_IMP_BMIPS5200:
 		c->cputype = CPU_BMIPS5000;
-		__cpu_name[cpu] = "Broadcom BMIPS5000";
+		if ((c->processor_id & PRID_IMP_MASK) == PRID_IMP_BMIPS5200)
+			__cpu_name[cpu] = "Broadcom BMIPS5200";
+		else
+			__cpu_name[cpu] = "Broadcom BMIPS5000";
 		set_elf_platform(cpu, "bmips5000");
 		c->options |= MIPS_CPU_ULRI;
 		break;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 018/312] MIPS: Fix HTW config on XPA kernel without LPA enabled
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (16 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 017/312] MIPS: BMIPS: Pretty print BMIPS5200 processor name Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 019/312] MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 Greg Kroah-Hartman
                   ` (295 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Steven J. Hill,
	Paul Burton, Paul Gortmaker, linux-mips, Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 14bc241443e126c62fcbf571b7d4c79740debc58 upstream.

The hardware page table walker (HTW) configuration is broken on XPA
kernels where XPA couldn't be enabled (either nohtw or the hardware
doesn't support it). This is because the PWSize.PTEW field (PTE width)
was only set to 8 bytes (an extra shift of 1) in config_htw_params() if
PageGrain.ELPA (enable large physical addressing) is set. On an XPA
kernel though the size of PTEs is fixed at 8 bytes regardless of whether
XPA could actually be enabled.

Fix the initialisation of this field based on sizeof(pte_t) instead.

Fixes: c5b367835cfc ("MIPS: Add support for XPA.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Steven J. Hill <sjhill@realitydiluted.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13113/
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/tlbex.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -2329,9 +2329,7 @@ static void config_htw_params(void)
 	if (CONFIG_PGTABLE_LEVELS >= 3)
 		pwsize |= ilog2(PTRS_PER_PMD) << MIPS_PWSIZE_MDW_SHIFT;
 
-	/* If XPA has been enabled, PTEs are 64-bit in size. */
-	if (config_enabled(CONFIG_64BITS) || (read_c0_pagegrain() & PG_ELPA))
-		pwsize |= 1;
+	pwsize |= ilog2(sizeof(pte_t)/4) << MIPS_PWSIZE_PTEW_SHIFT;
 
 	write_c0_pwsize(pwsize);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 019/312] MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (17 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 018/312] MIPS: Fix HTW config on XPA kernel without LPA enabled Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 020/312] MIPS: math-emu: Fix BC1{EQ,NE}Z emulation Greg Kroah-Hartman
                   ` (294 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, linux-mips, john,
	cernekee, jaedon.shin, Ralf Baechle

From: Florian Fainelli <f.fainelli@gmail.com>

commit 80fa40acaa1dad5a0a9c15ed2e5d2e72461843f5 upstream.

The CPU actually runs at 1405Mhz which gives us a 175625000 Hz MIPS timer
frequency (CPU frequency / 8).

Fixes: e4c7d009654a ("MIPS: BMIPS: Add BCM7435 dtsi")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Cc: linux-mips@linux-mips.org
Cc: john@phrozen.org
Cc: cernekee@gmail.com
Cc: jaedon.shin@gmail.com
Patchwork: https://patchwork.linux-mips.org/patch/13132/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/boot/dts/brcm/bcm7435.dtsi |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/boot/dts/brcm/bcm7435.dtsi
+++ b/arch/mips/boot/dts/brcm/bcm7435.dtsi
@@ -7,7 +7,7 @@
 		#address-cells = <1>;
 		#size-cells = <0>;
 
-		mips-hpt-frequency = <163125000>;
+		mips-hpt-frequency = <175625000>;
 
 		cpu@0 {
 			compatible = "brcm,bmips5200";



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 020/312] MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (18 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 019/312] MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 021/312] MIPS: Fix BC1{EQ,NE}Z return offset calculation Greg Kroah-Hartman
                   ` (293 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Burton, James Hogan,
	Maciej W. Rozycki, linux-mips, Ralf Baechle

From: Paul Burton <paul.burton@imgtec.com>

commit 93583e178ebfdd2fadf950eef1547f305cac12ca upstream.

The conditions for branching when emulating the BC1EQZ & BC1NEZ
instructions were backwards, leading to each of those instructions being
treated as the other. Fix this by reversing the conditions, and clear up
the code a little for readability & checkpatch.

Fixes: c909ca718e8f ("MIPS: math-emu: Emulate missing BC1{EQ,NE}Z instructions")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: Maciej W. Rozycki <macro@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13150/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/math-emu/cp1emu.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

--- a/arch/mips/math-emu/cp1emu.c
+++ b/arch/mips/math-emu/cp1emu.c
@@ -975,9 +975,10 @@ static int cop1Emulate(struct pt_regs *x
 		struct mm_decoded_insn dec_insn, void *__user *fault_addr)
 {
 	unsigned long contpc = xcp->cp0_epc + dec_insn.pc_inc;
-	unsigned int cond, cbit;
+	unsigned int cond, cbit, bit0;
 	mips_instruction ir;
 	int likely, pc_inc;
+	union fpureg *fpr;
 	u32 __user *wva;
 	u64 __user *dva;
 	u32 wval;
@@ -1189,14 +1190,14 @@ emul:
 				return SIGILL;
 
 			cond = likely = 0;
+			fpr = &current->thread.fpu.fpr[MIPSInst_RT(ir)];
+			bit0 = get_fpr32(fpr, 0) & 0x1;
 			switch (MIPSInst_RS(ir)) {
 			case bc1eqz_op:
-				if (get_fpr32(&current->thread.fpu.fpr[MIPSInst_RT(ir)], 0) & 0x1)
-				    cond = 1;
+				cond = bit0 == 0;
 				break;
 			case bc1nez_op:
-				if (!(get_fpr32(&current->thread.fpu.fpr[MIPSInst_RT(ir)], 0) & 0x1))
-				    cond = 1;
+				cond = bit0 != 0;
 				break;
 			}
 			goto branch_common;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 021/312] MIPS: Fix BC1{EQ,NE}Z return offset calculation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (19 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 020/312] MIPS: math-emu: Fix BC1{EQ,NE}Z emulation Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 022/312] MIPS: math-emu: Fix m{add,sub}.s shifts Greg Kroah-Hartman
                   ` (292 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Burton, James Hogan, linux-mips,
	Ralf Baechle

From: Paul Burton <paul.burton@imgtec.com>

commit ac1496980f1d2752f26769f5db63afbc9ac2b603 upstream.

The conditions for branching when emulating the BC1EQZ & BC1NEZ
instructions were backwards, leading to each of those instructions being
treated as the other. Fix this by reversing the conditions, and clear up
the code a little for readability & checkpatch.

Fixes: c8a34581ec09 ("MIPS: Emulate the BC1{EQ,NE}Z FPU instructions")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13151/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/branch.c |   18 +++---------------
 1 file changed, 3 insertions(+), 15 deletions(-)

--- a/arch/mips/kernel/branch.c
+++ b/arch/mips/kernel/branch.c
@@ -685,21 +685,9 @@ int __compute_return_epc_for_insn(struct
 			}
 			lose_fpu(1);    /* Save FPU state for the emulator. */
 			reg = insn.i_format.rt;
-			bit = 0;
-			switch (insn.i_format.rs) {
-			case bc1eqz_op:
-				/* Test bit 0 */
-				if (get_fpr32(&current->thread.fpu.fpr[reg], 0)
-				    & 0x1)
-					bit = 1;
-				break;
-			case bc1nez_op:
-				/* Test bit 0 */
-				if (!(get_fpr32(&current->thread.fpu.fpr[reg], 0)
-				      & 0x1))
-					bit = 1;
-				break;
-			}
+			bit = get_fpr32(&current->thread.fpu.fpr[reg], 0) & 0x1;
+			if (insn.i_format.rs == bc1eqz_op)
+				bit = !bit;
 			own_fpu(1);
 			if (bit)
 				epc = epc + 4 +



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 022/312] MIPS: math-emu: Fix m{add,sub}.s shifts
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (20 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 021/312] MIPS: Fix BC1{EQ,NE}Z return offset calculation Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 023/312] MIPS: perf: Fix I6400 event numbers Greg Kroah-Hartman
                   ` (291 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Paul Burton, Adam Buchbinder,
	Maciej W. Rozycki, linux-mips, Ralf Baechle

From: Paul Burton <paul.burton@imgtec.com>

commit db57f29d50683afd75c7f8b9908af7669837c3a9 upstream.

The code in _sp_maddf (formerly ieee754sp_madd) appears to have been
copied verbatim from ieee754sp_add, and although it's adding the
unpacked "r" & "z" floats it kept using macros that operate on "x" &
"y". This led to the addition being carried out incorrectly on some
mismash of the product, accumulator & multiplicand fields. Typically
this would lead to the assertions "ze == re" & "ze <= SP_EMAX" failing
since ze & re hadn't been operated upon.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: e24c3bec3e8e ("MIPS: math-emu: Add support for the MIPS R6 MADDF FPU instruction")
Cc: Adam Buchbinder <adam.buchbinder@gmail.com>
Cc: Maciej W. Rozycki <macro@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13159/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/math-emu/ieee754sp.c |    3 ++-
 arch/mips/math-emu/ieee754sp.h |   16 +++++++---------
 arch/mips/math-emu/sp_add.c    |    6 ++++--
 arch/mips/math-emu/sp_maddf.c  |   13 ++++++++-----
 arch/mips/math-emu/sp_sub.c    |    6 ++++--
 5 files changed, 25 insertions(+), 19 deletions(-)

--- a/arch/mips/math-emu/ieee754sp.c
+++ b/arch/mips/math-emu/ieee754sp.c
@@ -130,7 +130,8 @@ union ieee754sp ieee754sp_format(int sn,
 		} else {
 			/* sticky right shift es bits
 			 */
-			SPXSRSXn(es);
+			xm = XSPSRS(xm, es);
+			xe += es;
 			assert((xm & (SP_HIDDEN_BIT << 3)) == 0);
 			assert(xe == SP_EMIN);
 		}
--- a/arch/mips/math-emu/ieee754sp.h
+++ b/arch/mips/math-emu/ieee754sp.h
@@ -46,19 +46,17 @@ static inline int ieee754sp_finite(union
 }
 
 /* 3bit extended single precision sticky right shift */
-#define SPXSRSXn(rs)							\
-	(xe += rs,							\
-	 xm = (rs > (SP_FBITS+3))?1:((xm) >> (rs)) | ((xm) << (32-(rs)) != 0))
+#define XSPSRS(v, rs)						\
+	((rs > (SP_FBITS+3))?1:((v) >> (rs)) | ((v) << (32-(rs)) != 0))
 
-#define SPXSRSX1() \
-	(xe++, (xm = (xm >> 1) | (xm & 1)))
+#define XSPSRS1(m) \
+	((m >> 1) | (m & 1))
 
-#define SPXSRSYn(rs)								\
-	(ye+=rs,								\
-	 ym = (rs > (SP_FBITS+3))?1:((ym) >> (rs)) | ((ym) << (32-(rs)) != 0))
+#define SPXSRSX1() \
+	(xe++, (xm = XSPSRS1(xm)))
 
 #define SPXSRSY1() \
-	(ye++, (ym = (ym >> 1) | (ym & 1)))
+	(ye++, (ym = XSPSRS1(ym)))
 
 /* convert denormal to normalized with extended exponent */
 #define SPDNORMx(m,e) \
--- a/arch/mips/math-emu/sp_add.c
+++ b/arch/mips/math-emu/sp_add.c
@@ -132,13 +132,15 @@ union ieee754sp ieee754sp_add(union ieee
 		 * Have to shift y fraction right to align.
 		 */
 		s = xe - ye;
-		SPXSRSYn(s);
+		ym = XSPSRS(ym, s);
+		ye += s;
 	} else if (ye > xe) {
 		/*
 		 * Have to shift x fraction right to align.
 		 */
 		s = ye - xe;
-		SPXSRSXn(s);
+		xm = XSPSRS(xm, s);
+		xe += s;
 	}
 	assert(xe == ye);
 	assert(xe <= SP_EMAX);
--- a/arch/mips/math-emu/sp_maddf.c
+++ b/arch/mips/math-emu/sp_maddf.c
@@ -208,16 +208,18 @@ union ieee754sp ieee754sp_maddf(union ie
 
 	if (ze > re) {
 		/*
-		 * Have to shift y fraction right to align.
+		 * Have to shift r fraction right to align.
 		 */
 		s = ze - re;
-		SPXSRSYn(s);
+		rm = XSPSRS(rm, s);
+		re += s;
 	} else if (re > ze) {
 		/*
-		 * Have to shift x fraction right to align.
+		 * Have to shift z fraction right to align.
 		 */
 		s = re - ze;
-		SPXSRSYn(s);
+		zm = XSPSRS(zm, s);
+		ze += s;
 	}
 	assert(ze == re);
 	assert(ze <= SP_EMAX);
@@ -230,7 +232,8 @@ union ieee754sp ieee754sp_maddf(union ie
 		zm = zm + rm;
 
 		if (zm >> (SP_FBITS + 1 + 3)) { /* carry out */
-			SPXSRSX1();
+			zm = XSPSRS1(zm);
+			ze++;
 		}
 	} else {
 		if (zm >= rm) {
--- a/arch/mips/math-emu/sp_sub.c
+++ b/arch/mips/math-emu/sp_sub.c
@@ -134,13 +134,15 @@ union ieee754sp ieee754sp_sub(union ieee
 		 * have to shift y fraction right to align
 		 */
 		s = xe - ye;
-		SPXSRSYn(s);
+		ym = XSPSRS(ym, s);
+		ye += s;
 	} else if (ye > xe) {
 		/*
 		 * have to shift x fraction right to align
 		 */
 		s = ye - xe;
-		SPXSRSXn(s);
+		xm = XSPSRS(xm, s);
+		xe += s;
 	}
 	assert(xe == ye);
 	assert(xe <= SP_EMAX);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 023/312] MIPS: perf: Fix I6400 event numbers
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (21 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 022/312] MIPS: math-emu: Fix m{add,sub}.s shifts Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 024/312] MIPS: Fix 64-bit HTW configuration Greg Kroah-Hartman
                   ` (290 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Peter Zijlstra,
	Ingo Molnar, Arnaldo Carvalho de Melo, Alexander Shishkin,
	linux-mips, Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit fd716fca10fc3dc0f18b8c16d4ecfa6d93f010d2 upstream.

Fix perf hardware performance counter event numbers for I6400. This core
does not follow the performance event numbering scheme of previous MIPS
cores. All performance counters (both odd and even) are capable of
counting any of the available events.

Fixes: 4e88a8621301 ("MIPS: Add cases for CPU_I6400")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13259/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/perf_event_mipsxx.c |   54 +++++++++++++++++++++++++++++++++--
 1 file changed, 52 insertions(+), 2 deletions(-)

--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -825,6 +825,16 @@ static const struct mips_perf_event mips
 	[PERF_COUNT_HW_BRANCH_MISSES] = { 0x27, CNTR_ODD, T },
 };
 
+static const struct mips_perf_event i6400_event_map[PERF_COUNT_HW_MAX] = {
+	[PERF_COUNT_HW_CPU_CYCLES]          = { 0x00, CNTR_EVEN | CNTR_ODD },
+	[PERF_COUNT_HW_INSTRUCTIONS]        = { 0x01, CNTR_EVEN | CNTR_ODD },
+	/* These only count dcache, not icache */
+	[PERF_COUNT_HW_CACHE_REFERENCES]    = { 0x45, CNTR_EVEN | CNTR_ODD },
+	[PERF_COUNT_HW_CACHE_MISSES]        = { 0x48, CNTR_EVEN | CNTR_ODD },
+	[PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = { 0x15, CNTR_EVEN | CNTR_ODD },
+	[PERF_COUNT_HW_BRANCH_MISSES]       = { 0x16, CNTR_EVEN | CNTR_ODD },
+};
+
 static const struct mips_perf_event loongson3_event_map[PERF_COUNT_HW_MAX] = {
 	[PERF_COUNT_HW_CPU_CYCLES] = { 0x00, CNTR_EVEN },
 	[PERF_COUNT_HW_INSTRUCTIONS] = { 0x00, CNTR_ODD },
@@ -1015,6 +1025,46 @@ static const struct mips_perf_event mips
 },
 };
 
+static const struct mips_perf_event i6400_cache_map
+				[PERF_COUNT_HW_CACHE_MAX]
+				[PERF_COUNT_HW_CACHE_OP_MAX]
+				[PERF_COUNT_HW_CACHE_RESULT_MAX] = {
+[C(L1D)] = {
+	[C(OP_READ)] = {
+		[C(RESULT_ACCESS)]	= { 0x46, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x49, CNTR_EVEN | CNTR_ODD },
+	},
+	[C(OP_WRITE)] = {
+		[C(RESULT_ACCESS)]	= { 0x47, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x4a, CNTR_EVEN | CNTR_ODD },
+	},
+},
+[C(L1I)] = {
+	[C(OP_READ)] = {
+		[C(RESULT_ACCESS)]	= { 0x84, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x85, CNTR_EVEN | CNTR_ODD },
+	},
+},
+[C(DTLB)] = {
+	/* Can't distinguish read & write */
+	[C(OP_READ)] = {
+		[C(RESULT_ACCESS)]	= { 0x40, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x41, CNTR_EVEN | CNTR_ODD },
+	},
+	[C(OP_WRITE)] = {
+		[C(RESULT_ACCESS)]	= { 0x40, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x41, CNTR_EVEN | CNTR_ODD },
+	},
+},
+[C(BPU)] = {
+	/* Conditional branches / mispredicted */
+	[C(OP_READ)] = {
+		[C(RESULT_ACCESS)]	= { 0x15, CNTR_EVEN | CNTR_ODD },
+		[C(RESULT_MISS)]	= { 0x16, CNTR_EVEN | CNTR_ODD },
+	},
+},
+};
+
 static const struct mips_perf_event loongson3_cache_map
 				[PERF_COUNT_HW_CACHE_MAX]
 				[PERF_COUNT_HW_CACHE_OP_MAX]
@@ -1720,8 +1770,8 @@ init_hw_perf_events(void)
 		break;
 	case CPU_I6400:
 		mipspmu.name = "mips/I6400";
-		mipspmu.general_event_map = &mipsxxcore_event_map2;
-		mipspmu.cache_event_map = &mipsxxcore_cache_map2;
+		mipspmu.general_event_map = &i6400_event_map;
+		mipspmu.cache_event_map = &i6400_cache_map;
 		break;
 	case CPU_1004K:
 		mipspmu.name = "mips/1004K";



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 024/312] MIPS: Fix 64-bit HTW configuration
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (22 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 023/312] MIPS: perf: Fix I6400 event numbers Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 025/312] MIPS: Fix little endian microMIPS MSA encodings Greg Kroah-Hartman
                   ` (289 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Paul Burton, linux-mips,
	Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit aa76042a016474775ccd187c068669148c30c3bb upstream.

The Hardware page Table Walker (HTW) is being misconfigured on 64-bit
kernels. The PWSize.PS (pointer size) bit determines whether pointers
within directories are loaded as 32-bit or 64-bit addresses, but was
never being set to 1 for 64-bit kernels where the unsigned long in pgd_t
is 64-bits wide.

This actually reduces rather than improves performance when the HTW is
enabled on P6600 since the HTW is initiated lots, but walks are all
aborted due I think to bad intermediate pointers.

Since we were already taking the width of the PTEs into account by
setting PWSize.PTEW, which is the left shift applied to the page table
index *in addition to* the native pointer size, we also need to reduce
PTEW by 1 when PS=1. This is done by calculating PTEW based on the
relative size of pte_t compared to pgd_t.

Finally in order for the HTW to be used when PS=1, the appropriate
XK/XS/XU bits corresponding to the different 64-bit segments need to be
set in PWCtl. We enable only XU for now to enable walking for XUSeg.

Supporting walking for XKSeg would be a bit more involved so is left for
a future patch. It would either require the use of a per-CPU top level
base directory if supported by the HTW (a bit like pgd_current but with
a second entry pointing at swapper_pg_dir), or the HTW would prepend bit
63 of the address to the global directory index which doesn't really
match how we split user and kernel page directories.

Fixes: cab25bc7537b ("MIPS: Extend hardware table walking support to MIPS64")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13364/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/tlbex.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -2329,15 +2329,25 @@ static void config_htw_params(void)
 	if (CONFIG_PGTABLE_LEVELS >= 3)
 		pwsize |= ilog2(PTRS_PER_PMD) << MIPS_PWSIZE_MDW_SHIFT;
 
-	pwsize |= ilog2(sizeof(pte_t)/4) << MIPS_PWSIZE_PTEW_SHIFT;
+	/* Set pointer size to size of directory pointers */
+	if (config_enabled(CONFIG_64BIT))
+		pwsize |= MIPS_PWSIZE_PS_MASK;
+	/* PTEs may be multiple pointers long (e.g. with XPA) */
+	pwsize |= ((PTE_T_LOG2 - PGD_T_LOG2) << MIPS_PWSIZE_PTEW_SHIFT)
+			& MIPS_PWSIZE_PTEW_MASK;
 
 	write_c0_pwsize(pwsize);
 
 	/* Make sure everything is set before we enable the HTW */
 	back_to_back_c0_hazard();
 
-	/* Enable HTW and disable the rest of the pwctl fields */
+	/*
+	 * Enable HTW (and only for XUSeg on 64-bit), and disable the rest of
+	 * the pwctl fields.
+	 */
 	config = 1 << MIPS_PWCTL_PWEN_SHIFT;
+	if (config_enabled(CONFIG_64BIT))
+		config |= MIPS_PWCTL_XU_MASK;
 	write_c0_pwctl(config);
 	pr_info("Hardware Page Table Walker enabled\n");
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 025/312] MIPS: Fix little endian microMIPS MSA encodings
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (23 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 024/312] MIPS: Fix 64-bit HTW configuration Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 026/312] MIPS: KVM: Fix translation of MFC0 ErrCtl Greg Kroah-Hartman
                   ` (288 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Paul Burton, linux-mips,
	Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 6e1b29c3094688b6803fa1f9d5da676a7d0fbff9 upstream.

When the toolchain doesn't support MSA we encode MSA instructions
explicitly in assembly. Unfortunately we use .word for both MIPS and
microMIPS encodings which is wrong, since 32-bit microMIPS instructions
are made up from a pair of halfwords.

- The most significant halfword always comes first, so for little endian
  builds the halves will be emitted in the wrong order.

- 32-bit alignment isn't guaranteed, so the assembler may insert a
  16-bit nop instruction to pad the instruction stream to a 32-bit
  boundary.

Use the new instruction encoding macros to encode microMIPS MSA
instructions correctly.

Fixes: d96cc3d1ec5d ("MIPS: Add microMIPS MSA support.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paul Burton <Paul.Burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13312/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/include/asm/asmmacro.h |   99 +++++++++++++++++++--------------------
 arch/mips/include/asm/msa.h      |   21 +++-----
 2 files changed, 58 insertions(+), 62 deletions(-)

--- a/arch/mips/include/asm/asmmacro.h
+++ b/arch/mips/include/asm/asmmacro.h
@@ -19,6 +19,28 @@
 #include <asm/asmmacro-64.h>
 #endif
 
+/*
+ * Helper macros for generating raw instruction encodings.
+ */
+#ifdef CONFIG_CPU_MICROMIPS
+	.macro	insn32_if_mm enc
+	.insn
+	.hword ((\enc) >> 16)
+	.hword ((\enc) & 0xffff)
+	.endm
+
+	.macro	insn_if_mips enc
+	.endm
+#else
+	.macro	insn32_if_mm enc
+	.endm
+
+	.macro	insn_if_mips enc
+	.insn
+	.word (\enc)
+	.endm
+#endif
+
 #if defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6)
 	.macro	local_irq_enable reg=t0
 	ei
@@ -336,38 +358,6 @@
 	.endm
 #else
 
-#ifdef CONFIG_CPU_MICROMIPS
-#define CFC_MSA_INSN		0x587e0056
-#define CTC_MSA_INSN		0x583e0816
-#define LDB_MSA_INSN		0x58000807
-#define LDH_MSA_INSN		0x58000817
-#define LDW_MSA_INSN		0x58000827
-#define LDD_MSA_INSN		0x58000837
-#define STB_MSA_INSN		0x5800080f
-#define STH_MSA_INSN		0x5800081f
-#define STW_MSA_INSN		0x5800082f
-#define STD_MSA_INSN		0x5800083f
-#define COPY_SW_MSA_INSN	0x58b00056
-#define COPY_SD_MSA_INSN	0x58b80056
-#define INSERT_W_MSA_INSN	0x59300816
-#define INSERT_D_MSA_INSN	0x59380816
-#else
-#define CFC_MSA_INSN		0x787e0059
-#define CTC_MSA_INSN		0x783e0819
-#define LDB_MSA_INSN		0x78000820
-#define LDH_MSA_INSN		0x78000821
-#define LDW_MSA_INSN		0x78000822
-#define LDD_MSA_INSN		0x78000823
-#define STB_MSA_INSN		0x78000824
-#define STH_MSA_INSN		0x78000825
-#define STW_MSA_INSN		0x78000826
-#define STD_MSA_INSN		0x78000827
-#define COPY_SW_MSA_INSN	0x78b00059
-#define COPY_SD_MSA_INSN	0x78b80059
-#define INSERT_W_MSA_INSN	0x79300819
-#define INSERT_D_MSA_INSN	0x79380819
-#endif
-
 	/*
 	 * Temporary until all toolchains in use include MSA support.
 	 */
@@ -375,8 +365,8 @@
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	.insn
-	.word	CFC_MSA_INSN | (\cs << 11)
+	insn_if_mips 0x787e0059 | (\cs << 11)
+	insn32_if_mm 0x587e0056 | (\cs << 11)
 	move	\rd, $1
 	.set	pop
 	.endm
@@ -386,7 +376,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	move	$1, \rs
-	.word	CTC_MSA_INSN | (\cd << 6)
+	insn_if_mips 0x783e0819 | (\cd << 6)
+	insn32_if_mm 0x583e0816 | (\cd << 6)
 	.set	pop
 	.endm
 
@@ -395,7 +386,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	LDB_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000820 | (\wd << 6)
+	insn32_if_mm 0x58000807 | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -404,7 +396,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	LDH_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000821 | (\wd << 6)
+	insn32_if_mm 0x58000817 | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -413,7 +406,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	LDW_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000822 | (\wd << 6)
+	insn32_if_mm 0x58000827 | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -422,7 +416,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	LDD_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000823 | (\wd << 6)
+	insn32_if_mm 0x58000837 | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -431,7 +426,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	STB_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000824 | (\wd << 6)
+	insn32_if_mm 0x5800080f | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -440,7 +436,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	STH_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000825 | (\wd << 6)
+	insn32_if_mm 0x5800081f | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -449,7 +446,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	STW_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000826 | (\wd << 6)
+	insn32_if_mm 0x5800082f | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -458,7 +456,8 @@
 	.set	noat
 	SET_HARDFLOAT
 	PTR_ADDU $1, \base, \off
-	.word	STD_MSA_INSN | (\wd << 6)
+	insn_if_mips 0x78000827 | (\wd << 6)
+	insn32_if_mm 0x5800083f | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -466,8 +465,8 @@
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	.insn
-	.word	COPY_SW_MSA_INSN | (\n << 16) | (\ws << 11)
+	insn_if_mips 0x78b00059 | (\n << 16) | (\ws << 11)
+	insn32_if_mm 0x58b00056 | (\n << 16) | (\ws << 11)
 	.set	pop
 	.endm
 
@@ -475,8 +474,8 @@
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	.insn
-	.word	COPY_SD_MSA_INSN | (\n << 16) | (\ws << 11)
+	insn_if_mips 0x78b80059 | (\n << 16) | (\ws << 11)
+	insn32_if_mm 0x58b80056 | (\n << 16) | (\ws << 11)
 	.set	pop
 	.endm
 
@@ -484,7 +483,8 @@
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	.word	INSERT_W_MSA_INSN | (\n << 16) | (\wd << 6)
+	insn_if_mips 0x79300819 | (\n << 16) | (\wd << 6)
+	insn32_if_mm 0x59300816 | (\n << 16) | (\wd << 6)
 	.set	pop
 	.endm
 
@@ -492,7 +492,8 @@
 	.set	push
 	.set	noat
 	SET_HARDFLOAT
-	.word	INSERT_D_MSA_INSN | (\n << 16) | (\wd << 6)
+	insn_if_mips 0x79380819 | (\n << 16) | (\wd << 6)
+	insn32_if_mm 0x59380816 | (\n << 16) | (\wd << 6)
 	.set	pop
 	.endm
 #endif
--- a/arch/mips/include/asm/msa.h
+++ b/arch/mips/include/asm/msa.h
@@ -192,13 +192,6 @@ static inline void write_msa_##name(unsi
  * allow compilation with toolchains that do not support MSA. Once all
  * toolchains in use support MSA these can be removed.
  */
-#ifdef CONFIG_CPU_MICROMIPS
-#define CFC_MSA_INSN	0x587e0056
-#define CTC_MSA_INSN	0x583e0816
-#else
-#define CFC_MSA_INSN	0x787e0059
-#define CTC_MSA_INSN	0x783e0819
-#endif
 
 #define __BUILD_MSA_CTL_REG(name, cs)				\
 static inline unsigned int read_msa_##name(void)		\
@@ -207,11 +200,12 @@ static inline unsigned int read_msa_##na
 	__asm__ __volatile__(					\
 	"	.set	push\n"					\
 	"	.set	noat\n"					\
-	"	.insn\n"					\
-	"	.word	%1 | (" #cs " << 11)\n"			\
+	"	# cfcmsa $1, $%1\n"				\
+	_ASM_INSN_IF_MIPS(0x787e0059 | %1 << 11)		\
+	_ASM_INSN32_IF_MM(0x587e0056 | %1 << 11)		\
 	"	move	%0, $1\n"				\
 	"	.set	pop\n"					\
-	: "=r"(reg) : "i"(CFC_MSA_INSN));			\
+	: "=r"(reg) : "i"(cs));					\
 	return reg;						\
 }								\
 								\
@@ -221,10 +215,11 @@ static inline void write_msa_##name(unsi
 	"	.set	push\n"					\
 	"	.set	noat\n"					\
 	"	move	$1, %0\n"				\
-	"	.insn\n"					\
-	"	.word	%1 | (" #cs " << 6)\n"			\
+	"	# ctcmsa $%1, $1\n"				\
+	_ASM_INSN_IF_MIPS(0x783e0819 | %1 << 6)			\
+	_ASM_INSN32_IF_MM(0x583e0816 | %1 << 6)			\
 	"	.set	pop\n"					\
-	: : "r"(val), "i"(CTC_MSA_INSN));			\
+	: : "r"(val), "i"(cs));					\
 }
 
 #endif /* !TOOLCHAIN_SUPPORTS_MSA */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 026/312] MIPS: KVM: Fix translation of MFC0 ErrCtl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (24 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 025/312] MIPS: Fix little endian microMIPS MSA encodings Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 027/312] MIPS: SMP: Update cpu_foreign_map on CPU disable Greg Kroah-Hartman
                   ` (287 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Paolo Bonzini,
	Radim Krčmář,
	Ralf Baechle, linux-mips, kvm

From: James Hogan <james.hogan@imgtec.com>

commit 66ffc50c480e7ab6ad5642f47276435a8873c31a upstream.

The MIPS KVM dynamic translation is meant to translate "MFC0 rt, ErrCtl"
instructions into "ADD rt, zero, zero" to zero the destination register,
however the rt register number was copied into rt of the ADD instruction
encoding, which is the 2nd source operand. This results in "ADD zero,
zero, rt" which is a no-op, so only the first execution of each such
MFC0 from ErrCtl will actually read 0.

Fix the shift to put the rt from the MFC0 encoding into the rd field of
the ADD.

Fixes: 50c8308538dc ("KVM/MIPS32: Binary patching of select privileged instructions.")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kvm/dyntrans.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/kvm/dyntrans.c
+++ b/arch/mips/kvm/dyntrans.c
@@ -82,7 +82,7 @@ int kvm_mips_trans_mfc0(uint32_t inst, u
 
 	if ((rd == MIPS_CP0_ERRCTL) && (sel == 0)) {
 		mfc0_inst = CLEAR_TEMPLATE;
-		mfc0_inst |= ((rt & 0x1f) << 16);
+		mfc0_inst |= ((rt & 0x1f) << 11);
 	} else {
 		mfc0_inst = LW_TEMPLATE;
 		mfc0_inst |= ((rt & 0x1f) << 16);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 027/312] MIPS: SMP: Update cpu_foreign_map on CPU disable
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (25 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 026/312] MIPS: KVM: Fix translation of MFC0 ErrCtl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 028/312] MIPS: c-r4k: Fix protected_writeback_scache_line for EVA Greg Kroah-Hartman
                   ` (286 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Paul Burton,
	David Daney, Kevin Cernekee, Florian Fainelli, Huacai Chen,
	Hongliang Tao, Hua Yan, linux-mips, Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 826e99be6ab5189dbfb096389016ffb8d20a683e upstream.

When a CPU is disabled via CPU hotplug, cpu_foreign_map is not updated.
This could result in cache management SMP calls being sent to offline
CPUs instead of online siblings in the same core.

Add a call to calculate_cpu_foreign_map() in the various MIPS cpu
disable callbacks after set_cpu_online(). All cases are updated for
consistency and to keep cpu_foreign_map strictly up to date, not just
those which may support hardware multithreading.

Fixes: cccf34e9411c ("MIPS: c-r4k: Fix cache flushing for MT cores")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: David Daney <david.daney@cavium.com>
Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: Huacai Chen <chenhc@lemote.com>
Cc: Hongliang Tao <taohl@lemote.com>
Cc: Hua Yan <yanh@lemote.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13799/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/cavium-octeon/smp.c         |    1 +
 arch/mips/include/asm/smp.h           |    2 ++
 arch/mips/kernel/smp-bmips.c          |    1 +
 arch/mips/kernel/smp-cps.c            |    1 +
 arch/mips/kernel/smp.c                |    2 +-
 arch/mips/loongson64/loongson-3/smp.c |    1 +
 6 files changed, 7 insertions(+), 1 deletion(-)

--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -239,6 +239,7 @@ static int octeon_cpu_disable(void)
 		return -ENOTSUPP;
 
 	set_cpu_online(cpu, false);
+	calculate_cpu_foreign_map();
 	cpumask_clear_cpu(cpu, &cpu_callin_map);
 	octeon_fixup_irqs();
 
--- a/arch/mips/include/asm/smp.h
+++ b/arch/mips/include/asm/smp.h
@@ -63,6 +63,8 @@ extern cpumask_t cpu_coherent_mask;
 
 extern void asmlinkage smp_bootstrap(void);
 
+extern void calculate_cpu_foreign_map(void);
+
 /*
  * this function sends a 'reschedule' IPI to another CPU.
  * it goes straight through and wastes no time serializing
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -362,6 +362,7 @@ static int bmips_cpu_disable(void)
 	pr_info("SMP: CPU%d is offline\n", cpu);
 
 	set_cpu_online(cpu, false);
+	calculate_cpu_foreign_map();
 	cpumask_clear_cpu(cpu, &cpu_callin_map);
 	clear_c0_status(IE_IRQ5);
 
--- a/arch/mips/kernel/smp-cps.c
+++ b/arch/mips/kernel/smp-cps.c
@@ -338,6 +338,7 @@ static int cps_cpu_disable(void)
 	atomic_sub(1 << cpu_vpe_id(&current_cpu_data), &core_cfg->vpe_mask);
 	smp_mb__after_atomic();
 	set_cpu_online(cpu, false);
+	calculate_cpu_foreign_map();
 	cpumask_clear_cpu(cpu, &cpu_callin_map);
 
 	return 0;
--- a/arch/mips/kernel/smp.c
+++ b/arch/mips/kernel/smp.c
@@ -118,7 +118,7 @@ static inline void set_cpu_core_map(int
  * Calculate a new cpu_foreign_map mask whenever a
  * new cpu appears or disappears.
  */
-static inline void calculate_cpu_foreign_map(void)
+void calculate_cpu_foreign_map(void)
 {
 	int i, k, core_present;
 	cpumask_t temp_foreign_map;
--- a/arch/mips/loongson64/loongson-3/smp.c
+++ b/arch/mips/loongson64/loongson-3/smp.c
@@ -417,6 +417,7 @@ static int loongson3_cpu_disable(void)
 		return -EBUSY;
 
 	set_cpu_online(cpu, false);
+	calculate_cpu_foreign_map();
 	cpumask_clear_cpu(cpu, &cpu_callin_map);
 	local_irq_save(flags);
 	fixup_irqs();



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 028/312] MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (26 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 027/312] MIPS: SMP: Update cpu_foreign_map on CPU disable Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 029/312] MIPS: Octeon: Off by one in octeon_irq_gpio_map() Greg Kroah-Hartman
                   ` (285 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, Leonid Yegoshin,
	linux-mips, Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 0758b116b4080d9a2a2a715bec6eee2cbd828215 upstream.

The protected_writeback_scache_line() function is used by
local_r4k_flush_cache_sigtramp() to flush an FPU delay slot emulation
trampoline on the userland stack from the caches so it is visible to
subsequent instruction fetches.

Commit de8974e3f76c ("MIPS: asm: r4kcache: Add EVA cache flushing
functions") updated some protected_ cache flush functions to use EVA
CACHEE instructions via protected_cachee_op(), and commit 83fd43449baa
("MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line") did
the same thing for protected_writeback_dcache_line(), but
protected_writeback_scache_line() never got updated. Lets fix that now
to flush the right user address from the secondary cache rather than
some arbitrary kernel unmapped address.

This issue was spotted through code inspection, and it seems unlikely to
be possible to hit this in practice. It theoretically affect EVA kernels
on EVA capable cores with an L2 cache, where the icache fetches straight
from RAM (cpu_icache_snoops_remote_store == 0), running a hard float
userland with FPU disabled (nofpu). That both Malta and Boston platforms
override cpu_icache_snoops_remote_store to 1 suggests that all MIPS
cores fetch instructions into icache straight from L2 rather than RAM.

Fixes: de8974e3f76c ("MIPS: asm: r4kcache: Add EVA cache flushing functions")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13800/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/include/asm/r4kcache.h |    4 ++++
 1 file changed, 4 insertions(+)

--- a/arch/mips/include/asm/r4kcache.h
+++ b/arch/mips/include/asm/r4kcache.h
@@ -210,7 +210,11 @@ static inline void protected_writeback_d
 
 static inline void protected_writeback_scache_line(unsigned long addr)
 {
+#ifdef CONFIG_EVA
+	protected_cachee_op(Hit_Writeback_Inv_SD, addr);
+#else
 	protected_cache_op(Hit_Writeback_Inv_SD, addr);
+#endif
 }
 
 /*



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 029/312] MIPS: Octeon: Off by one in octeon_irq_gpio_map()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (27 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 028/312] MIPS: c-r4k: Fix protected_writeback_scache_line for EVA Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 030/312] bpf, mips: fix off-by-one in ctx offset allocation Greg Kroah-Hartman
                   ` (284 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David Daney,
	Rob Herring, Marc Zyngier, linux-mips, kernel-janitors,
	Ralf Baechle

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 008d0cf1ec69ec6d2c08f2d23aff2b67cbe5d2af upstream.

It should be >= ARRAY_SIZE() instead of > ARRAY_SIZE().

Fixes: 64b139f97c01 ('MIPS: OCTEON: irq: add CIB and other fixes')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: David Daney <david.daney@cavium.com>
Cc: Rob Herring <robh@kernel.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: linux-mips@linux-mips.org
Cc: kernel-janitors@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13813/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/cavium-octeon/octeon-irq.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -1220,7 +1220,7 @@ static int octeon_irq_gpio_map(struct ir
 
 	line = (hw + gpiod->base_hwirq) >> 6;
 	bit = (hw + gpiod->base_hwirq) & 63;
-	if (line > ARRAY_SIZE(octeon_irq_ciu_to_irq) ||
+	if (line >= ARRAY_SIZE(octeon_irq_ciu_to_irq) ||
 		octeon_irq_ciu_to_irq[line][bit] != 0)
 		return -EINVAL;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 030/312] bpf, mips: fix off-by-one in ctx offset allocation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (28 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 029/312] MIPS: Octeon: Off by one in octeon_irq_gpio_map() Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 031/312] MIPS: RM7000: Double locking bug in rm7k_tc_disable() Greg Kroah-Hartman
                   ` (283 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Daniel Borkmann,
	Alexei Starovoitov, linux-mips, Ralf Baechle

From: Daniel Borkmann <daniel@iogearbox.net>

commit b4e76f7e6d3200462c6354a6ad4ae167459e61f8 upstream.

Dan Carpenter reported [1] a static checker warning that ctx->offsets[]
may be accessed off by one from build_body(), since it's allocated with
fp->len * sizeof(*ctx.offsets) as length. The cBPF arm and ppc code
doesn't have this issue as claimed, so only mips seems to be affected and
should like most other JITs allocate with fp->len + 1. A few number of
JITs (x86, sparc, arm64) handle this differently, where they only require
fp->len array elements.

  [1] http://www.spinics.net/lists/mips/msg64193.html

Fixes: c6610de353da ("MIPS: net: Add BPF JIT")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: ast@kernel.org
Cc: linux-mips@linux-mips.org
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/13814/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/net/bpf_jit.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/net/bpf_jit.c
+++ b/arch/mips/net/bpf_jit.c
@@ -1207,7 +1207,7 @@ void bpf_jit_compile(struct bpf_prog *fp
 
 	memset(&ctx, 0, sizeof(ctx));
 
-	ctx.offsets = kcalloc(fp->len, sizeof(*ctx.offsets), GFP_KERNEL);
+	ctx.offsets = kcalloc(fp->len + 1, sizeof(*ctx.offsets), GFP_KERNEL);
 	if (ctx.offsets == NULL)
 		return;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 031/312] MIPS: RM7000: Double locking bug in rm7k_tc_disable()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (29 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 030/312] bpf, mips: fix off-by-one in ctx offset allocation Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 032/312] MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Greg Kroah-Hartman
                   ` (282 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, linux-mips,
	kernel-janitors, Ralf Baechle

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 58a7e1c140f3ad61646bc0cd9a1f6a9cafc0b225 upstream.

We obviously intended to enable IRQs again at the end.

Fixes: 745aef5df1e2 ('MIPS: RM7000: Add support for tertiary cache')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Cc: kernel-janitors@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13815/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/sc-rm7k.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/mips/mm/sc-rm7k.c
+++ b/arch/mips/mm/sc-rm7k.c
@@ -161,7 +161,7 @@ static void rm7k_tc_disable(void)
 	local_irq_save(flags);
 	blast_rm7k_tcache();
 	clear_c0_config(RM7K_CONF_TE);
-	local_irq_save(flags);
+	local_irq_restore(flags);
 }
 
 static void rm7k_sc_disable(void)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 032/312] MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (30 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 031/312] MIPS: RM7000: Double locking bug in rm7k_tc_disable() Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 033/312] mips/panic: replace smp_send_stop() with kdump friendly version in panic path Greg Kroah-Hartman
                   ` (281 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, James Hogan, linux-mips, linux-arch,
	Ralf Baechle

From: James Hogan <james.hogan@imgtec.com>

commit 233b2ca181f20674ecad11be90b00814911ce345 upstream.

AT_VECTOR_SIZE_ARCH should be defined with the maximum number of
NEW_AUX_ENT entries that ARCH_DLINFO can contain, but it wasn't defined
for MIPS at all even though ARCH_DLINFO will contain one NEW_AUX_ENT for
the VDSO address.

This shouldn't be a problem as AT_VECTOR_SIZE_BASE includes space for
AT_BASE_PLATFORM which MIPS doesn't use, but lets define it now and add
the comment above ARCH_DLINFO as found in several other architectures to
remind future modifiers of ARCH_DLINFO to keep AT_VECTOR_SIZE_ARCH up to
date.

Fixes: ebb5e78cc634 ("MIPS: Initial implementation of a VDSO")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-arch@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/13823/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/include/asm/elf.h         |    1 +
 arch/mips/include/uapi/asm/auxvec.h |    2 ++
 2 files changed, 3 insertions(+)

--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -420,6 +420,7 @@ extern const char *__elf_platform;
 #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
 #endif
 
+/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
 #define ARCH_DLINFO							\
 do {									\
 	NEW_AUX_ENT(AT_SYSINFO_EHDR,					\
--- a/arch/mips/include/uapi/asm/auxvec.h
+++ b/arch/mips/include/uapi/asm/auxvec.h
@@ -14,4 +14,6 @@
 /* Location of VDSO image. */
 #define AT_SYSINFO_EHDR		33
 
+#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
+
 #endif /* __ASM_AUXVEC_H */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 033/312] mips/panic: replace smp_send_stop() with kdump friendly version in panic path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (31 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 032/312] MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 034/312] ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz Greg Kroah-Hartman
                   ` (280 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hidehiro Kawai, Daniel Walker,
	Dave Young, Baoquan He, Vivek Goyal, Eric Biederman,
	Masami Hiramatsu, Xunlei Pang, Thomas Gleixner, Ingo Molnar,
	H. Peter Anvin, Borislav Petkov, David Vrabel, Toshi Kani,
	Ralf Baechle, David Daney, Aaro Koskinen, Steven J. Hill,
	Corey Minyard, Andrew Morton, Linus Torvalds

From: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>

commit 54c721b857fd45f3ad3bda695ee4f472518db02a upstream.

Daniel Walker reported problems which happens when
crash_kexec_post_notifiers kernel option is enabled
(https://lkml.org/lkml/2015/6/24/44).

In that case, smp_send_stop() is called before entering kdump routines
which assume other CPUs are still online.  As the result, kdump
routines fail to save other CPUs' registers.  Additionally for MIPS
OCTEON, it misses to stop the watchdog timer.

To fix this problem, call a new kdump friendly function,
crash_smp_send_stop(), instead of the smp_send_stop() when
crash_kexec_post_notifiers is enabled.  crash_smp_send_stop() is a
weak function, and it just call smp_send_stop().  Architecture
codes should override it so that kdump can work appropriately.
This patch provides MIPS version.

Fixes: f06e5153f4ae (kernel/panic.c: add "crash_kexec_post_notifiers" option)
Link: http://lkml.kernel.org/r/20160810080950.11028.28000.stgit@sysi4-13.yrl.intra.hitachi.co.jp
Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Reported-by: Daniel Walker <dwalker@fifo99.com>
Cc: Dave Young <dyoung@redhat.com>
Cc: Baoquan He <bhe@redhat.com>
Cc: Vivek Goyal <vgoyal@redhat.com>
Cc: Eric Biederman <ebiederm@xmission.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Daniel Walker <dwalker@fifo99.com>
Cc: Xunlei Pang <xpang@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Toshi Kani <toshi.kani@hpe.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: David Daney <david.daney@cavium.com>
Cc: Aaro Koskinen <aaro.koskinen@iki.fi>
Cc: "Steven J. Hill" <steven.hill@cavium.com>
Cc: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/cavium-octeon/setup.c  |   14 ++++++++++++++
 arch/mips/include/asm/kexec.h    |    1 +
 arch/mips/kernel/crash.c         |   18 +++++++++++++++++-
 arch/mips/kernel/machine_kexec.c |    1 +
 4 files changed, 33 insertions(+), 1 deletion(-)

--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -251,6 +251,17 @@ static void octeon_crash_shutdown(struct
 	default_machine_crash_shutdown(regs);
 }
 
+#ifdef CONFIG_SMP
+void octeon_crash_smp_send_stop(void)
+{
+	int cpu;
+
+	/* disable watchdogs */
+	for_each_online_cpu(cpu)
+		cvmx_write_csr(CVMX_CIU_WDOGX(cpu_logical_map(cpu)), 0);
+}
+#endif
+
 #endif /* CONFIG_KEXEC */
 
 #ifdef CONFIG_CAVIUM_RESERVE32
@@ -864,6 +875,9 @@ void __init prom_init(void)
 	_machine_kexec_shutdown = octeon_shutdown;
 	_machine_crash_shutdown = octeon_crash_shutdown;
 	_machine_kexec_prepare = octeon_kexec_prepare;
+#ifdef CONFIG_SMP
+	_crash_smp_send_stop = octeon_crash_smp_send_stop;
+#endif
 #endif
 
 	octeon_user_io_init();
--- a/arch/mips/include/asm/kexec.h
+++ b/arch/mips/include/asm/kexec.h
@@ -45,6 +45,7 @@ extern const unsigned char kexec_smp_wai
 extern unsigned long secondary_kexec_args[4];
 extern void (*relocated_kexec_smp_wait) (void *);
 extern atomic_t kexec_ready_to_reboot;
+extern void (*_crash_smp_send_stop)(void);
 #endif
 #endif
 
--- a/arch/mips/kernel/crash.c
+++ b/arch/mips/kernel/crash.c
@@ -50,9 +50,14 @@ static void crash_shutdown_secondary(voi
 
 static void crash_kexec_prepare_cpus(void)
 {
+	static int cpus_stopped;
 	unsigned int msecs;
+	unsigned int ncpus;
 
-	unsigned int ncpus = num_online_cpus() - 1;/* Excluding the panic cpu */
+	if (cpus_stopped)
+		return;
+
+	ncpus = num_online_cpus() - 1;/* Excluding the panic cpu */
 
 	dump_send_ipi(crash_shutdown_secondary);
 	smp_wmb();
@@ -67,6 +72,17 @@ static void crash_kexec_prepare_cpus(voi
 		cpu_relax();
 		mdelay(1);
 	}
+
+	cpus_stopped = 1;
+}
+
+/* Override the weak function in kernel/panic.c */
+void crash_smp_send_stop(void)
+{
+	if (_crash_smp_send_stop)
+		_crash_smp_send_stop();
+
+	crash_kexec_prepare_cpus();
 }
 
 #else /* !defined(CONFIG_SMP)  */
--- a/arch/mips/kernel/machine_kexec.c
+++ b/arch/mips/kernel/machine_kexec.c
@@ -25,6 +25,7 @@ void (*_machine_crash_shutdown)(struct p
 #ifdef CONFIG_SMP
 void (*relocated_kexec_smp_wait) (void *);
 atomic_t kexec_ready_to_reboot = ATOMIC_INIT(0);
+void (*_crash_smp_send_stop)(void) = NULL;
 #endif
 
 int



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 034/312] ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (32 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 033/312] mips/panic: replace smp_send_stop() with kdump friendly version in panic path Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 035/312] ARM: imx: select SRC for i.MX7 Greg Kroah-Hartman
                   ` (279 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Simon Horman

From: Geert Uytterhoeven <geert+renesas@glider.be>

commit c61f30a255550bbfc6b83c1ca720661489cac4c0 upstream.

On r8a7740/armadillo, actual clock rates are ca. 4% lower than reported
by /sys/kernel/debug/clk/clk_summary. Correct the extal1 frequency from
25 MHz to 24 MHz to fix this.

This matches the Armadillo-800 EVA Product Manual, which claims the main
crystal runs at 24 MHz, and the old legacy/reference board code.

Fixes: 25aa7ba3fdfb ("ARM: shmobile: armadillo800eva: Sync DTS")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/r8a7740-armadillo800eva.dts |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/r8a7740-armadillo800eva.dts
+++ b/arch/arm/boot/dts/r8a7740-armadillo800eva.dts
@@ -180,7 +180,7 @@
 };
 
 &extal1_clk {
-	clock-frequency = <25000000>;
+	clock-frequency = <24000000>;
 };
 &extal2_clk {
 	clock-frequency = <48000000>;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 035/312] ARM: imx: select SRC for i.MX7
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (33 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 034/312] ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 036/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
                   ` (278 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Shawn Guo

From: Arnd Bergmann <arnd@arndb.de>

commit f1858b0e801a45d801dc23bc1ff5be14805022c8 upstream.

The i.MX7 Kconfig option had a couple of missing select lines that
I fixed already, but I missed HAVE_IMX_SRC:

arch/arm/mach-imx/built-in.o: In function `imx7d_init_irq':
platform-spi_imx.c:(.init.text+0x25a8): undefined reference to `imx_src_init'

This adds that one as well.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 0be5da9dc249 ("ARM: imx: imx7d requires anatop")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-imx/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -562,6 +562,7 @@ config SOC_IMX7D
 	select ARM_GIC
 	select HAVE_IMX_ANATOP
 	select HAVE_IMX_MMDC
+	select HAVE_IMX_SRC
 	help
 		This enables support for Freescale i.MX7 Dual processor.
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 036/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (34 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 035/312] ARM: imx: select SRC for i.MX7 Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 037/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
                   ` (277 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnaud Patard (Rtp),
	Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit 144e08abe80080c9c2cf0a06e40f1bc8150674eb upstream.

For kirkwood, gpio pins starts from 32 are in the 2nd bank, so it should be
converted to "gpio1 <pin minus 32>" in dts file.
e.g. gpio 40 should be "gpio1 8"

Besides, a few other pin fixes for ls-wxl/wsxl, to match with mpp pin
definition:
  - gpio-leds: "lswxl:blue:power" pin
  - gpio-leds: "lswxl:red:func" pin
  - gpio-leds: "lswxl:red:hdderr0" pin
  - gpio-leds: "lswxl:red:hdderr1" pin
  - gpio-fan:  low/high/alarm pin

The pin/bank issue was found when discussing Debian Bug #810894
  [https://bugs.debian.org/810894#47]

Fixes: e54e4b1b622e ("ARM: dts: add buffalo linkstation ls-wxl/wsxl")
Reported-by: Arnaud Patard (Rtp) <arnaud.patard@rtp-net.org>
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/kirkwood-lswxl.dts |   29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

--- a/arch/arm/boot/dts/kirkwood-lswxl.dts
+++ b/arch/arm/boot/dts/kirkwood-lswxl.dts
@@ -1,7 +1,8 @@
 /*
  * Device Tree file for Buffalo Linkstation LS-WXL/WSXL
  *
- * Copyright (C) 2015, rogershimizu@gmail.com
+ * Copyright (C) 2015, 2016
+ * Roger Shimizu <rogershimizu@gmail.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -156,21 +157,21 @@
 		button@1 {
 			label = "Function Button";
 			linux,code = <KEY_OPTION>;
-			gpios = <&gpio1 41 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 9 GPIO_ACTIVE_LOW>;
 		};
 
 		button@2 {
 			label = "Power-on Switch";
 			linux,code = <KEY_RESERVED>;
 			linux,input-type = <5>;
-			gpios = <&gpio1 42 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
 		};
 
 		button@3 {
 			label = "Power-auto Switch";
 			linux,code = <KEY_ESC>;
 			linux,input-type = <5>;
-			gpios = <&gpio1 43 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 11 GPIO_ACTIVE_LOW>;
 		};
 	};
 
@@ -185,12 +186,12 @@
 
 		led@1 {
 			label = "lswxl:blue:func";
-			gpios = <&gpio1 36 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
 		};
 
 		led@2 {
 			label = "lswxl:red:alarm";
-			gpios = <&gpio1 49 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 17 GPIO_ACTIVE_LOW>;
 		};
 
 		led@3 {
@@ -200,23 +201,23 @@
 
 		led@4 {
 			label = "lswxl:blue:power";
-			gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
 		};
 
 		led@5 {
 			label = "lswxl:red:func";
-			gpios = <&gpio1 5 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
 			default-state = "keep";
 		};
 
 		led@6 {
 			label = "lswxl:red:hdderr0";
-			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio0 8 GPIO_ACTIVE_LOW>;
 		};
 
 		led@7 {
 			label = "lswxl:red:hdderr1";
-			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
 		};
 	};
 
@@ -225,15 +226,15 @@
 		pinctrl-0 = <&pmx_fan_low &pmx_fan_high &pmx_fan_lock>;
 		pinctrl-names = "default";
 
-		gpios = <&gpio0 47 GPIO_ACTIVE_LOW
-			 &gpio0 48 GPIO_ACTIVE_LOW>;
+		gpios = <&gpio1 16 GPIO_ACTIVE_LOW
+			 &gpio1 15 GPIO_ACTIVE_LOW>;
 
 		gpio-fan,speed-map = <0 3
 				1500 2
 				3250 1
 				5000 0>;
 
-		alarm-gpios = <&gpio1 49 GPIO_ACTIVE_HIGH>;
+		alarm-gpios = <&gpio1 8 GPIO_ACTIVE_HIGH>;
 	};
 
 	restart_poweroff {
@@ -256,7 +257,7 @@
 			enable-active-high;
 			regulator-always-on;
 			regulator-boot-on;
-			gpio = <&gpio0 37 GPIO_ACTIVE_HIGH>;
+			gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
 		};
 		hdd_power0: regulator@2 {
 			compatible = "regulator-fixed";



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 037/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (35 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 036/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 038/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
                   ` (276 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnaud Patard (Rtp),
	Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit 6f86e9adc53b4c0a2a4283692216d119019f0b8d upstream.

For kirkwood, gpio pins starts from 32 are in the 2nd bank, so it should be
converted to "gpio1 <pin minus 32>" in dts file.
e.g. gpio 40 should be "gpio1 8"

The pin/bank issue was found when discussing Debian Bug #810894
  [https://bugs.debian.org/810894#47]

Fixes: c43379e150aa ("ARM: dts: add buffalo linkstation ls-wvl/vl")
Reported-by: Arnaud Patard (Rtp) <arnaud.patard@rtp-net.org>
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/kirkwood-lswvl.dts |   25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

--- a/arch/arm/boot/dts/kirkwood-lswvl.dts
+++ b/arch/arm/boot/dts/kirkwood-lswvl.dts
@@ -1,7 +1,8 @@
 /*
  * Device Tree file for Buffalo Linkstation LS-WVL/VL
  *
- * Copyright (C) 2015, rogershimizu@gmail.com
+ * Copyright (C) 2015, 2016
+ * Roger Shimizu <rogershimizu@gmail.com>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License
@@ -156,21 +157,21 @@
 		button@1 {
 			label = "Function Button";
 			linux,code = <KEY_OPTION>;
-			gpios = <&gpio0 45 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 13 GPIO_ACTIVE_LOW>;
 		};
 
 		button@2 {
 			label = "Power-on Switch";
 			linux,code = <KEY_RESERVED>;
 			linux,input-type = <5>;
-			gpios = <&gpio0 46 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
 		};
 
 		button@3 {
 			label = "Power-auto Switch";
 			linux,code = <KEY_ESC>;
 			linux,input-type = <5>;
-			gpios = <&gpio0 47 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 15 GPIO_ACTIVE_LOW>;
 		};
 	};
 
@@ -185,38 +186,38 @@
 
 		led@1 {
 			label = "lswvl:red:alarm";
-			gpios = <&gpio0 36 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
 		};
 
 		led@2 {
 			label = "lswvl:red:func";
-			gpios = <&gpio0 37 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 5 GPIO_ACTIVE_LOW>;
 		};
 
 		led@3 {
 			label = "lswvl:amber:info";
-			gpios = <&gpio0 38 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
 		};
 
 		led@4 {
 			label = "lswvl:blue:func";
-			gpios = <&gpio0 39 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
 		};
 
 		led@5 {
 			label = "lswvl:blue:power";
-			gpios = <&gpio0 40 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 8 GPIO_ACTIVE_LOW>;
 			default-state = "keep";
 		};
 
 		led@6 {
 			label = "lswvl:red:hdderr0";
-			gpios = <&gpio0 34 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
 		};
 
 		led@7 {
 			label = "lswvl:red:hdderr1";
-			gpios = <&gpio0 35 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
 		};
 	};
 
@@ -233,7 +234,7 @@
 				3250 1
 				5000 0>;
 
-		alarm-gpios = <&gpio0 43 GPIO_ACTIVE_HIGH>;
+		alarm-gpios = <&gpio1 11 GPIO_ACTIVE_HIGH>;
 	};
 
 	restart_poweroff {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 038/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (36 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 037/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 039/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
                   ` (275 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit e98bd707e39d52d8bef8622e6e7b0ab4bd0ed8d0 upstream.

The GPIOs controlling the LEDs, listed below, are active high, not low:
  - gpio-leds: "lswxl:blue:power" pin
  - gpio-leds: "lswxl:red:func" pin
  - gpio-leds: "lswxl:red:hdderr{0,1}" pin

Fixes: e54e4b1b622e ("ARM: dts: add buffalo linkstation ls-wxl/wsxl")
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/kirkwood-lswxl.dts |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/arch/arm/boot/dts/kirkwood-lswxl.dts
+++ b/arch/arm/boot/dts/kirkwood-lswxl.dts
@@ -201,23 +201,23 @@
 
 		led@4 {
 			label = "lswxl:blue:power";
-			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>;
+			default-state = "keep";
 		};
 
 		led@5 {
 			label = "lswxl:red:func";
-			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
-			default-state = "keep";
+			gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@6 {
 			label = "lswxl:red:hdderr0";
-			gpios = <&gpio0 8 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio0 8 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@7 {
 			label = "lswxl:red:hdderr1";
-			gpios = <&gpio1 14 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 14 GPIO_ACTIVE_HIGH>;
 		};
 	};
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 039/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (37 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 038/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 040/312] ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl Greg Kroah-Hartman
                   ` (274 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit 0418138e2ffd90f4a00b263593f2e199db87321d upstream.

The GPIOs controlling the LEDs, listed below, are active high, not low:
  - gpio-leds: "lswvl:red:alarm" pin
  - gpio-leds: "lswvl:red:func" pin
  - gpio-leds: "lswvl:amber:info" pin
  - gpio-leds: "lswvl:blue:func" pin
  - gpio-leds: "lswvl:red:hdderr{0,1}" pin

Fixes: c43379e150aa ("ARM: dts: add buffalo linkstation ls-wvl/vl")
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/kirkwood-lswvl.dts |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/arm/boot/dts/kirkwood-lswvl.dts
+++ b/arch/arm/boot/dts/kirkwood-lswvl.dts
@@ -186,22 +186,22 @@
 
 		led@1 {
 			label = "lswvl:red:alarm";
-			gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 4 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@2 {
 			label = "lswvl:red:func";
-			gpios = <&gpio1 5 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@3 {
 			label = "lswvl:amber:info";
-			gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 6 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@4 {
 			label = "lswvl:blue:func";
-			gpios = <&gpio1 7 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 7 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@5 {
@@ -212,12 +212,12 @@
 
 		led@6 {
 			label = "lswvl:red:hdderr0";
-			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
 		};
 
 		led@7 {
 			label = "lswvl:red:hdderr1";
-			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>;
 		};
 	};
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 040/312] ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (38 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 039/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 041/312] ARM: dts: orion5x: fix the missing mtd flash on " Greg Kroah-Hartman
                   ` (273 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit ff61ee84e7aa5842d9e33c0b442f0b43a6a44eaf upstream.

Here're a few gpio pin related fixes:
  - remove pinctrl-0 definition from pinctrl, since those pins are used
    in other places such as gpio-fan and regulators.
  - keep initial state of power led
  - fix for alarm pin of gpio-fan.

Fixes: dc57844a736f ("ARM: dts: orion5x: add buffalo linkstation ls-wtgl")
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts
+++ b/arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts
@@ -1,7 +1,8 @@
 /*
  * Device Tree file for Buffalo Linkstation LS-WTGL
  *
- * Copyright (C) 2015, Roger Shimizu <rogershimizu@gmail.com>
+ * Copyright (C) 2015, 2016
+ * Roger Shimizu <rogershimizu@gmail.com>
  *
  * This file is dual-licensed: you can use it either under the terms
  * of the GPL or the X11 license, at your option. Note that this dual
@@ -69,8 +70,6 @@
 
 		internal-regs {
 			pinctrl: pinctrl@10000 {
-				pinctrl-0 = <&pmx_usb_power &pmx_power_hdd
-					&pmx_fan_low &pmx_fan_high &pmx_fan_lock>;
 				pinctrl-names = "default";
 
 				pmx_led_power: pmx-leds {
@@ -162,6 +161,7 @@
 		led@1 {
 			label = "lswtgl:blue:power";
 			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			default-state = "keep";
 		};
 
 		led@2 {
@@ -188,7 +188,7 @@
 				3250 1
 				5000 0>;
 
-		alarm-gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>;
+		alarm-gpios = <&gpio0 6 GPIO_ACTIVE_HIGH>;
 	};
 
 	restart_poweroff {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 041/312] ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (39 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 040/312] ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 042/312] ARM: dts: kirkwood: use unique machine name for ds112 Greg Kroah-Hartman
                   ` (272 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Roger Shimizu, Andrew Lunn, Gregory CLEMENT

From: Roger Shimizu <rogershimizu@gmail.com>

commit 44361a2cc13493fc41216d33bb9a562ec3a9cc4e upstream.

MTD flash stores u-boot and u-boot environment on linkstation lswtgl.
The latter one can be easily read/write by u-boot-tools package in Debian.

Fixes: dc57844a736f ("ARM: dts: orion5x: add buffalo linkstation ls-wtgl")
Signed-off-by: Roger Shimizu <rogershimizu@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts |   31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)

--- a/arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts
+++ b/arch/arm/boot/dts/orion5x-linkstation-lswtgl.dts
@@ -228,6 +228,37 @@
 	};
 };
 
+&devbus_bootcs {
+	status = "okay";
+	devbus,keep-config;
+
+	flash@0 {
+		compatible = "jedec-flash";
+		reg = <0 0x40000>;
+		bank-width = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			header@0 {
+				reg = <0 0x30000>;
+				read-only;
+			};
+
+			uboot@30000 {
+				reg = <0x30000 0xF000>;
+				read-only;
+			};
+
+			uboot_env@3F000 {
+				reg = <0x3F000 0x1000>;
+			};
+		};
+	};
+};
+
 &mdio {
 	status = "okay";
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 042/312] ARM: dts: kirkwood: use unique machine name for ds112
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (40 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 041/312] ARM: dts: orion5x: fix the missing mtd flash on " Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 043/312] ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile Greg Kroah-Hartman
                   ` (271 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heinrich Schuchardt, Andrew Lunn,
	Gregory CLEMENT

From: Heinrich Schuchardt <xypron.glpk@gmx.de>

commit 9d021c9d1b4b774a35d8a03d58dbf029544debda upstream.

Downstream packages like Debian flash-kernel use
/proc/device-tree/model
to determine which dtb file to install.

Hence each dts in the Linux kernel should provide a unique model
identifier.

Commit 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS
devices") created the new files kirkwood-ds111.dts and kirkwood-ds112.dts
using the same model identifier.

This patch provides a unique model identifier for the
Synology DiskStation DS112.

Fixes: 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/kirkwood-ds112.dts |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/boot/dts/kirkwood-ds112.dts
+++ b/arch/arm/boot/dts/kirkwood-ds112.dts
@@ -14,7 +14,7 @@
 #include "kirkwood-synology.dtsi"
 
 / {
-	model = "Synology DS111";
+	model = "Synology DS112";
 	compatible = "synology,ds111", "marvell,kirkwood";
 
 	memory {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 043/312] ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (41 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 042/312] ARM: dts: kirkwood: use unique machine name for ds112 Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 044/312] ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence Greg Kroah-Hartman
                   ` (270 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heinrich Schuchardt, Gregory CLEMENT

From: Heinrich Schuchardt <xypron.glpk@gmx.de>

commit fc5c796e12511a7c027b5a4438719dde2f796208 upstream.

Commit 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology
NAS devices") created the new file kirkwood-ds112.dts but did not
add it to the Makefile.

Fixes: 2d0a7addbd10 ("ARM: Kirkwood: Add support for many Synology NAS devices")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/Makefile |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -166,6 +166,7 @@ dtb-$(CONFIG_MACH_KIRKWOOD) += \
 	kirkwood-ds109.dtb \
 	kirkwood-ds110jv10.dtb \
 	kirkwood-ds111.dtb \
+	kirkwood-ds112.dtb \
 	kirkwood-ds209.dtb \
 	kirkwood-ds210.dtb \
 	kirkwood-ds212.dtb \



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 044/312] ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (42 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 043/312] ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 045/312] perf/x86: Fix filter_events() bug with event mappings Greg Kroah-Hartman
                   ` (269 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Suman Anna, Paul Walmsley

From: Suman Anna <s-anna@ti.com>

commit c20c8f750d9f8f8617f07ee2352d3ff560e66bc2 upstream.

The omap_hwmod _enable() function can return success without setting
the hwmod state to _HWMOD_STATE_ENABLED for IPs with reset lines when
all of the reset lines are asserted. The omap_hwmod _idle() function
also performs a similar check, but after checking for the hwmod state
first. This triggers the WARN when pm_runtime_get and pm_runtime_put
are invoked on IPs with all reset lines asserted. Reverse the checks
for hwmod state and reset lines status to fix this.

Issue found during a unbind operation on a device with reset lines
still asserted, example backtrace below

 ------------[ cut here ]------------
 WARNING: CPU: 1 PID: 879 at arch/arm/mach-omap2/omap_hwmod.c:2207 _idle+0x1e4/0x240()
 omap_hwmod: mmu_dsp: idle state can only be entered from enabled state
 Modules linked in:
 CPU: 1 PID: 879 Comm: sh Not tainted 4.4.0-00008-ga989d951331a #3
 Hardware name: Generic OMAP5 (Flattened Device Tree)
 [<c0018e60>] (unwind_backtrace) from [<c0014dc4>] (show_stack+0x10/0x14)
 [<c0014dc4>] (show_stack) from [<c037ac28>] (dump_stack+0x90/0xc0)
 [<c037ac28>] (dump_stack) from [<c003f420>] (warn_slowpath_common+0x78/0xb4)
 [<c003f420>] (warn_slowpath_common) from [<c003f48c>] (warn_slowpath_fmt+0x30/0x40)
 [<c003f48c>] (warn_slowpath_fmt) from [<c0028c20>] (_idle+0x1e4/0x240)
 [<c0028c20>] (_idle) from [<c0029080>] (omap_hwmod_idle+0x28/0x48)
 [<c0029080>] (omap_hwmod_idle) from [<c002a5a4>] (omap_device_idle+0x3c/0x90)
 [<c002a5a4>] (omap_device_idle) from [<c0427a90>] (__rpm_callback+0x2c/0x60)
 [<c0427a90>] (__rpm_callback) from [<c0427ae4>] (rpm_callback+0x20/0x80)
 [<c0427ae4>] (rpm_callback) from [<c0427f84>] (rpm_suspend+0x138/0x74c)
 [<c0427f84>] (rpm_suspend) from [<c0428b78>] (__pm_runtime_idle+0x78/0xa8)
 [<c0428b78>] (__pm_runtime_idle) from [<c041f514>] (__device_release_driver+0x64/0x100)
 [<c041f514>] (__device_release_driver) from [<c041f5d0>] (device_release_driver+0x20/0x2c)
 [<c041f5d0>] (device_release_driver) from [<c041d85c>] (unbind_store+0x78/0xf8)
 [<c041d85c>] (unbind_store) from [<c0206df8>] (kernfs_fop_write+0xc0/0x1c4)
 [<c0206df8>] (kernfs_fop_write) from [<c018a120>] (__vfs_write+0x20/0xdc)
 [<c018a120>] (__vfs_write) from [<c018a9cc>] (vfs_write+0x90/0x164)
 [<c018a9cc>] (vfs_write) from [<c018b1f0>] (SyS_write+0x44/0x9c)
 [<c018b1f0>] (SyS_write) from [<c0010420>] (ret_fast_syscall+0x0/0x1c)
 ---[ end trace a4182013c75a9f50 ]---

While at this, fix the sequence in _shutdown() as well, though there
is no easy reproducible scenario.

Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior")
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/mach-omap2/omap_hwmod.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/arch/arm/mach-omap2/omap_hwmod.c
+++ b/arch/arm/mach-omap2/omap_hwmod.c
@@ -2207,15 +2207,15 @@ static int _idle(struct omap_hwmod *oh)
 
 	pr_debug("omap_hwmod: %s: idling\n", oh->name);
 
+	if (_are_all_hardreset_lines_asserted(oh))
+		return 0;
+
 	if (oh->_state != _HWMOD_STATE_ENABLED) {
 		WARN(1, "omap_hwmod: %s: idle state can only be entered from enabled state\n",
 			oh->name);
 		return -EINVAL;
 	}
 
-	if (_are_all_hardreset_lines_asserted(oh))
-		return 0;
-
 	if (oh->class->sysc)
 		_idle_sysc(oh);
 	_del_initiator_dep(oh, mpu_oh);
@@ -2262,6 +2262,9 @@ static int _shutdown(struct omap_hwmod *
 	int ret, i;
 	u8 prev_state;
 
+	if (_are_all_hardreset_lines_asserted(oh))
+		return 0;
+
 	if (oh->_state != _HWMOD_STATE_IDLE &&
 	    oh->_state != _HWMOD_STATE_ENABLED) {
 		WARN(1, "omap_hwmod: %s: disabled state can only be entered from idle, or enabled state\n",
@@ -2269,9 +2272,6 @@ static int _shutdown(struct omap_hwmod *
 		return -EINVAL;
 	}
 
-	if (_are_all_hardreset_lines_asserted(oh))
-		return 0;
-
 	pr_debug("omap_hwmod: %s: disabling\n", oh->name);
 
 	if (oh->class->pre_shutdown) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 045/312] perf/x86: Fix filter_events() bug with event mappings
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (43 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 044/312] ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 046/312] x86/LDT: Print the real LDT base address Greg Kroah-Hartman
                   ` (268 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stephane Eranian,
	Peter Zijlstra (Intel),
	Arnaldo Carvalho de Melo, Jiri Olsa, Linus Torvalds,
	Thomas Gleixner, Vince Weaver, jolsa, kan.liang, Ingo Molnar

From: Stephane Eranian <eranian@google.com>

commit 61b87cae6361ea6af161c1ffa549898892707b19 upstream.

This patch fixes a bug in the filter_events() function.

The patch fixes the bug whereby if some mappings did not
exist, e.g., STALLED_CYCLES_FRONTEND, then any event after it
in the attrs array would disappear from the published list of
events in /sys/devices/cpu/events. This could be verified
easily on any system post SNB (which do not publish
STALLED_CYCLES_FRONTEND):

	$ ./perf stat -e cycles,ref-cycles true
	Performance counter stats for 'true':
              1,217,348      cycles
	<not supported>      ref-cycles

The problem is that in filter_events() there is an assumption
that the argument (attrs) is organized in increasing continuous
event indexes related to the event_map(). But if we remove the
non-supported events by shifing the position in the array, then
the lookup x86_pmu.event_map() needs to compensate for it, otherwise
we are looking up the wrong index. This patch corrects this problem
by compensating for the deleted events and with that ref-cycles
reappears (here shown on Haswell):

	$ perf stat -e ref-cycles,cycles true
	Performance counter stats for 'true':
         4,525,910      ref-cycles
         1,064,920      cycles
       0.002943888 seconds time elapsed

Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: jolsa@kernel.org
Cc: kan.liang@intel.com
Fixes: 8300daa26755 ("perf/x86: Filter out undefined events from sysfs events attribute")
Link: http://lkml.kernel.org/r/1449516805-6637-1-git-send-email-eranian@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/perf_event.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1550,6 +1550,7 @@ static void __init filter_events(struct
 {
 	struct device_attribute *d;
 	struct perf_pmu_events_attr *pmu_attr;
+	int offset = 0;
 	int i, j;
 
 	for (i = 0; attrs[i]; i++) {
@@ -1558,7 +1559,7 @@ static void __init filter_events(struct
 		/* str trumps id */
 		if (pmu_attr->event_str)
 			continue;
-		if (x86_pmu.event_map(i))
+		if (x86_pmu.event_map(i + offset))
 			continue;
 
 		for (j = i; attrs[j]; j++)
@@ -1566,6 +1567,14 @@ static void __init filter_events(struct
 
 		/* Check the shifted attr. */
 		i--;
+
+		/*
+		 * event_map() is index based, the attrs array is organized
+		 * by increasing event index. If we shift the events, then
+		 * we need to compensate for the event_map(), otherwise
+		 * we are looking up the wrong event in the map
+		 */
+		offset++;
 	}
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 046/312] x86/LDT: Print the real LDT base address
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (44 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 045/312] perf/x86: Fix filter_events() bug with event mappings Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 047/312] x86/apic/uv: Silence a shift wrapping warning Greg Kroah-Hartman
                   ` (267 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jan Beulich, Andy Lutomirski,
	Thomas Gleixner

From: Jan Beulich <JBeulich@suse.com>

commit 0d430e3fb3f7cdc13c0d22078b820f682821b45a upstream.

This was meant to print base address and entry count; make it do so
again.

Fixes: 37868fe113ff "x86/ldt: Make modify_ldt synchronous"
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Link: http://lkml.kernel.org/r/56797D8402000078000C24F0@prv-mh.provo.novell.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/process_64.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -128,7 +128,7 @@ void release_thread(struct task_struct *
 		if (dead_task->mm->context.ldt) {
 			pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n",
 				dead_task->comm,
-				dead_task->mm->context.ldt,
+				dead_task->mm->context.ldt->entries,
 				dead_task->mm->context.ldt->size);
 			BUG();
 		}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 047/312] x86/apic/uv: Silence a shift wrapping warning
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (45 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 046/312] x86/LDT: Print the real LDT base address Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 048/312] ALSA: fm801: explicitly free IRQ line Greg Kroah-Hartman
                   ` (266 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Alex Thorlton,
	Dimitri Sivanich, Linus Torvalds, Mike Travis, Nathan Zimmer,
	Peter Zijlstra, Sebastian Andrzej Siewior, Thomas Gleixner,
	kernel-janitors, Ingo Molnar

From: Dan Carpenter <dan.carpenter@oracle.com>

commit c4597fd756836a5fb7900f2091797ab564390ad0 upstream.

'm_io' is stored in 6 bits so it's a number in the 0-63 range.  Static
analysis tools complain that 1 << 63 will wrap so I have changed it to
1ULL << m_io.

This code is over three years old so presumably the bug doesn't happen
very frequently in real life or someone would have complained by now.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: Dimitri Sivanich <sivanich@sgi.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Travis <travis@sgi.com>
Cc: Nathan Zimmer <nzimmer@sgi.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: kernel-janitors@vger.kernel.org
Fixes: b15cc4a12bed ("x86, uv, uv3: Update x2apic Support for SGI UV3")
Link: http://lkml.kernel.org/r/20161123221908.GA23997@mwanda
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/apic/x2apic_uv_x.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/x86/kernel/apic/x2apic_uv_x.c
+++ b/arch/x86/kernel/apic/x2apic_uv_x.c
@@ -648,9 +648,9 @@ static __init void map_mmioh_high_uv3(in
 				l = li;
 			}
 			addr1 = (base << shift) +
-				f * (unsigned long)(1 << m_io);
+				f * (1ULL << m_io);
 			addr2 = (base << shift) +
-				(l + 1) * (unsigned long)(1 << m_io);
+				(l + 1) * (1ULL << m_io);
 			pr_info("UV: %s[%03d..%03d] NASID 0x%04x ADDR 0x%016lx - 0x%016lx\n",
 				id, fi, li, lnasid, addr1, addr2);
 			if (max_io < l)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 048/312] ALSA: fm801: explicitly free IRQ line
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (46 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 047/312] x86/apic/uv: Silence a shift wrapping warning Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 049/312] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Greg Kroah-Hartman
                   ` (265 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Takashi Iwai

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit e97e98c63b43040732ad5d1f0b38ad4a8371c73a upstream.

Otherwise we will have a warning on ->remove() since device is a PCI one.

WARNING: CPU: 4 PID: 1411 at /home/andy/prj/linux/fs/proc/generic.c:575 remove_proc_entry+0x137/0x160()
remove_proc_entry: removing non-empty directory 'irq/21', leaking at least 'snd_fm801'

Fixes: 5618955c4269 (ALSA: fm801: move to pcim_* and devm_* functions)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/fm801.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1173,6 +1173,8 @@ static int snd_fm801_free(struct fm801 *
 	cmdw |= 0x00c3;
 	fm801_writew(chip, IRQ_MASK, cmdw);
 
+	devm_free_irq(&chip->pci->dev, chip->irq, chip);
+
       __end_hw:
 #ifdef CONFIG_SND_FM801_TEA575X_BOOL
 	if (!(chip->tea575x_tuner & TUNER_DISABLED)) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 049/312] ALSA: fm801: propagate TUNER_ONLY bit when autodetected
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (47 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 048/312] ALSA: fm801: explicitly free IRQ line Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 050/312] ALSA: fm801: detect FM-only card earlier Greg Kroah-Hartman
                   ` (264 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Ondrej Zary, Takashi Iwai

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit dbec6719ac036f68568d8488805d41346c021eff upstream.

The commit d7ba858a7f7a (ALSA: fm801: implement TEA575x tuner autodetection)
brings autodetection to the driver. However the autodetection algorithm misses
the TUNER_ONLY bit if it is supplied by the user.

Thus, user gets weird messages and no card registered.

 snd_fm801 0000:0d:01.0: detected TEA575x radio type SF64-PCR
 snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
 snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
...
 snd_fm801 0000:0d:01.0: AC'97 0 does not respond - RESET
 snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
 snd_fm801 0000:0d:01.0: AC'97 interface is busy (1)
 snd_fm801 0000:0d:01.0: AC'97 0 access is not valid [0x0], removing mixer.
 snd_fm801: probe of 0000:0d:01.0 failed with error -5

Do a copy of TUNER_ONLY bit to be applied after autodetection is done.

Fixes: d7ba858a7f7a (ALSA: fm801: implement TEA575x tuner autodetection)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Ondrej Zary <linux@rainbow-software.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/fm801.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1259,6 +1259,8 @@ static int snd_fm801_create(struct snd_c
 			return -ENODEV;
 		}
 	} else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
+		unsigned int tuner_only = tea575x_tuner & TUNER_ONLY;
+
 		/* autodetect tuner connection */
 		for (tea575x_tuner = 1; tea575x_tuner <= 3; tea575x_tuner++) {
 			chip->tea575x_tuner = tea575x_tuner;
@@ -1273,6 +1275,8 @@ static int snd_fm801_create(struct snd_c
 			dev_err(card->dev, "TEA575x radio not found\n");
 			chip->tea575x_tuner = TUNER_DISABLED;
 		}
+
+		chip->tea575x_tuner |= tuner_only;
 	}
 	if (!(chip->tea575x_tuner & TUNER_DISABLED)) {
 		strlcpy(chip->tea.card, get_tea575x_gpio(chip)->name,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 050/312] ALSA: fm801: detect FM-only card earlier
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (48 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 049/312] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 051/312] netfilter: nfnetlink: use original skbuff when acking batches Greg Kroah-Hartman
                   ` (263 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Takashi Iwai

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit b56fa687e02b27f8bd9d282950a88c2ed23d766b upstream.

If user does not supply tea575x_tuner parameter the driver tries to detect the
tuner type. The failed codec initialization is considered as FM-only card
present, however the driver still registers an IRQ handler for it.

Move codec detection earlier to set tea575x_tuner parameter before check.

Here the following functions are introduced
 reset_coded()                       resets AC97 codec
 snd_fm801_chip_multichannel_init()  initializes cards with multichannel support

Fixes: 5618955c4269 (ALSA: fm801: move to pcim_* and devm_* functions)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/fm801.c |   69 ++++++++++++++++++++++++++++++------------------------
 1 file changed, 39 insertions(+), 30 deletions(-)

--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1088,26 +1088,20 @@ static int wait_for_codec(struct fm801 *
 	return -EIO;
 }
 
-static int snd_fm801_chip_init(struct fm801 *chip, int resume)
+static int reset_codec(struct fm801 *chip)
 {
-	unsigned short cmdw;
-
-	if (chip->tea575x_tuner & TUNER_ONLY)
-		goto __ac97_ok;
-
 	/* codec cold reset + AC'97 warm reset */
 	fm801_writew(chip, CODEC_CTRL, (1 << 5) | (1 << 6));
 	fm801_readw(chip, CODEC_CTRL); /* flush posting data */
 	udelay(100);
 	fm801_writew(chip, CODEC_CTRL, 0);
 
-	if (wait_for_codec(chip, 0, AC97_RESET, msecs_to_jiffies(750)) < 0)
-		if (!resume) {
-			dev_info(chip->card->dev,
-				 "Primary AC'97 codec not found, assume SF64-PCR (tuner-only)\n");
-			chip->tea575x_tuner = 3 | TUNER_ONLY;
-			goto __ac97_ok;
-		}
+	return wait_for_codec(chip, 0, AC97_RESET, msecs_to_jiffies(750));
+}
+
+static void snd_fm801_chip_multichannel_init(struct fm801 *chip)
+{
+	unsigned short cmdw;
 
 	if (chip->multichannel) {
 		if (chip->secondary_addr) {
@@ -1134,8 +1128,11 @@ static int snd_fm801_chip_init(struct fm
 		/* cause timeout problems */
 		wait_for_codec(chip, 0, AC97_VENDOR_ID1, msecs_to_jiffies(750));
 	}
+}
 
-      __ac97_ok:
+static void snd_fm801_chip_init(struct fm801 *chip)
+{
+	unsigned short cmdw;
 
 	/* init volume */
 	fm801_writew(chip, PCM_VOL, 0x0808);
@@ -1156,11 +1153,8 @@ static int snd_fm801_chip_init(struct fm
 	/* interrupt clear */
 	fm801_writew(chip, IRQ_STATUS,
 		     FM801_IRQ_PLAYBACK | FM801_IRQ_CAPTURE | FM801_IRQ_MPU);
-
-	return 0;
 }
 
-
 static int snd_fm801_free(struct fm801 *chip)
 {
 	unsigned short cmdw;
@@ -1217,7 +1211,23 @@ static int snd_fm801_create(struct snd_c
 	if ((err = pci_request_regions(pci, "FM801")) < 0)
 		return err;
 	chip->port = pci_resource_start(pci, 0);
-	if ((tea575x_tuner & TUNER_ONLY) == 0) {
+
+	if (pci->revision >= 0xb1)	/* FM801-AU */
+		chip->multichannel = 1;
+
+	if (!(chip->tea575x_tuner & TUNER_ONLY)) {
+		if (reset_codec(chip) < 0) {
+			dev_info(chip->card->dev,
+				 "Primary AC'97 codec not found, assume SF64-PCR (tuner-only)\n");
+			chip->tea575x_tuner = 3 | TUNER_ONLY;
+		} else {
+			snd_fm801_chip_multichannel_init(chip);
+		}
+	}
+
+	snd_fm801_chip_init(chip);
+
+	if ((chip->tea575x_tuner & TUNER_ONLY) == 0) {
 		if (devm_request_irq(&pci->dev, pci->irq, snd_fm801_interrupt,
 				IRQF_SHARED, KBUILD_MODNAME, chip)) {
 			dev_err(card->dev, "unable to grab IRQ %d\n", pci->irq);
@@ -1228,13 +1238,6 @@ static int snd_fm801_create(struct snd_c
 		pci_set_master(pci);
 	}
 
-	if (pci->revision >= 0xb1)	/* FM801-AU */
-		chip->multichannel = 1;
-
-	snd_fm801_chip_init(chip, 0);
-	/* init might set tuner access method */
-	tea575x_tuner = chip->tea575x_tuner;
-
 	if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
 		snd_fm801_free(chip);
 		return err;
@@ -1251,15 +1254,15 @@ static int snd_fm801_create(struct snd_c
 	chip->tea.private_data = chip;
 	chip->tea.ops = &snd_fm801_tea_ops;
 	sprintf(chip->tea.bus_info, "PCI:%s", pci_name(pci));
-	if ((tea575x_tuner & TUNER_TYPE_MASK) > 0 &&
-	    (tea575x_tuner & TUNER_TYPE_MASK) < 4) {
+	if ((chip->tea575x_tuner & TUNER_TYPE_MASK) > 0 &&
+	    (chip->tea575x_tuner & TUNER_TYPE_MASK) < 4) {
 		if (snd_tea575x_init(&chip->tea, THIS_MODULE)) {
 			dev_err(card->dev, "TEA575x radio not found\n");
 			snd_fm801_free(chip);
 			return -ENODEV;
 		}
-	} else if ((tea575x_tuner & TUNER_TYPE_MASK) == 0) {
-		unsigned int tuner_only = tea575x_tuner & TUNER_ONLY;
+	} else if ((chip->tea575x_tuner & TUNER_TYPE_MASK) == 0) {
+		unsigned int tuner_only = chip->tea575x_tuner & TUNER_ONLY;
 
 		/* autodetect tuner connection */
 		for (tea575x_tuner = 1; tea575x_tuner <= 3; tea575x_tuner++) {
@@ -1395,7 +1398,13 @@ static int snd_fm801_resume(struct devic
 	struct fm801 *chip = card->private_data;
 	int i;
 
-	snd_fm801_chip_init(chip, 1);
+	if (chip->tea575x_tuner & TUNER_ONLY) {
+		snd_fm801_chip_init(chip);
+	} else {
+		reset_codec(chip);
+		snd_fm801_chip_multichannel_init(chip);
+		snd_fm801_chip_init(chip);
+	}
 	snd_ac97_resume(chip->ac97);
 	snd_ac97_resume(chip->ac97_sec);
 	for (i = 0; i < ARRAY_SIZE(saved_regs); i++)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 051/312] netfilter: nfnetlink: use original skbuff when acking batches
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (49 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 050/312] ALSA: fm801: detect FM-only card earlier Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 052/312] xfrm: fix crash in XFRM_MSG_GETSA netlink handler Greg Kroah-Hartman
                   ` (262 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Pablo Neira Ayuso

From: Pablo Neira Ayuso <pablo@netfilter.org>

commit 7c7bdf35991bb8f7cfaeaf22ea3a2f2d1967c166 upstream.

Since bd678e09dc17 ("netfilter: nfnetlink: fix splat due to incorrect
socket memory accounting in skbuff clones"), we don't manually attach
the sk to the skbuff clone anymore, so we have to use the original
skbuff from netlink_ack() which needs to access the sk pointer.

Fixes: bd678e09dc17 ("netfilter: nfnetlink: fix splat due to incorrect socket memory accounting in skbuff clones")
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nfnetlink.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/netfilter/nfnetlink.c
+++ b/net/netfilter/nfnetlink.c
@@ -309,14 +309,14 @@ replay:
 #endif
 		{
 			nfnl_unlock(subsys_id);
-			netlink_ack(skb, nlh, -EOPNOTSUPP);
+			netlink_ack(oskb, nlh, -EOPNOTSUPP);
 			return kfree_skb(skb);
 		}
 	}
 
 	if (!ss->commit || !ss->abort) {
 		nfnl_unlock(subsys_id);
-		netlink_ack(skb, nlh, -EOPNOTSUPP);
+		netlink_ack(oskb, nlh, -EOPNOTSUPP);
 		return kfree_skb(skb);
 	}
 
@@ -406,7 +406,7 @@ ack:
 				 * pointing to the batch header.
 				 */
 				nfnl_err_reset(&err_list);
-				netlink_ack(skb, nlmsg_hdr(oskb), -ENOMEM);
+				netlink_ack(oskb, nlmsg_hdr(oskb), -ENOMEM);
 				status |= NFNL_BATCH_FAILURE;
 				goto done;
 			}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 052/312] xfrm: fix crash in XFRM_MSG_GETSA netlink handler
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (50 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 051/312] netfilter: nfnetlink: use original skbuff when acking batches Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 053/312] mwifiex: fix IBSS data path issue Greg Kroah-Hartman
                   ` (261 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Dichtel, Steffen Klassert,
	Vegard Nossum

From: Vegard Nossum <vegard.nossum@oracle.com>

commit 1ba5bf993c6a3142e18e68ea6452b347f9cb5635 upstream.

If we hit any of the error conditions inside xfrm_dump_sa(), then
xfrm_state_walk_init() never gets called. However, we still call
xfrm_state_walk_done() from xfrm_dump_sa_done(), which will crash
because the state walk was never initialized properly.

We can fix this by setting cb->args[0] only after we've processed the
first element and checking this before calling xfrm_state_walk_done().

Fixes: d3623099d3 ("ipsec: add support of limited SA dump")
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/xfrm/xfrm_user.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -923,7 +923,8 @@ static int xfrm_dump_sa_done(struct netl
 	struct sock *sk = cb->skb->sk;
 	struct net *net = sock_net(sk);
 
-	xfrm_state_walk_done(walk, net);
+	if (cb->args[0])
+		xfrm_state_walk_done(walk, net);
 	return 0;
 }
 
@@ -948,8 +949,6 @@ static int xfrm_dump_sa(struct sk_buff *
 		u8 proto = 0;
 		int err;
 
-		cb->args[0] = 1;
-
 		err = nlmsg_parse(cb->nlh, 0, attrs, XFRMA_MAX,
 				  xfrma_policy);
 		if (err < 0)
@@ -966,6 +965,7 @@ static int xfrm_dump_sa(struct sk_buff *
 			proto = nla_get_u8(attrs[XFRMA_PROTO]);
 
 		xfrm_state_walk_init(walk, proto, filter);
+		cb->args[0] = 1;
 	}
 
 	(void) xfrm_state_walk(net, walk, dump_one_state, &info);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 053/312] mwifiex: fix IBSS data path issue.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (51 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 052/312] xfrm: fix crash in XFRM_MSG_GETSA netlink handler Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 054/312] mwifiex: add missing check for PCIe8997 chipset Greg Kroah-Hartman
                   ` (260 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, chunfan chen, Amitkumar Karwar, Kalle Valo

From: chunfan chen <jeffc@marvell.com>

commit dc386ce76dedaeeaaf006fceb6ed8cf2e20ff026 upstream.

The port_open flag is not applicable for IBSS mode. IBSS data
path was broken when port_open flag was introduced.
This patch fixes the problem by correcting the checks.

Fixes: 5c8946330abfa4c ("mwifiex: enable traffic only when port is open")
Signed-off-by: chunfan chen <jeffc@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/sta_event.c |   10 ++++++----
 drivers/net/wireless/mwifiex/wmm.c       |    6 ++++--
 2 files changed, 10 insertions(+), 6 deletions(-)

--- a/drivers/net/wireless/mwifiex/sta_event.c
+++ b/drivers/net/wireless/mwifiex/sta_event.c
@@ -607,11 +607,13 @@ int mwifiex_process_sta_event(struct mwi
 
 	case EVENT_PS_AWAKE:
 		mwifiex_dbg(adapter, EVENT, "info: EVENT: AWAKE\n");
-		if (!adapter->pps_uapsd_mode && priv->port_open &&
+		if (!adapter->pps_uapsd_mode &&
+		    (priv->port_open ||
+		     (priv->bss_mode == NL80211_IFTYPE_ADHOC)) &&
 		    priv->media_connected && adapter->sleep_period.period) {
-				adapter->pps_uapsd_mode = true;
-				mwifiex_dbg(adapter, EVENT,
-					    "event: PPS/UAPSD mode activated\n");
+			adapter->pps_uapsd_mode = true;
+			mwifiex_dbg(adapter, EVENT,
+				    "event: PPS/UAPSD mode activated\n");
 		}
 		adapter->tx_lock_flag = false;
 		if (adapter->pps_uapsd_mode && adapter->gen_null_pkt) {
--- a/drivers/net/wireless/mwifiex/wmm.c
+++ b/drivers/net/wireless/mwifiex/wmm.c
@@ -475,7 +475,8 @@ mwifiex_wmm_lists_empty(struct mwifiex_a
 		priv = adapter->priv[i];
 		if (!priv)
 			continue;
-		if (!priv->port_open)
+		if (!priv->port_open &&
+		    (priv->bss_mode != NL80211_IFTYPE_ADHOC))
 			continue;
 		if (adapter->if_ops.is_port_ready &&
 		    !adapter->if_ops.is_port_ready(priv))
@@ -1109,7 +1110,8 @@ mwifiex_wmm_get_highest_priolist_ptr(str
 
 			priv_tmp = adapter->bss_prio_tbl[j].bss_prio_cur->priv;
 
-			if (!priv_tmp->port_open ||
+			if (((priv_tmp->bss_mode != NL80211_IFTYPE_ADHOC) &&
+			     !priv_tmp->port_open) ||
 			    (atomic_read(&priv_tmp->wmm.tx_pkts_queued) == 0))
 				continue;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 054/312] mwifiex: add missing check for PCIe8997 chipset
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (52 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 053/312] mwifiex: fix IBSS data path issue Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 055/312] iwlwifi: set max firmware version of 7265 to 17 Greg Kroah-Hartman
                   ` (259 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Amitkumar Karwar, Kalle Valo

From: Amitkumar Karwar <akarwar@marvell.com>

commit f3b35f28096895f2438c10ef719ef67d2951a8c9 upstream.

This patch ensures mwifiex_pcie_txbd_empty() does take care
of 8997 chipset.

Fixes: 6d85ef00d9dfe ("mwifiex: add support for 8997 chipset")
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/pcie.h |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/wireless/mwifiex/pcie.h
+++ b/drivers/net/wireless/mwifiex/pcie.h
@@ -342,6 +342,7 @@ mwifiex_pcie_txbd_empty(struct pcie_serv
 			return 1;
 		break;
 	case PCIE_DEVICE_ID_MARVELL_88W8897:
+	case PCIE_DEVICE_ID_MARVELL_88W8997:
 		if (((card->txbd_wrptr & reg->tx_mask) ==
 		     (rdptr & reg->tx_mask)) &&
 		    ((card->txbd_wrptr & reg->tx_rollover_ind) ==



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 055/312] iwlwifi: set max firmware version of 7265 to 17
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (53 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 054/312] mwifiex: add missing check for PCIe8997 chipset Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 056/312] Bluetooth: btmrvl: fix hung task warning dump Greg Kroah-Hartman
                   ` (258 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach

From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit ed0450cef00d2c76bcb8778721df947ba7ff4147 upstream.

Just like 7260, 7265 will not have firmware releases newer
than iwlwifi-7265-17.ucode. 7265D is still supported in
latest firmware releases.

Fixes: 628a2918afe4 ("iwlwifi: separate firmware version for 7260 devices")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/iwlwifi/iwl-7000.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -70,7 +70,7 @@
 
 /* Highest firmware API version supported */
 #define IWL7260_UCODE_API_MAX	17
-#define IWL7265_UCODE_API_MAX	19
+#define IWL7265_UCODE_API_MAX	17
 #define IWL7265D_UCODE_API_MAX	19
 
 /* Oldest version we won't warn about */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 056/312] Bluetooth: btmrvl: fix hung task warning dump
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (54 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 055/312] iwlwifi: set max firmware version of 7265 to 17 Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 057/312] dccp: limit sk_filter trim to payload Greg Kroah-Hartman
                   ` (257 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chin-Ran Lo, Amitkumar Karwar,
	Marcel Holtmann

From: Chin-Ran Lo <crlo@marvell.com>

commit 86f7ac77d4035e22ec7e58dcdb96327e2ecc3a9b upstream.

It's been observed that when bluetooth driver fails to
activate the firmware, below hung task warning dump is
displayed after 120 seconds.

[   36.461022] Bluetooth: vendor=0x2df, device=0x912e, class=255, fn=2
[   56.512128] Bluetooth: FW failed to be active in time!
[   56.517264] Bluetooth: Downloading firmware failed!
[  240.252176] INFO: task kworker/3:2:129 blocked for more than 120 seconds.
[  240.258931]       Not tainted 3.18.0 #254
[  240.262972] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  240.270751] kworker/3:2     D ffffffc000205760     0   129      2 0x00000000
[  240.277825] Workqueue: events request_firmware_work_func
[  240.283134] Call trace:
[  240.285581] [<ffffffc000205760>] __switch_to+0x80/0x8c
[  240.290693] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
[  240.295921] [<ffffffc00088ddd0>] schedule+0x78/0x84
[  240.300764] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
[  240.306395] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
[  240.311840] [<ffffffbffc163d08>] 0xffffffbffc163d08
[  240.316685] [<ffffffbffc165104>] 0xffffffbffc165104
[  240.321524] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
[  240.327918] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
[  240.334741] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
[  240.341127] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
[  240.346831] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
[  240.352272] [<ffffffc0002419bc>] kthread+0xf0/0xfc
[  240.357019] 2 locks held by kworker/3:2/129:
[  240.361248]  #0:  ("events"){.+.+.+}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
[  240.369562]  #1:  ((&fw_work->work)){+.+.+.}, at: [<ffffffc00023b840>] process_one_work+0x1f8/0x50c
[  240.378589]   task                        PC stack   pid father
[  240.384501] kworker/1:1     D ffffffc000205760     0    40      2 0x00000000
[  240.391524] Workqueue: events mtk_atomic_work
[  240.395884] Call trace:
[  240.398317] [<ffffffc000205760>] __switch_to+0x80/0x8c
[  240.403448] [<ffffffc00027279c>] lock_acquire+0x128/0x164
[  240.408821] kworker/3:2     D ffffffc000205760     0   129      2 0x00000000
[  240.415867] Workqueue: events request_firmware_work_func
[  240.421138] Call trace:
[  240.423589] [<ffffffc000205760>] __switch_to+0x80/0x8c
[  240.428688] [<ffffffc00088dae0>] __schedule+0x540/0x7b8
[  240.433886] [<ffffffc00088ddd0>] schedule+0x78/0x84
[  240.438732] [<ffffffc0006dfd48>] __mmc_claim_host+0xe8/0x1c8
[  240.444361] [<ffffffc0006edd6c>] sdio_claim_host+0x74/0x84
[  240.449801] [<ffffffbffc163d08>] 0xffffffbffc163d08
[  240.454649] [<ffffffbffc165104>] 0xffffffbffc165104
[  240.459486] [<ffffffbffc130cf8>] mwifiex_dnld_fw+0x98/0x110 [mwifiex]
[  240.465882] [<ffffffbffc12ee88>] mwifiex_remove_card+0x2c4/0x5fc [mwifiex]
[  240.472705] [<ffffffc000596780>] request_firmware_work_func+0x44/0x80
[  240.479090] [<ffffffc00023b934>] process_one_work+0x2ec/0x50c
[  240.484794] [<ffffffc00023c6a0>] worker_thread+0x350/0x470
[  240.490231] [<ffffffc0002419bc>] kthread+0xf0/0xfc

This patch adds missing sdio_release_host() call so that wlan driver
thread can claim sdio host.

Fixes: 4863e4cc31d647e1 ("Bluetooth: btmrvl: release sdio bus after firmware is up")
Signed-off-by: Chin-Ran Lo <crlo@marvell.com>
Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/bluetooth/btmrvl_sdio.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -1112,7 +1112,8 @@ static int btmrvl_sdio_download_fw(struc
 	 */
 	if (btmrvl_sdio_verify_fw_download(card, pollnum)) {
 		BT_ERR("FW failed to be active in time!");
-		return -ETIMEDOUT;
+		ret = -ETIMEDOUT;
+		goto done;
 	}
 
 	sdio_release_host(card->func);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 057/312] dccp: limit sk_filter trim to payload
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (55 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 056/312] Bluetooth: btmrvl: fix hung task warning dump Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 058/312] net/mlx4_core: Do not BUG_ON during reset when PCI is offline Greg Kroah-Hartman
                   ` (256 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Willem de Bruijn, Daniel Borkmann,
	David S. Miller

From: Willem de Bruijn <willemb@google.com>

commit 4f0c40d94461cfd23893a17335b2ab78ecb333c8 upstream.

Dccp verifies packet integrity, including length, at initial rcv in
dccp_invalid_packet, later pulls headers in dccp_enqueue_skb.

A call to sk_filter in-between can cause __skb_pull to wrap skb->len.
skb_copy_datagram_msg interprets this as a negative value, so
(correctly) fails with EFAULT. The negative length is reported in
ioctl SIOCINQ or possibly in a DCCP_WARN in dccp_close.

Introduce an sk_receive_skb variant that caps how small a filter
program can trim packets, and call this in dccp with the header
length. Excessively trimmed packets are now processed normally and
queued for reception as 0B payloads.

Fixes: 7c657876b63c ("[DCCP]: Initial implementation")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/sock.h |    8 +++++++-
 net/core/sock.c    |    7 ++++---
 net/dccp/ipv4.c    |    2 +-
 net/dccp/ipv6.c    |    2 +-
 4 files changed, 13 insertions(+), 6 deletions(-)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1651,7 +1651,13 @@ static inline void sock_put(struct sock
  */
 void sock_gen_put(struct sock *sk);
 
-int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested);
+int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested,
+		     unsigned int trim_cap);
+static inline int sk_receive_skb(struct sock *sk, struct sk_buff *skb,
+				 const int nested)
+{
+	return __sk_receive_skb(sk, skb, nested, 1);
+}
 
 static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
 {
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -484,11 +484,12 @@ int sock_queue_rcv_skb(struct sock *sk,
 }
 EXPORT_SYMBOL(sock_queue_rcv_skb);
 
-int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
+int __sk_receive_skb(struct sock *sk, struct sk_buff *skb,
+		     const int nested, unsigned int trim_cap)
 {
 	int rc = NET_RX_SUCCESS;
 
-	if (sk_filter(sk, skb))
+	if (sk_filter_trim_cap(sk, skb, trim_cap))
 		goto discard_and_relse;
 
 	skb->dev = NULL;
@@ -524,7 +525,7 @@ discard_and_relse:
 	kfree_skb(skb);
 	goto out;
 }
-EXPORT_SYMBOL(sk_receive_skb);
+EXPORT_SYMBOL(__sk_receive_skb);
 
 struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 {
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -868,7 +868,7 @@ lookup:
 		goto discard_and_relse;
 	nf_reset(skb);
 
-	return sk_receive_skb(sk, skb, 1);
+	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4);
 
 no_dccp_socket:
 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -741,7 +741,7 @@ lookup:
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
 
-	return sk_receive_skb(sk, skb, 1) ? -1 : 0;
+	return __sk_receive_skb(sk, skb, 1, dh->dccph_doff * 4) ? -1 : 0;
 
 no_dccp_socket:
 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 058/312] net/mlx4_core: Do not BUG_ON during reset when PCI is offline
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (56 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 057/312] dccp: limit sk_filter trim to payload Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 059/312] mlxsw: pci: Correctly determine if descriptor queue is full Greg Kroah-Hartman
                   ` (255 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Jurgens, Yishai Hadas,
	David S. Miller

From: Daniel Jurgens <danielj@mellanox.com>

commit 22e3817e6c8301dc0520b855c8a2d764580e719c upstream.

The PCI channel could go offline during reset due to EEH.  Don't bug on in
this case, the error is recoverable.

Fixes: f6bc11e42646 ('net/mlx4_core: Enhance the catas flow to support device reset')
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/catas.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
@@ -182,10 +182,17 @@ void mlx4_enter_error_state(struct mlx4_
 		err = mlx4_reset_slave(dev);
 	else
 		err = mlx4_reset_master(dev);
-	BUG_ON(err != 0);
 
+	if (!err) {
+		mlx4_err(dev, "device was reset successfully\n");
+	} else {
+		/* EEH could have disabled the PCI channel during reset. That's
+		 * recoverable and the PCI error flow will handle it.
+		 */
+		if (!pci_channel_offline(dev->persist->pdev))
+			BUG_ON(1);
+	}
 	dev->persist->state |= MLX4_DEVICE_STATE_INTERNAL_ERROR;
-	mlx4_err(dev, "device was reset successfully\n");
 	mutex_unlock(&persist->device_state_mutex);
 
 	/* At that step HW was already reset, now notify clients */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 059/312] mlxsw: pci: Correctly determine if descriptor queue is full
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (57 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 058/312] net/mlx4_core: Do not BUG_ON during reset when PCI is offline Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 060/312] PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() Greg Kroah-Hartman
                   ` (254 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jiri Pirko, David S. Miller

From: Ido Schimmel <idosch@mellanox.com>

commit 5091730d7795ccb21eb880699b5194730641c70b upstream.

The descriptor queues for sending (SDQs) and receiving (RDQs) packets
are managed by two counters - producer and consumer - which are both
16-bit in size. A queue is considered full when the difference between
the two equals the queue's maximum number of descriptors.

However, if the producer counter overflows, then it's possible for the
full queue check to fail, as it doesn't take the overflow into account.
In such a case, descriptors already passed to the device - but for which
a completion has yet to be posted - will be overwritten, thereby causing
undefined behavior. The above can be achieved under heavy load (~30
netperf instances).

Fix that by casting the subtraction result to u16, preventing it from
being treated as a signed integer.

Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/pci.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c
@@ -215,7 +215,7 @@ mlxsw_pci_queue_elem_info_producer_get(s
 {
 	int index = q->producer_counter & (q->count - 1);
 
-	if ((q->producer_counter - q->consumer_counter) == q->count)
+	if ((u16) (q->producer_counter - q->consumer_counter) == q->count)
 		return NULL;
 	return mlxsw_pci_queue_elem_info_get(q, index);
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 060/312] PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (58 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 059/312] mlxsw: pci: Correctly determine if descriptor queue is full Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 061/312] net/mlx4_core: Implement pci_resume callback Greg Kroah-Hartman
                   ` (253 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yinghai Lu, Bjorn Helgaas, Arjan van de Ven

From: Bjorn Helgaas <bhelgaas@google.com>

commit ca620723d4ff9ea7ed484eab46264c3af871b9ae upstream.

iomem_is_exclusive() requires a CPU physical address, but on some arches we
supplied a PCI bus address instead.

On most arches, pci_resource_to_user(res) returns "res->start", which is a
CPU physical address.  But on microblaze, mips, powerpc, and sparc, it
returns the PCI bus address corresponding to "res->start".

The result is that pci_mmap_resource() may fail when it shouldn't (if the
bus address happens to match an existing resource), or it may succeed when
it should fail (if the resource is exclusive but the bus address doesn't
match it).

Call iomem_is_exclusive() with "res->start", which is always a CPU physical
address, not the result of pci_resource_to_user().

Fixes: e8de1481fd71 ("resource: allow MMIO exclusivity for device drivers")
Suggested-by: Yinghai Lu <yinghai@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: Arjan van de Ven <arjan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/pci-sysfs.c |    7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -1027,6 +1027,9 @@ static int pci_mmap_resource(struct kobj
 	if (i >= PCI_ROM_RESOURCE)
 		return -ENODEV;
 
+	if (res->flags & IORESOURCE_MEM && iomem_is_exclusive(res->start))
+		return -EINVAL;
+
 	if (!pci_mmap_fits(pdev, i, vma, PCI_MMAP_SYSFS)) {
 		WARN(1, "process \"%s\" tried to map 0x%08lx bytes at page 0x%08lx on %s BAR %d (start 0x%16Lx, size 0x%16Lx)\n",
 			current->comm, vma->vm_end-vma->vm_start, vma->vm_pgoff,
@@ -1043,10 +1046,6 @@ static int pci_mmap_resource(struct kobj
 	pci_resource_to_user(pdev, i, res, &start, &end);
 	vma->vm_pgoff += start >> PAGE_SHIFT;
 	mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io;
-
-	if (res->flags & IORESOURCE_MEM && iomem_is_exclusive(start))
-		return -EINVAL;
-
 	return pci_mmap_page_range(pdev, vma, mmap_type, write_combine);
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 061/312] net/mlx4_core: Implement pci_resume callback
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (59 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 060/312] PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 062/312] alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO Greg Kroah-Hartman
                   ` (252 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Jurgens, Yishai Hadas,
	Or Gerlitz, David S. Miller

From: Daniel Jurgens <danielj@mellanox.com>

commit c12833acff62cff83a8b728253e7ebbc1264d75e upstream.

Move resume related activities to a new pci_resume function instead of
performing them in mlx4_pci_slot_reset.  This change is needed to avoid
a hotplug during EEH recovery due to commit f2da4ccf8bd4 ("powerpc/eeh:
More relaxed hotplug criterion").

Fixes: 2ba5fbd62b25 ('net/mlx4_core: Handle AER flow properly')
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/main.c |   39 ++++++++++++++++++------------
 1 file changed, 24 insertions(+), 15 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -3854,45 +3854,53 @@ static pci_ers_result_t mlx4_pci_slot_re
 {
 	struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
 	struct mlx4_dev	 *dev  = persist->dev;
-	struct mlx4_priv *priv = mlx4_priv(dev);
-	int               ret;
-	int nvfs[MLX4_MAX_PORTS + 1] = {0, 0, 0};
-	int total_vfs;
+	int err;
 
 	mlx4_err(dev, "mlx4_pci_slot_reset was called\n");
-	ret = pci_enable_device(pdev);
-	if (ret) {
-		mlx4_err(dev, "Can not re-enable device, ret=%d\n", ret);
+	err = pci_enable_device(pdev);
+	if (err) {
+		mlx4_err(dev, "Can not re-enable device, err=%d\n", err);
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
 
 	pci_set_master(pdev);
 	pci_restore_state(pdev);
 	pci_save_state(pdev);
+	return PCI_ERS_RESULT_RECOVERED;
+}
+
+static void mlx4_pci_resume(struct pci_dev *pdev)
+{
+	struct mlx4_dev_persistent *persist = pci_get_drvdata(pdev);
+	struct mlx4_dev	 *dev  = persist->dev;
+	struct mlx4_priv *priv = mlx4_priv(dev);
+	int nvfs[MLX4_MAX_PORTS + 1] = {0, 0, 0};
+	int total_vfs;
+	int err;
 
+	mlx4_err(dev, "%s was called\n", __func__);
 	total_vfs = dev->persist->num_vfs;
 	memcpy(nvfs, dev->persist->nvfs, sizeof(dev->persist->nvfs));
 
 	mutex_lock(&persist->interface_state_mutex);
 	if (!(persist->interface_state & MLX4_INTERFACE_STATE_UP)) {
-		ret = mlx4_load_one(pdev, priv->pci_dev_data, total_vfs, nvfs,
+		err = mlx4_load_one(pdev, priv->pci_dev_data, total_vfs, nvfs,
 				    priv, 1);
-		if (ret) {
-			mlx4_err(dev, "%s: mlx4_load_one failed, ret=%d\n",
-				 __func__,  ret);
+		if (err) {
+			mlx4_err(dev, "%s: mlx4_load_one failed, err=%d\n",
+				 __func__,  err);
 			goto end;
 		}
 
-		ret = restore_current_port_types(dev, dev->persist->
+		err = restore_current_port_types(dev, dev->persist->
 						 curr_port_type, dev->persist->
 						 curr_port_poss_type);
-		if (ret)
-			mlx4_err(dev, "could not restore original port types (%d)\n", ret);
+		if (err)
+			mlx4_err(dev, "could not restore original port types (%d)\n", err);
 	}
 end:
 	mutex_unlock(&persist->interface_state_mutex);
 
-	return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
 }
 
 static void mlx4_shutdown(struct pci_dev *pdev)
@@ -3909,6 +3917,7 @@ static void mlx4_shutdown(struct pci_dev
 static const struct pci_error_handlers mlx4_err_handler = {
 	.error_detected = mlx4_pci_err_detected,
 	.slot_reset     = mlx4_pci_slot_reset,
+	.resume		= mlx4_pci_resume,
 };
 
 static struct pci_driver mlx4_driver = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 062/312] alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (60 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 061/312] net/mlx4_core: Implement pci_resume callback Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 063/312] vfio/pci: Allow VPD short read Greg Kroah-Hartman
                   ` (251 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bjorn Helgaas, Ivan Kokshaysky

From: Bjorn Helgaas <bhelgaas@google.com>

commit c20e128030caf0537d5e906753eac1c28fefdb75 upstream.

The alpha pci_mmap_resource() is used for both IORESOURCE_MEM and
IORESOURCE_IO resources, but iomem_is_exclusive() is only applicable for
IORESOURCE_MEM.

Call iomem_is_exclusive() only for IORESOURCE_MEM resources, and do it
earlier to match the generic version of pci_mmap_resource().

Fixes: 10a0ef39fbd1 ("PCI/alpha: pci sysfs resources")
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/alpha/kernel/pci-sysfs.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/alpha/kernel/pci-sysfs.c
+++ b/arch/alpha/kernel/pci-sysfs.c
@@ -77,10 +77,10 @@ static int pci_mmap_resource(struct kobj
 	if (i >= PCI_ROM_RESOURCE)
 		return -ENODEV;
 
-	if (!__pci_mmap_fits(pdev, i, vma, sparse))
+	if (res->flags & IORESOURCE_MEM && iomem_is_exclusive(res->start))
 		return -EINVAL;
 
-	if (iomem_is_exclusive(res->start))
+	if (!__pci_mmap_fits(pdev, i, vma, sparse))
 		return -EINVAL;
 
 	pcibios_resource_to_bus(pdev->bus, &bar, res);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 063/312] vfio/pci: Allow VPD short read
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (61 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 062/312] alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 064/312] brcmfmac: add eth_type_trans back for PCIe full dongle Greg Kroah-Hartman
                   ` (250 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Williamson

From: Alex Williamson <alex.williamson@redhat.com>

commit ce7585f3c4d76bca1dff4b66ae1ea32552954f9e upstream.

The size of the VPD area is not necessarily 4-byte aligned, so a
pci_vpd_read() might return less than 4 bytes.  Zero our buffer and
accept anything other than an error.  Intel X710 NICs exercise this.

Fixes: 4e1a635552d3 ("vfio/pci: Use kernel VPD access functions")
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vfio/pci/vfio_pci_config.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/vfio/pci/vfio_pci_config.c
+++ b/drivers/vfio/pci/vfio_pci_config.c
@@ -698,7 +698,8 @@ static int vfio_vpd_config_write(struct
 		if (pci_write_vpd(pdev, addr & ~PCI_VPD_ADDR_F, 4, &data) != 4)
 			return count;
 	} else {
-		if (pci_read_vpd(pdev, addr, 4, &data) != 4)
+		data = 0;
+		if (pci_read_vpd(pdev, addr, 4, &data) < 0)
 			return count;
 		*pdata = cpu_to_le32(data);
 	}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 064/312] brcmfmac: add eth_type_trans back for PCIe full dongle
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (62 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 063/312] vfio/pci: Allow VPD short read Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 065/312] mlxsw: Treat local port 64 as valid Greg Kroah-Hartman
                   ` (249 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rafal Milecki, Grey Christoforo,
	Pieter-Paul Giesberts, Arend Van Spriel, Hante Meuleman,
	Franky Lin, Kalle Valo

From: Franky Lin <franky.lin@broadcom.com>

commit 31143e2933d1675c4c1ba6ce125cdd95870edd85 upstream.

A regression was introduced in commit 9c349892ccc9 ("brcmfmac: revise
handling events in receive path") which moves eth_type_trans() call
to brcmf_rx_frame(). Msgbuf layer doesn't use brcmf_rx_frame() but invokes
brcmf_netif_rx() directly. In such case the Ethernet header was not
stripped out resulting in null pointer dereference in the networking
stack.

BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
IP: [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
PGD 0
Oops: 0000 [#1] PREEMPT SMP
Modules linked in: fuse ipt_MASQUERADE nf_nat_masquerade_ipv4
iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype
[...]
rtsx_pci scsi_mod usbcore usb_common i8042 serio nvme nvme_core
CPU: 7 PID: 1340 Comm: irq/136-brcmf_p Not tainted 4.7.0-rc1-mainline #1
Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 01.02.00 04/07/2016
task: ffff8804a0c5bd00 ti: ffff88049e124000 task.ti: ffff88049e124000
RIP: 0010:[<ffffffff814c3ce6>] [<ffffffff814c3ce6>]
enqueue_to_backlog+0x56/0x260
RSP: 0018:ffff88049e127ca0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff8804bddd7c40 RCX: 000000000000002f
RDX: 0000000000000000 RSI: 0000000000000007 RDI: ffff8804bddd7d4c
RBP: ffff88049e127ce8 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8804bddd12c0 R11: 000000000000149e R12: 0000000000017c40
R13: ffff88049e127d08 R14: ffff8804a9bd6d00 R15: ffff8804bddd7d4c
FS: 0000000000000000(0000) GS:ffff8804bddc0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000048 CR3: 0000000001806000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffff8804bdddad00 ffff8804ad089e00 0000000000000000 0000000000000282
0000000000000000 ffff8804a9bd6d00 ffff8804a1b27e00 ffff8804a9bd6d00
ffff88002ee88000 ffff88049e127d28 ffffffff814c3f3b ffffffff81311fc3
Call Trace:
[<ffffffff814c3f3b>] netif_rx_internal+0x4b/0x170
[<ffffffff81311fc3>] ? swiotlb_tbl_unmap_single+0xf3/0x120
[<ffffffff814c5467>] netif_rx_ni+0x27/0xc0
[<ffffffffa08519e9>] brcmf_netif_rx+0x49/0x70 [brcmfmac]
[<ffffffffa08564d4>] brcmf_msgbuf_process_rx+0x2b4/0x570 [brcmfmac]
[<ffffffff81020017>] ? __xen_set_pgd_hyper+0x57/0xd0
[<ffffffff810d60b0>] ? irq_forced_thread_fn+0x70/0x70
[<ffffffffa0857381>] brcmf_proto_msgbuf_rx_trigger+0x31/0xe0 [brcmfmac]
[<ffffffffa0861e8f>] brcmf_pcie_isr_thread+0x7f/0x110 [brcmfmac]
[<ffffffff810d60d0>] irq_thread_fn+0x20/0x50
[<ffffffff810d63ad>] irq_thread+0x12d/0x1c0
[<ffffffff815d07d5>] ? __schedule+0x2f5/0x7a0
[<ffffffff810d61d0>] ? wake_threads_waitq+0x30/0x30
[<ffffffff810d6280>] ? irq_thread_dtor+0xb0/0xb0
[<ffffffff81098ea8>] kthread+0xd8/0xf0
[<ffffffff815d4b7f>] ret_from_fork+0x1f/0x40
[<ffffffff81098dd0>] ? kthread_worker_fn+0x170/0x170
Code: 1c f5 60 9a 8e 81 9c 58 0f 1f 44 00 00 48 89 45 d0 fa 66 0f 1f
44 00 00 4c 8d bb 0c 01 00 00 4c 89 ff e8 5e 08 11 00 49 8b 56 20 <48>
8b 52 48 83 e2 01 74 10 8b 8b 08 01 00 00 8b 15 59 c5 42 00
RIP [<ffffffff814c3ce6>] enqueue_to_backlog+0x56/0x260
RSP <ffff88049e127ca0>
CR2: 0000000000000048

Fixes: 9c349892ccc9 ("brcmfmac: revise handling events in receive path")
Reported-by: Rafal Milecki <zajec5@gmail.com>
Reported-by: Grey Christoforo <grey@christoforo.net>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Arend Van Spriel <arend@broadcom.com>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Signed-off-by: Franky Lin <franky.lin@broadcom.com>
[arend@broadcom.com: rephrased the commit message]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/msgbuf.c
@@ -1155,6 +1155,8 @@ brcmf_msgbuf_process_rx_complete(struct
 		brcmu_pkt_buf_free_skb(skb);
 		return;
 	}
+
+	skb->protocol = eth_type_trans(skb, ifp->ndev);
 	brcmf_netif_rx(ifp, skb);
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 065/312] mlxsw: Treat local port 64 as valid
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (63 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 064/312] brcmfmac: add eth_type_trans back for PCIe full dongle Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 066/312] IB/mlx4: Initialize hop_limit when creating address handle Greg Kroah-Hartman
                   ` (248 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jiri Pirko, David S. Miller

From: Ido Schimmel <idosch@mellanox.com>

commit 1e5ad30c649a82a062ce79a87c1296e6c6f328c2 upstream.

MLXSW_PORT_MAX_PORTS represents the maximum number of local ports, which
is 65 for both ASICs (SwitchX-2 and Spectrum) supported by this driver.

Fixes: 93c1edb27f9e ("mlxsw: Introduce Mellanox switch driver core")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/port.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/port.h
+++ b/drivers/net/ethernet/mellanox/mlxsw/port.h
@@ -49,7 +49,7 @@
 #define MLXSW_PORT_MID			0xd000
 
 #define MLXSW_PORT_MAX_PHY_PORTS	0x40
-#define MLXSW_PORT_MAX_PORTS		MLXSW_PORT_MAX_PHY_PORTS
+#define MLXSW_PORT_MAX_PORTS		(MLXSW_PORT_MAX_PHY_PORTS + 1)
 
 #define MLXSW_PORT_DEVID_BITS_OFFSET	10
 #define MLXSW_PORT_PHY_BITS_OFFSET	4



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 066/312] IB/mlx4: Initialize hop_limit when creating address handle
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (64 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 065/312] mlxsw: Treat local port 64 as valid Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 067/312] ovs/gre,geneve: fix error path when creating an iface Greg Kroah-Hartman
                   ` (247 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Matan Barak, Doug Ledford

From: Matan Barak <matanb@mellanox.com>

commit 4e4081673445485aa6bc90383bdb83e7a96cc48a upstream.

Hop limit value wasn't copied from attributes  when ah was created.
This may influence packets for unconnected services to get dropped in
routers when endpoints are not in the same subnet.

Fixes: fa417f7b520e ("IB/mlx4: Add support for IBoE")
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx4/ah.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -107,6 +107,7 @@ static struct ib_ah *create_iboe_ah(stru
 		return ERR_PTR(ret);
 	ah->av.eth.gid_index = ret;
 	ah->av.eth.vlan = cpu_to_be16(vlan_tag);
+	ah->av.eth.hop_limit = ah_attr->grh.hop_limit;
 	if (ah_attr->static_rate) {
 		ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
 		while (ah->av.eth.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 067/312] ovs/gre,geneve: fix error path when creating an iface
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (65 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 066/312] IB/mlx4: Initialize hop_limit when creating address handle Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:30 ` [PATCH 4.4 068/312] GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU Greg Kroah-Hartman
                   ` (246 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Wragg, Nicolas Dichtel,
	David S. Miller

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit 106da663ff495e0aea3ac15b8317aa410754fcac upstream.

After ipgre_newlink()/geneve_configure() call, the netdev is registered.

Fixes: 7e059158d57b ("vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices")
CC: David Wragg <david@weave.works>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/geneve.c |   10 +++++++---
 net/ipv4/ip_gre.c    |   10 +++++++---
 2 files changed, 14 insertions(+), 6 deletions(-)

--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1340,6 +1340,7 @@ struct net_device *geneve_dev_create_fb(
 {
 	struct nlattr *tb[IFLA_MAX + 1];
 	struct net_device *dev;
+	LIST_HEAD(list_kill);
 	int err;
 
 	memset(tb, 0, sizeof(tb));
@@ -1350,8 +1351,10 @@ struct net_device *geneve_dev_create_fb(
 
 	err = geneve_configure(net, dev, &geneve_remote_unspec,
 			       0, 0, 0, htons(dst_port), true);
-	if (err)
-		goto err;
+	if (err) {
+		free_netdev(dev);
+		return ERR_PTR(err);
+	}
 
 	/* openvswitch users expect packet sizes to be unrestricted,
 	 * so set the largest MTU we can.
@@ -1363,7 +1366,8 @@ struct net_device *geneve_dev_create_fb(
 	return dev;
 
  err:
-	free_netdev(dev);
+	geneve_dellink(dev, &list_kill);
+	unregister_netdevice_many(&list_kill);
 	return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1230,6 +1230,7 @@ struct net_device *gretap_fb_dev_create(
 {
 	struct nlattr *tb[IFLA_MAX + 1];
 	struct net_device *dev;
+	LIST_HEAD(list_kill);
 	struct ip_tunnel *t;
 	int err;
 
@@ -1245,8 +1246,10 @@ struct net_device *gretap_fb_dev_create(
 	t->collect_md = true;
 
 	err = ipgre_newlink(net, dev, tb, NULL);
-	if (err < 0)
-		goto out;
+	if (err < 0) {
+		free_netdev(dev);
+		return ERR_PTR(err);
+	}
 
 	/* openvswitch users expect packet sizes to be unrestricted,
 	 * so set the largest MTU we can.
@@ -1257,7 +1260,8 @@ struct net_device *gretap_fb_dev_create(
 
 	return dev;
 out:
-	free_netdev(dev);
+	ip_tunnel_dellink(dev, &list_kill);
+	unregister_netdevice_many(&list_kill);
 	return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(gretap_fb_dev_create);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 068/312] GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (66 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 067/312] ovs/gre,geneve: fix error path when creating an iface Greg Kroah-Hartman
@ 2020-05-08 12:30 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 069/312] powerpc/pci/of: Parse unassigned resources Greg Kroah-Hartman
                   ` (245 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:30 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Duyck, David S. Miller

From: Alexander Duyck <aduyck@mirantis.com>

commit a0ca153f98db8cf25298565a09e11fe9d82846ad upstream.

This patch fixes an issue I found in which we were dropping frames if we
had enabled checksums on GRE headers that were encapsulated by either FOU
or GUE.  Without this patch I was barely able to get 1 Gb/s of throughput.
With this patch applied I am now at least getting around 6 Gb/s.

The issue is due to the fact that with FOU or GUE applied we do not provide
a transport offset pointing to the GRE header, nor do we offload it in
software as the GRE header is completely skipped by GSO and treated like a
VXLAN or GENEVE type header.  As such we need to prevent the stack from
generating it and also prevent GRE from generating it via any interface we
create.

Fixes: c3483384ee511 ("gro: Allow tunnel stacking in the case of FOU/GUE")
Signed-off-by: Alexander Duyck <aduyck@mirantis.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/netdevice.h |    5 ++++-
 net/core/dev.c            |    1 +
 net/ipv4/fou.c            |    6 ++++++
 net/ipv4/gre_offload.c    |    8 ++++++++
 net/ipv4/ip_gre.c         |   13 ++++++++++---
 5 files changed, 29 insertions(+), 4 deletions(-)

--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2013,7 +2013,10 @@ struct napi_gro_cb {
 	/* Number of gro_receive callbacks this packet already went through */
 	u8 recursion_counter:4;
 
-	/* 3 bit hole */
+	/* Used in GRE, set in fou/gue_gro_receive */
+	u8	is_fou:1;
+
+	/* 2 bit hole */
 
 	/* used to support CHECKSUM_COMPLETE for tunneling protocols */
 	__wsum	csum;
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4320,6 +4320,7 @@ static enum gro_result dev_gro_receive(s
 		NAPI_GRO_CB(skb)->free = 0;
 		NAPI_GRO_CB(skb)->encap_mark = 0;
 		NAPI_GRO_CB(skb)->recursion_counter = 0;
+		NAPI_GRO_CB(skb)->is_fou = 0;
 		NAPI_GRO_CB(skb)->gro_remcsum_start = 0;
 
 		/* Setup for GRO checksum validation */
--- a/net/ipv4/fou.c
+++ b/net/ipv4/fou.c
@@ -205,6 +205,9 @@ static struct sk_buff **fou_gro_receive(
 	 */
 	NAPI_GRO_CB(skb)->encap_mark = 0;
 
+	/* Flag this frame as already having an outer encap header */
+	NAPI_GRO_CB(skb)->is_fou = 1;
+
 	rcu_read_lock();
 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
 	ops = rcu_dereference(offloads[proto]);
@@ -372,6 +375,9 @@ static struct sk_buff **gue_gro_receive(
 	 */
 	NAPI_GRO_CB(skb)->encap_mark = 0;
 
+	/* Flag this frame as already having an outer encap header */
+	NAPI_GRO_CB(skb)->is_fou = 1;
+
 	rcu_read_lock();
 	offloads = NAPI_GRO_CB(skb)->is_ipv6 ? inet6_offloads : inet_offloads;
 	ops = rcu_dereference(offloads[guehdr->proto_ctype]);
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -151,6 +151,14 @@ static struct sk_buff **gre_gro_receive(
 	if ((greh->flags & ~(GRE_KEY|GRE_CSUM)) != 0)
 		goto out;
 
+	/* We can only support GRE_CSUM if we can track the location of
+	 * the GRE header.  In the case of FOU/GUE we cannot because the
+	 * outer UDP header displaces the GRE header leaving us in a state
+	 * of limbo.
+	 */
+	if ((greh->flags & GRE_CSUM) && NAPI_GRO_CB(skb)->is_fou)
+		goto out;
+
 	type = greh->protocol;
 
 	rcu_read_lock();
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -851,9 +851,16 @@ static void __gre_tunnel_init(struct net
 	dev->hw_features	|= GRE_FEATURES;
 
 	if (!(tunnel->parms.o_flags & TUNNEL_SEQ)) {
-		/* TCP offload with GRE SEQ is not supported. */
-		dev->features    |= NETIF_F_GSO_SOFTWARE;
-		dev->hw_features |= NETIF_F_GSO_SOFTWARE;
+		/* TCP offload with GRE SEQ is not supported, nor
+		 * can we support 2 levels of outer headers requiring
+		 * an update.
+		 */
+		if (!(tunnel->parms.o_flags & TUNNEL_CSUM) ||
+		    (tunnel->encap.type == TUNNEL_ENCAP_NONE)) {
+			dev->features    |= NETIF_F_GSO_SOFTWARE;
+			dev->hw_features |= NETIF_F_GSO_SOFTWARE;
+		}
+
 		/* Can use a lockless transmit, unless we generate
 		 * output sequences
 		 */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 069/312] powerpc/pci/of: Parse unassigned resources
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (67 preceding siblings ...)
  2020-05-08 12:30 ` [PATCH 4.4 068/312] GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 070/312] firmware: actually return NULL on failed request_firmware_nowait() Greg Kroah-Hartman
                   ` (244 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy,
	Michael Ellerman, Guenter Roeck

From: Alexey Kardashevskiy <aik@ozlabs.ru>

commit dead1c845dbe97e0061dae2017eaf3bd8f8f06ee upstream.

The pseries platform uses the PCI_PROBE_DEVTREE method of PCI probing
which reads "assigned-addresses" of every PCI device and initializes
the device resources. However if the property is missing or zero sized,
then there is no fallback of any kind and the PCI resources remain
undiscovered, i.e. pdev->resource[] array remains empty.

This adds a fallback which parses the "reg" property in pretty much same
way except it marks resources as "unset" which later make Linux assign
those resources proper addresses.

This has an effect when:
1. a hypervisor failed to assign any resource for a device;
2. /chosen/linux,pci-probe-only=0 is in the DT so the system may try
assigning a resource.
Neither is likely to happen under PowerVM.

Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/pci_of_scan.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/arch/powerpc/kernel/pci_of_scan.c
+++ b/arch/powerpc/kernel/pci_of_scan.c
@@ -82,10 +82,16 @@ static void of_pci_parse_addrs(struct de
 	const __be32 *addrs;
 	u32 i;
 	int proplen;
+	bool mark_unset = false;
 
 	addrs = of_get_property(node, "assigned-addresses", &proplen);
-	if (!addrs)
-		return;
+	if (!addrs || !proplen) {
+		addrs = of_get_property(node, "reg", &proplen);
+		if (!addrs || !proplen)
+			return;
+		mark_unset = true;
+	}
+
 	pr_debug("    parse addresses (%d bytes) @ %p\n", proplen, addrs);
 	for (; proplen >= 20; proplen -= 20, addrs += 5) {
 		flags = pci_parse_of_flags(of_read_number(addrs, 1), 0);
@@ -110,6 +116,8 @@ static void of_pci_parse_addrs(struct de
 			continue;
 		}
 		res->flags = flags;
+		if (mark_unset)
+			res->flags |= IORESOURCE_UNSET;
 		res->name = pci_name(dev);
 		region.start = base;
 		region.end = base + size - 1;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 070/312] firmware: actually return NULL on failed request_firmware_nowait()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (68 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 069/312] powerpc/pci/of: Parse unassigned resources Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 071/312] [media] c8sectpfe: Rework firmware loading mechanism Greg Kroah-Hartman
                   ` (243 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Norris, Ming Lei, Kees Cook,
	Shuah Khan

From: Brian Norris <computersforpeace@gmail.com>

commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream.

The kerneldoc for request_firmware_nowait() says that it may call the
provided cont() callback with @fw == NULL, if the firmware request
fails. However, this is not the case when called with an empty string
(""). This case is short-circuited by the 'name[0] == '\0'' check
introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests
contain a name"), so _request_firmware() never gets to set the fw to
NULL.

Noticed while using the new 'trigger_async_request' testing hook:

    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [10553.726178] test_firmware: loading ''
    [10553.729859] test_firmware: loaded: 995209091
    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [10733.676184] test_firmware: loading ''
    [10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004
    [10733.687951] pgd = ec188000
    [10733.690655] [00000004] *pgd=00000000
    [10733.694240] Internal error: Oops: 5 [#1] SMP ARM
    [10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
    [10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178
    [10733.733137] Hardware name: Rockchip (Device Tree)
    [10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000
    [10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0
    [10733.747831] LR is at _raw_spin_lock+0x18/0x1c
    [10733.752180] pc : [<c00653a0>]    lr : [<c054c204>]    psr: a00d0013
    [10733.752180] sp : ee323df8  ip : ee323e20  fp : ee323e1c
    [10733.763634] r10: 00000051  r9 : b6f18000  r8 : ee323f80
    [10733.768847] r7 : c089cebc  r6 : 00000001  r5 : 00000000  r4 : ec0e6000
    [10733.775360] r3 : dead4ead  r2 : c06bd140  r1 : eef913b4  r0 : 00000000
    [10733.781874] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    [10733.788995] Control: 10c5387d  Table: 2c18806a  DAC: 00000051
    [10733.794728] Process bash (pid: 6600, stack limit = 0xee322218)
    [10733.800549] Stack: (0xee323df8 to 0xee324000)
    [10733.804896] 3de0:                                                       ec0e6000 00000000
    [10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394
    [10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48
    [10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac
    [10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c
    [10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720
    [10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00
    [10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8
    [10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001
    [10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28
    [10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80
    [10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00
    [10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24
    [10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8
    [10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000
    [10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84
    [10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390
    [10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c)
    [10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64)
    [10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74)
    [10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124)
    [10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34)
    [10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58)
    [10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8)
    [10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4)

After this patch:

    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [   32.126322] test_firmware: loading ''
    [   32.129995] test_firmware: failed to async load firmware
    -bash: printf: write error: No such device

Fixes: 471b095dfe0d ("firmware_class: make sure fw requests contain a name")
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/firmware_class.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -1119,15 +1119,17 @@ static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
 		  struct device *device, unsigned int opt_flags)
 {
-	struct firmware *fw;
+	struct firmware *fw = NULL;
 	long timeout;
 	int ret;
 
 	if (!firmware_p)
 		return -EINVAL;
 
-	if (!name || name[0] == '\0')
-		return -EINVAL;
+	if (!name || name[0] == '\0') {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	ret = _request_firmware_prepare(&fw, name, device);
 	if (ret <= 0) /* error or already assigned */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 071/312] [media] c8sectpfe: Rework firmware loading mechanism
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (69 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 070/312] firmware: actually return NULL on failed request_firmware_nowait() Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 072/312] net/mlx5: Avoid passing dma address 0 to firmware Greg Kroah-Hartman
                   ` (242 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Peter Griffin, Mauro Carvalho Chehab

From: Peter Griffin <peter.griffin@linaro.org>

commit c23ac90f78aa9190643c82c1975a0cfe480d7c60 upstream.

c8sectpfe driver relied on CONFIG_FW_LOADER_USER_HELPER_FALLBACK option
for loading its xp70 firmware. A previous commit removed this Kconfig
option, as it is apparently harmful, but did not update the driver
code which relied on it.

This patch reworks the firmware loading into the start_feed callback.
At this point we can be sure the rootfs is present, thereby removing
the depedency on CONFIG_FW_LOADER_USER_HELPER_FALLBACK.

Fixes: 79f5b6ae960d ('[media] c8sectpfe: Remove select on CONFIG_FW_LOADER_USER_HELPER_FALLBACK')

Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c |   65 ++++++------------
 1 file changed, 22 insertions(+), 43 deletions(-)

--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
+++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c
@@ -49,7 +49,7 @@ MODULE_FIRMWARE(FIRMWARE_MEMDMA);
 #define PID_TABLE_SIZE 1024
 #define POLL_MSECS 50
 
-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei);
+static int load_c8sectpfe_fw(struct c8sectpfei *fei);
 
 #define TS_PKT_SIZE 188
 #define HEADER_SIZE (4)
@@ -143,6 +143,7 @@ static int c8sectpfe_start_feed(struct d
 	struct channel_info *channel;
 	u32 tmp;
 	unsigned long *bitmap;
+	int ret;
 
 	switch (dvbdmxfeed->type) {
 	case DMX_TYPE_TS:
@@ -171,8 +172,9 @@ static int c8sectpfe_start_feed(struct d
 	}
 
 	if (!atomic_read(&fei->fw_loaded)) {
-		dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__);
-		return -EINVAL;
+		ret = load_c8sectpfe_fw(fei);
+		if (ret)
+			return ret;
 	}
 
 	mutex_lock(&fei->lock);
@@ -267,8 +269,9 @@ static int c8sectpfe_stop_feed(struct dv
 	unsigned long *bitmap;
 
 	if (!atomic_read(&fei->fw_loaded)) {
-		dev_err(fei->dev, "%s: c8sectpfe fw not loaded\n", __func__);
-		return -EINVAL;
+		ret = load_c8sectpfe_fw(fei);
+		if (ret)
+			return ret;
 	}
 
 	mutex_lock(&fei->lock);
@@ -882,13 +885,6 @@ static int c8sectpfe_probe(struct platfo
 		goto err_clk_disable;
 	}
 
-	/* ensure all other init has been done before requesting firmware */
-	ret = load_c8sectpfe_fw_step1(fei);
-	if (ret) {
-		dev_err(dev, "Couldn't load slim core firmware\n");
-		goto err_clk_disable;
-	}
-
 	c8sectpfe_debugfs_init(fei);
 
 	return 0;
@@ -1093,15 +1089,14 @@ static void load_dmem_segment(struct c8s
 		phdr->p_memsz - phdr->p_filesz);
 }
 
-static int load_slim_core_fw(const struct firmware *fw, void *context)
+static int load_slim_core_fw(const struct firmware *fw, struct c8sectpfei *fei)
 {
-	struct c8sectpfei *fei = context;
 	Elf32_Ehdr *ehdr;
 	Elf32_Phdr *phdr;
 	u8 __iomem *dst;
 	int err = 0, i;
 
-	if (!fw || !context)
+	if (!fw || !fei)
 		return -EINVAL;
 
 	ehdr = (Elf32_Ehdr *)fw->data;
@@ -1153,29 +1148,35 @@ static int load_slim_core_fw(const struc
 	return err;
 }
 
-static void load_c8sectpfe_fw_cb(const struct firmware *fw, void *context)
+static int load_c8sectpfe_fw(struct c8sectpfei *fei)
 {
-	struct c8sectpfei *fei = context;
+	const struct firmware *fw;
 	int err;
 
+	dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
+
+	err = request_firmware(&fw, FIRMWARE_MEMDMA, fei->dev);
+	if (err)
+		return err;
+
 	err = c8sectpfe_elf_sanity_check(fei, fw);
 	if (err) {
 		dev_err(fei->dev, "c8sectpfe_elf_sanity_check failed err=(%d)\n"
 			, err);
-		goto err;
+		return err;
 	}
 
-	err = load_slim_core_fw(fw, context);
+	err = load_slim_core_fw(fw, fei);
 	if (err) {
 		dev_err(fei->dev, "load_slim_core_fw failed err=(%d)\n", err);
-		goto err;
+		return err;
 	}
 
 	/* now the firmware is loaded configure the input blocks */
 	err = configure_channels(fei);
 	if (err) {
 		dev_err(fei->dev, "configure_channels failed err=(%d)\n", err);
-		goto err;
+		return err;
 	}
 
 	/*
@@ -1188,28 +1189,6 @@ static void load_c8sectpfe_fw_cb(const s
 	writel(0x1,  fei->io + DMA_CPU_RUN);
 
 	atomic_set(&fei->fw_loaded, 1);
-err:
-	complete_all(&fei->fw_ack);
-}
-
-static int load_c8sectpfe_fw_step1(struct c8sectpfei *fei)
-{
-	int err;
-
-	dev_info(fei->dev, "Loading firmware: %s\n", FIRMWARE_MEMDMA);
-
-	init_completion(&fei->fw_ack);
-	atomic_set(&fei->fw_loaded, 0);
-
-	err = request_firmware_nowait(THIS_MODULE, FW_ACTION_HOTPLUG,
-				FIRMWARE_MEMDMA, fei->dev, GFP_KERNEL, fei,
-				load_c8sectpfe_fw_cb);
-
-	if (err) {
-		dev_err(fei->dev, "request_firmware_nowait err: %d.\n", err);
-		complete_all(&fei->fw_ack);
-		return err;
-	}
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 072/312] net/mlx5: Avoid passing dma address 0 to firmware
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (70 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 071/312] [media] c8sectpfe: Rework firmware loading mechanism Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 073/312] IB/mlx5: Fix RC transport send queue overhead computation Greg Kroah-Hartman
                   ` (241 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Noa Osherovich, Saeed Mahameed,
	David S. Miller

From: Noa Osherovich <noaos@mellanox.com>

commit 6b276190c50a12511d889d9079ffb901ff94a822 upstream.

Currently the firmware can't work with a page with dma address 0.
Passing such an address to the firmware will cause the give_pages
command to fail.

To avoid this, in case we get a 0 dma address of a page from the
dma engine, we avoid passing it to FW by remapping to get an address
other than 0.

Fixes: bf0bf77f6519 ('mlx5: Support communicating arbitrary host...')
Signed-off-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c |   26 +++++++++++++-------
 1 file changed, 18 insertions(+), 8 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
@@ -243,6 +243,7 @@ static void free_4k(struct mlx5_core_dev
 static int alloc_system_page(struct mlx5_core_dev *dev, u16 func_id)
 {
 	struct page *page;
+	u64 zero_addr = 1;
 	u64 addr;
 	int err;
 	int nid = dev_to_node(&dev->pdev->dev);
@@ -252,26 +253,35 @@ static int alloc_system_page(struct mlx5
 		mlx5_core_warn(dev, "failed to allocate page\n");
 		return -ENOMEM;
 	}
+map:
 	addr = dma_map_page(&dev->pdev->dev, page, 0,
 			    PAGE_SIZE, DMA_BIDIRECTIONAL);
 	if (dma_mapping_error(&dev->pdev->dev, addr)) {
 		mlx5_core_warn(dev, "failed dma mapping page\n");
 		err = -ENOMEM;
-		goto out_alloc;
+		goto err_mapping;
 	}
+
+	/* Firmware doesn't support page with physical address 0 */
+	if (addr == 0) {
+		zero_addr = addr;
+		goto map;
+	}
+
 	err = insert_page(dev, addr, page, func_id);
 	if (err) {
 		mlx5_core_err(dev, "failed to track allocated page\n");
-		goto out_mapping;
+		dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE,
+			       DMA_BIDIRECTIONAL);
 	}
 
-	return 0;
-
-out_mapping:
-	dma_unmap_page(&dev->pdev->dev, addr, PAGE_SIZE, DMA_BIDIRECTIONAL);
+err_mapping:
+	if (err)
+		__free_page(page);
 
-out_alloc:
-	__free_page(page);
+	if (zero_addr == 0)
+		dma_unmap_page(&dev->pdev->dev, zero_addr, PAGE_SIZE,
+			       DMA_BIDIRECTIONAL);
 
 	return err;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 073/312] IB/mlx5: Fix RC transport send queue overhead computation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (71 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 072/312] net/mlx5: Avoid passing dma address 0 to firmware Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 074/312] net/mlx5: Make command timeout way shorter Greg Kroah-Hartman
                   ` (240 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Leon Romanovsky,
	Sagi Grimberg, Doug Ledford

From: Leon Romanovsky <leon@leon.nu>

commit 75c1657e1d50730dc0130a67977f7831a4e241f4 upstream.

Fix the RC QPs send queue overhead computation to take into account
two additional segments in the WQE which are needed for registration
operations.

The ATOMIC and UMR segments can't coexist together, so chose maximum out
of them.

The commit 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead
computation") was intended to update RC transport as commit messages
states, but added the code to UC transport.

Fixes: 9e65dc371b5c ("IB/mlx5: Fix RC transport send queue overhead computation")
Signed-off-by: Kamal Heib <kamalh@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx5/qp.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -271,8 +271,10 @@ static int sq_overhead(enum ib_qp_type q
 		/* fall through */
 	case IB_QPT_RC:
 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
-			sizeof(struct mlx5_wqe_atomic_seg) +
-			sizeof(struct mlx5_wqe_raddr_seg);
+			max(sizeof(struct mlx5_wqe_atomic_seg) +
+			    sizeof(struct mlx5_wqe_raddr_seg),
+			    sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+			    sizeof(struct mlx5_mkey_seg));
 		break;
 
 	case IB_QPT_XRC_TGT:
@@ -280,9 +282,9 @@ static int sq_overhead(enum ib_qp_type q
 
 	case IB_QPT_UC:
 		size += sizeof(struct mlx5_wqe_ctrl_seg) +
-			sizeof(struct mlx5_wqe_raddr_seg) +
-			sizeof(struct mlx5_wqe_umr_ctrl_seg) +
-			sizeof(struct mlx5_mkey_seg);
+			max(sizeof(struct mlx5_wqe_raddr_seg),
+			    sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+			    sizeof(struct mlx5_mkey_seg));
 		break;
 
 	case IB_QPT_UD:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 074/312] net/mlx5: Make command timeout way shorter
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (72 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 073/312] IB/mlx5: Fix RC transport send queue overhead computation Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 075/312] IB/mlx5: Fix FW version diaplay in sysfs Greg Kroah-Hartman
                   ` (239 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Or Gerlitz, Leon Romanovsky,
	Saeed Mahameed, David S. Miller

From: Or Gerlitz <ogerlitz@mellanox.com>

commit 6b6c07bdcdc97ccac2596063bfc32a5faddfe884 upstream.

The command timeout is terribly long, whole two hours. Make it 60s so if
things do go wrong, the user gets feedback in relatively short time, so
they can take corrective actions and/or investigate using tools and such.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/mlx5/driver.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -54,7 +54,7 @@ enum {
 	/* one minute for the sake of bringup. Generally, commands must always
 	 * complete and we may need to increase this timeout value
 	 */
-	MLX5_CMD_TIMEOUT_MSEC	= 7200 * 1000,
+	MLX5_CMD_TIMEOUT_MSEC	= 60 * 1000,
 	MLX5_CMD_WQ_MAX_NAME	= 32,
 };
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 075/312] IB/mlx5: Fix FW version diaplay in sysfs
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (73 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 074/312] net/mlx5: Make command timeout way shorter Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 076/312] net/mlx5e: Fix MLX5E_100BASE_T define Greg Kroah-Hartman
                   ` (238 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eran Ben Elisha, Noa Osherovich,
	Leon Romanovsky, Doug Ledford

From: Eran Ben Elisha <eranbe@mellanox.com>

commit c0fcebf55289c48148992eee002a7caf853a5358 upstream.

Add a 4-digit padding to show FW version in proper format.

Fixes: 9603b61de1eee ('mlx5: Move pci device handling from...')
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx5/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -905,7 +905,7 @@ static ssize_t show_fw_ver(struct device
 {
 	struct mlx5_ib_dev *dev =
 		container_of(device, struct mlx5_ib_dev, ib_dev.dev);
-	return sprintf(buf, "%d.%d.%d\n", fw_rev_maj(dev->mdev),
+	return sprintf(buf, "%d.%d.%04d\n", fw_rev_maj(dev->mdev),
 		       fw_rev_min(dev->mdev), fw_rev_sub(dev->mdev));
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 076/312] net/mlx5e: Fix MLX5E_100BASE_T define
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (74 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 075/312] IB/mlx5: Fix FW version diaplay in sysfs Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 077/312] net/mlx5: Fix the size of modify QP mailbox Greg Kroah-Hartman
                   ` (237 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rana Shahout, Saeed Mahameed,
	David S. Miller

From: Rana Shahout <ranas@mellanox.com>

commit 6e4c21894673baabdbef03c3ac2458a28246128b upstream.

Bit 25 of eth_proto_capability in PTYS register is
1000Base-TT and not 100Base-T.

Fixes: f62b8bb8f2d3 ('net/mlx5: Extend mlx5_core to
support ConnectX-4 Ethernet functionality')
Signed-off-by: Rana Shahout <ranas@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/en.h         |    2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c |    8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -543,7 +543,7 @@ enum mlx5e_link_mode {
 	MLX5E_100GBASE_KR4	 = 22,
 	MLX5E_100GBASE_LR4	 = 23,
 	MLX5E_100BASE_TX	 = 24,
-	MLX5E_100BASE_T		 = 25,
+	MLX5E_1000BASE_T	 = 25,
 	MLX5E_10GBASE_T		 = 26,
 	MLX5E_25GBASE_CR	 = 27,
 	MLX5E_25GBASE_KR	 = 28,
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -138,10 +138,10 @@ static const struct {
 	[MLX5E_100BASE_TX]   = {
 		.speed      = 100,
 	},
-	[MLX5E_100BASE_T]    = {
-		.supported  = SUPPORTED_100baseT_Full,
-		.advertised = ADVERTISED_100baseT_Full,
-		.speed      = 100,
+	[MLX5E_1000BASE_T]    = {
+		.supported  = SUPPORTED_1000baseT_Full,
+		.advertised = ADVERTISED_1000baseT_Full,
+		.speed      = 1000,
 	},
 	[MLX5E_10GBASE_T]    = {
 		.supported  = SUPPORTED_10000baseT_Full,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 077/312] net/mlx5: Fix the size of modify QP mailbox
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (75 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 076/312] net/mlx5e: Fix MLX5E_100BASE_T define Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 078/312] net/mlx5: Fix masking of reserved bits in XRCD number Greg Kroah-Hartman
                   ` (236 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Majd Dibbiny, Saeed Mahameed,
	David S. Miller

From: Majd Dibbiny <majd@mellanox.com>

commit 418f8399a8bedf376ec13eb01088f04a76ebdd6f upstream.

Add 16 reserved bytes at the end of mlx5_modify_qp_mbox_in to
match the hardware spec definition.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/mlx5/qp.h |    1 +
 1 file changed, 1 insertion(+)

--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -539,6 +539,7 @@ struct mlx5_modify_qp_mbox_in {
 	__be32			optparam;
 	u8			rsvd1[4];
 	struct mlx5_qp_context	ctx;
+	u8			rsvd2[16];
 };
 
 struct mlx5_modify_qp_mbox_out {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 078/312] net/mlx5: Fix masking of reserved bits in XRCD number
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (76 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 077/312] net/mlx5: Fix the size of modify QP mailbox Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 079/312] net/mlx5e: Fix blue flame quota logic Greg Kroah-Hartman
                   ` (235 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Majd Dibbiny, Saeed Mahameed,
	David S. Miller

From: Majd Dibbiny <majd@mellanox.com>

commit 9cd3411c42c5d5ba55d6e745edfe7df53c1ffa41 upstream.

Mask the reserved bits when reading the number of newly
created XRCD.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/qp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c
@@ -393,7 +393,7 @@ int mlx5_core_xrcd_alloc(struct mlx5_cor
 	if (out.hdr.status)
 		err = mlx5_cmd_status_to_err(&out.hdr);
 	else
-		*xrcdn = be32_to_cpu(out.xrcdn);
+		*xrcdn = be32_to_cpu(out.xrcdn) & 0xffffff;
 
 	return err;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 079/312] net/mlx5e: Fix blue flame quota logic
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (77 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 078/312] net/mlx5: Fix masking of reserved bits in XRCD number Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 080/312] net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create Greg Kroah-Hartman
                   ` (234 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eli Cohen, Saeed Mahameed, David S. Miller

From: Eli Cohen <eli@mellanox.com>

commit 0ca00fc1f808602137dc6d51f17747b3bb0fc34d upstream.

Blue flame is a latency enhancement feature that allows the driver to
write the packet data directly to the NIC's registers thus making the
read of the packet data from host memory redundant.

We maintain a quota for the blue flame which is reloaded whenever we
identify that the hardware is processing send requests and processes
them fast enough so by the time we post the next send request it was
able to process all the pending ones. This indicates that the hardware
is capable of processing more blue flame requests efficiently. The blue
flame quota is decremented whenever we send using blue flame.

The current code erroneously clears the budget if we did not use blue
flame for the current post send operation and we fix it here.

Fixes: 88a85f99e51f ('net/mlx5e: TX latency optimization to save DMA reads')
Signed-off-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -290,7 +290,8 @@ static netdev_tx_t mlx5e_sq_xmit(struct
 	while ((sq->pc & wq->sz_m1) > sq->edge)
 		mlx5e_send_nop(sq, false);
 
-	sq->bf_budget = bf ? sq->bf_budget - 1 : 0;
+	if (bf)
+		sq->bf_budget--;
 
 	sq->stats.packets++;
 	return NETDEV_TX_OK;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 080/312] net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (78 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 079/312] net/mlx5e: Fix blue flame quota logic Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 081/312] net/mlx5: Avoid calling sleeping function by the health poll thread Greg Kroah-Hartman
                   ` (233 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Wang Sheng-Hui, Saeed Mahameed,
	David S. Miller

From: Wang Sheng-Hui <shhuiw@foxmail.com>

commit f299a02d5f13c4deb52c1a7ddf2b42630fe6294a upstream.

Commit 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on
reader NUMA node") introduced mlx5_*_alloc_node() but missed changing
some calling and warn messages. This patch introduces 2 changes:
	* Use mlx5_buf_alloc_node() instead of mlx5_buf_alloc() in
	  mlx5_wq_ll_create()
	* Update the failure warn messages with _node postfix for
	  mlx5_*_alloc function names

Fixes: 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node")
Signed-off-by: Wang Sheng-Hui <shhuiw@foxmail.com>
Acked-By: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/wq.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/wq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/wq.c
@@ -75,14 +75,14 @@ int mlx5_wq_cyc_create(struct mlx5_core_
 
 	err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
 		return err;
 	}
 
 	err = mlx5_buf_alloc_node(mdev, mlx5_wq_cyc_get_byte_size(wq),
 				  &wq_ctrl->buf, param->buf_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
 		goto err_db_free;
 	}
 
@@ -111,14 +111,14 @@ int mlx5_cqwq_create(struct mlx5_core_de
 
 	err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
 		return err;
 	}
 
 	err = mlx5_buf_alloc_node(mdev, mlx5_cqwq_get_byte_size(wq),
 				  &wq_ctrl->buf, param->buf_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
 		goto err_db_free;
 	}
 
@@ -148,13 +148,14 @@ int mlx5_wq_ll_create(struct mlx5_core_d
 
 	err = mlx5_db_alloc_node(mdev, &wq_ctrl->db, param->db_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_db_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_db_alloc_node() failed, %d\n", err);
 		return err;
 	}
 
-	err = mlx5_buf_alloc(mdev, mlx5_wq_ll_get_byte_size(wq), &wq_ctrl->buf);
+	err = mlx5_buf_alloc_node(mdev, mlx5_wq_ll_get_byte_size(wq),
+				  &wq_ctrl->buf, param->buf_numa_node);
 	if (err) {
-		mlx5_core_warn(mdev, "mlx5_buf_alloc() failed, %d\n", err);
+		mlx5_core_warn(mdev, "mlx5_buf_alloc_node() failed, %d\n", err);
 		goto err_db_free;
 	}
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 081/312] net/mlx5: Avoid calling sleeping function by the health poll thread
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (79 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 080/312] net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 082/312] net/mlx5: Fix wait_vital for VFs and remove fixed sleep Greg Kroah-Hartman
                   ` (232 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mohamad Haj Yahia, Saeed Mahameed,
	David S. Miller

From: Mohamad Haj Yahia <mohamad@mellanox.com>

commit c1d4d2e92ad670168a17a57dfa182a5a5baa72d4 upstream.

In internal error state the health poll thread will eventually call
synchronize_irq() (to safely trigger command completions) which might
sleep, so we are calling sleeping function from atomic context which is
invalid.
Here we move trigger_cmd_completions(dev) to enter error state which is
the earliest stage in error state handling.
This way we won't need to wait for next health poll to trigger command
completions and will solve the scheduling while atomic issue.
mlx5_enter_error_state can be called from two contexts, protect it with
dev->intf_state_lock

Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core driver')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/health.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c
@@ -108,15 +108,21 @@ static int in_fatal(struct mlx5_core_dev
 
 void mlx5_enter_error_state(struct mlx5_core_dev *dev)
 {
+	mutex_lock(&dev->intf_state_mutex);
 	if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR)
-		return;
+		goto unlock;
 
 	mlx5_core_err(dev, "start\n");
-	if (pci_channel_offline(dev->pdev) || in_fatal(dev))
+	if (pci_channel_offline(dev->pdev) || in_fatal(dev)) {
 		dev->state = MLX5_DEVICE_STATE_INTERNAL_ERROR;
+		trigger_cmd_completions(dev);
+	}
 
 	mlx5_core_event(dev, MLX5_DEV_EVENT_SYS_ERROR, 0);
 	mlx5_core_err(dev, "end\n");
+
+unlock:
+	mutex_unlock(&dev->intf_state_mutex);
 }
 
 static void mlx5_handle_bad_state(struct mlx5_core_dev *dev)
@@ -245,7 +251,6 @@ static void poll_health(unsigned long da
 	u32 count;
 
 	if (dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
-		trigger_cmd_completions(dev);
 		mod_timer(&health->timer, get_next_poll_jiffies());
 		return;
 	}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 082/312] net/mlx5: Fix wait_vital for VFs and remove fixed sleep
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (80 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 081/312] net/mlx5: Avoid calling sleeping function by the health poll thread Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 083/312] net/mlx5: Fix potential deadlock in command mode change Greg Kroah-Hartman
                   ` (231 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Jurgens, Saeed Mahameed,
	David S. Miller

From: Daniel Jurgens <danielj@mellanox.com>

commit d57847dc4177c6fd8d950cb533f5edf0eab45b11 upstream.

The device ID for VFs is in a different location than PFs. This results
in the poll always timing out for VFs. There's no good way to read the
VF device ID without using the PF's configuration space.  Switch to waiting
for the health poll to start incrementing. Also remove the 1s sleep
at the beginning.

fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core
driver')
Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

---
 drivers/net/ethernet/mellanox/mlx5/core/main.c |   41 +++++++++----------------
 1 file changed, 15 insertions(+), 26 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1306,46 +1306,31 @@ void mlx5_disable_device(struct mlx5_cor
 	mlx5_pci_err_detected(dev->pdev, 0);
 }
 
-/* wait for the device to show vital signs. For now we check
- * that we can read the device ID and that the health buffer
- * shows a non zero value which is different than 0xffffffff
+/* wait for the device to show vital signs by waiting
+ * for the health counter to start counting.
  */
-static void wait_vital(struct pci_dev *pdev)
+static int wait_vital(struct pci_dev *pdev)
 {
 	struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
 	struct mlx5_core_health *health = &dev->priv.health;
 	const int niter = 100;
+	u32 last_count = 0;
 	u32 count;
-	u16 did;
 	int i;
 
-	/* Wait for firmware to be ready after reset */
-	msleep(1000);
-	for (i = 0; i < niter; i++) {
-		if (pci_read_config_word(pdev, 2, &did)) {
-			dev_warn(&pdev->dev, "failed reading config word\n");
-			break;
-		}
-		if (did == pdev->device) {
-			dev_info(&pdev->dev, "device ID correctly read after %d iterations\n", i);
-			break;
-		}
-		msleep(50);
-	}
-	if (i == niter)
-		dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__);
-
 	for (i = 0; i < niter; i++) {
 		count = ioread32be(health->health_counter);
 		if (count && count != 0xffffffff) {
-			dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i);
-			break;
+			if (last_count && last_count != count) {
+				dev_info(&pdev->dev, "Counter value 0x%x after %d iterations\n", count, i);
+				return 0;
+			}
+			last_count = count;
 		}
 		msleep(50);
 	}
 
-	if (i == niter)
-		dev_warn(&pdev->dev, "%s-%d: could not read device ID\n", __func__, __LINE__);
+	return -ETIMEDOUT;
 }
 
 static void mlx5_pci_resume(struct pci_dev *pdev)
@@ -1357,7 +1342,11 @@ static void mlx5_pci_resume(struct pci_d
 	dev_info(&pdev->dev, "%s was called\n", __func__);
 
 	pci_save_state(pdev);
-	wait_vital(pdev);
+	err = wait_vital(pdev);
+	if (err) {
+		dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
+		return;
+	}
 
 	err = mlx5_load_one(dev, priv);
 	if (err)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 083/312] net/mlx5: Fix potential deadlock in command mode change
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (81 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 082/312] net/mlx5: Fix wait_vital for VFs and remove fixed sleep Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 084/312] net/mlx5: Add timeout handle to commands with callback Greg Kroah-Hartman
                   ` (230 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mohamad Haj Yahia, Saeed Mahameed,
	David S. Miller

From: Mohamad Haj Yahia <mohamad@mellanox.com>

commit 9cba4ebcf374c3772f6eb61f2d065294b2451b49 upstream.

Call command completion handler in case of timeout when working in
interrupts mode.
Avoid flushing the commands workqueue after acquiring the semaphores to
prevent a potential deadlock.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c |   79 ++++++++++----------------
 1 file changed, 33 insertions(+), 46 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -750,13 +750,13 @@ static int wait_func(struct mlx5_core_de
 
 	if (cmd->mode == CMD_MODE_POLLING) {
 		wait_for_completion(&ent->done);
-		err = ent->ret;
-	} else {
-		if (!wait_for_completion_timeout(&ent->done, timeout))
-			err = -ETIMEDOUT;
-		else
-			err = 0;
+	} else if (!wait_for_completion_timeout(&ent->done, timeout)) {
+		ent->ret = -ETIMEDOUT;
+		mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
 	}
+
+	err = ent->ret;
+
 	if (err == -ETIMEDOUT) {
 		mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
 			       mlx5_command_str(msg_to_opcode(ent->in)),
@@ -817,28 +817,26 @@ static int mlx5_cmd_invoke(struct mlx5_c
 		goto out_free;
 	}
 
-	if (!callback) {
-		err = wait_func(dev, ent);
-		if (err == -ETIMEDOUT)
-			goto out;
-
-		ds = ent->ts2 - ent->ts1;
-		op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode);
-		if (op < ARRAY_SIZE(cmd->stats)) {
-			stats = &cmd->stats[op];
-			spin_lock_irq(&stats->lock);
-			stats->sum += ds;
-			++stats->n;
-			spin_unlock_irq(&stats->lock);
-		}
-		mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME,
-				   "fw exec time for %s is %lld nsec\n",
-				   mlx5_command_str(op), ds);
-		*status = ent->status;
-		free_cmd(ent);
-	}
+	if (callback)
+		goto out;
 
-	return err;
+	err = wait_func(dev, ent);
+	if (err == -ETIMEDOUT)
+		goto out_free;
+
+	ds = ent->ts2 - ent->ts1;
+	op = be16_to_cpu(((struct mlx5_inbox_hdr *)in->first.data)->opcode);
+	if (op < ARRAY_SIZE(cmd->stats)) {
+		stats = &cmd->stats[op];
+		spin_lock_irq(&stats->lock);
+		stats->sum += ds;
+		++stats->n;
+		spin_unlock_irq(&stats->lock);
+	}
+	mlx5_core_dbg_mask(dev, 1 << MLX5_CMD_TIME,
+			   "fw exec time for %s is %lld nsec\n",
+			   mlx5_command_str(op), ds);
+	*status = ent->status;
 
 out_free:
 	free_cmd(ent);
@@ -1230,41 +1228,30 @@ err_dbg:
 	return err;
 }
 
-void mlx5_cmd_use_events(struct mlx5_core_dev *dev)
+static void mlx5_cmd_change_mod(struct mlx5_core_dev *dev, int mode)
 {
 	struct mlx5_cmd *cmd = &dev->cmd;
 	int i;
 
 	for (i = 0; i < cmd->max_reg_cmds; i++)
 		down(&cmd->sem);
-
 	down(&cmd->pages_sem);
 
-	flush_workqueue(cmd->wq);
-
-	cmd->mode = CMD_MODE_EVENTS;
+	cmd->mode = mode;
 
 	up(&cmd->pages_sem);
 	for (i = 0; i < cmd->max_reg_cmds; i++)
 		up(&cmd->sem);
 }
 
-void mlx5_cmd_use_polling(struct mlx5_core_dev *dev)
+void mlx5_cmd_use_events(struct mlx5_core_dev *dev)
 {
-	struct mlx5_cmd *cmd = &dev->cmd;
-	int i;
-
-	for (i = 0; i < cmd->max_reg_cmds; i++)
-		down(&cmd->sem);
-
-	down(&cmd->pages_sem);
-
-	flush_workqueue(cmd->wq);
-	cmd->mode = CMD_MODE_POLLING;
+	mlx5_cmd_change_mod(dev, CMD_MODE_EVENTS);
+}
 
-	up(&cmd->pages_sem);
-	for (i = 0; i < cmd->max_reg_cmds; i++)
-		up(&cmd->sem);
+void mlx5_cmd_use_polling(struct mlx5_core_dev *dev)
+{
+	mlx5_cmd_change_mod(dev, CMD_MODE_POLLING);
 }
 
 static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 084/312] net/mlx5: Add timeout handle to commands with callback
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (82 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 083/312] net/mlx5: Fix potential deadlock in command mode change Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 085/312] net/mlx5: Fix pci error recovery flow Greg Kroah-Hartman
                   ` (229 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mohamad Haj Yahia, Saeed Mahameed,
	David S. Miller

From: Mohamad Haj Yahia <mohamad@mellanox.com>

commit 65ee67084589c1783a74b4a4a5db38d7264ec8b5 upstream.

The current implementation does not handle timeout in case of command
with callback request, and this can lead to deadlock if the command
doesn't get fw response.
Add delayed callback timeout work before posting the command to fw.
In case of real fw command completion we will cancel the delayed work.
In case of fw command timeout the callback timeout handler will be
called and it will simulate fw completion with timeout error.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/cmd.c |   38 +++++++++++++++++++++-----
 include/linux/mlx5/driver.h                   |    1 
 2 files changed, 32 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -634,11 +634,36 @@ static void free_msg(struct mlx5_core_de
 static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev,
 			      struct mlx5_cmd_msg *msg);
 
+static u16 msg_to_opcode(struct mlx5_cmd_msg *in)
+{
+	struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data);
+
+	return be16_to_cpu(hdr->opcode);
+}
+
+static void cb_timeout_handler(struct work_struct *work)
+{
+	struct delayed_work *dwork = container_of(work, struct delayed_work,
+						  work);
+	struct mlx5_cmd_work_ent *ent = container_of(dwork,
+						     struct mlx5_cmd_work_ent,
+						     cb_timeout_work);
+	struct mlx5_core_dev *dev = container_of(ent->cmd, struct mlx5_core_dev,
+						 cmd);
+
+	ent->ret = -ETIMEDOUT;
+	mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
+		       mlx5_command_str(msg_to_opcode(ent->in)),
+		       msg_to_opcode(ent->in));
+	mlx5_cmd_comp_handler(dev, 1UL << ent->idx);
+}
+
 static void cmd_work_handler(struct work_struct *work)
 {
 	struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work);
 	struct mlx5_cmd *cmd = ent->cmd;
 	struct mlx5_core_dev *dev = container_of(cmd, struct mlx5_core_dev, cmd);
+	unsigned long cb_timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC);
 	struct mlx5_cmd_layout *lay;
 	struct semaphore *sem;
 	unsigned long flags;
@@ -691,6 +716,9 @@ static void cmd_work_handler(struct work
 	ent->ts1 = ktime_get_ns();
 	cmd_mode = cmd->mode;
 
+	if (ent->callback)
+		schedule_delayed_work(&ent->cb_timeout_work, cb_timeout);
+
 	/* ring doorbell after the descriptor is valid */
 	mlx5_core_dbg(dev, "writing 0x%x to command doorbell\n", 1 << ent->idx);
 	wmb();
@@ -735,13 +763,6 @@ static const char *deliv_status_to_str(u
 	}
 }
 
-static u16 msg_to_opcode(struct mlx5_cmd_msg *in)
-{
-	struct mlx5_inbox_hdr *hdr = (struct mlx5_inbox_hdr *)(in->first.data);
-
-	return be16_to_cpu(hdr->opcode);
-}
-
 static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
 {
 	unsigned long timeout = msecs_to_jiffies(MLX5_CMD_TIMEOUT_MSEC);
@@ -808,6 +829,7 @@ static int mlx5_cmd_invoke(struct mlx5_c
 	if (!callback)
 		init_completion(&ent->done);
 
+	INIT_DELAYED_WORK(&ent->cb_timeout_work, cb_timeout_handler);
 	INIT_WORK(&ent->work, cmd_work_handler);
 	if (page_queue) {
 		cmd_work_handler(&ent->work);
@@ -1287,6 +1309,8 @@ void mlx5_cmd_comp_handler(struct mlx5_c
 			struct semaphore *sem;
 
 			ent = cmd->ent_arr[i];
+			if (ent->callback)
+				cancel_delayed_work(&ent->cb_timeout_work);
 			if (ent->page_queue)
 				sem = &cmd->pages_sem;
 			else
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -566,6 +566,7 @@ struct mlx5_cmd_work_ent {
 	void		       *uout;
 	int			uout_size;
 	mlx5_cmd_cbk_t		callback;
+	struct delayed_work	cb_timeout_work;
 	void		       *context;
 	int			idx;
 	struct completion	done;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 085/312] net/mlx5: Fix pci error recovery flow
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (83 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 084/312] net/mlx5: Add timeout handle to commands with callback Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 086/312] net/mlx5e: Copy all L2 headers into inline segment Greg Kroah-Hartman
                   ` (228 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mohamad Haj Yahia, Saeed Mahameed,
	David S. Miller

From: Mohamad Haj Yahia <mohamad@mellanox.com>

commit 1061c90f524963a0a90e7d2f9a6bfa666458af51 upstream.

When PCI error is detected we should save the state of the pci prior to
disabling it.

Also when receiving pci slot reset call we need to verify that the
device is responsive.

Fixes: 89d44f0a6c73 ('net/mlx5_core: Add pci error handlers to mlx5_core
driver')
Signed-off-by: Mohamad Haj Yahia <mohamad@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

---
 drivers/net/ethernet/mellanox/mlx5/core/main.c |   59 ++++++++++++-------------
 1 file changed, 29 insertions(+), 30 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1276,36 +1276,12 @@ static pci_ers_result_t mlx5_pci_err_det
 	dev_info(&pdev->dev, "%s was called\n", __func__);
 	mlx5_enter_error_state(dev);
 	mlx5_unload_one(dev, priv);
+	pci_save_state(pdev);
 	mlx5_pci_disable_device(dev);
 	return state == pci_channel_io_perm_failure ?
 		PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET;
 }
 
-static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
-{
-	struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-	int err = 0;
-
-	dev_info(&pdev->dev, "%s was called\n", __func__);
-
-	err = mlx5_pci_enable_device(dev);
-	if (err) {
-		dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
-			, __func__, err);
-		return PCI_ERS_RESULT_DISCONNECT;
-	}
-	pci_set_master(pdev);
-	pci_set_power_state(pdev, PCI_D0);
-	pci_restore_state(pdev);
-
-	return err ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED;
-}
-
-void mlx5_disable_device(struct mlx5_core_dev *dev)
-{
-	mlx5_pci_err_detected(dev->pdev, 0);
-}
-
 /* wait for the device to show vital signs by waiting
  * for the health counter to start counting.
  */
@@ -1333,21 +1309,44 @@ static int wait_vital(struct pci_dev *pd
 	return -ETIMEDOUT;
 }
 
-static void mlx5_pci_resume(struct pci_dev *pdev)
+static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)
 {
 	struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
-	struct mlx5_priv *priv = &dev->priv;
 	int err;
 
 	dev_info(&pdev->dev, "%s was called\n", __func__);
 
-	pci_save_state(pdev);
-	err = wait_vital(pdev);
+	err = mlx5_pci_enable_device(dev);
 	if (err) {
+		dev_err(&pdev->dev, "%s: mlx5_pci_enable_device failed with error code: %d\n"
+			, __func__, err);
+		return PCI_ERS_RESULT_DISCONNECT;
+	}
+
+	pci_set_master(pdev);
+	pci_restore_state(pdev);
+
+	if (wait_vital(pdev)) {
 		dev_err(&pdev->dev, "%s: wait_vital timed out\n", __func__);
-		return;
+		return PCI_ERS_RESULT_DISCONNECT;
 	}
 
+	return PCI_ERS_RESULT_RECOVERED;
+}
+
+void mlx5_disable_device(struct mlx5_core_dev *dev)
+{
+	mlx5_pci_err_detected(dev->pdev, 0);
+}
+
+static void mlx5_pci_resume(struct pci_dev *pdev)
+{
+	struct mlx5_core_dev *dev = pci_get_drvdata(pdev);
+	struct mlx5_priv *priv = &dev->priv;
+	int err;
+
+	dev_info(&pdev->dev, "%s was called\n", __func__);
+
 	err = mlx5_load_one(dev, priv);
 	if (err)
 		dev_err(&pdev->dev, "%s: mlx5_load_one failed with error code: %d\n"



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 086/312] net/mlx5e: Copy all L2 headers into inline segment
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (84 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 085/312] net/mlx5: Fix pci error recovery flow Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 087/312] net_sched: keep backlog updated with qlen Greg Kroah-Hartman
                   ` (227 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Matthew Finlay, Saeed Mahameed,
	David S. Miller

From: Matthew Finlay <matt@mellanox.com>

commit e3a19b53cbb0e6738b7a547f262179065b72e3fa upstream.

ConnectX4-Lx uses an inline wqe mode that currently defaults to
requiring the entire L2 header be included in the wqe.
This patch fixes mlx5e_get_inline_hdr_size() to account for
all L2 headers (VLAN, QinQ, etc) using skb_network_offset(skb).

Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files")
Signed-off-by: Matthew Finlay <matt@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx5/core/en_tx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
@@ -124,7 +124,7 @@ static inline u16 mlx5e_get_inline_hdr_s
 	 * headers and occur before the data gather.
 	 * Therefore these headers must be copied into the WQE
 	 */
-#define MLX5E_MIN_INLINE ETH_HLEN
+#define MLX5E_MIN_INLINE (ETH_HLEN + VLAN_HLEN)
 
 	if (bf) {
 		u16 ihs = skb_headlen(skb);
@@ -136,7 +136,7 @@ static inline u16 mlx5e_get_inline_hdr_s
 			return skb_headlen(skb);
 	}
 
-	return MLX5E_MIN_INLINE;
+	return max(skb_network_offset(skb), MLX5E_MIN_INLINE);
 }
 
 static inline void mlx5e_insert_vlan(void *start, struct sk_buff *skb, u16 ihs)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 087/312] net_sched: keep backlog updated with qlen
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (85 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 086/312] net/mlx5e: Copy all L2 headers into inline segment Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 088/312] sch_drr: update backlog as well Greg Kroah-Hartman
                   ` (226 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stas Nichiporovich, Jamal Hadi Salim,
	Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit a27758ffaf96f89002129eedb2cc172d254099f8 upstream.

For gso_skb we only update qlen, backlog should be updated too.

Note, it is correct to just update these stats at one layer,
because the gso_skb is cached there.

Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/sch_generic.h |    5 ++++-
 net/sched/sch_generic.c   |    2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -674,9 +674,11 @@ static inline struct sk_buff *qdisc_peek
 	/* we can reuse ->gso_skb because peek isn't called for root qdiscs */
 	if (!sch->gso_skb) {
 		sch->gso_skb = sch->dequeue(sch);
-		if (sch->gso_skb)
+		if (sch->gso_skb) {
 			/* it's still part of the queue */
+			qdisc_qstats_backlog_inc(sch, sch->gso_skb);
 			sch->q.qlen++;
+		}
 	}
 
 	return sch->gso_skb;
@@ -689,6 +691,7 @@ static inline struct sk_buff *qdisc_dequ
 
 	if (skb) {
 		sch->gso_skb = NULL;
+		qdisc_qstats_backlog_dec(sch, skb);
 		sch->q.qlen--;
 	} else {
 		skb = sch->dequeue(sch);
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -49,6 +49,7 @@ static inline int dev_requeue_skb(struct
 {
 	q->gso_skb = skb;
 	q->qstats.requeues++;
+	qdisc_qstats_backlog_inc(q, skb);
 	q->q.qlen++;	/* it's still part of the queue */
 	__netif_schedule(q);
 
@@ -92,6 +93,7 @@ static struct sk_buff *dequeue_skb(struc
 		txq = skb_get_tx_queue(txq->dev, skb);
 		if (!netif_xmit_frozen_or_stopped(txq)) {
 			q->gso_skb = NULL;
+			qdisc_qstats_backlog_dec(q, skb);
 			q->q.qlen--;
 		} else
 			skb = NULL;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 088/312] sch_drr: update backlog as well
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (86 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 087/312] net_sched: keep backlog updated with qlen Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 089/312] sch_hfsc: always keep backlog updated Greg Kroah-Hartman
                   ` (225 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jamal Hadi Salim, Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 6a73b571b63075ef408c83f07c2565b5652f93cc upstream.

Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_drr.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -375,6 +375,7 @@ static int drr_enqueue(struct sk_buff *s
 		cl->deficit = cl->quantum;
 	}
 
+	qdisc_qstats_backlog_inc(sch, skb);
 	sch->q.qlen++;
 	return err;
 }
@@ -405,6 +406,7 @@ static struct sk_buff *drr_dequeue(struc
 
 			bstats_update(&cl->bstats, skb);
 			qdisc_bstats_update(sch, skb);
+			qdisc_qstats_backlog_dec(sch, skb);
 			sch->q.qlen--;
 			return skb;
 		}
@@ -426,6 +428,7 @@ static unsigned int drr_drop(struct Qdis
 		if (cl->qdisc->ops->drop) {
 			len = cl->qdisc->ops->drop(cl->qdisc);
 			if (len > 0) {
+				sch->qstats.backlog -= len;
 				sch->q.qlen--;
 				if (cl->qdisc->q.qlen == 0)
 					list_del(&cl->alist);
@@ -461,6 +464,7 @@ static void drr_reset_qdisc(struct Qdisc
 			qdisc_reset(cl->qdisc);
 		}
 	}
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 089/312] sch_hfsc: always keep backlog updated
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (87 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 088/312] sch_drr: update backlog as well Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 090/312] sch_prio: update backlog as well Greg Kroah-Hartman
                   ` (224 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stas Nichiporovich, Jamal Hadi Salim,
	Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 357cc9b4a8a7a0cd0e662537b76e6fa4670b6798 upstream.

hfsc updates backlog lazily, that is only when we
dump the stats. This is problematic after we begin to
update backlog in qdisc_tree_reduce_backlog().

Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Tested-by: Stas Nichiporovich <stasn77@gmail.com>
Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_hfsc.c |   12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1529,6 +1529,7 @@ hfsc_reset_qdisc(struct Qdisc *sch)
 	q->eligible = RB_ROOT;
 	INIT_LIST_HEAD(&q->droplist);
 	qdisc_watchdog_cancel(&q->watchdog);
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 }
 
@@ -1559,14 +1560,6 @@ hfsc_dump_qdisc(struct Qdisc *sch, struc
 	struct hfsc_sched *q = qdisc_priv(sch);
 	unsigned char *b = skb_tail_pointer(skb);
 	struct tc_hfsc_qopt qopt;
-	struct hfsc_class *cl;
-	unsigned int i;
-
-	sch->qstats.backlog = 0;
-	for (i = 0; i < q->clhash.hashsize; i++) {
-		hlist_for_each_entry(cl, &q->clhash.hash[i], cl_common.hnode)
-			sch->qstats.backlog += cl->qdisc->qstats.backlog;
-	}
 
 	qopt.defcls = q->defcls;
 	if (nla_put(skb, TCA_OPTIONS, sizeof(qopt), &qopt))
@@ -1604,6 +1597,7 @@ hfsc_enqueue(struct sk_buff *skb, struct
 	if (cl->qdisc->q.qlen == 1)
 		set_active(cl, qdisc_pkt_len(skb));
 
+	qdisc_qstats_backlog_inc(sch, skb);
 	sch->q.qlen++;
 
 	return NET_XMIT_SUCCESS;
@@ -1672,6 +1666,7 @@ hfsc_dequeue(struct Qdisc *sch)
 
 	qdisc_unthrottled(sch);
 	qdisc_bstats_update(sch, skb);
+	qdisc_qstats_backlog_dec(sch, skb);
 	sch->q.qlen--;
 
 	return skb;
@@ -1695,6 +1690,7 @@ hfsc_drop(struct Qdisc *sch)
 			}
 			cl->qstats.drops++;
 			qdisc_qstats_drop(sch);
+			sch->qstats.backlog -= len;
 			sch->q.qlen--;
 			return len;
 		}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 090/312] sch_prio: update backlog as well
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (88 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 089/312] sch_hfsc: always keep backlog updated Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 091/312] sch_qfq: keep backlog updated with qlen Greg Kroah-Hartman
                   ` (223 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stas Nichiporovich, Jamal Hadi Salim,
	Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 6529d75ad9228f4d8a8f6c5c5244ceb945ac9bc2 upstream.

We need to update backlog too when we update qlen.

Joint work with Stas.

Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Tested-by: Stas Nichiporovich <stasn77@gmail.com>
Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_prio.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -85,6 +85,7 @@ prio_enqueue(struct sk_buff *skb, struct
 
 	ret = qdisc_enqueue(skb, qdisc);
 	if (ret == NET_XMIT_SUCCESS) {
+		qdisc_qstats_backlog_inc(sch, skb);
 		sch->q.qlen++;
 		return NET_XMIT_SUCCESS;
 	}
@@ -117,6 +118,7 @@ static struct sk_buff *prio_dequeue(stru
 		struct sk_buff *skb = qdisc_dequeue_peeked(qdisc);
 		if (skb) {
 			qdisc_bstats_update(sch, skb);
+			qdisc_qstats_backlog_dec(sch, skb);
 			sch->q.qlen--;
 			return skb;
 		}
@@ -135,6 +137,7 @@ static unsigned int prio_drop(struct Qdi
 	for (prio = q->bands-1; prio >= 0; prio--) {
 		qdisc = q->queues[prio];
 		if (qdisc->ops->drop && (len = qdisc->ops->drop(qdisc)) != 0) {
+			sch->qstats.backlog -= len;
 			sch->q.qlen--;
 			return len;
 		}
@@ -151,6 +154,7 @@ prio_reset(struct Qdisc *sch)
 
 	for (prio = 0; prio < q->bands; prio++)
 		qdisc_reset(q->queues[prio]);
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 091/312] sch_qfq: keep backlog updated with qlen
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (89 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 090/312] sch_prio: update backlog as well Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 092/312] sch_sfb: " Greg Kroah-Hartman
                   ` (222 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stas Nichiporovich, Jamal Hadi Salim,
	Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 2ed5c3f09627f72a2e0e407a86b2ac05494190f9 upstream.

Reported-by: Stas Nichiporovich <stasn77@gmail.com>
Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_qfq.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1150,6 +1150,7 @@ static struct sk_buff *qfq_dequeue(struc
 	if (!skb)
 		return NULL;
 
+	qdisc_qstats_backlog_dec(sch, skb);
 	sch->q.qlen--;
 	qdisc_bstats_update(sch, skb);
 
@@ -1250,6 +1251,7 @@ static int qfq_enqueue(struct sk_buff *s
 	}
 
 	bstats_update(&cl->bstats, skb);
+	qdisc_qstats_backlog_inc(sch, skb);
 	++sch->q.qlen;
 
 	agg = cl->agg;
@@ -1516,6 +1518,7 @@ static void qfq_reset_qdisc(struct Qdisc
 			qdisc_reset(cl->qdisc);
 		}
 	}
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 092/312] sch_sfb: keep backlog updated with qlen
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (90 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 091/312] sch_qfq: keep backlog updated with qlen Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 093/312] sch_tbf: update backlog as well Greg Kroah-Hartman
                   ` (221 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jamal Hadi Salim, Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 3d4357fba82b3cf19ebf0a04d1c9cb086af15d02 upstream.

Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_sfb.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -400,6 +400,7 @@ static int sfb_enqueue(struct sk_buff *s
 enqueue:
 	ret = qdisc_enqueue(skb, child);
 	if (likely(ret == NET_XMIT_SUCCESS)) {
+		qdisc_qstats_backlog_inc(sch, skb);
 		sch->q.qlen++;
 		increment_qlen(skb, q);
 	} else if (net_xmit_drop_count(ret)) {
@@ -428,6 +429,7 @@ static struct sk_buff *sfb_dequeue(struc
 
 	if (skb) {
 		qdisc_bstats_update(sch, skb);
+		qdisc_qstats_backlog_dec(sch, skb);
 		sch->q.qlen--;
 		decrement_qlen(skb, q);
 	}
@@ -450,6 +452,7 @@ static void sfb_reset(struct Qdisc *sch)
 	struct sfb_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 	q->slot = 0;
 	q->double_buffering = false;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 093/312] sch_tbf: update backlog as well
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (91 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 092/312] sch_sfb: " Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 094/312] btrfs: cleaner_kthread() doesnt need explicit freeze Greg Kroah-Hartman
                   ` (220 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jamal Hadi Salim, Cong Wang, David S. Miller

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 8d5958f424b62060a8696b12c17dad198d5d386f upstream.

Fixes: 2ccccf5fb43f ("net_sched: update hierarchical backlog too")
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_tbf.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -197,6 +197,7 @@ static int tbf_enqueue(struct sk_buff *s
 		return ret;
 	}
 
+	qdisc_qstats_backlog_inc(sch, skb);
 	sch->q.qlen++;
 	return NET_XMIT_SUCCESS;
 }
@@ -207,6 +208,7 @@ static unsigned int tbf_drop(struct Qdis
 	unsigned int len = 0;
 
 	if (q->qdisc->ops->drop && (len = q->qdisc->ops->drop(q->qdisc)) != 0) {
+		sch->qstats.backlog -= len;
 		sch->q.qlen--;
 		qdisc_qstats_drop(sch);
 	}
@@ -253,6 +255,7 @@ static struct sk_buff *tbf_dequeue(struc
 			q->t_c = now;
 			q->tokens = toks;
 			q->ptokens = ptoks;
+			qdisc_qstats_backlog_dec(sch, skb);
 			sch->q.qlen--;
 			qdisc_unthrottled(sch);
 			qdisc_bstats_update(sch, skb);
@@ -284,6 +287,7 @@ static void tbf_reset(struct Qdisc *sch)
 	struct tbf_sched_data *q = qdisc_priv(sch);
 
 	qdisc_reset(q->qdisc);
+	sch->qstats.backlog = 0;
 	sch->q.qlen = 0;
 	q->t_c = ktime_get_ns();
 	q->tokens = q->buffer;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 094/312] btrfs: cleaner_kthread() doesnt need explicit freeze
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (92 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 093/312] sch_tbf: update backlog as well Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 095/312] irda: Free skb on irda_accept error path Greg Kroah-Hartman
                   ` (219 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Kosina, David Sterba

From: Jiri Kosina <jkosina@suse.cz>

commit 838fe1887765f4cc679febea60d87d2a06bd300e upstream.

cleaner_kthread() is not marked freezable, and therefore calling
try_to_freeze() in its context is a pointless no-op.

In addition to that, as has been clearly demonstrated by 80ad623edd2d
("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"), it's perfectly
valid / legal for cleaner_kthread() to stay scheduled out in an arbitrary
place during suspend (in that particular example that was waiting for
reading of extent pages), so there is no need to leave any traces of
freezer in this kthread.

Fixes: 80ad623edd2d ("Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()")
Fixes: 696249132158 ("btrfs: clear PF_NOFREEZE in cleaner_kthread()")
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/disk-io.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1750,7 +1750,7 @@ static int cleaner_kthread(void *arg)
 		 */
 		btrfs_delete_unused_bgs(root->fs_info);
 sleep:
-		if (!try_to_freeze() && !again) {
+		if (!again) {
 			set_current_state(TASK_INTERRUPTIBLE);
 			if (!kthread_should_stop())
 				schedule();



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 095/312] irda: Free skb on irda_accept error path.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (93 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 094/312] btrfs: cleaner_kthread() doesnt need explicit freeze Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 096/312] phy: fix device reference leaks Greg Kroah-Hartman
                   ` (218 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Phil Turnbull, David S. Miller

From: phil.turnbull@oracle.com <phil.turnbull@oracle.com>

commit 8ab86c00e349cef9fb14719093a7f198bcc72629 upstream.

skb is not freed if newsk is NULL. Rework the error path so free_skb is
unconditionally called on function exit.

Fixes: c3ea9fa27413 ("[IrDA] af_irda: IRDA_ASSERT cleanups")
Signed-off-by: Phil Turnbull <phil.turnbull@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/irda/af_irda.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -839,7 +839,7 @@ static int irda_accept(struct socket *so
 	struct sock *sk = sock->sk;
 	struct irda_sock *new, *self = irda_sk(sk);
 	struct sock *newsk;
-	struct sk_buff *skb;
+	struct sk_buff *skb = NULL;
 	int err;
 
 	err = irda_create(sock_net(sk), newsock, sk->sk_protocol, 0);
@@ -907,7 +907,6 @@ static int irda_accept(struct socket *so
 	err = -EPERM; /* value does not seem to make sense. -arnd */
 	if (!new->tsap) {
 		pr_debug("%s(), dup failed!\n", __func__);
-		kfree_skb(skb);
 		goto out;
 	}
 
@@ -926,7 +925,6 @@ static int irda_accept(struct socket *so
 	/* Clean up the original one to keep it in listen state */
 	irttp_listen(self->tsap);
 
-	kfree_skb(skb);
 	sk->sk_ack_backlog--;
 
 	newsock->state = SS_CONNECTED;
@@ -934,6 +932,7 @@ static int irda_accept(struct socket *so
 	irda_connect_response(new);
 	err = 0;
 out:
+	kfree_skb(skb);
 	release_sock(sk);
 	return err;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 096/312] phy: fix device reference leaks
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (94 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 095/312] irda: Free skb on irda_accept error path Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 097/312] bonding: prevent out of bound accesses Greg Kroah-Hartman
                   ` (217 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Johan Hovold,
	David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 17ae1c650c1ecf8dc8e16d54b0f68a345965f43f upstream.

Make sure to drop the reference taken by bus_find_device_by_name()
before returning from phy_connect() and phy_attach().

Note that both function still take a reference to the phy device
through phy_attach_direct().

Fixes: e13934563db0 ("[PATCH] PHY Layer fixup")
Cc: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/phy_device.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -522,6 +522,7 @@ struct phy_device *phy_connect(struct ne
 	phydev = to_phy_device(d);
 
 	rc = phy_connect_direct(dev, phydev, handler, interface);
+	put_device(d);
 	if (rc)
 		return ERR_PTR(rc);
 
@@ -721,6 +722,7 @@ struct phy_device *phy_attach(struct net
 	phydev = to_phy_device(d);
 
 	rc = phy_attach_direct(dev, phydev, phydev->dev_flags, interface);
+	put_device(d);
 	if (rc)
 		return ERR_PTR(rc);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 097/312] bonding: prevent out of bound accesses
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (95 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 096/312] phy: fix device reference leaks Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 098/312] mtd: nand: fix ONFI parameter page layout Greg Kroah-Hartman
                   ` (216 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Dmitry Vyukov,
	Nikolay Aleksandrov, Ding Tianhong, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit f87fda00b6ed232a817c655b8d179b48bde8fdbe upstream.

ether_addr_equal_64bits() requires some care about its arguments,
namely that 8 bytes might be read, even if last 2 byte values are not
used.

KASan detected a violation with null_mac_addr and lacpdu_mcast_addr
in bond_3ad.c

Same problem with mac_bcast[] and mac_v6_allmcast[] in bond_alb.c :
Although the 8-byte alignment was there, KASan would detect out
of bound accesses.

Fixes: 815117adaf5b ("bonding: use ether_addr_equal_unaligned for bond addr compare")
Fixes: bb54e58929f3 ("bonding: Verify RX LACPDU has proper dest mac-addr")
Fixes: 885a136c52a8 ("bonding: use compare_ether_addr_64bits() in ALB")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Acked-by: Ding Tianhong <dingtianhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/bonding/bond_3ad.c |   11 +++++++----
 drivers/net/bonding/bond_alb.c |    7 ++-----
 include/net/bonding.h          |    7 ++++++-
 3 files changed, 15 insertions(+), 10 deletions(-)

--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -100,11 +100,14 @@ enum ad_link_speed_type {
 #define MAC_ADDRESS_EQUAL(A, B)	\
 	ether_addr_equal_64bits((const u8 *)A, (const u8 *)B)
 
-static struct mac_addr null_mac_addr = { { 0, 0, 0, 0, 0, 0 } };
+static const u8 null_mac_addr[ETH_ALEN + 2] __long_aligned = {
+	0, 0, 0, 0, 0, 0
+};
 static u16 ad_ticks_per_sec;
 static const int ad_delta_in_ticks = (AD_TIMER_INTERVAL * HZ) / 1000;
 
-static const u8 lacpdu_mcast_addr[ETH_ALEN] = MULTICAST_LACPDU_ADDR;
+static const u8 lacpdu_mcast_addr[ETH_ALEN + 2] __long_aligned =
+	MULTICAST_LACPDU_ADDR;
 
 /* ================= main 802.3ad protocol functions ================== */
 static int ad_lacpdu_send(struct port *port);
@@ -1701,7 +1704,7 @@ static void ad_clear_agg(struct aggregat
 		aggregator->is_individual = false;
 		aggregator->actor_admin_aggregator_key = 0;
 		aggregator->actor_oper_aggregator_key = 0;
-		aggregator->partner_system = null_mac_addr;
+		eth_zero_addr(aggregator->partner_system.mac_addr_value);
 		aggregator->partner_system_priority = 0;
 		aggregator->partner_oper_aggregator_key = 0;
 		aggregator->receive_state = 0;
@@ -1723,7 +1726,7 @@ static void ad_initialize_agg(struct agg
 	if (aggregator) {
 		ad_clear_agg(aggregator);
 
-		aggregator->aggregator_mac_address = null_mac_addr;
+		eth_zero_addr(aggregator->aggregator_mac_address.mac_addr_value);
 		aggregator->aggregator_identifier = 0;
 		aggregator->slave = NULL;
 	}
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -42,13 +42,10 @@
 
 
 
-#ifndef __long_aligned
-#define __long_aligned __attribute__((aligned((sizeof(long)))))
-#endif
-static const u8 mac_bcast[ETH_ALEN] __long_aligned = {
+static const u8 mac_bcast[ETH_ALEN + 2] __long_aligned = {
 	0xff, 0xff, 0xff, 0xff, 0xff, 0xff
 };
-static const u8 mac_v6_allmcast[ETH_ALEN] __long_aligned = {
+static const u8 mac_v6_allmcast[ETH_ALEN + 2] __long_aligned = {
 	0x33, 0x33, 0x00, 0x00, 0x00, 0x01
 };
 static const int alb_delta_in_ticks = HZ / ALB_TIMER_TICKS_PER_SEC;
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -34,6 +34,9 @@
 
 #define BOND_DEFAULT_MIIMON	100
 
+#ifndef __long_aligned
+#define __long_aligned __attribute__((aligned((sizeof(long)))))
+#endif
 /*
  * Less bad way to call ioctl from within the kernel; this needs to be
  * done some other way to get the call out of interrupt context.
@@ -138,7 +141,9 @@ struct bond_params {
 	struct reciprocal_value reciprocal_packets_per_slave;
 	u16 ad_actor_sys_prio;
 	u16 ad_user_port_key;
-	u8 ad_actor_system[ETH_ALEN];
+
+	/* 2 bytes of padding : see ether_addr_equal_64bits() */
+	u8 ad_actor_system[ETH_ALEN + 2];
 };
 
 struct bond_parm_tbl {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 098/312] mtd: nand: fix ONFI parameter page layout
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (96 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 097/312] bonding: prevent out of bound accesses Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 099/312] ath10k: free cached fw bin contents when get board id fails Greg Kroah-Hartman
                   ` (215 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Brian Norris

From: Boris Brezillon <boris.brezillon@free-electrons.com>

commit de64aa9ec129ba627634088f662a4d09e356ddb6 upstream.

src_ssync_features field is only 1 byte large, and the 4th reserved area
is actually 8 bytes large.

Fixes: d1e1f4e42b5 ("mtd: nand: add support for reading ONFI parameters from NAND device")
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/mtd/nand.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -276,7 +276,7 @@ struct nand_onfi_params {
 	__le16 t_r;
 	__le16 t_ccs;
 	__le16 src_sync_timing_mode;
-	__le16 src_ssync_features;
+	u8 src_ssync_features;
 	__le16 clk_pin_capacitance_typ;
 	__le16 io_pin_capacitance_typ;
 	__le16 input_pin_capacitance_typ;
@@ -284,7 +284,7 @@ struct nand_onfi_params {
 	u8 driver_strength_support;
 	__le16 t_int_r;
 	__le16 t_ald;
-	u8 reserved4[7];
+	u8 reserved4[8];
 
 	/* vendor */
 	__le16 vendor_revision;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 099/312] ath10k: free cached fw bin contents when get board id fails
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (97 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 098/312] mtd: nand: fix ONFI parameter page layout Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 100/312] xprtrdma: checking for NULL instead of IS_ERR() Greg Kroah-Hartman
                   ` (214 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Raja Mani, Kalle Valo

From: Raja Mani <rmani@qti.qualcomm.com>

commit b9c191be3fbdd9d78be11160dd7a3ddb9fdc6d42 upstream.

ath10k_core_probe_fw() simply returns error without freeing
cached firmware file content when get board id operation fails.
Free cached fw bin data in failure case to avoid memory leak.

Fixes: db0984e51a18 ("ath10k: select board data based on BMI chip id and board id")
Signed-off-by: Raja Mani <rmani@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath10k/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -1805,7 +1805,7 @@ static int ath10k_core_probe_fw(struct a
 	if (ret && ret != -EOPNOTSUPP) {
 		ath10k_err(ar, "failed to get board id from otp for qca99x0: %d\n",
 			   ret);
-		return ret;
+		goto err_free_firmware_files;
 	}
 
 	ret = ath10k_core_fetch_board_file(ar);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 100/312] xprtrdma: checking for NULL instead of IS_ERR()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (98 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 099/312] ath10k: free cached fw bin contents when get board id fails Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 101/312] xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) Greg Kroah-Hartman
                   ` (213 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Anna Schumaker

From: Dan Carpenter <dan.carpenter@oracle.com>

commit abfb689711aaebd14d893236c6ea4bcdfb61e74c upstream.

The rpcrdma_create_req() function returns error pointers or success.  It
never returns NULL.

Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst and send/receive buffers')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/backchannel.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -42,8 +42,8 @@ static int rpcrdma_bc_setup_rqst(struct
 	size_t size;
 
 	req = rpcrdma_create_req(r_xprt);
-	if (!req)
-		return -ENOMEM;
+	if (IS_ERR(req))
+		return PTR_ERR(req);
 	req->rl_backchannel = true;
 
 	size = RPCRDMA_INLINE_WRITE_THRESHOLD(rqst);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 101/312] xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (99 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 100/312] xprtrdma: checking for NULL instead of IS_ERR() Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 102/312] xprtrdma: xprt_rdma_free() must not release backchannel reqs Greg Kroah-Hartman
                   ` (212 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuck Lever, Devesh Sharma, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit 9b06688bc3b9f13f8de90f832c455fddec3d4e8a upstream.

Clean up.

rb_lock critical sections added in rpcrdma_ep_post_extra_recv()
should have first been converted to use normal spin_lock now that
the reply handler is a work queue.

The backchannel set up code should use the appropriate helper
instead of open-coding a rb_recv_bufs list add.

Problem introduced by glib patch re-ordering on my part.

Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Devesh Sharma <devesh.sharma@avagotech.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/backchannel.c |    6 +-----
 net/sunrpc/xprtrdma/verbs.c       |    7 +++----
 2 files changed, 4 insertions(+), 9 deletions(-)

--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -84,9 +84,7 @@ out_fail:
 static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
 				 unsigned int count)
 {
-	struct rpcrdma_buffer *buffers = &r_xprt->rx_buf;
 	struct rpcrdma_rep *rep;
-	unsigned long flags;
 	int rc = 0;
 
 	while (count--) {
@@ -98,9 +96,7 @@ static int rpcrdma_bc_setup_reps(struct
 			break;
 		}
 
-		spin_lock_irqsave(&buffers->rb_lock, flags);
-		list_add(&rep->rr_list, &buffers->rb_recv_bufs);
-		spin_unlock_irqrestore(&buffers->rb_lock, flags);
+		rpcrdma_recv_buffer_put(rep);
 	}
 
 	return rc;
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1337,15 +1337,14 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm
 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
 	struct rpcrdma_ep *ep = &r_xprt->rx_ep;
 	struct rpcrdma_rep *rep;
-	unsigned long flags;
 	int rc;
 
 	while (count--) {
-		spin_lock_irqsave(&buffers->rb_lock, flags);
+		spin_lock(&buffers->rb_lock);
 		if (list_empty(&buffers->rb_recv_bufs))
 			goto out_reqbuf;
 		rep = rpcrdma_buffer_get_rep_locked(buffers);
-		spin_unlock_irqrestore(&buffers->rb_lock, flags);
+		spin_unlock(&buffers->rb_lock);
 
 		rc = rpcrdma_ep_post_recv(ia, ep, rep);
 		if (rc)
@@ -1355,7 +1354,7 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm
 	return 0;
 
 out_reqbuf:
-	spin_unlock_irqrestore(&buffers->rb_lock, flags);
+	spin_unlock(&buffers->rb_lock);
 	pr_warn("%s: no extra receive buffers\n", __func__);
 	return -ENOMEM;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 102/312] xprtrdma: xprt_rdma_free() must not release backchannel reqs
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (100 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 101/312] xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 103/312] xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len Greg Kroah-Hartman
                   ` (211 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuck Lever, Devesh Sharma, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit ffc4d9b1596c34caa98962722e930e97912c8a9f upstream.

Preserve any rpcrdma_req that is attached to rpc_rqst's allocated
for the backchannel. Otherwise, after all the pre-allocated
backchannel req's are consumed, incoming backward calls start
writing on freed memory.

Somehow this hunk got lost.

Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Tested-by: Devesh Sharma <devesh.sharma@avagotech.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/transport.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/sunrpc/xprtrdma/transport.c
+++ b/net/sunrpc/xprtrdma/transport.c
@@ -576,6 +576,9 @@ xprt_rdma_free(void *buffer)
 
 	rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]);
 	req = rb->rg_owner;
+	if (req->rl_backchannel)
+		return;
+
 	r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
 
 	dprintk("RPC:       %s: called on 0x%p\n", __func__, req->rl_reply);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 103/312] xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (101 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 102/312] xprtrdma: xprt_rdma_free() must not release backchannel reqs Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 104/312] RDMA/cxgb3: device driver frees DMA memory with different size Greg Kroah-Hartman
                   ` (210 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit 9f74660bcf1e4cca577be99e54bc77b5df62b508 upstream.

Some NFSv4.1 OPEN requests were hanging waiting for the NFS server
to finish recalling delegations. Turns out that each NFSv4.1 CB
request on RDMA gets a GARBAGE_ARGS reply from the Linux client.

Commit 756b9b37cfb2e3dc added a line in bc_svc_process that
overwrites the incoming rq_rcv_buf's length with the value in
rq_private_buf.len. But rpcrdma_bc_receive_call() does not invoke
xprt_complete_bc_request(), thus rq_private_buf.len is not
initialized. svc_process_common() is invoked with a zero-length
RPC message, and fails.

Fixes: 756b9b37cfb2e3dc ('SUNRPC: Fix callback channel')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/backchannel.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -337,6 +337,8 @@ void rpcrdma_bc_receive_call(struct rpcr
 	rqst->rq_reply_bytes_recvd = 0;
 	rqst->rq_bytes_sent = 0;
 	rqst->rq_xid = headerp->rm_xid;
+
+	rqst->rq_private_buf.len = size;
 	set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state);
 
 	buf = &rqst->rq_rcv_buf;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 104/312] RDMA/cxgb3: device driver frees DMA memory with different size
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (102 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 103/312] xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 105/312] mlxsw: spectrum: Dont forward packets when STP state is DISABLED Greg Kroah-Hartman
                   ` (209 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Honggang Li, Leon Romanovsky,
	Steve Wise, Doug Ledford

From: Honggang Li <honli@redhat.com>

commit 0de4cbb3dddca35ecd06b95918f38439c9c6401f upstream.

[  598.852037] ------------[ cut here ]------------
[  598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920()
[  598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes]
[  598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod
[  598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1
[  598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012
[  598.962193]  ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918
[  598.969663]  ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0
[  598.977132]  ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00
[  598.984602] Call Trace:
[  598.987062]  [<ffffffff81700918>] dump_stack+0x19/0x1b
[  598.992224]  [<ffffffff8108b6c0>] warn_slowpath_common+0x70/0xb0
[  598.998254]  [<ffffffff8108b75c>] warn_slowpath_fmt+0x5c/0x80
[  599.004033]  [<ffffffff813903b8>] check_unmap+0xf8/0x920
[  599.009369]  [<ffffffff81025959>] ? sched_clock+0x9/0x10
[  599.014702]  [<ffffffff81390cee>] debug_dma_free_coherent+0x7e/0xa0
[  599.021008]  [<ffffffffa01ece2c>] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3]
[  599.027654]  [<ffffffffa01e8da0>] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3]
[  599.034307]  [<ffffffffa01c4bfe>] ib_destroy_cq+0x1e/0x30 [ib_core]
[  599.040601]  [<ffffffffa04ff2d2>] ib_uverbs_close+0x302/0x4d0 [ib_uverbs]
[  599.047417]  [<ffffffff812335a2>] __fput+0x102/0x310
[  599.052401]  [<ffffffff8123388e>] ____fput+0xe/0x10
[  599.057297]  [<ffffffff810bbde4>] task_work_run+0xb4/0xe0
[  599.062719]  [<ffffffff81092a84>] do_exit+0x304/0xc60
[  599.067789]  [<ffffffff81025905>] ? native_sched_clock+0x35/0x80
[  599.073820]  [<ffffffff81025959>] ? sched_clock+0x9/0x10
[  599.079153]  [<ffffffff8170a49c>] ? _raw_spin_unlock_irq+0x2c/0x50
[  599.085358]  [<ffffffff8109346c>] do_group_exit+0x4c/0xc0
[  599.090779]  [<ffffffff810a8661>] get_signal_to_deliver+0x2e1/0x960
[  599.097071]  [<ffffffff8101c497>] do_signal+0x57/0x6e0
[  599.102229]  [<ffffffff81714bd1>] ? sysret_signal+0x5/0x4e
[  599.107738]  [<ffffffff8101cb7f>] do_notify_resume+0x5f/0xb0
[  599.113418]  [<ffffffff81714e7d>] int_signal+0x12/0x17
[  599.118576] ---[ end trace 1e4653102e7e7019 ]---
[  599.123211] Mapped at:
[  599.125577]  [<ffffffff8138ed8b>] debug_dma_alloc_coherent+0x2b/0x80
[  599.131968]  [<ffffffffa01ec862>] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3]
[  599.139920]  [<ffffffffa01e9c05>] iwch_create_cq+0x105/0x4e0 [iw_cxgb3]
[  599.147895]  [<ffffffffa0500584>] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs]
[  599.156649]  [<ffffffffa05027fb>] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs]

Fixes: b955150ea784 ('RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error')
Signed-off-by: Honggang Li <honli@redhat.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/cxgb3/cxio_hal.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rd
 	kfree(cq->sw_queue);
 	dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
 			  (1UL << (cq->size_log2))
-			  * sizeof(struct t3_cqe), cq->queue,
+			  * sizeof(struct t3_cqe) + 1, cq->queue,
 			  dma_unmap_addr(cq, mapping));
 	cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
 	return err;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 105/312] mlxsw: spectrum: Dont forward packets when STP state is DISABLED
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (103 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 104/312] RDMA/cxgb3: device driver frees DMA memory with different size Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 106/312] mlxsw: spectrum: Disable learning according to STP state Greg Kroah-Hartman
                   ` (208 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jiri Pirko, David S. Miller

From: Ido Schimmel <idosch@mellanox.com>

commit 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 upstream.

When STP state is set to DISABLED the port is assumed to be inactive, but
currently we forward packets ingressing through it.

Instead, set the port's STP state in hardware to DISCARDING, which means
it doesn't forward packets or perform any learning, but it does trap
control packets. However, these packets will be dropped by bridge code,
which results in the expected behavior.

Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -87,7 +87,6 @@ static int mlxsw_sp_port_stp_state_set(s
 	int err;
 
 	switch (state) {
-	case BR_STATE_DISABLED: /* fall-through */
 	case BR_STATE_FORWARDING:
 		spms_state = MLXSW_REG_SPMS_STATE_FORWARDING;
 		break;
@@ -95,6 +94,7 @@ static int mlxsw_sp_port_stp_state_set(s
 	case BR_STATE_LEARNING:
 		spms_state = MLXSW_REG_SPMS_STATE_LEARNING;
 		break;
+	case BR_STATE_DISABLED: /* fall-through */
 	case BR_STATE_BLOCKING:
 		spms_state = MLXSW_REG_SPMS_STATE_DISCARDING;
 		break;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 106/312] mlxsw: spectrum: Disable learning according to STP state
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (104 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 105/312] mlxsw: spectrum: Dont forward packets when STP state is DISABLED Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 107/312] mlxsw: spectrum: Dont count internal TX header bytes to stats Greg Kroah-Hartman
                   ` (207 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jiri Pirko, David S. Miller

From: Ido Schimmel <idosch@mellanox.com>

commit 454911333b1d86e1d58a557be271bc6b7e9e7f10 upstream.

When port is put into LISTENING state it shouldn't populate the FDB, so
set the port's STP state in hardware to DISCARDING instead of LEARNING.
It will therefore keep listening to BPDU packets, but discard other
non-control packets and won't perform any learning.

Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -90,10 +90,10 @@ static int mlxsw_sp_port_stp_state_set(s
 	case BR_STATE_FORWARDING:
 		spms_state = MLXSW_REG_SPMS_STATE_FORWARDING;
 		break;
-	case BR_STATE_LISTENING: /* fall-through */
 	case BR_STATE_LEARNING:
 		spms_state = MLXSW_REG_SPMS_STATE_LEARNING;
 		break;
+	case BR_STATE_LISTENING: /* fall-through */
 	case BR_STATE_DISABLED: /* fall-through */
 	case BR_STATE_BLOCKING:
 		spms_state = MLXSW_REG_SPMS_STATE_DISCARDING;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 107/312] mlxsw: spectrum: Dont count internal TX header bytes to stats
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (105 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 106/312] mlxsw: spectrum: Disable learning according to STP state Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 108/312] mlxsw: spectrum: Indicate support for autonegotiation Greg Kroah-Hartman
                   ` (206 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Nogah Frankel,
	Jiri Pirko, David S. Miller

From: Nogah Frankel <nogahf@mellanox.com>

commit 63dcdd35c1552ca0c911e98ba3389a0729a457f4 upstream.

Stop the SW TX counter from counting the TX header bytes
since they are not being sent out.

Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Reviewed-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -399,7 +399,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(st
 	}
 
 	mlxsw_sp_txhdr_construct(skb, &tx_info);
-	len = skb->len;
+	/* TX header is consumed by HW on the way so we shouldn't count its
+	 * bytes as being sent.
+	 */
+	len = skb->len - MLXSW_TXHDR_LEN;
+
 	/* Due to a race we might fail here because of a full queue. In that
 	 * unlikely case we simply drop the packet.
 	 */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 108/312] mlxsw: spectrum: Indicate support for autonegotiation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (106 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 107/312] mlxsw: spectrum: Dont count internal TX header bytes to stats Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 109/312] mlxsw: spectrum: Fix misuse of hard_header_len Greg Kroah-Hartman
                   ` (205 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ido Schimmel, Jiri Pirko, David S. Miller

From: Ido Schimmel <idosch@mellanox.com>

commit c3f1576810affced47684e04a08c1ffa845144c9 upstream.

The device supports link autonegotiation, so let the user know about it
by indicating support via ethtool ops.

Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -1104,7 +1104,8 @@ static int mlxsw_sp_port_get_settings(st
 
 	cmd->supported = mlxsw_sp_from_ptys_supported_port(eth_proto_cap) |
 			 mlxsw_sp_from_ptys_supported_link(eth_proto_cap) |
-			 SUPPORTED_Pause | SUPPORTED_Asym_Pause;
+			 SUPPORTED_Pause | SUPPORTED_Asym_Pause |
+			 SUPPORTED_Autoneg;
 	cmd->advertising = mlxsw_sp_from_ptys_advert_link(eth_proto_admin);
 	mlxsw_sp_from_ptys_speed_duplex(netif_carrier_ok(dev),
 					eth_proto_oper, cmd);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 109/312] mlxsw: spectrum: Fix misuse of hard_header_len
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (107 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 108/312] mlxsw: spectrum: Indicate support for autonegotiation Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 110/312] net: tcp_memcontrol: properly detect ancestor socket pressure Greg Kroah-Hartman
                   ` (204 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yotam Gigi, Ido Schimmel, Jiri Pirko,
	David S. Miller

From: Yotam Gigi <yotamg@mellanox.com>

commit feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e upstream.

In order to specify that the mlxsw spectrum driver needs additional
headroom for packets, there have been use of the hard_header_len field of
the netdevice struct.

This commit changes that to use needed_headroom instead, as this is the
correct way to do that.

Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -1261,7 +1261,7 @@ static int mlxsw_sp_port_create(struct m
 	/* Each packet needs to have a Tx header (metadata) on top all other
 	 * headers.
 	 */
-	dev->hard_header_len += MLXSW_TXHDR_LEN;
+	dev->needed_headroom = MLXSW_TXHDR_LEN;
 
 	err = mlxsw_sp_port_module_check(mlxsw_sp_port, &usable);
 	if (err) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 110/312] net: tcp_memcontrol: properly detect ancestor socket pressure
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (108 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 109/312] mlxsw: spectrum: Fix misuse of hard_header_len Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 111/312] tcp: do not set rtt_min to 1 Greg Kroah-Hartman
                   ` (203 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Johannes Weiner, David S. Miller,
	Vladimir Davydov, Andrew Morton, Linus Torvalds

From: Johannes Weiner <hannes@cmpxchg.org>

commit 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 upstream.

When charging socket memory, the code currently checks only the local
page counter for excess to determine whether the memcg is under socket
pressure.  But even if the local counter is fine, one of the ancestors
could have breached its limit, which should also force this child to
enter socket pressure.  This currently doesn't happen.

Fix this by using page_counter_try_charge() first.  If that fails, it
means that either the local counter or one of the ancestors are in
excess of their limit, and the child should enter socket pressure.

Fixes: 3e32cb2e0a12 ("mm: memcontrol: lockless page counters")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: David S. Miller <davem@davemloft.net>
Reviewed-by: Vladimir Davydov <vdavydov@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/sock.h |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1204,11 +1204,13 @@ static inline void memcg_memory_allocate
 					      unsigned long amt,
 					      int *parent_status)
 {
-	page_counter_charge(&prot->memory_allocated, amt);
+	struct page_counter *counter;
+
+	if (page_counter_try_charge(&prot->memory_allocated, amt, &counter))
+		return;
 
-	if (page_counter_read(&prot->memory_allocated) >
-	    prot->memory_allocated.limit)
-		*parent_status = OVER_LIMIT;
+	page_counter_charge(&prot->memory_allocated, amt);
+	*parent_status = OVER_LIMIT;
 }
 
 static inline void memcg_memory_allocated_sub(struct cg_proto *prot,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 111/312] tcp: do not set rtt_min to 1
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (109 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 110/312] net: tcp_memcontrol: properly detect ancestor socket pressure Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 112/312] RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock Greg Kroah-Hartman
                   ` (202 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Neal Cardwell,
	Yuchung Cheng, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 372022830b06d9980c7e8b41fa0a4081cff883b0 upstream.

There are some cases where rtt_us derives from deltas of jiffies,
instead of using usec timestamps.

Since we want to track minimal rtt, better to assume a delta of 0 jiffie
might be in fact be very close to 1 jiffie.

It is kind of sad jiffies_to_usecs(1) calls a function instead of simply
using a constant.

Fixes: f672258391b42 ("tcp: track min RTT using windowed min-filter")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/tcp_input.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2926,7 +2926,10 @@ static void tcp_update_rtt_min(struct so
 {
 	const u32 now = tcp_time_stamp, wlen = sysctl_tcp_min_rtt_wlen * HZ;
 	struct rtt_meas *m = tcp_sk(sk)->rtt_min;
-	struct rtt_meas rttm = { .rtt = (rtt_us ? : 1), .ts = now };
+	struct rtt_meas rttm = {
+		.rtt = likely(rtt_us) ? rtt_us : jiffies_to_usecs(1),
+		.ts = now,
+	};
 	u32 elapsed;
 
 	/* Check if the new measurement updates the 1st, 2nd, or 3rd choices */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 112/312] RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (110 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 111/312] tcp: do not set rtt_min to 1 Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 113/312] net: ipv6: tcp reset, icmp need to consider L3 domain Greg Kroah-Hartman
                   ` (201 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sowmini Varadhan, Santosh Shilimkar,
	David S. Miller

From: Sowmini Varadhan <sowmini.varadhan@oracle.com>

commit eb192840266fab3e3da644018121eed30153355d upstream.

There is a race condition between rds_send_xmit -> rds_tcp_xmit
and the code that deals with resolution of duelling syns added
by commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an
outgoing socket in rds_tcp_accept_one()").

Specifically, we may end up derefencing a null pointer in rds_send_xmit
if we have the interleaving sequence:
           rds_tcp_accept_one                  rds_send_xmit

                                             conn is RDS_CONN_UP, so
    					 invoke rds_tcp_xmit

                                             tc = conn->c_transport_data
        rds_tcp_restore_callbacks
            /* reset t_sock */
    					 null ptr deref from tc->t_sock

The race condition can be avoided without adding the overhead of
additional locking in the xmit path: have rds_tcp_accept_one wait
for rds_tcp_xmit threads to complete before resetting callbacks.
The synchronization can be done in the same manner as rds_conn_shutdown().
First set the rds_conn_state to something other than RDS_CONN_UP
(so that new threads cannot get into rds_tcp_xmit()), then wait for
RDS_IN_XMIT to be cleared in the conn->c_flags indicating that any
threads in rds_tcp_xmit are done.

Fixes: 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an
outgoing socket in rds_tcp_accept_one()")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/rds/tcp.c        |    2 +-
 net/rds/tcp_listen.c |   38 +++++++++++++++++++++++---------------
 2 files changed, 24 insertions(+), 16 deletions(-)

--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -110,7 +110,7 @@ void rds_tcp_restore_callbacks(struct so
 
 /*
  * This is the only path that sets tc->t_sock.  Send and receive trust that
- * it is set.  The RDS_CONN_CONNECTED bit protects those paths from being
+ * it is set.  The RDS_CONN_UP bit protects those paths from being
  * called while it isn't set.
  */
 void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -115,24 +115,32 @@ int rds_tcp_accept_one(struct socket *so
 	 * rds_tcp_state_change() will do that cleanup
 	 */
 	rs_tcp = (struct rds_tcp_connection *)conn->c_transport_data;
-	if (rs_tcp->t_sock &&
-	    ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
-		struct sock *nsk = new_sock->sk;
+	rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING);
+	if (rs_tcp->t_sock) {
+		/* Need to resolve a duelling SYN between peers.
+		 * We have an outstanding SYN to this peer, which may
+		 * potentially have transitioned to the RDS_CONN_UP state,
+		 * so we must quiesce any send threads before resetting
+		 * c_transport_data.
+		 */
+		wait_event(conn->c_waitq,
+			   !test_bit(RDS_IN_XMIT, &conn->c_flags));
+		if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
+			struct sock *nsk = new_sock->sk;
 
-		nsk->sk_user_data = NULL;
-		nsk->sk_prot->disconnect(nsk, 0);
-		tcp_done(nsk);
-		new_sock = NULL;
-		ret = 0;
-		goto out;
-	} else if (rs_tcp->t_sock) {
-		rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
-		conn->c_outgoing = 0;
+			nsk->sk_user_data = NULL;
+			nsk->sk_prot->disconnect(nsk, 0);
+			tcp_done(nsk);
+			new_sock = NULL;
+			ret = 0;
+			goto out;
+		} else if (rs_tcp->t_sock) {
+			rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
+			conn->c_outgoing = 0;
+		}
 	}
-
-	rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING);
 	rds_tcp_set_callbacks(new_sock, conn);
-	rds_connect_complete(conn);
+	rds_connect_complete(conn); /* marks RDS_CONN_UP */
 	new_sock = NULL;
 	ret = 0;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 113/312] net: ipv6: tcp reset, icmp need to consider L3 domain
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (111 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 112/312] RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 114/312] batman-adv: Fix lockdep annotation of batadv_tlv_container_remove Greg Kroah-Hartman
                   ` (200 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 upstream.

Responses for packets to unused ports are getting lost with L3 domains.

IPv4 has ip_send_unicast_reply for sending TCP responses which accounts
for L3 domains; update the IPv6 counterpart tcp_v6_send_response.
For icmp the L3 master check needs to be moved up in icmp6_send
to properly respond to UDP packets to a port with no listener.

Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/icmp.c     |    5 ++---
 net/ipv6/tcp_ipv6.c |    7 ++++++-
 2 files changed, 8 insertions(+), 4 deletions(-)

--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *s
 
 	if (__ipv6_addr_needs_scope_id(addr_type))
 		iif = skb->dev->ifindex;
+	else
+		iif = l3mdev_master_ifindex(skb->dev);
 
 	/*
 	 *	Must not send error if the source does not uniquely
@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *s
 	else if (!fl6.flowi6_oif)
 		fl6.flowi6_oif = np->ucast_oif;
 
-	if (!fl6.flowi6_oif)
-		fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
-
 	dst = icmpv6_route_lookup(net, skb, sk, &fl6);
 	if (IS_ERR(dst))
 		goto out;
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -815,8 +815,13 @@ static void tcp_v6_send_response(const s
 	fl6.flowi6_proto = IPPROTO_TCP;
 	if (rt6_need_strict(&fl6.daddr) && !oif)
 		fl6.flowi6_oif = tcp_v6_iif(skb);
-	else
+	else {
+		if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
+			oif = skb->skb_iif;
+
 		fl6.flowi6_oif = oif;
+	}
+
 	fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
 	fl6.fl6_dport = t1->dest;
 	fl6.fl6_sport = t1->source;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 114/312] batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (112 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 113/312] net: ipv6: tcp reset, icmp need to consider L3 domain Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 115/312] batman-adv: replace WARN with rate limited output on non-existing VLAN Greg Kroah-Hartman
                   ` (199 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Marek Lindner,
	Antonio Quartulli

From: Sven Eckelmann <sven@open-mesh.com>

commit 008a374487070a391c12aa39288fd8511f822cab upstream.

The function handles tlv containers and not tlv handlers. Thus the
lockdep_assert_held has to check for the container_list lock.

Fixes: 2c72d655b044 ("batman-adv: Annotate deleting functions with external lock via lockdep")
Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/batman-adv/main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -747,7 +747,7 @@ static u16 batadv_tvlv_container_list_si
 static void batadv_tvlv_container_remove(struct batadv_priv *bat_priv,
 					 struct batadv_tvlv_container *tvlv)
 {
-	lockdep_assert_held(&bat_priv->tvlv.handler_list_lock);
+	lockdep_assert_held(&bat_priv->tvlv.container_list_lock);
 
 	if (!tvlv)
 		return;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 115/312] batman-adv: replace WARN with rate limited output on non-existing VLAN
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (113 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 114/312] batman-adv: Fix lockdep annotation of batadv_tlv_container_remove Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 116/312] tty: serial: msm: Support more bauds Greg Kroah-Hartman
                   ` (198 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Simon Wunderlich, Marek Lindner,
	Sven Eckelmann, David S. Miller

From: Simon Wunderlich <sw@simonwunderlich.de>

commit 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 upstream.

If a VLAN tagged frame is received and the corresponding VLAN is not
configured on the soft interface, it will splat a WARN on every packet
received. This is a quite annoying behaviour for some scenarios, e.g. if
bat0 is bridged with eth0, and there are arbitrary VLAN tagged frames
from Ethernet coming in without having any VLAN configuration on bat0.

The code should probably create vlan objects on the fly and
transparently transport these VLAN-tagged Ethernet frames, but until
this is done, at least the WARN splat should be replaced by a rate
limited output.

Fixes: 354136bcc3c4 ("batman-adv: fix kernel crash due to missing NULL checks")
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/batman-adv/translation-table.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -614,8 +614,10 @@ bool batadv_tt_local_add(struct net_devi
 
 	/* increase the refcounter of the related vlan */
 	vlan = batadv_softif_vlan_get(bat_priv, vid);
-	if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
-		 addr, BATADV_PRINT_VID(vid))) {
+	if (!vlan) {
+		net_ratelimited_function(batadv_info, soft_iface,
+					 "adding TT local entry %pM to non-existent VLAN %d\n",
+					 addr, BATADV_PRINT_VID(vid));
 		kfree(tt_local);
 		tt_local = NULL;
 		goto out;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 116/312] tty: serial: msm: Support more bauds
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (114 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 115/312] batman-adv: replace WARN with rate limited output on non-existing VLAN Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 117/312] serial: samsung: Fix possible out of bounds access on non-DT platform Greg Kroah-Hartman
                   ` (197 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ivan T. Ivanov, Matthew McClintock,
	Stephen Boyd, Srinivas Kandagatla, Andy Gross, Bjorn Andersson,
	Cristian Prundeanu

From: Stephen Boyd <stephen.boyd@linaro.org>

commit 98952bf510d0c7cdfc284f098bbf4682dc47bc61 upstream.

The msm_find_best_baud() function is written with the assumption
that the port->uartclk rate is fixed to a particular rate at boot
time, but now this driver changes that clk rate at runtime when
the baud is changed.

The way the hardware works is that an input clk rate comes from
the clk controller into the uart hw block. That rate is typically
1843200 or 3686400 Hz. That rate can then be divided by an
internal divider in the hw block to achieve a particular baud on
the serial wire. msm_find_best_baud() is looking for that divider
value.

A few things are wrong with the way the code is written. First,
it assumes that the maximum baud that the uart can support if the
clk rate is fixed at boot is 460800, which would correspond to an
input clk rate of 230400 * 16 == 3686400 Hz.  Except some devices
have a boot rate of 1843200 Hz or max baud of 115200, so
achieving 230400 on those devices doesn't work at all because we
don't increase the clk rate unless max baud is 460800.

Second, we can't achieve bauds higher than 460800 that require
anything besides a divisor of 1, because we always call
msm_find_best_baud() with a fixed port->uartclk rate that will
eventually be changed after we calculate the divisor. So if we
need to get a baud of 500000, we'll just multiply that by 16 and
hope that the clk can give us 500000 * 16 == 8000000 Hz, which it
typically can't do. To really achieve 500000 baud, we need to get
an input clk rate of 24000000 Hz and then divide that by 3 inside
the uart hardware.

Finally, we return success for bauds even when we can't actually
achieve them. This means that when the user asks for 500000 baud,
we actually get 921600 right now, but the user doesn't know that.

Fix all of this by searching through the divisor and clk rate
space with a combination of clk_round_rate() and baud
calculations, keeping track of the best clk rate and divisor we
find if we can't get an exact match. Typically we can get an
exact match with a divisor of 1, but sometimes we need to keep
track and try more frequencies. On my msm8916 device, this
results in all standard bauds in baud_table being supported
except for 1800, 576000, 1152000, and 4000000.

Fixes: 850b37a71bde ("tty: serial: msm: Remove 115.2 Kbps maximum baud rate limitation")
Cc: "Ivan T. Ivanov" <iivanov.xz@gmail.com>
Cc: Matthew McClintock <mmcclint@codeaurora.org>
Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Acked-by: Andy Gross <andy.gross@linaro.org>
Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Tested-by: Cristian Prundeanu <cprundea@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/msm_serial.c |  101 ++++++++++++++++++++++++++--------------
 1 file changed, 67 insertions(+), 34 deletions(-)

--- a/drivers/tty/serial/msm_serial.c
+++ b/drivers/tty/serial/msm_serial.c
@@ -872,37 +872,72 @@ struct msm_baud_map {
 };
 
 static const struct msm_baud_map *
-msm_find_best_baud(struct uart_port *port, unsigned int baud)
+msm_find_best_baud(struct uart_port *port, unsigned int baud,
+		   unsigned long *rate)
 {
-	unsigned int i, divisor;
-	const struct msm_baud_map *entry;
+	struct msm_port *msm_port = UART_TO_MSM(port);
+	unsigned int divisor, result;
+	unsigned long target, old, best_rate = 0, diff, best_diff = ULONG_MAX;
+	const struct msm_baud_map *entry, *end, *best;
 	static const struct msm_baud_map table[] = {
-		{ 1536, 0x00,  1 },
-		{  768, 0x11,  1 },
-		{  384, 0x22,  1 },
-		{  192, 0x33,  1 },
-		{   96, 0x44,  1 },
-		{   48, 0x55,  1 },
-		{   32, 0x66,  1 },
-		{   24, 0x77,  1 },
-		{   16, 0x88,  1 },
-		{   12, 0x99,  6 },
-		{    8, 0xaa,  6 },
-		{    6, 0xbb,  6 },
-		{    4, 0xcc,  6 },
-		{    3, 0xdd,  8 },
-		{    2, 0xee, 16 },
 		{    1, 0xff, 31 },
-		{    0, 0xff, 31 },
+		{    2, 0xee, 16 },
+		{    3, 0xdd,  8 },
+		{    4, 0xcc,  6 },
+		{    6, 0xbb,  6 },
+		{    8, 0xaa,  6 },
+		{   12, 0x99,  6 },
+		{   16, 0x88,  1 },
+		{   24, 0x77,  1 },
+		{   32, 0x66,  1 },
+		{   48, 0x55,  1 },
+		{   96, 0x44,  1 },
+		{  192, 0x33,  1 },
+		{  384, 0x22,  1 },
+		{  768, 0x11,  1 },
+		{ 1536, 0x00,  1 },
 	};
 
-	divisor = uart_get_divisor(port, baud);
-
-	for (i = 0, entry = table; i < ARRAY_SIZE(table); i++, entry++)
-		if (entry->divisor <= divisor)
-			break;
+	best = table; /* Default to smallest divider */
+	target = clk_round_rate(msm_port->clk, 16 * baud);
+	divisor = DIV_ROUND_CLOSEST(target, 16 * baud);
+
+	end = table + ARRAY_SIZE(table);
+	entry = table;
+	while (entry < end) {
+		if (entry->divisor <= divisor) {
+			result = target / entry->divisor / 16;
+			diff = abs(result - baud);
+
+			/* Keep track of best entry */
+			if (diff < best_diff) {
+				best_diff = diff;
+				best = entry;
+				best_rate = target;
+			}
+
+			if (result == baud)
+				break;
+		} else if (entry->divisor > divisor) {
+			old = target;
+			target = clk_round_rate(msm_port->clk, old + 1);
+			/*
+			 * The rate didn't get any faster so we can't do
+			 * better at dividing it down
+			 */
+			if (target == old)
+				break;
+
+			/* Start the divisor search over at this new rate */
+			entry = table;
+			divisor = DIV_ROUND_CLOSEST(target, 16 * baud);
+			continue;
+		}
+		entry++;
+	}
 
-	return entry; /* Default to smallest divider */
+	*rate = best_rate;
+	return best;
 }
 
 static int msm_set_baud_rate(struct uart_port *port, unsigned int baud,
@@ -911,22 +946,20 @@ static int msm_set_baud_rate(struct uart
 	unsigned int rxstale, watermark, mask;
 	struct msm_port *msm_port = UART_TO_MSM(port);
 	const struct msm_baud_map *entry;
-	unsigned long flags;
-
-	entry = msm_find_best_baud(port, baud);
-
-	msm_write(port, entry->code, UART_CSR);
-
-	if (baud > 460800)
-		port->uartclk = baud * 16;
+	unsigned long flags, rate;
 
 	flags = *saved_flags;
 	spin_unlock_irqrestore(&port->lock, flags);
 
-	clk_set_rate(msm_port->clk, port->uartclk);
+	entry = msm_find_best_baud(port, baud, &rate);
+	clk_set_rate(msm_port->clk, rate);
+	baud = rate / 16 / entry->divisor;
 
 	spin_lock_irqsave(&port->lock, flags);
 	*saved_flags = flags;
+	port->uartclk = rate;
+
+	msm_write(port, entry->code, UART_CSR);
 
 	/* RX stale watermark */
 	rxstale = entry->rxstale;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 117/312] serial: samsung: Fix possible out of bounds access on non-DT platform
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (115 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 116/312] tty: serial: msm: Support more bauds Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 118/312] Drivers: hv: utils: use memdup_user in hvt_op_write Greg Kroah-Hartman
                   ` (196 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bartlomiej Zolnierkiewicz,
	Krzysztof Kozlowski

From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

commit 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 upstream.

On non-DeviceTree platforms, the index of serial device is a static
variable incremented on each probe.  It is incremented even if deferred
probe happens when getting the clock in s3c24xx_serial_init_port().

This index is used for referencing elements of statically allocated
s3c24xx_serial_ports array.  In case of re-probe, the index will point
outside of this array leading to memory corruption.

Increment the index only on successful probe.

Reported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Fixes: b497549a035c ("[ARM] S3C24XX: Split serial driver into core and per-cpu drivers")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/samsung.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1841,8 +1841,6 @@ static int s3c24xx_serial_probe(struct p
 	ourport->min_dma_size = max_t(int, ourport->port.fifosize,
 				    dma_get_cache_alignment());
 
-	probe_index++;
-
 	dbg("%s: initialising port %p...\n", __func__, ourport);
 
 	ret = s3c24xx_serial_init_port(ourport, pdev);
@@ -1872,6 +1870,8 @@ static int s3c24xx_serial_probe(struct p
 	if (ret < 0)
 		dev_err(&pdev->dev, "failed to add cpufreq notifier\n");
 
+	probe_index++;
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 118/312] Drivers: hv: utils: use memdup_user in hvt_op_write
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (116 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 117/312] serial: samsung: Fix possible out of bounds access on non-DT platform Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 119/312] isa: Call isa_bus_init before dependent ISA bus drivers register Greg Kroah-Hartman
                   ` (195 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Olaf Hering, K. Y. Srinivasan

From: Olaf Hering <olaf@aepfle.de>

commit b00359642c2427da89dc8f77daa2c9e8a84e6d76 upstream.

Use memdup_user to handle OOM.

Fixes: 14b50f80c32d ('Drivers: hv: util: introduce hv_utils_transport abstraction')

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/hv/hv_utils_transport.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/hv/hv_utils_transport.c
+++ b/drivers/hv/hv_utils_transport.c
@@ -80,11 +80,10 @@ static ssize_t hvt_op_write(struct file
 
 	hvt = container_of(file->f_op, struct hvutil_transport, fops);
 
-	inmsg = kzalloc(count, GFP_KERNEL);
-	if (copy_from_user(inmsg, buf, count)) {
-		kfree(inmsg);
-		return -EFAULT;
-	}
+	inmsg = memdup_user(buf, count);
+	if (IS_ERR(inmsg))
+		return PTR_ERR(inmsg);
+
 	if (hvt->on_msg(inmsg, count))
 		return -EFAULT;
 	kfree(inmsg);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 119/312] isa: Call isa_bus_init before dependent ISA bus drivers register
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (117 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 118/312] Drivers: hv: utils: use memdup_user in hvt_op_write Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 120/312] Btrfs: clean up an error code in btrfs_init_space_info() Greg Kroah-Hartman
                   ` (194 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Rene Herman, William Breathitt Gray

From: William Breathitt Gray <vilhelm.gray@gmail.com>

commit 32a5a0c047343b11f581f663a2309cf43d13466f upstream.

The isa_bus_init function must be called before drivers which utilize
the ISA bus driver are registered. A race condition for initilization
exists if device_initcall is used (the isa_bus_init callback is placed
in the same initcall level as dependent drivers which use module_init).
This patch ensures that isa_bus_init is called first by utilizing
postcore_initcall in favor of device_initcall.

Fixes: a5117ba7da37 ("[PATCH] Driver model: add ISA bus")
Cc: Rene Herman <rene.herman@keyaccess.nl>
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/base/isa.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/base/isa.c
+++ b/drivers/base/isa.c
@@ -180,4 +180,4 @@ static int __init isa_bus_init(void)
 	return error;
 }
 
-device_initcall(isa_bus_init);
+postcore_initcall(isa_bus_init);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 120/312] Btrfs: clean up an error code in btrfs_init_space_info()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (118 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 119/312] isa: Call isa_bus_init before dependent ISA bus drivers register Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 121/312] Input: gpio-keys - fix check for disabling unsupported keys Greg Kroah-Hartman
                   ` (193 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David Sterba

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 0dc924c5f2a3c4d999e12feaccee5f970cea1315 upstream.

If we return 1 here, then the caller treats it as an error and returns
-EINVAL.  It causes a static checker warning to treat positive returns
as an error.

Fixes: 1aba86d67f34 ('Btrfs: fix easily get into ENOSPC in mixed case')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/btrfs/extent-tree.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -10688,7 +10688,7 @@ int btrfs_init_space_info(struct btrfs_f
 
 	disk_super = fs_info->super_copy;
 	if (!btrfs_super_root(disk_super))
-		return 1;
+		return -EINVAL;
 
 	features = btrfs_super_incompat_flags(disk_super);
 	if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 121/312] Input: gpio-keys - fix check for disabling unsupported keys
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (119 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 120/312] Btrfs: clean up an error code in btrfs_init_space_info() Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 122/312] Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree Greg Kroah-Hartman
                   ` (192 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ivaylo Dimitrov, Dmitry Torokhov

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 8679ee4204cfd5cf78b996508ccadc1ec6130f1a upstream.

Commit 4ea14a53d8f881034fa9e186653821c4e3d9a8fb ("Input: gpio-keys - report
error when disabling unsupported key") tried let user know that they
attempted to disable an unsupported key, unfortunately the check is wrong
as it believes that all codes are invalid. Fix it by ensuring that keys
that we try to disable are subset of keys (or switches) that device
reports.

Fixes: 4ea14a53d8f8 ("Input: gpio-keys - report error when disabling unsupported key")
Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/keyboard/gpio_keys.c |   29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -96,7 +96,7 @@ struct gpio_keys_drvdata {
  * Return value of this function can be used to allocate bitmap
  * large enough to hold all bits for given type.
  */
-static inline int get_n_events_by_type(int type)
+static int get_n_events_by_type(int type)
 {
 	BUG_ON(type != EV_SW && type != EV_KEY);
 
@@ -104,6 +104,22 @@ static inline int get_n_events_by_type(i
 }
 
 /**
+ * get_bm_events_by_type() - returns bitmap of supported events per @type
+ * @input: input device from which bitmap is retrieved
+ * @type: type of button (%EV_KEY, %EV_SW)
+ *
+ * Return value of this function can be used to allocate bitmap
+ * large enough to hold all bits for given type.
+ */
+static const unsigned long *get_bm_events_by_type(struct input_dev *dev,
+						  int type)
+{
+	BUG_ON(type != EV_SW && type != EV_KEY);
+
+	return (type == EV_KEY) ? dev->keybit : dev->swbit;
+}
+
+/**
  * gpio_keys_disable_button() - disables given GPIO button
  * @bdata: button data for button to be disabled
  *
@@ -213,6 +229,7 @@ static ssize_t gpio_keys_attr_store_help
 					   const char *buf, unsigned int type)
 {
 	int n_events = get_n_events_by_type(type);
+	const unsigned long *bitmap = get_bm_events_by_type(ddata->input, type);
 	unsigned long *bits;
 	ssize_t error;
 	int i;
@@ -226,6 +243,11 @@ static ssize_t gpio_keys_attr_store_help
 		goto out;
 
 	/* First validate */
+	if (!bitmap_subset(bits, bitmap, n_events)) {
+		error = -EINVAL;
+		goto out;
+	}
+
 	for (i = 0; i < ddata->pdata->nbuttons; i++) {
 		struct gpio_button_data *bdata = &ddata->data[i];
 
@@ -239,11 +261,6 @@ static ssize_t gpio_keys_attr_store_help
 		}
 	}
 
-	if (i == ddata->pdata->nbuttons) {
-		error = -EINVAL;
-		goto out;
-	}
-
 	mutex_lock(&ddata->disable_lock);
 
 	for (i = 0; i < ddata->pdata->nbuttons; i++) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 122/312] Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (120 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 121/312] Input: gpio-keys - fix check for disabling unsupported keys Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 123/312] net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key Greg Kroah-Hartman
                   ` (191 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Philipp Zabel, Dmitry Torokhov

From: Philipp Zabel <p.zabel@pengutronix.de>

commit dc262dfaaeda7617ae0b15b5ce1252a6cd102b19 upstream.

A recent patch broke parsing the gain, offset, and threshold parameters
from device tree. Instead of setting the cached values and writing them
to the correct registers during probe, it would write the values from DT
into the register address variables and never write them to the chip
during normal operation.

Fixes: 2e23b7a96372 ("Input: edt-ft5x06 - use generic properties API")
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/touchscreen/edt-ft5x06.c |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -822,16 +822,22 @@ static void edt_ft5x06_ts_get_defaults(s
 	int error;
 
 	error = device_property_read_u32(dev, "threshold", &val);
-	if (!error)
-		reg_addr->reg_threshold = val;
+	if (!error) {
+		edt_ft5x06_register_write(tsdata, reg_addr->reg_threshold, val);
+		tsdata->threshold = val;
+	}
 
 	error = device_property_read_u32(dev, "gain", &val);
-	if (!error)
-		reg_addr->reg_gain = val;
+	if (!error) {
+		edt_ft5x06_register_write(tsdata, reg_addr->reg_gain, val);
+		tsdata->gain = val;
+	}
 
 	error = device_property_read_u32(dev, "offset", &val);
-	if (!error)
-		reg_addr->reg_offset = val;
+	if (!error) {
+		edt_ft5x06_register_write(tsdata, reg_addr->reg_offset, val);
+		tsdata->offset = val;
+	}
 }
 
 static void



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 123/312] net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (121 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 122/312] Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 124/312] xfrm_user: propagate sec ctx allocation errors Greg Kroah-Hartman
                   ` (190 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Kodanev, Steffen Klassert

From: Alexey Kodanev <alexey.kodanev@oracle.com>

commit 1625f4529957738be7d87cf157e107b8fb9d23b9 upstream.

Running LTP 'icmp-uni-basic.sh -6 -p ipcomp -m tunnel' test over
openvswitch + veth can trigger kernel panic:

  BUG: unable to handle kernel NULL pointer dereference
  at 00000000000000e0 IP: [<ffffffff8169d1d2>] xfrm_input+0x82/0x750
  ...
  [<ffffffff816d472e>] xfrm6_rcv_spi+0x1e/0x20
  [<ffffffffa082c3c2>] xfrm6_tunnel_rcv+0x42/0x50 [xfrm6_tunnel]
  [<ffffffffa082727e>] tunnel6_rcv+0x3e/0x8c [tunnel6]
  [<ffffffff8169f365>] ip6_input_finish+0xd5/0x430
  [<ffffffff8169fc53>] ip6_input+0x33/0x90
  [<ffffffff8169f1d5>] ip6_rcv_finish+0xa5/0xb0
  ...

It seems that tunnel.ip6 can have garbage values and also dereferenced
without a proper check, only tunnel.ip4 is being verified. Fix it by
adding one more if block for AF_INET6 and initialize tunnel.ip6 with NULL
inside xfrm6_rcv_spi() (which is similar to xfrm4_rcv_spi()).

Fixes: 049f8e2 ("xfrm: Override skb->mark with tunnel->parm.i_key in xfrm_input")

Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/xfrm6_input.c |    1 +
 net/xfrm/xfrm_input.c  |   14 +++++++-------
 2 files changed, 8 insertions(+), 7 deletions(-)

--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -23,6 +23,7 @@ int xfrm6_extract_input(struct xfrm_stat
 
 int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
 {
+	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
 	XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
 	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
 	return xfrm_input(skb, nexthdr, spi, 0);
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -207,15 +207,15 @@ int xfrm_input(struct sk_buff *skb, int
 	family = XFRM_SPI_SKB_CB(skb)->family;
 
 	/* if tunnel is present override skb->mark value with tunnel i_key */
-	if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4) {
-		switch (family) {
-		case AF_INET:
+	switch (family) {
+	case AF_INET:
+		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4)
 			mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4->parms.i_key);
-			break;
-		case AF_INET6:
+		break;
+	case AF_INET6:
+		if (XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6)
 			mark = be32_to_cpu(XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6->parms.i_key);
-			break;
-		}
+		break;
 	}
 
 	/* Allocate new secpath or COW existing one. */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 124/312] xfrm_user: propagate sec ctx allocation errors
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (122 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 123/312] net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 125/312] xfrm: Fix memory leak of aead algorithm name Greg Kroah-Hartman
                   ` (189 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mathias Krause, Thomas Graf,
	Steffen Klassert

From: Mathias Krause <minipli@googlemail.com>

commit 2f30ea5090cbc57ea573cdc66421264b3de3fb0a upstream.

When we fail to attach the security context in xfrm_state_construct()
we'll return 0 as error value which, in turn, will wrongly claim success
to userland when, in fact, we won't be adding / updating the XFRM state.

This is a regression introduced by commit fd21150a0fe1 ("[XFRM] netlink:
Inline attach_encap_tmpl(), attach_sec_ctx(), and attach_one_addr()").

Fix it by propagating the error returned by security_xfrm_state_alloc()
in this case.

Fixes: fd21150a0fe1 ("[XFRM] netlink: Inline attach_encap_tmpl()...")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/xfrm/xfrm_user.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -609,9 +609,12 @@ static struct xfrm_state *xfrm_state_con
 	if (err)
 		goto error;
 
-	if (attrs[XFRMA_SEC_CTX] &&
-	    security_xfrm_state_alloc(x, nla_data(attrs[XFRMA_SEC_CTX])))
-		goto error;
+	if (attrs[XFRMA_SEC_CTX]) {
+		err = security_xfrm_state_alloc(x,
+						nla_data(attrs[XFRMA_SEC_CTX]));
+		if (err)
+			goto error;
+	}
 
 	if ((err = xfrm_alloc_replay_state_esn(&x->replay_esn, &x->preplay_esn,
 					       attrs[XFRMA_REPLAY_ESN_VAL])))



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 125/312] xfrm: Fix memory leak of aead algorithm name
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (123 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 124/312] xfrm_user: propagate sec ctx allocation errors Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 126/312] mac80211: fix mgmt-tx abort cookie and leak Greg Kroah-Hartman
                   ` (188 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilan Tayari, Rami Rosen, Steffen Klassert

From: Ilan Tayari <ilant@mellanox.com>

commit b588479358ce26f32138e0f0a7ab0678f8e3e601 upstream.

commit 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms")
introduced aead. The function attach_aead kmemdup()s the algorithm
name during xfrm_state_construct().
However this memory is never freed.
Implementation has since been slightly modified in
commit ee5c23176fcc ("xfrm: Clone states properly on migration")
without resolving this leak.
This patch adds a kfree() call for the aead algorithm name.

Fixes: 1a6509d99122 ("[IPSEC]: Add support for combined mode algorithms")
Signed-off-by: Ilan Tayari <ilant@mellanox.com>
Acked-by: Rami Rosen <roszenrami@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/xfrm/xfrm_state.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -332,6 +332,7 @@ static void xfrm_state_gc_destroy(struct
 {
 	tasklet_hrtimer_cancel(&x->mtimer);
 	del_timer_sync(&x->rtimer);
+	kfree(x->aead);
 	kfree(x->aalg);
 	kfree(x->ealg);
 	kfree(x->calg);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 126/312] mac80211: fix mgmt-tx abort cookie and leak
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (124 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 125/312] xfrm: Fix memory leak of aead algorithm name Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 127/312] mac80211: TDLS: always downgrade invalid chandefs Greg Kroah-Hartman
                   ` (187 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg

From: Johannes Berg <johannes.berg@intel.com>

commit e673a65952b4ab045a3e3eb200fdf408004fb4fd upstream.

If a mgmt-tx operation is aborted before it runs, the wrong
cookie is reported back to userspace, and the ack_skb gets
leaked since the frame is freed directly instead of freeing
it using ieee80211_free_txskb(). Fix that.

Fixes: 3b79af973cf4 ("mac80211: stop using pointers as userspace cookies")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/offchannel.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -308,11 +308,10 @@ void ieee80211_roc_notify_destroy(struct
 
 	/* was never transmitted */
 	if (roc->frame) {
-		cfg80211_mgmt_tx_status(&roc->sdata->wdev,
-					(unsigned long)roc->frame,
+		cfg80211_mgmt_tx_status(&roc->sdata->wdev, roc->mgmt_tx_cookie,
 					roc->frame->data, roc->frame->len,
 					false, GFP_KERNEL);
-		kfree_skb(roc->frame);
+		ieee80211_free_txskb(&roc->sdata->local->hw, roc->frame);
 	}
 
 	if (!roc->mgmt_tx_cookie)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 127/312] mac80211: TDLS: always downgrade invalid chandefs
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (125 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 126/312] mac80211: fix mgmt-tx abort cookie and leak Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:31 ` [PATCH 4.4 128/312] mac80211: TDLS: change BW calculation for WIDER_BW peers Greg Kroah-Hartman
                   ` (186 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arik Nemtsov, Emmanuel Grumbach,
	Johannes Berg

From: Arik Nemtsov <arik@wizery.com>

commit db8d99774c2682559b7648857697b9b588c6795a upstream.

Even if the current chandef width is equal to the station's max-BW, it
doesn't mean it's a valid width for TDLS. Make sure to always check
regulatory constraints in these cases.

Fixes: 0fabfaafec3a ("mac80211: upgrade BW of TDLS peers when possible")
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/tdls.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -332,7 +332,7 @@ ieee80211_tdls_chandef_vht_upgrade(struc
 		return;
 
 	/* proceed to downgrade the chandef until usable or the same */
-	while (uc.width > max_width &&
+	while (uc.width > max_width ||
 	       !cfg80211_reg_can_beacon_relax(sdata->local->hw.wiphy, &uc,
 					      sdata->wdev.iftype))
 		ieee80211_chandef_downgrade(&uc);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 128/312] mac80211: TDLS: change BW calculation for WIDER_BW peers
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (126 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 127/312] mac80211: TDLS: always downgrade invalid chandefs Greg Kroah-Hartman
@ 2020-05-08 12:31 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 129/312] mac80211: Fix BW upgrade for TDLS peers Greg Kroah-Hartman
                   ` (185 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arik Nemtsov, Emmanuel Grumbach,
	Johannes Berg

From: Arik Nemtsov <arik@wizery.com>

commit 59021c675995281d453eee45b3e2e1e3edbc0ec2 upstream.

The previous approach simply ignored chandef restrictions when calculating
the appropriate peer BW for a WIDER_BW peer. This could result in a
regulatory violation if both peers indicated 80MHz support, but the
regdomain forbade it.

Change the approach to setting a WIDER_BW peer's BW. Don't exempt it from
the chandef width at first. If during TDLS negotiation the chandef width
is upgraded, update the peer's BW to match.

Fixes: 0fabfaafec3a ("mac80211: upgrade BW of TDLS peers when possible")
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/ieee80211_i.h |    4 ++++
 net/mac80211/tdls.c        |   38 ++++++++++++++++++++++++++++++++------
 net/mac80211/vht.c         |   30 +++++++++++++++++++++++++-----
 3 files changed, 61 insertions(+), 11 deletions(-)

--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1706,6 +1706,10 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(stru
 enum ieee80211_sta_rx_bandwidth ieee80211_sta_cap_rx_bw(struct sta_info *sta);
 enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta);
 void ieee80211_sta_set_rx_nss(struct sta_info *sta);
+enum ieee80211_sta_rx_bandwidth
+ieee80211_chan_width_to_rx_bw(enum nl80211_chan_width width);
+enum nl80211_chan_width ieee80211_sta_cap_chan_bw(struct sta_info *sta);
+void ieee80211_sta_set_rx_nss(struct sta_info *sta);
 u32 __ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                   struct sta_info *sta, u8 opmode,
 				  enum ieee80211_band band);
--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -4,7 +4,7 @@
  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
  * Copyright 2014, Intel Corporation
  * Copyright 2014  Intel Mobile Communications GmbH
- * Copyright 2015  Intel Deutschland GmbH
+ * Copyright 2015 - 2016 Intel Deutschland GmbH
  *
  * This file is GPLv2 as found in COPYING.
  */
@@ -15,6 +15,7 @@
 #include <linux/rtnetlink.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
+#include "rate.h"
 
 /* give usermode some time for retries in setting up the TDLS session */
 #define TDLS_PEER_SETUP_TIMEOUT	(15 * HZ)
@@ -302,7 +303,7 @@ ieee80211_tdls_chandef_vht_upgrade(struc
 	/* IEEE802.11ac-2013 Table E-4 */
 	u16 centers_80mhz[] = { 5210, 5290, 5530, 5610, 5690, 5775 };
 	struct cfg80211_chan_def uc = sta->tdls_chandef;
-	enum nl80211_chan_width max_width = ieee80211_get_sta_bw(&sta->sta);
+	enum nl80211_chan_width max_width = ieee80211_sta_cap_chan_bw(sta);
 	int i;
 
 	/* only support upgrading non-narrow channels up to 80Mhz */
@@ -1242,18 +1243,44 @@ int ieee80211_tdls_mgmt(struct wiphy *wi
 	return ret;
 }
 
-static void iee80211_tdls_recalc_chanctx(struct ieee80211_sub_if_data *sdata)
+static void iee80211_tdls_recalc_chanctx(struct ieee80211_sub_if_data *sdata,
+					 struct sta_info *sta)
 {
 	struct ieee80211_local *local = sdata->local;
 	struct ieee80211_chanctx_conf *conf;
 	struct ieee80211_chanctx *ctx;
+	enum nl80211_chan_width width;
+	struct ieee80211_supported_band *sband;
 
 	mutex_lock(&local->chanctx_mtx);
 	conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
 					 lockdep_is_held(&local->chanctx_mtx));
 	if (conf) {
+		width = conf->def.width;
+		sband = local->hw.wiphy->bands[conf->def.chan->band];
 		ctx = container_of(conf, struct ieee80211_chanctx, conf);
 		ieee80211_recalc_chanctx_chantype(local, ctx);
+
+		/* if width changed and a peer is given, update its BW */
+		if (width != conf->def.width && sta &&
+		    test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW)) {
+			enum ieee80211_sta_rx_bandwidth bw;
+
+			bw = ieee80211_chan_width_to_rx_bw(conf->def.width);
+			bw = min(bw, ieee80211_sta_cap_rx_bw(sta));
+			if (bw != sta->sta.bandwidth) {
+				sta->sta.bandwidth = bw;
+				rate_control_rate_update(local, sband, sta,
+							 IEEE80211_RC_BW_CHANGED);
+				/*
+				 * if a TDLS peer BW was updated, we need to
+				 * recalc the chandef width again, to get the
+				 * correct chanctx min_def
+				 */
+				ieee80211_recalc_chanctx_chantype(local, ctx);
+			}
+		}
+
 	}
 	mutex_unlock(&local->chanctx_mtx);
 }
@@ -1350,8 +1377,6 @@ int ieee80211_tdls_oper(struct wiphy *wi
 			break;
 		}
 
-		iee80211_tdls_recalc_chanctx(sdata);
-
 		mutex_lock(&local->sta_mtx);
 		sta = sta_info_get(sdata, peer);
 		if (!sta) {
@@ -1360,6 +1385,7 @@ int ieee80211_tdls_oper(struct wiphy *wi
 			break;
 		}
 
+		iee80211_tdls_recalc_chanctx(sdata, sta);
 		iee80211_tdls_recalc_ht_protection(sdata, sta);
 
 		set_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH);
@@ -1390,7 +1416,7 @@ int ieee80211_tdls_oper(struct wiphy *wi
 		iee80211_tdls_recalc_ht_protection(sdata, NULL);
 		mutex_unlock(&local->sta_mtx);
 
-		iee80211_tdls_recalc_chanctx(sdata);
+		iee80211_tdls_recalc_chanctx(sdata, NULL);
 		break;
 	default:
 		ret = -ENOTSUPP;
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -299,7 +299,30 @@ enum ieee80211_sta_rx_bandwidth ieee8021
 	return IEEE80211_STA_RX_BW_80;
 }
 
-static enum ieee80211_sta_rx_bandwidth
+enum nl80211_chan_width ieee80211_sta_cap_chan_bw(struct sta_info *sta)
+{
+	struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap;
+	u32 cap_width;
+
+	if (!vht_cap->vht_supported) {
+		if (!sta->sta.ht_cap.ht_supported)
+			return NL80211_CHAN_WIDTH_20_NOHT;
+
+		return sta->sta.ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40 ?
+				NL80211_CHAN_WIDTH_40 : NL80211_CHAN_WIDTH_20;
+	}
+
+	cap_width = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+
+	if (cap_width == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ)
+		return NL80211_CHAN_WIDTH_160;
+	else if (cap_width == IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
+		return NL80211_CHAN_WIDTH_80P80;
+
+	return NL80211_CHAN_WIDTH_80;
+}
+
+enum ieee80211_sta_rx_bandwidth
 ieee80211_chan_width_to_rx_bw(enum nl80211_chan_width width)
 {
 	switch (width) {
@@ -327,10 +350,7 @@ enum ieee80211_sta_rx_bandwidth ieee8021
 
 	bw = ieee80211_sta_cap_rx_bw(sta);
 	bw = min(bw, sta->cur_max_bandwidth);
-
-	/* do not cap the BW of TDLS WIDER_BW peers by the bss */
-	if (!test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW))
-		bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
+	bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width));
 
 	return bw;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 129/312] mac80211: Fix BW upgrade for TDLS peers
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (127 preceding siblings ...)
  2020-05-08 12:31 ` [PATCH 4.4 128/312] mac80211: TDLS: change BW calculation for WIDER_BW peers Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 130/312] NFS: Fix an LOCK/OPEN race when unlinking an open file Greg Kroah-Hartman
                   ` (184 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ilan Peer, Emmanuel Grumbach, Johannes Berg

From: Ilan Peer <ilan.peer@intel.com>

commit 4b559ec0bfc3a9f41a127cea6964f38b2b4bb323 upstream.

It is possible that the station is connected to an AP
with bandwidth of 80+80MHz or 160MHz. In such cases
there is no need to perform an upgrade as the maximal
supported bandwidth is 80MHz.

In addition, when upgrading and setting center_freq1
and bandwidth to 80MHz also set center_freq2 to 0.

Fixes: 0fabfaafec3a ("mac80211: upgrade BW of TDLS peers when possible"
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/mac80211/tdls.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/net/mac80211/tdls.c
+++ b/net/mac80211/tdls.c
@@ -314,7 +314,7 @@ ieee80211_tdls_chandef_vht_upgrade(struc
 	if (max_width > NL80211_CHAN_WIDTH_80)
 		max_width = NL80211_CHAN_WIDTH_80;
 
-	if (uc.width == max_width)
+	if (uc.width >= max_width)
 		return;
 	/*
 	 * Channel usage constrains in the IEEE802.11ac-2013 specification only
@@ -325,6 +325,7 @@ ieee80211_tdls_chandef_vht_upgrade(struc
 	for (i = 0; i < ARRAY_SIZE(centers_80mhz); i++)
 		if (abs(uc.chan->center_freq - centers_80mhz[i]) <= 30) {
 			uc.center_freq1 = centers_80mhz[i];
+			uc.center_freq2 = 0;
 			uc.width = NL80211_CHAN_WIDTH_80;
 			break;
 		}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 130/312] NFS: Fix an LOCK/OPEN race when unlinking an open file
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (128 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 129/312] mac80211: Fix BW upgrade for TDLS peers Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 131/312] net: get rid of an signed integer overflow in ip_idents_reserve() Greg Kroah-Hartman
                   ` (183 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit 11476e9dec39d90fe1e9bf12abc6f3efe35a073d upstream.

At Connectathon 2016, we found that recent upstream Linux clients
would occasionally send a LOCK operation with a zero stateid. This
appeared to happen in close proximity to another thread returning
a delegation before unlinking the same file while it remained open.

Earlier, the client received a write delegation on this file and
returned the open stateid. Now, as it is getting ready to unlink the
file, it returns the write delegation. But there is still an open
file descriptor on that file, so the client must OPEN the file
again before it returns the delegation.

Since commit 24311f884189 ('NFSv4: Recovery of recalled read
delegations is broken'), nfs_open_delegation_recall() clears the
NFS_DELEGATED_STATE flag _before_ it sends the OPEN. This allows a
racing LOCK on the same inode to be put on the wire before the OPEN
operation has returned a valid open stateid.

To eliminate this race, serialize delegation return with the
acquisition of a file lock on the same file. Adopt the same approach
as is used in the unlock path.

This patch also eliminates a similar race seen when sending a LOCK
operation at the same time as returning a delegation on the same file.

Fixes: 24311f884189 ('NFSv4: Recovery of recalled read ... ')
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
[Anna: Add sentence about LOCK / delegation race]
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs4proc.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6054,6 +6054,7 @@ static int nfs41_lock_expired(struct nfs
 static int _nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
 {
 	struct nfs_inode *nfsi = NFS_I(state->inode);
+	struct nfs4_state_owner *sp = state->owner;
 	unsigned char fl_flags = request->fl_flags;
 	int status = -ENOLCK;
 
@@ -6068,6 +6069,7 @@ static int _nfs4_proc_setlk(struct nfs4_
 	status = do_vfs_lock(state->inode, request);
 	if (status < 0)
 		goto out;
+	mutex_lock(&sp->so_delegreturn_mutex);
 	down_read(&nfsi->rwsem);
 	if (test_bit(NFS_DELEGATED_STATE, &state->flags)) {
 		/* Yes: cache locks! */
@@ -6075,9 +6077,11 @@ static int _nfs4_proc_setlk(struct nfs4_
 		request->fl_flags = fl_flags & ~FL_SLEEP;
 		status = do_vfs_lock(state->inode, request);
 		up_read(&nfsi->rwsem);
+		mutex_unlock(&sp->so_delegreturn_mutex);
 		goto out;
 	}
 	up_read(&nfsi->rwsem);
+	mutex_unlock(&sp->so_delegreturn_mutex);
 	status = _nfs4_do_setlk(state, cmd, request, NFS_LOCK_NEW);
 out:
 	request->fl_flags = fl_flags;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 131/312] net: get rid of an signed integer overflow in ip_idents_reserve()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (129 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 130/312] NFS: Fix an LOCK/OPEN race when unlinking an open file Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 132/312] mtd: nand: denali: add missing nand_release() call in denali_remove() Greg Kroah-Hartman
                   ` (182 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Jiri Pirko, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit adb03115f4590baa280ddc440a8eff08a6be0cb7 upstream.

Jiri Pirko reported an UBSAN warning happening in ip_idents_reserve()

[] UBSAN: Undefined behaviour in ./arch/x86/include/asm/atomic.h:156:11
[] signed integer overflow:
[] -2117905507 + -695755206 cannot be represented in type 'int'

Since we do not have uatomic_add_return() yet, use atomic_cmpxchg()
so that the arithmetics can be done using unsigned int.

Fixes: 04ca6973f7c1 ("ip: make IP identifiers less predictable")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/route.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -477,12 +477,18 @@ u32 ip_idents_reserve(u32 hash, int segs
 	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
 	u32 old = ACCESS_ONCE(*p_tstamp);
 	u32 now = (u32)jiffies;
-	u32 delta = 0;
+	u32 new, delta = 0;
 
 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
 		delta = prandom_u32_max(now - old);
 
-	return atomic_add_return(segs + delta, p_id) - segs;
+	/* Do not use atomic_add_return() as it makes UBSAN unhappy */
+	do {
+		old = (u32)atomic_read(p_id);
+		new = old + delta + segs;
+	} while (atomic_cmpxchg(p_id, old, new) != old);
+
+	return new - segs;
 }
 EXPORT_SYMBOL(ip_idents_reserve);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 132/312] mtd: nand: denali: add missing nand_release() call in denali_remove()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (130 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 131/312] net: get rid of an signed integer overflow in ip_idents_reserve() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 133/312] mtd: nand: pxa3xx_nand: fix dmaengine initialization Greg Kroah-Hartman
                   ` (181 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Dinh Nguyen, Brian Norris

From: Boris Brezillon <boris.brezillon@free-electrons.com>

commit 320092a05dab2f44819c42f33d6b51efb6c474f2 upstream.

Unregister the NAND device from the NAND subsystem when removing a denali
NAND controller, otherwise the MTD attached to the NAND device is still
exposed by the MTD layer, and accesses to this device will likely crash
the system.

Fixes: 2a0a288ec258 ("mtd: denali: split the generic driver and PCI layer")
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Dinh Nguyen <dinguyen@opensource.altera.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/denali.c |   11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

--- a/drivers/mtd/nand/denali.c
+++ b/drivers/mtd/nand/denali.c
@@ -1622,9 +1622,16 @@ EXPORT_SYMBOL(denali_init);
 /* driver exit point */
 void denali_remove(struct denali_nand_info *denali)
 {
+	/*
+	 * Pre-compute DMA buffer size to avoid any problems in case
+	 * nand_release() ever changes in a way that mtd->writesize and
+	 * mtd->oobsize are not reliable after this call.
+	 */
+	int bufsize = denali->mtd.writesize + denali->mtd.oobsize;
+
+	nand_release(&denali->mtd);
 	denali_irq_cleanup(denali->irq, denali);
-	dma_unmap_single(denali->dev, denali->buf.dma_buf,
-			 denali->mtd.writesize + denali->mtd.oobsize,
+	dma_unmap_single(denali->dev, denali->buf.dma_buf, bufsize,
 			 DMA_BIDIRECTIONAL);
 }
 EXPORT_SYMBOL(denali_remove);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 133/312] mtd: nand: pxa3xx_nand: fix dmaengine initialization
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (131 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 132/312] mtd: nand: denali: add missing nand_release() call in denali_remove() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 134/312] ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() Greg Kroah-Hartman
                   ` (180 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Robert Jarzmik, Ezequiel Garcia,
	Brian Norris

From: Robert Jarzmik <robert.jarzmik@free.fr>

commit 9097103f06332d099c5ab06d1e7f22f4bcaca6e2 upstream.

When the driver is initialized in a pure device-tree platform, the
driver's probe fails allocating the dma channel :
[  525.624435] pxa3xx-nand 43100000.nand: no resource defined for data DMA
[  525.632088] pxa3xx-nand 43100000.nand: alloc nand resource failed

The reason is that the DMA IO resource is not acquired through platform
resources but by OF bindings.

Fix this by ensuring that DMA IO resources are only queried in the non
device-tree case.

Fixes: 8f5ba31aa565 ("mtd: nand: pxa3xx-nand: switch to dmaengine")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/pxa3xx_nand.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -1750,7 +1750,7 @@ static int alloc_nand_resource(struct pl
 	if (ret < 0)
 		return ret;
 
-	if (use_dma) {
+	if (!np && use_dma) {
 		r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
 		if (r == NULL) {
 			dev_err(&pdev->dev,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 134/312] ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (132 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 133/312] mtd: nand: pxa3xx_nand: fix dmaengine initialization Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 135/312] ASoC: tegra_alc5632: check return value Greg Kroah-Hartman
                   ` (179 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Dinesh Mirche,
	Vinod Koul, Mark Brown

From: Dan Carpenter <dan.carpenter@oracle.com>

commit d16a2b9f2465b5486f830178fbfb7d203e0a17ae upstream.

"data" is always NULL in this function.  I think we should be passing
"&data" to sst_prepare_and_post_msg() instead of "data".

Fixes: 3d9ff34622ba ('ASoC: Intel: sst: add stream operations')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Dinesh Mirche <dinesh.mirche@intel.com>
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/intel/atom/sst/sst_stream.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/soc/intel/atom/sst/sst_stream.c
+++ b/sound/soc/intel/atom/sst/sst_stream.c
@@ -108,7 +108,7 @@ int sst_alloc_stream_mrfld(struct intel_
 			str_id, pipe_id);
 	ret = sst_prepare_and_post_msg(sst_drv_ctx, task_id, IPC_CMD,
 			IPC_IA_ALLOC_STREAM_MRFLD, pipe_id, sizeof(alloc_param),
-			&alloc_param, data, true, true, false, true);
+			&alloc_param, &data, true, true, false, true);
 
 	if (ret < 0) {
 		dev_err(sst_drv_ctx->dev, "FW alloc failed ret %d\n", ret);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 135/312] ASoC: tegra_alc5632: check return value
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (133 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 134/312] ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 136/312] ASoC: fsl_ssi: mark SACNT register volatile Greg Kroah-Hartman
                   ` (178 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sudip Mukherjee, Mark Brown

From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>

commit 319c32597fc22a58b946a6146f2be1fd208582e0 upstream.

We have been returning success even if snd_soc_card_jack_new() fails.
Lets check the return value and return error if it fails.

Fixes: 12cc6d1dca4d ("ASoC: tegra_alc5632: Register jacks at the card level")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/tegra/tegra_alc5632.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/sound/soc/tegra/tegra_alc5632.c
+++ b/sound/soc/tegra/tegra_alc5632.c
@@ -101,12 +101,16 @@ static const struct snd_kcontrol_new teg
 
 static int tegra_alc5632_asoc_init(struct snd_soc_pcm_runtime *rtd)
 {
+	int ret;
 	struct tegra_alc5632 *machine = snd_soc_card_get_drvdata(rtd->card);
 
-	snd_soc_card_jack_new(rtd->card, "Headset Jack", SND_JACK_HEADSET,
-			      &tegra_alc5632_hs_jack,
-			      tegra_alc5632_hs_jack_pins,
-			      ARRAY_SIZE(tegra_alc5632_hs_jack_pins));
+	ret = snd_soc_card_jack_new(rtd->card, "Headset Jack",
+				    SND_JACK_HEADSET,
+				    &tegra_alc5632_hs_jack,
+				    tegra_alc5632_hs_jack_pins,
+				    ARRAY_SIZE(tegra_alc5632_hs_jack_pins));
+	if (ret)
+		return ret;
 
 	if (gpio_is_valid(machine->gpio_hp_det)) {
 		tegra_alc5632_hp_jack_gpio.gpio = machine->gpio_hp_det;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 136/312] ASoC: fsl_ssi: mark SACNT register volatile
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (134 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 135/312] ASoC: tegra_alc5632: check return value Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 137/312] Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" Greg Kroah-Hartman
                   ` (177 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Maciej S. Szmigiero, Fabio Estevam,
	Mark Brown

From: Maciej S. Szmigiero <mail@maciej.szmigiero.name>

commit 3f1c241f0f5f90046258e6b8d4aeb6463ffdc08e upstream.

SACNT register should be marked volatile since
its WR and RD bits are cleared by SSI after
completing the relevant operation.
This unbreaks AC'97 register access.

Fixes: 05cf237972fe ("ASoC: fsl_ssi: Add driver suspend and resume to support MEGA Fast")

Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/soc/fsl/fsl_ssi.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/sound/soc/fsl/fsl_ssi.c
+++ b/sound/soc/fsl/fsl_ssi.c
@@ -146,6 +146,7 @@ static bool fsl_ssi_volatile_reg(struct
 	case CCSR_SSI_SRX1:
 	case CCSR_SSI_SISR:
 	case CCSR_SSI_SFCSR:
+	case CCSR_SSI_SACNT:
 	case CCSR_SSI_SACADD:
 	case CCSR_SSI_SACDAT:
 	case CCSR_SSI_SATAG:
@@ -239,8 +240,9 @@ struct fsl_ssi_private {
 	unsigned int baudclk_streams;
 	unsigned int bitclk_freq;
 
-	/*regcache for SFCSR*/
+	/* regcache for volatile regs */
 	u32 regcache_sfcsr;
+	u32 regcache_sacnt;
 
 	/* DMA params */
 	struct snd_dmaengine_dai_dma_data dma_params_tx;
@@ -1597,6 +1599,8 @@ static int fsl_ssi_suspend(struct device
 
 	regmap_read(regs, CCSR_SSI_SFCSR,
 			&ssi_private->regcache_sfcsr);
+	regmap_read(regs, CCSR_SSI_SACNT,
+			&ssi_private->regcache_sacnt);
 
 	regcache_cache_only(regs, true);
 	regcache_mark_dirty(regs);
@@ -1615,6 +1619,8 @@ static int fsl_ssi_resume(struct device
 			CCSR_SSI_SFCSR_RFWM1_MASK | CCSR_SSI_SFCSR_TFWM1_MASK |
 			CCSR_SSI_SFCSR_RFWM0_MASK | CCSR_SSI_SFCSR_TFWM0_MASK,
 			ssi_private->regcache_sfcsr);
+	regmap_write(regs, CCSR_SSI_SACNT,
+			ssi_private->regcache_sacnt);
 
 	return regcache_sync(regs);
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 137/312] Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (135 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 136/312] ASoC: fsl_ssi: mark SACNT register volatile Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 138/312] mmc: sdhci: restore behavior when setting VDD via external regulator Greg Kroah-Hartman
                   ` (176 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andy Shevchenko, Rafael J. Wysocki

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit b5f88dd1d6efc472e35ca1b21a44e662c5422088 upstream.

The specific power domain can't be used in a way provided by the commit
01ac170ba29a, i.e. pointer to platform device is a subject to change during
unbound / bind cycle.

This reverts commit 01ac170ba29a9903ee590e1ef2d8e6b27b49a16c.

Fixes: 3df2da968744 (Revert "ACPI / LPSS: introduce a 'proxy' device to power on LPSS for DMA")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/acpi_lpss.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -704,8 +704,13 @@ static int acpi_lpss_platform_notify(str
 	}
 
 	switch (action) {
-	case BUS_NOTIFY_ADD_DEVICE:
+	case BUS_NOTIFY_BOUND_DRIVER:
 		pdev->dev.pm_domain = &acpi_lpss_pm_domain;
+		break;
+	case BUS_NOTIFY_UNBOUND_DRIVER:
+		pdev->dev.pm_domain = NULL;
+		break;
+	case BUS_NOTIFY_ADD_DEVICE:
 		if (pdata->dev_desc->flags & LPSS_LTR)
 			return sysfs_create_group(&pdev->dev.kobj,
 						  &lpss_attr_group);
@@ -713,7 +718,6 @@ static int acpi_lpss_platform_notify(str
 	case BUS_NOTIFY_DEL_DEVICE:
 		if (pdata->dev_desc->flags & LPSS_LTR)
 			sysfs_remove_group(&pdev->dev.kobj, &lpss_attr_group);
-		pdev->dev.pm_domain = NULL;
 		break;
 	default:
 		break;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 138/312] mmc: sdhci: restore behavior when setting VDD via external regulator
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (136 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 137/312] Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 139/312] mmc: sd: limit SD card power limit according to cards capabilities Greg Kroah-Hartman
                   ` (175 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jisheng Zhang, Ludovic Desroches,
	Ulf Hansson

From: Jisheng Zhang <jszhang@marvell.com>

commit 918f4cbd4340ddd1eb389cd8efa3b07ac74ec4c0 upstream.

After commit 52221610dd84 ("mmc: sdhci: Improve external VDD regulator
support"), for the VDD is supplied via external regulators, we ignore
the code to convert a VDD voltage request into one of the standard
SDHCI voltage levels, then program it in the SDHCI_POWER_CONTROL. This
brings two issues:

1. SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON quirk isn't handled properly any
more.

2. What's more, once SDHCI_POWER_ON bit is set, some controllers such
as the sdhci-pxav3 used in marvell berlin SoCs require the voltage
levels programming in the SDHCI_POWER_CONTROL register, even the VDD
is supplied by external regulator. So the host in marvell berlin SoCs
still works fine after the commit. However, commit 3cbc6123a93d ("mmc:
sdhci: Set SDHCI_POWER_ON with external vmmc") sets the SDHCI_POWER_ON
bit, this would make the host in marvell berlin SoCs won't work any
more with external vmmc.

This patch restores the behavior when setting VDD through external
regulator by moving the call of mmc_regulator_set_ocr() to the end
of sdhci_set_power() function.

After this patch, the sdcard on Marvell Berlin SoC boards work again.

Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
Fixes: 52221610dd84 ("mmc: sdhci: Improve external VDD ...")
Reviewed-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Tested-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci.c |   19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1290,19 +1290,6 @@ static void sdhci_set_power(struct sdhci
 	struct mmc_host *mmc = host->mmc;
 	u8 pwr = 0;
 
-	if (!IS_ERR(mmc->supply.vmmc)) {
-		spin_unlock_irq(&host->lock);
-		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
-		spin_lock_irq(&host->lock);
-
-		if (mode != MMC_POWER_OFF)
-			sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
-		else
-			sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
-
-		return;
-	}
-
 	if (mode != MMC_POWER_OFF) {
 		switch (1 << vdd) {
 		case MMC_VDD_165_195:
@@ -1363,6 +1350,12 @@ static void sdhci_set_power(struct sdhci
 		if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER)
 			mdelay(10);
 	}
+
+	if (!IS_ERR(mmc->supply.vmmc)) {
+		spin_unlock_irq(&host->lock);
+		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+		spin_lock_irq(&host->lock);
+	}
 }
 
 /*****************************************************************************\



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 139/312] mmc: sd: limit SD card power limit according to cards capabilities
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (137 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 138/312] mmc: sdhci: restore behavior when setting VDD via external regulator Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 140/312] mmc: debugfs: correct wrong voltage value Greg Kroah-Hartman
                   ` (174 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Ulf Hansson

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit d9812780a020bcec44565b5950b2a8b31afb5545 upstream.

The SD card specification allows cards to error out a SWITCH command
where the requested function in a group is not supported.  The spec
provides for a set of capabilities which indicate which functions are
supported.

In the case of the power limit, requesting an unsupported power level
via the SWITCH command fails, resulting in the power level remaining at
the power-on default of 0.72W, even though the host and card may support
higher powers levels.

This has been seen with SanDisk 8GB cards, which support the default
0.72W and 1.44W (200mA and 400mA) in combination with an iMX6 host,
supporting up to 2.88W (800mA).  This currently causes us to try to set
a power limit function value of '3' (2.88W) which the card errors out
on, and thereby causes the power level to remain at 0.72W rather than
the desired 1.44W.

Arrange to limit the selected current limit by the capabilities reported
by the card to avoid the SWITCH command failing.  Select the highest
current limit that the host and card combination support.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Fixes: a39ca6ae0a08 ("mmc: core: Simplify and fix for SD switch processing")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/core/sd.c |   20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -337,6 +337,7 @@ static int mmc_read_switch(struct mmc_ca
 		card->sw_caps.sd3_bus_mode = status[13];
 		/* Driver Strengths supported by the card */
 		card->sw_caps.sd3_drv_type = status[9];
+		card->sw_caps.sd3_curr_limit = status[7] | status[6] << 8;
 	}
 
 out:
@@ -553,14 +554,25 @@ static int sd_set_current_limit(struct m
 	 * when we set current limit to 200ma, the card will draw 200ma, and
 	 * when we set current limit to 400/600/800ma, the card will draw its
 	 * maximum 300ma from the host.
+	 *
+	 * The above is incorrect: if we try to set a current limit that is
+	 * not supported by the card, the card can rightfully error out the
+	 * attempt, and remain at the default current limit.  This results
+	 * in a 300mA card being limited to 200mA even though the host
+	 * supports 800mA. Failures seen with SanDisk 8GB UHS cards with
+	 * an iMX6 host. --rmk
 	 */
-	if (max_current >= 800)
+	if (max_current >= 800 &&
+	    card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_800)
 		current_limit = SD_SET_CURRENT_LIMIT_800;
-	else if (max_current >= 600)
+	else if (max_current >= 600 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_600)
 		current_limit = SD_SET_CURRENT_LIMIT_600;
-	else if (max_current >= 400)
+	else if (max_current >= 400 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_400)
 		current_limit = SD_SET_CURRENT_LIMIT_400;
-	else if (max_current >= 200)
+	else if (max_current >= 200 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_200)
 		current_limit = SD_SET_CURRENT_LIMIT_200;
 
 	if (current_limit != SD_SET_CURRENT_NO_CHANGE) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 140/312] mmc: debugfs: correct wrong voltage value
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (138 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 139/312] mmc: sd: limit SD card power limit according to cards capabilities Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 141/312] mmc: block: return error on failed mmc_blk_get() Greg Kroah-Hartman
                   ` (173 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Chuanxiao Dong, Pawel Wodkowski, Ulf Hansson

From: Chuanxiao Dong <chuanxiao.dong@intel.com>

commit 0036e74686344f1051afc3107740140abfd03616 upstream.

Correct the wrong voltage value shown in debugfs for mmc/sd/sdio.

Signed-off-by: Chuanxiao Dong <chuanxiao.dong@intel.com>
Signed-off-by: Pawel Wodkowski <pawelx.wodkowski@intel.com>
Fixes: 42cd95a0603e ("mmc: core: debugfs: Add signal_voltage to ios dump")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/core/debugfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mmc/core/debugfs.c
+++ b/drivers/mmc/core/debugfs.c
@@ -170,7 +170,7 @@ static int mmc_ios_show(struct seq_file
 		str = "invalid";
 		break;
 	}
-	seq_printf(s, "signal voltage:\t%u (%s)\n", ios->chip_select, str);
+	seq_printf(s, "signal voltage:\t%u (%s)\n", ios->signal_voltage, str);
 
 	switch (ios->drv_type) {
 	case MMC_SET_DRIVER_TYPE_A:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 141/312] mmc: block: return error on failed mmc_blk_get()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (139 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 140/312] mmc: debugfs: correct wrong voltage value Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 142/312] clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" Greg Kroah-Hartman
                   ` (172 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Olof Johansson, Grant Grundler, Ulf Hansson

From: Olof Johansson <olof@lixom.net>

commit f00ab14c252ac459e86194747a1f580ab503c954 upstream.

This used to return -EFAULT, but the function above returns -EINVAL on
the same condition so let's stick to that.

The removal of error return on this path was introduced with b093410c9aef
('mmc: block: copy resp[] data on err for MMC_IOC_MULTI_CMD').

Fixes: b093410c9aef ('mmc: block: copy resp[] data on err for MMC_IOC_MULTI_CMD').
Signed-off-by: Olof Johansson <olof@lixom.net>
Cc: Grant Grundler <grundler@google.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/card/block.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -668,8 +668,10 @@ static int mmc_blk_ioctl_multi_cmd(struc
 	}
 
 	md = mmc_blk_get(bdev->bd_disk);
-	if (!md)
+	if (!md) {
+		err = -EINVAL;
 		goto cmd_err;
+	}
 
 	card = md->queue.card;
 	if (IS_ERR(card)) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 142/312] clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (140 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 141/312] mmc: block: return error on failed mmc_blk_get() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 143/312] mmc: dw_mmc: rockchip: Set the drive phase properly Greg Kroah-Hartman
                   ` (171 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Shawn Lin, Heiko Stuebner

From: Douglas Anderson <dianders@chromium.org>

commit 4715f81afc342996f680b08c944a712d9cbef11b upstream.

This reverts commit 7a03fe6f48f3 ("clk: rockchip: reset init state
before mmc card initialization").

Though not totally obvious from the commit message nor from the source
code, that commit appears to be trying to reset the "_drv" MMC clocks to
90 degrees (note that the "_sample" MMC clocks have a shift of 0 so are
not touched).

The major problem here is that it doesn't properly reset things.  The
phase is a two bit field and the commit only touches one of the two
bits.  Thus the commit had the following affect:
- phase   0  => phase  90
- phase  90  => phase  90
- phase 180  => phase 270
- phase 270  => phase 270

Things get even weirder if you happen to have a bootloader that was
actually using delay elements (should be no reason to, but you never
know), since those are additional bits that weren't touched by the
original patch.

This is unlikely to be what we actually want.  Checking on rk3288-veyron
devices, I can see that the bootloader leaves these clocks as:
- emmc:  phase 180
- sdmmc: phase 90
- sdio0: phase 90

Thus on rk3288-veyron devices the commit we're reverting had the effect
of changing the eMMC clock to phase 270.  This probably explains the
scattered reports I've heard of eMMC devices not working on some veyron
devices when using the upstream kernel.

The original commit was presumably made because previously the kernel
didn't touch the "_drv" phase at all and relied on whatever value was
there when the kernel started.  If someone was using a bootloader that
touched the "_drv" phase then, indeed, we should have code in the kernel
to fix that.  ...and also, to get ideal timings, we should also have the
kernel change the phase depending on the speed mode.  In fact, that's
the subject of a recent patch I posted at
<https://patchwork.kernel.org/patch/9075141/>.

Ideally, we should take both the patch posted to dw_mmc and this
revert.  Since those will likely go through different trees, here I
describe behavior with the combos:

1. Just this revert: likely will fix rk3288-veyron eMMC on some devices
   + other cases; might break someone with a strange bootloader that
   sets the phase to 0 or one that uses delay elements (pretty
   unpredicable what would happen in that case).
2. Just dw_mmc patch: fixes everyone.  Effectly the dw_mmc patch will
   totally override the broken patch and fix everything.
3. Both patches: fixes everyone.  Once dw_mmc is initting properly then
   any defaults from the clock code doesn't mattery.

Fixes: 7a03fe6f48f3 ("clk: rockchip: reset init state before mmc card initialization")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[emmc and sdmmc still work on all current boards in mainline after this
revert, so they should take precedence over any out-of-tree board that
will hopefully again get fixed with the better upcoming dw_mmc change.]
Signed-off-by: Heiko Stuebner <heiko@sntech.de>

---
 drivers/clk/rockchip/clk-mmc-phase.c |   11 -----------
 1 file changed, 11 deletions(-)

--- a/drivers/clk/rockchip/clk-mmc-phase.c
+++ b/drivers/clk/rockchip/clk-mmc-phase.c
@@ -41,8 +41,6 @@ static unsigned long rockchip_mmc_recalc
 #define ROCKCHIP_MMC_DEGREE_MASK 0x3
 #define ROCKCHIP_MMC_DELAYNUM_OFFSET 2
 #define ROCKCHIP_MMC_DELAYNUM_MASK (0xff << ROCKCHIP_MMC_DELAYNUM_OFFSET)
-#define ROCKCHIP_MMC_INIT_STATE_RESET 0x1
-#define ROCKCHIP_MMC_INIT_STATE_SHIFT 1
 
 #define PSECS_PER_SEC 1000000000000LL
 
@@ -183,15 +181,6 @@ struct clk *rockchip_clk_register_mmc(co
 	mmc_clock->reg = reg;
 	mmc_clock->shift = shift;
 
-	/*
-	 * Assert init_state to soft reset the CLKGEN
-	 * for mmc tuning phase and degree
-	 */
-	if (mmc_clock->shift == ROCKCHIP_MMC_INIT_STATE_SHIFT)
-		writel(HIWORD_UPDATE(ROCKCHIP_MMC_INIT_STATE_RESET,
-				     ROCKCHIP_MMC_INIT_STATE_RESET,
-				     mmc_clock->shift), mmc_clock->reg);
-
 	clk = clk_register(NULL, &mmc_clock->hw);
 	if (IS_ERR(clk))
 		goto err_free;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 143/312] mmc: dw_mmc: rockchip: Set the drive phase properly
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (141 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 142/312] clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 144/312] mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type Greg Kroah-Hartman
                   ` (170 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Douglas Anderson, Shawn Lin,
	Heiko Stuebner, Enric Balletbo i Serra, Jaehoon Chung,
	Ulf Hansson

From: Douglas Anderson <dianders@chromium.org>

commit d4aa908c7978f60557a799ca53b5ae4166fd8355 upstream.

Historically for Rockchip devices we've relied on the power-on
default (or perhaps the firmware setting) to get the correct drive
phase for dw_mmc devices.  This worked OK for the most part, but:

* Relying on the setting just "being right" is a bit fragile.

* As soon as there is an instance where the power on default is wrong or
  where the firmware didn't configure this properly then we'll get a
  mysterious failure.

In commit 7a03fe6f48f3 ("clk: rockchip: reset init state before mmc card
initialization") we actually started setting this explicitly in the
kernel, but that commit wasn't quite right and also wasn't quite
enough.  See <https://patchwork.kernel.org/patch/9085311/> for some
details.

Let's explicitly set this phase in dw_mmc.

The comments inside this patch try to explain the situation quite
throughly, but the high level overview of this is:

Before this patch on rk3288 devices tested (after revert of the clock
patch described above):
* eMMC: 180 degrees
* SDMMC/SDIO0/SDIO1: 90 degrees

After this patch:
* Use 90 degree phase offset usually.
* Use 180 degree phase offset for MMC_DDR52, SDR104, HS200.

That means we are _changing_ behavior for those devices in this way:

* If we have HS200 eMMC or DDR52 eMMC, we'll run ID mode at 90
  degrees (vs 180) but otherwise have no change.

* For any non-HS200 / non-DDR52 eMMC devices we'll now _always_ run at
  90 degrees (vs 180).  It seems fairly unlikely that building modern
  hardware is using an eMMC that isn't using DDR52 or HS200, of course.

* For SDR104 cards we'll now run with 180 degree phase offset (vs 90).
  It's expected that 90 degree phase offset would have worked OK, but
  this gives us extra margin.

I have tested this by inserting my collection of uSD cards (mostly UHS,
though a few not) into a veyron_minnie and confirmed that they still
seem to enumerate properly.  For a subset of them I tried putting a
filesystem on them and also tried running mmc_test.

Fixes: 7a03fe6f48f3 ("clk: rockchip: reset init state before mmc card initialization")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Tested-by: Enric Balletbo i Serra <enric.balletbo@collabora.com>
Signed-off-by: Jaehoon Chung <jh80.chung@samsung.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/dw_mmc-rockchip.c |   64 +++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

--- a/drivers/mmc/host/dw_mmc-rockchip.c
+++ b/drivers/mmc/host/dw_mmc-rockchip.c
@@ -78,6 +78,70 @@ static void dw_mci_rk3288_set_ios(struct
 	/* Make sure we use phases which we can enumerate with */
 	if (!IS_ERR(priv->sample_clk))
 		clk_set_phase(priv->sample_clk, priv->default_sample_phase);
+
+	/*
+	 * Set the drive phase offset based on speed mode to achieve hold times.
+	 *
+	 * NOTE: this is _not_ a value that is dynamically tuned and is also
+	 * _not_ a value that will vary from board to board.  It is a value
+	 * that could vary between different SoC models if they had massively
+	 * different output clock delays inside their dw_mmc IP block (delay_o),
+	 * but since it's OK to overshoot a little we don't need to do complex
+	 * calculations and can pick values that will just work for everyone.
+	 *
+	 * When picking values we'll stick with picking 0/90/180/270 since
+	 * those can be made very accurately on all known Rockchip SoCs.
+	 *
+	 * Note that these values match values from the DesignWare Databook
+	 * tables for the most part except for SDR12 and "ID mode".  For those
+	 * two modes the databook calculations assume a clock in of 50MHz.  As
+	 * seen above, we always use a clock in rate that is exactly the
+	 * card's input clock (times RK3288_CLKGEN_DIV, but that gets divided
+	 * back out before the controller sees it).
+	 *
+	 * From measurement of a single device, it appears that delay_o is
+	 * about .5 ns.  Since we try to leave a bit of margin, it's expected
+	 * that numbers here will be fine even with much larger delay_o
+	 * (the 1.4 ns assumed by the DesignWare Databook would result in the
+	 * same results, for instance).
+	 */
+	if (!IS_ERR(priv->drv_clk)) {
+		int phase;
+
+		/*
+		 * In almost all cases a 90 degree phase offset will provide
+		 * sufficient hold times across all valid input clock rates
+		 * assuming delay_o is not absurd for a given SoC.  We'll use
+		 * that as a default.
+		 */
+		phase = 90;
+
+		switch (ios->timing) {
+		case MMC_TIMING_MMC_DDR52:
+			/*
+			 * Since clock in rate with MMC_DDR52 is doubled when
+			 * bus width is 8 we need to double the phase offset
+			 * to get the same timings.
+			 */
+			if (ios->bus_width == MMC_BUS_WIDTH_8)
+				phase = 180;
+			break;
+		case MMC_TIMING_UHS_SDR104:
+		case MMC_TIMING_MMC_HS200:
+			/*
+			 * In the case of 150 MHz clock (typical max for
+			 * Rockchip SoCs), 90 degree offset will add a delay
+			 * of 1.67 ns.  That will meet min hold time of .8 ns
+			 * as long as clock output delay is < .87 ns.  On
+			 * SoCs measured this seems to be OK, but it doesn't
+			 * hurt to give margin here, so we use 180.
+			 */
+			phase = 180;
+			break;
+		}
+
+		clk_set_phase(priv->drv_clk, phase);
+	}
 }
 
 #define NUM_PHASES			360



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 144/312] mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (142 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 143/312] mmc: dw_mmc: rockchip: Set the drive phase properly Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 145/312] mmc: sdhci: Fix regression setting power on Trats2 board Greg Kroah-Hartman
                   ` (169 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Ulf Hansson

From: Nicholas Mc Guire <hofrat@osadl.org>

commit 41f469cac2663a41a7b0c84cb94e8f7024385ae4 upstream.

wait_for_completion_timeout_interruptible returns long not unsigned long
so dma_time, which is used exclusively here, is changed to long.

Fixes: 1b66e94e6b99 ("mmc: moxart: Add MOXA ART SD/MMC driver")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/moxart-mmc.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/mmc/host/moxart-mmc.c
+++ b/drivers/mmc/host/moxart-mmc.c
@@ -257,7 +257,7 @@ static void moxart_dma_complete(void *pa
 static void moxart_transfer_dma(struct mmc_data *data, struct moxart_host *host)
 {
 	u32 len, dir_data, dir_slave;
-	unsigned long dma_time;
+	long dma_time;
 	struct dma_async_tx_descriptor *desc = NULL;
 	struct dma_chan *dma_chan;
 
@@ -397,7 +397,8 @@ static void moxart_prepare_data(struct m
 static void moxart_request(struct mmc_host *mmc, struct mmc_request *mrq)
 {
 	struct moxart_host *host = mmc_priv(mmc);
-	unsigned long pio_time, flags;
+	long pio_time;
+	unsigned long flags;
 	u32 status;
 
 	spin_lock_irqsave(&host->lock, flags);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 145/312] mmc: sdhci: Fix regression setting power on Trats2 board
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (143 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 144/312] mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 146/312] perf tools: Fix perf regs mask generation Greg Kroah-Hartman
                   ` (168 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski,
	Ludovic Desroches, Adrian Hunter, Jisheng Zhang, Jaehoon Chung,
	Anand Moon, Ulf Hansson

From: Adrian Hunter <adrian.hunter@intel.com>

commit 1dceb0415aa0c6bc11dacdab47c9ef83a3604166 upstream.

Several commits relating to setting power have been introducing
problems by putting driver-specific rules into generic SDHCI code.

Krzysztof Kozlowski reported that after commit 918f4cbd4340 ("mmc:
sdhci: restore behavior when setting VDD via external regulator")
on Trats2 board there are warnings for invalid VDD  value (2.8V):

[    3.119656] ------------[ cut here ]------------
[    3.119666] WARNING: CPU: 3 PID: 90 at
../drivers/mmc/host/sdhci.c:1234 sdhci_do_set_ios+0x4cc/0x5e0
[    3.119669] mmc0: Invalid vdd 0x10
[    3.119673] Modules linked in:
[    3.119679] CPU: 3 PID: 90 Comm: kworker/3:1 Tainted: G        W
   4.5.0-next-20160324 #23
[    3.119681] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
[    3.119690] Workqueue: events_freezable mmc_rescan
[    3.119708] [<c010e0ac>] (unwind_backtrace) from [<c010ae10>]
(show_stack+0x10/0x14)
[    3.119719] [<c010ae10>] (show_stack) from [<c0323260>]
(dump_stack+0x88/0x9c)
[    3.119728] [<c0323260>] (dump_stack) from [<c011b754>] (__warn+0xe8/0x100)
[    3.119734] [<c011b754>] (__warn) from [<c011b7a4>]
(warn_slowpath_fmt+0x38/0x48)
[    3.119740] [<c011b7a4>] (warn_slowpath_fmt) from [<c0527d28>]
(sdhci_do_set_ios+0x4cc/0x5e0)
[    3.119748] [<c0527d28>] (sdhci_do_set_ios) from [<c0528018>]
(sdhci_runtime_resume_host+0x60/0x114)
[    3.119758] [<c0528018>] (sdhci_runtime_resume_host) from
[<c0402570>] (__rpm_callback+0x2c/0x60)
[    3.119767] [<c0402570>] (__rpm_callback) from [<c04025c4>]
(rpm_callback+0x20/0x80)
[    3.119773] [<c04025c4>] (rpm_callback) from [<c04034b8>]
(rpm_resume+0x36c/0x558)
[    3.119780] [<c04034b8>] (rpm_resume) from [<c04036f0>]
(__pm_runtime_resume+0x4c/0x64)
[    3.119788] [<c04036f0>] (__pm_runtime_resume) from [<c0512728>]
(__mmc_claim_host+0x170/0x1b0)
[    3.119795] [<c0512728>] (__mmc_claim_host) from [<c0514e2c>]
(mmc_rescan+0x54/0x348)
[    3.119807] [<c0514e2c>] (mmc_rescan) from [<c0130dac>]
(process_one_work+0x120/0x3f4)
[    3.119815] [<c0130dac>] (process_one_work) from [<c01310b8>]
(worker_thread+0x38/0x554)
[    3.119823] [<c01310b8>] (worker_thread) from [<c01365a4>]
(kthread+0xdc/0xf4)
[    3.119831] [<c01365a4>] (kthread) from [<c0107878>]
(ret_from_fork+0x14/0x3c)
[    3.119834] ---[ end trace a22d652aa3276886 ]---

Fix by adding a 'set_power' callback and restoring the default
behaviour prior to commit 918f4cbd4340 ("mmc: sdhci: restore
behavior when setting VDD via external regulator").  The desired
behaviour of that commit is gotten by having sdhci-pxav3 provide
its own set_power callback.

Reported-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Link: http://lkml.kernel.org/r/CAJKOXPcGDnPm-Ykh6wHqV1YxfTaov5E8iVqBoBn4OJc7BnhgEQ@mail.gmail.com
Fixes: 918f4cbd4340 ("mmc: sdhci: restore behavior when setting VDD...)
Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Tested-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org # v4.5+
Reviewed-by: Jisheng Zhang <jszhang@marvell.com>
Tested-by: Jisheng Zhang <jszhang@marvell.com>
Tested-by: Jaehoon Chung <jh80.chung@samsung.com>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mmc/host/sdhci-pxav3.c |   22 ++++++++++++++++++++++
 drivers/mmc/host/sdhci.c       |   39 ++++++++++++++++++++++++++++++---------
 drivers/mmc/host/sdhci.h       |    4 ++++
 3 files changed, 56 insertions(+), 9 deletions(-)

--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -307,8 +307,30 @@ static void pxav3_set_uhs_signaling(stru
 		__func__, uhs, ctrl_2);
 }
 
+static void pxav3_set_power(struct sdhci_host *host, unsigned char mode,
+			    unsigned short vdd)
+{
+	struct mmc_host *mmc = host->mmc;
+	u8 pwr = host->pwr;
+
+	sdhci_set_power(host, mode, vdd);
+
+	if (host->pwr == pwr)
+		return;
+
+	if (host->pwr == 0)
+		vdd = 0;
+
+	if (!IS_ERR(mmc->supply.vmmc)) {
+		spin_unlock_irq(&host->lock);
+		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+		spin_lock_irq(&host->lock);
+	}
+}
+
 static const struct sdhci_ops pxav3_sdhci_ops = {
 	.set_clock = sdhci_set_clock,
+	.set_power = pxav3_set_power,
 	.platform_send_init_74_clocks = pxav3_gen_init_74_clocks,
 	.get_max_clock = sdhci_pltfm_clk_get_max_clock,
 	.set_bus_width = sdhci_set_bus_width,
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1284,10 +1284,24 @@ clock_set:
 }
 EXPORT_SYMBOL_GPL(sdhci_set_clock);
 
-static void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
-			    unsigned short vdd)
+static void sdhci_set_power_reg(struct sdhci_host *host, unsigned char mode,
+				unsigned short vdd)
 {
 	struct mmc_host *mmc = host->mmc;
+
+	spin_unlock_irq(&host->lock);
+	mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
+	spin_lock_irq(&host->lock);
+
+	if (mode != MMC_POWER_OFF)
+		sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL);
+	else
+		sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
+}
+
+void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+		     unsigned short vdd)
+{
 	u8 pwr = 0;
 
 	if (mode != MMC_POWER_OFF) {
@@ -1319,7 +1333,6 @@ static void sdhci_set_power(struct sdhci
 		sdhci_writeb(host, 0, SDHCI_POWER_CONTROL);
 		if (host->quirks2 & SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON)
 			sdhci_runtime_pm_bus_off(host);
-		vdd = 0;
 	} else {
 		/*
 		 * Spec says that we should clear the power reg before setting
@@ -1350,12 +1363,20 @@ static void sdhci_set_power(struct sdhci
 		if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER)
 			mdelay(10);
 	}
+}
+EXPORT_SYMBOL_GPL(sdhci_set_power);
 
-	if (!IS_ERR(mmc->supply.vmmc)) {
-		spin_unlock_irq(&host->lock);
-		mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd);
-		spin_lock_irq(&host->lock);
-	}
+static void __sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+			      unsigned short vdd)
+{
+	struct mmc_host *mmc = host->mmc;
+
+	if (host->ops->set_power)
+		host->ops->set_power(host, mode, vdd);
+	else if (!IS_ERR(mmc->supply.vmmc))
+		sdhci_set_power_reg(host, mode, vdd);
+	else
+		sdhci_set_power(host, mode, vdd);
 }
 
 /*****************************************************************************\
@@ -1505,7 +1526,7 @@ static void sdhci_do_set_ios(struct sdhc
 		}
 	}
 
-	sdhci_set_power(host, ios->power_mode, ios->vdd);
+	__sdhci_set_power(host, ios->power_mode, ios->vdd);
 
 	if (host->ops->platform_send_init_74_clocks)
 		host->ops->platform_send_init_74_clocks(host, ios->power_mode);
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -529,6 +529,8 @@ struct sdhci_ops {
 #endif
 
 	void	(*set_clock)(struct sdhci_host *host, unsigned int clock);
+	void	(*set_power)(struct sdhci_host *host, unsigned char mode,
+			     unsigned short vdd);
 
 	int		(*enable_dma)(struct sdhci_host *host);
 	unsigned int	(*get_max_clock)(struct sdhci_host *host);
@@ -660,6 +662,8 @@ static inline bool sdhci_sdio_irq_enable
 }
 
 void sdhci_set_clock(struct sdhci_host *host, unsigned int clock);
+void sdhci_set_power(struct sdhci_host *host, unsigned char mode,
+		     unsigned short vdd);
 void sdhci_set_bus_width(struct sdhci_host *host, int width);
 void sdhci_reset(struct sdhci_host *host, u8 mask);
 void sdhci_set_uhs_signaling(struct sdhci_host *host, unsigned timing);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 146/312] perf tools: Fix perf regs mask generation
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (144 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 145/312] mmc: sdhci: Fix regression setting power on Trats2 board Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 147/312] powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() Greg Kroah-Hartman
                   ` (167 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Naveen N. Rao,
	Arnaldo Carvalho de Melo, Michael Ellerman

From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>

commit f47822078dece7189cad0a5f472f148e5e916736 upstream.

On some architectures (powerpc in particular), the number of registers
exceeds what can be represented in an integer bitmask. Ensure we
generate the proper bitmask on such platforms.

Fixes: 71ad0f5e4 ("perf tools: Support for DWARF CFI unwinding on post processing")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 tools/perf/util/perf_regs.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/tools/perf/util/perf_regs.c
+++ b/tools/perf/util/perf_regs.c
@@ -12,18 +12,18 @@ int perf_reg_value(u64 *valp, struct reg
 	int i, idx = 0;
 	u64 mask = regs->mask;
 
-	if (regs->cache_mask & (1 << id))
+	if (regs->cache_mask & (1ULL << id))
 		goto out;
 
-	if (!(mask & (1 << id)))
+	if (!(mask & (1ULL << id)))
 		return -EINVAL;
 
 	for (i = 0; i < id; i++) {
-		if (mask & (1 << i))
+		if (mask & (1ULL << i))
 			idx++;
 	}
 
-	regs->cache_mask |= (1 << id);
+	regs->cache_mask |= (1ULL << id);
 	regs->cache_regs[id] = regs->regs[idx];
 
 out:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 147/312] powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (145 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 146/312] perf tools: Fix perf regs mask generation Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 148/312] powerpc/book3s: Fix MCE console messages for unrecoverable MCE Greg Kroah-Hartman
                   ` (166 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Michael Neuling, Cyril Bur, Michael Ellerman

From: Michael Neuling <mikey@neuling.org>

commit 6bcb80143e792becfd2b9cc6a339ce523e4e2219 upstream.

At the start of __tm_recheckpoint() we save the kernel stack pointer
(r1) in SPRG SCRATCH0 (SPRG2) so that we can restore it after the
trecheckpoint.

Unfortunately, the same SPRG is used in the SLB miss handler.  If an
SLB miss is taken between the save and restore of r1 to the SPRG, the
SPRG is changed and hence r1 is also corrupted.  We can end up with
the following crash when we start using r1 again after the restore
from the SPRG:

  Oops: Bad kernel stack pointer, sig: 6 [#1]
  SMP NR_CPUS=2048 NUMA pSeries
  CPU: 658 PID: 143777 Comm: htm_demo Tainted: G            EL   X 4.4.13-0-default #1
  task: c0000b56993a7810 ti: c00000000cfec000 task.ti: c0000b56993bc000
  NIP: c00000000004f188 LR: 00000000100040b8 CTR: 0000000010002570
  REGS: c00000000cfefd40 TRAP: 0300   Tainted: G            EL   X  (4.4.13-0-default)
  MSR: 8000000300001033 <SF,ME,IR,DR,RI,LE>  CR: 02000424  XER: 20000000
  CFAR: c000000000008468 DAR: 00003ffd84e66880 DSISR: 40000000 SOFTE: 0
  PACATMSCRATCH: 00003ffbc865e680
  GPR00: fffffffcfabc4268 00003ffd84e667a0 00000000100d8c38 000000030544bb80
  GPR04: 0000000000000002 00000000100cf200 0000000000000449 00000000100cf100
  GPR08: 000000000000c350 0000000000002569 0000000000002569 00000000100d6c30
  GPR12: 00000000100d6c28 c00000000e6a6b00 00003ffd84660000 0000000000000000
  GPR16: 0000000000000003 0000000000000449 0000000010002570 0000010009684f20
  GPR20: 0000000000800000 00003ffd84e5f110 00003ffd84e5f7a0 00000000100d0f40
  GPR24: 0000000000000000 0000000000000000 0000000000000000 00003ffff0673f50
  GPR28: 00003ffd84e5e960 00000000003d0f00 00003ffd84e667a0 00003ffd84e5e680
  NIP [c00000000004f188] restore_gprs+0x110/0x17c
  LR [00000000100040b8] 0x100040b8
  Call Trace:
  Instruction dump:
  f8a1fff0 e8e700a8 38a00000 7ca10164 e8a1fff8 e821fff0 7c0007dd 7c421378
  7db142a6 7c3242a6 38800002 7c810164 <e9c100e0> e9e100e8 ea0100f0 ea2100f8

We hit this on large memory machines (> 2TB) but it can also be hit on
smaller machines when 1TB segments are disabled.

To hit this, you also need to be virtualised to ensure SLBs are
periodically removed by the hypervisor.

This patches moves the saving of r1 to the SPRG to the region where we
are guaranteed not to take any further SLB misses.

Fixes: 98ae22e15b43 ("powerpc: Add helper functions for transactional memory context switching")
Cc: stable@vger.kernel.org # v3.9+
Signed-off-by: Michael Neuling <mikey@neuling.org>
Acked-by: Cyril Bur <cyrilbur@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/tm.S |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -352,8 +352,6 @@ _GLOBAL(__tm_recheckpoint)
 	 */
 	subi	r7, r7, STACK_FRAME_OVERHEAD
 
-	SET_SCRATCH0(r1)
-
 	mfmsr	r6
 	/* R4 = original MSR to indicate whether thread used FP/Vector etc. */
 
@@ -482,6 +480,7 @@ restore_gprs:
 	 * until we turn MSR RI back on.
 	 */
 
+	SET_SCRATCH0(r1)
 	ld	r5, -8(r1)
 	ld	r1, -16(r1)
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 148/312] powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (146 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 147/312] powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 149/312] sctp: fix the transports round robin issue when init is retransmitted Greg Kroah-Hartman
                   ` (165 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mahesh Salgaonkar, Michael Ellerman

From: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>

commit c74dd88e77d3ecbc9e55c78796d82c9aa21cabad upstream.

When machine check occurs with MSR(RI=0), it means MC interrupt is
unrecoverable and kernel goes down to panic path. But the console
message still shows it as recovered. This patch fixes the MCE console
messages.

Fixes: 36df96f8acaf ("powerpc/book3s: Decode and save machine check event.")
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/mce.c             |    3 ++-
 arch/powerpc/platforms/powernv/opal.c |    1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -92,7 +92,8 @@ void save_mce_event(struct pt_regs *regs
 	mce->in_use = 1;
 
 	mce->initiator = MCE_INITIATOR_CPU;
-	if (handled)
+	/* Mark it recovered if we have handled it and MSR(RI=1). */
+	if (handled && (regs->msr & MSR_RI))
 		mce->disposition = MCE_DISPOSITION_RECOVERED;
 	else
 		mce->disposition = MCE_DISPOSITION_NOT_RECOVERED;
--- a/arch/powerpc/platforms/powernv/opal.c
+++ b/arch/powerpc/platforms/powernv/opal.c
@@ -401,6 +401,7 @@ static int opal_recover_mce(struct pt_re
 
 	if (!(regs->msr & MSR_RI)) {
 		/* If MSR_RI isn't set, we cannot recover */
+		pr_err("Machine check interrupt unrecoverable: MSR(RI=0)\n");
 		recovered = 0;
 	} else if (evt->disposition == MCE_DISPOSITION_RECOVERED) {
 		/* Platform corrected itself */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 149/312] sctp: fix the transports round robin issue when init is retransmitted
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (147 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 148/312] powerpc/book3s: Fix MCE console messages for unrecoverable MCE Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 150/312] sunrpc: Update RPCBIND_MAXNETIDLEN Greg Kroah-Hartman
                   ` (164 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xin Long, Daniel Borkmann,
	Marcelo Ricardo Leitner, David S. Miller

From: Xin Long <lucien.xin@gmail.com>

commit 39d2adebf137de5f900843f69f5e500932e31047 upstream.

prior to this patch, at the beginning if we have two paths in one assoc,
they may have the same params other than the last_time_heard, it will try
the paths like this:

1st cycle
  try trans1 fail.
  then trans2 is selected.(cause it's last_time_heard is after trans1).

2nd cycle:
  try  trans2 fail
  then trans2 is selected.(cause it's last_time_heard is after trans1).

3rd cycle:
  try  trans2 fail
  then trans2 is selected.(cause it's last_time_heard is after trans1).

....

trans1 will never have change to be selected, which is not what we expect.
we should keeping round robin all the paths if they are just added at the
beginning.

So at first every tranport's last_time_heard should be initialized 0, so
that we ensure they have the same value at the beginning, only by this,
all the transports could get equal chance to be selected.

Then for sctp_trans_elect_best, it should return the trans_next one when
*trans == *trans_next, so that we can try next if it fails,  but now it
always return trans. so we can fix it by exchanging these two params when
we calls sctp_trans_elect_tie().

Fixes: 4c47af4d5eb2 ('net: sctp: rework multihoming retransmission path selection to rfc4960')
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sctp/associola.c |    2 +-
 net/sctp/transport.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1290,7 +1290,7 @@ static struct sctp_transport *sctp_trans
 	if (score_curr > score_best)
 		return curr;
 	else if (score_curr == score_best)
-		return sctp_trans_elect_tie(curr, best);
+		return sctp_trans_elect_tie(best, curr);
 	else
 		return best;
 }
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -72,7 +72,7 @@ static struct sctp_transport *sctp_trans
 	 */
 	peer->rto = msecs_to_jiffies(net->sctp.rto_initial);
 
-	peer->last_time_heard = ktime_get();
+	peer->last_time_heard = ktime_set(0, 0);
 	peer->last_time_ecne_reduced = jiffies;
 
 	peer->param_flags = SPP_HB_DISABLE |



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 150/312] sunrpc: Update RPCBIND_MAXNETIDLEN
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (148 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 149/312] sctp: fix the transports round robin issue when init is retransmitted Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 151/312] NFC: nci: memory leak in nci_core_conn_create() Greg Kroah-Hartman
                   ` (163 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit 4b9c7f9db9a003f5c342184dc4401c1b7f2efb39 upstream.

Commit 176e21ee2ec8 ("SUNRPC: Support for RPC over AF_LOCAL
transports") added a 5-character netid, but did not bump
RPCBIND_MAXNETIDLEN from 4 to 5.

Fixes: 176e21ee2ec8 ("SUNRPC: Support for RPC over AF_LOCAL ...")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/sunrpc/msg_prot.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/linux/sunrpc/msg_prot.h
+++ b/include/linux/sunrpc/msg_prot.h
@@ -158,9 +158,9 @@ typedef __be32	rpc_fraghdr;
 
 /*
  * Note that RFC 1833 does not put any size restrictions on the
- * netid string, but all currently defined netid's fit in 4 bytes.
+ * netid string, but all currently defined netid's fit in 5 bytes.
  */
-#define RPCBIND_MAXNETIDLEN	(4u)
+#define RPCBIND_MAXNETIDLEN	(5u)
 
 /*
  * Universal addresses are introduced in RFC 1833 and further spelled



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 151/312] NFC: nci: memory leak in nci_core_conn_create()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (149 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 150/312] sunrpc: Update RPCBIND_MAXNETIDLEN Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 152/312] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS Greg Kroah-Hartman
                   ` (162 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christophe Ricard, Dan Carpenter,
	Samuel Ortiz

From: Dan Carpenter <dan.carpenter@oracle.com>

commit c6dc65d885b98898bf287aaf44e020077b41769f upstream.

I've moved the check for "number_destination_params" forward
a few lines to avoid leaking "cmd".

Fixes: caa575a86ec1 ('NFC: nci: fix possible crash in nci_core_conn_create')

Acked-by: Christophe Ricard <christophe-h.ricard@st.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/nfc/nci/core.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -610,14 +610,14 @@ int nci_core_conn_create(struct nci_dev
 	struct nci_core_conn_create_cmd *cmd;
 	struct core_conn_create_data data;
 
+	if (!number_destination_params)
+		return -EINVAL;
+
 	data.length = params_len + sizeof(struct nci_core_conn_create_cmd);
 	cmd = kzalloc(data.length, GFP_KERNEL);
 	if (!cmd)
 		return -ENOMEM;
 
-	if (!number_destination_params)
-		return -EINVAL;
-
 	cmd->destination_type = destination_type;
 	cmd->number_destination_params = number_destination_params;
 	memcpy(cmd->params, params, params_len);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 152/312] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (150 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 151/312] NFC: nci: memory leak in nci_core_conn_create() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 153/312] net: phy: Fix phy_mac_interrupt() Greg Kroah-Hartman
                   ` (161 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit d5c3d84657db57bd23ecd58b97f1c99dd42a7b80 upstream.

Commit 2c7b49212a86 ("phy: fix the use of PHY_IGNORE_INTERRUPT") changed
a hunk in phy_state_machine() in the PHY_RUNNING case which was not
needed. The change essentially makes the PHY library treat PHY devices
with PHY_IGNORE_INTERRUPT to keep polling for the PHY device, even
though the intent is not to do it.

Fix this by reverting that specific hunk, which makes the PHY state
machine wait for state changes, and stay in the PHY_RUNNING state for as
long as needed.

Fixes: 2c7b49212a86 ("phy: fix the use of PHY_IGNORE_INTERRUPT")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/phy.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -912,10 +912,10 @@ void phy_state_machine(struct work_struc
 		phydev->adjust_link(phydev->attached_dev);
 		break;
 	case PHY_RUNNING:
-		/* Only register a CHANGE if we are polling or ignoring
-		 * interrupts and link changed since latest checking.
+		/* Only register a CHANGE if we are polling and link changed
+		 * since latest checking.
 		 */
-		if (!phy_interrupt_is_valid(phydev)) {
+		if (phydev->irq == PHY_POLL) {
 			old_link = phydev->link;
 			err = phy_read_status(phydev);
 			if (err)
@@ -1015,8 +1015,13 @@ void phy_state_machine(struct work_struc
 	dev_dbg(&phydev->dev, "PHY state change %s -> %s\n",
 		phy_state_to_str(old_state), phy_state_to_str(phydev->state));
 
-	queue_delayed_work(system_power_efficient_wq, &phydev->state_queue,
-			   PHY_STATE_TIME * HZ);
+	/* Only re-schedule a PHY state machine change if we are polling the
+	 * PHY, if PHY_IGNORE_INTERRUPT is set, then we will be moving
+	 * between states from phy_mac_interrupt()
+	 */
+	if (phydev->irq == PHY_POLL)
+		queue_delayed_work(system_power_efficient_wq, &phydev->state_queue,
+				   PHY_STATE_TIME * HZ);
 }
 
 void phy_mac_interrupt(struct phy_device *phydev, int new_link)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 153/312] net: phy: Fix phy_mac_interrupt()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (151 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 152/312] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 154/312] net: phy: bcm7xxx: Fix shadow mode 2 disabling Greg Kroah-Hartman
                   ` (160 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit deccd16f91f930af8e91ffbbfc839d0ad8da999d upstream.

Commit 5ea94e7686a3 ("phy: add phy_mac_interrupt()") to use with
PHY_IGNORE_INTERRUPT added a cancel_work_sync() into phy_mac_interrupt()
which is allowed to sleep, whereas phy_mac_interrupt() is expected to be
callable from interrupt context.

Now that we have fixed how the PHY state machine treats
PHY_IGNORE_INTERRUPT with respect to state changes, we can just set the
new link state, and queue the PHY state machine for execution so it is
going to read the new link state.

For that to work properly, we need to update phy_change() not to try to
invoke any interrupt callbacks if we have configured the PHY device for
PHY_IGNORE_INTERRUPT, because that PHY device and its driver are not
required to implement those.

Fixes: 5ea94e7686a3 ("phy: add phy_mac_interrupt() to use with PHY_IGNORE_INTERRUPT")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/phy.c |   31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -699,25 +699,29 @@ void phy_change(struct work_struct *work
 	struct phy_device *phydev =
 		container_of(work, struct phy_device, phy_queue);
 
-	if (phydev->drv->did_interrupt &&
-	    !phydev->drv->did_interrupt(phydev))
-		goto ignore;
+	if (phy_interrupt_is_valid(phydev)) {
+		if (phydev->drv->did_interrupt &&
+		    !phydev->drv->did_interrupt(phydev))
+			goto ignore;
 
-	if (phy_disable_interrupts(phydev))
-		goto phy_err;
+		if (phy_disable_interrupts(phydev))
+			goto phy_err;
+	}
 
 	mutex_lock(&phydev->lock);
 	if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state))
 		phydev->state = PHY_CHANGELINK;
 	mutex_unlock(&phydev->lock);
 
-	atomic_dec(&phydev->irq_disable);
-	enable_irq(phydev->irq);
+	if (phy_interrupt_is_valid(phydev)) {
+		atomic_dec(&phydev->irq_disable);
+		enable_irq(phydev->irq);
 
-	/* Reenable interrupts */
-	if (PHY_HALTED != phydev->state &&
-	    phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED))
-		goto irq_enable_err;
+		/* Reenable interrupts */
+		if (PHY_HALTED != phydev->state &&
+		    phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED))
+			goto irq_enable_err;
+	}
 
 	/* reschedule state queue work to run as soon as possible */
 	cancel_delayed_work_sync(&phydev->state_queue);
@@ -1026,9 +1030,10 @@ void phy_state_machine(struct work_struc
 
 void phy_mac_interrupt(struct phy_device *phydev, int new_link)
 {
-	cancel_work_sync(&phydev->phy_queue);
 	phydev->link = new_link;
-	schedule_work(&phydev->phy_queue);
+
+	/* Trigger a state machine change */
+	queue_work(system_power_efficient_wq, &phydev->phy_queue);
 }
 EXPORT_SYMBOL(phy_mac_interrupt);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 154/312] net: phy: bcm7xxx: Fix shadow mode 2 disabling
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (152 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 153/312] net: phy: Fix phy_mac_interrupt() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 155/312] of_mdio: fix node leak in of_phy_register_fixed_link error path Greg Kroah-Hartman
                   ` (159 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit 50d899808d33a5b0aa82be23e824119944042689 upstream.

The clear and set masks in the call to phy_set_clr_bits() called from
bcm7xxx_config_init() are inverted. We need to fix this by swapping the two
arguments, that is, set 0 bits, but clear the shade mode 2 enable bit.

Fixes: b560a58c45c66 ("net: phy: add Broadcom BCM7xxx internal PHY driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/bcm7xxx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -270,7 +270,7 @@ static int bcm7xxx_config_init(struct ph
 	phy_write(phydev, MII_BCM7XXX_100TX_FALSE_CAR, 0x7555);
 
 	/* reset shadow mode 2 */
-	ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, MII_BCM7XXX_SHD_MODE_2, 0);
+	ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0, MII_BCM7XXX_SHD_MODE_2);
 	if (ret < 0)
 		return ret;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 155/312] of_mdio: fix node leak in of_phy_register_fixed_link error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (153 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 154/312] net: phy: bcm7xxx: Fix shadow mode 2 disabling Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 156/312] phy: micrel: Fix finding PHY properties in MAC node for KSZ9031 Greg Kroah-Hartman
                   ` (158 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 48c1699d5335bc045b50989a06b1c526b17a25ff upstream.

Make sure to drop the of_node reference also on failure to parse the
speed property in of_phy_register_fixed_link().

Fixes: 3be2a49e5c08 ("of: provide a binding for fixed link PHYs")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/of/of_mdio.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -334,8 +334,11 @@ int of_phy_register_fixed_link(struct de
 		status.link = 1;
 		status.duplex = of_property_read_bool(fixed_link_node,
 						      "full-duplex");
-		if (of_property_read_u32(fixed_link_node, "speed", &status.speed))
+		if (of_property_read_u32(fixed_link_node, "speed",
+					 &status.speed)) {
+			of_node_put(fixed_link_node);
 			return -EINVAL;
+		}
 		status.pause = of_property_read_bool(fixed_link_node, "pause");
 		status.asym_pause = of_property_read_bool(fixed_link_node,
 							  "asym-pause");



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 156/312] phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (154 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 155/312] of_mdio: fix node leak in of_phy_register_fixed_link error path Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 157/312] net: dsa: slave: fix of-node leak and phy priority Greg Kroah-Hartman
                   ` (157 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Lunn, Henri Roosen, David S. Miller

From: Roosen Henri <Henri.Roosen@ginzinger.com>

commit b4c19f71252e3b6b8c6478fd712c592f00b11438 upstream.

Commit 651df2183543 ("phy: micrel: Fix finding PHY properties in MAC
 node.") only fixes finding PHY properties in MAC node for KSZ9021. This
commit applies the same fix for KSZ9031.

Fixes: 8b63ec1837fa ("phylib: Make PHYs children of their MDIO bus, not the bus' parent.")
Acked-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Henri Roosen <henri.roosen@ginzinger.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/micrel.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -482,9 +482,17 @@ static int ksz9031_config_init(struct ph
 		"txd2-skew-ps", "txd3-skew-ps"
 	};
 	static const char *control_skews[2] = {"txen-skew-ps", "rxdv-skew-ps"};
+	const struct device *dev_walker;
 
-	if (!of_node && dev->parent->of_node)
-		of_node = dev->parent->of_node;
+	/* The Micrel driver has a deprecated option to place phy OF
+	 * properties in the MAC node. Walk up the tree of devices to
+	 * find a device with an OF node.
+	 */
+	dev_walker = &phydev->dev;
+	do {
+		of_node = dev_walker->of_node;
+		dev_walker = dev_walker->parent;
+	} while (!of_node && dev_walker);
 
 	if (of_node) {
 		ksz9031_of_load_skew_values(phydev, of_node,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 157/312] net: dsa: slave: fix of-node leak and phy priority
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (155 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 156/312] phy: micrel: Fix finding PHY properties in MAC node for KSZ9031 Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 158/312] drivers: net: cpsw: dont ignore phy-mode if phy-handle is used Greg Kroah-Hartman
                   ` (156 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 0d8f3c67151faaa80e332c254372dca58fb2a9d4 upstream.

Make sure to drop the reference taken by of_parse_phandle() before
returning from dsa_slave_phy_setup().

Note that this also modifies the PHY priority so that any fixed-link
node is only parsed when no phy-handle is given, which is in accordance
with the common scheme for this.

Fixes: 0d8bcdd383b8 ("net: dsa: allow for more complex PHY setups")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/dsa/slave.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1031,7 +1031,7 @@ static int dsa_slave_phy_setup(struct ds
 	p->phy_interface = mode;
 
 	phy_dn = of_parse_phandle(port_dn, "phy-handle", 0);
-	if (of_phy_is_fixed_link(port_dn)) {
+	if (!phy_dn && of_phy_is_fixed_link(port_dn)) {
 		/* In the case of a fixed PHY, the DT node associated
 		 * to the fixed PHY is the Port DT node
 		 */
@@ -1041,7 +1041,7 @@ static int dsa_slave_phy_setup(struct ds
 			return ret;
 		}
 		phy_is_fixed = true;
-		phy_dn = port_dn;
+		phy_dn = of_node_get(port_dn);
 	}
 
 	if (ds->drv->get_phy_flags)
@@ -1060,6 +1060,7 @@ static int dsa_slave_phy_setup(struct ds
 			ret = dsa_slave_phy_connect(p, slave_dev, phy_id);
 			if (ret) {
 				netdev_err(slave_dev, "failed to connect to phy%d: %d\n", phy_id, ret);
+				of_node_put(phy_dn);
 				return ret;
 			}
 		} else {
@@ -1068,6 +1069,8 @@ static int dsa_slave_phy_setup(struct ds
 						phy_flags,
 						p->phy_interface);
 		}
+
+		of_node_put(phy_dn);
 	}
 
 	if (p->phy && phy_is_fixed)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 158/312] drivers: net: cpsw: dont ignore phy-mode if phy-handle is used
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (156 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 157/312] net: dsa: slave: fix of-node leak and phy priority Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 159/312] iommu/dma: Respect IOMMU aperture when allocating Greg Kroah-Hartman
                   ` (155 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Rivshin, Nicolas Chauvet,
	Andrew Goodbody, Mugunthan V N, David S. Miller

From: David Rivshin <drivshin@allworx.com>

commit ae092b5bded24d5dc7dae0e0aef4669c169ce874 upstream.

The phy-mode emac property was only being processed in the phy_id
or fixed-link cases. However if phy-handle was specified instead,
an error message would complain about the lack of phy_id or
fixed-link, and then jump past the of_get_phy_mode(). This would
result in the PHY mode defaulting to MII, regardless of what the
devicetree specified.

Fixes: 9e42f715264f ("drivers: net: cpsw: add phy-handle parsing")
Signed-off-by: David Rivshin <drivshin@allworx.com>
Tested-by: Nicolas Chauvet <kwizart@gmail.com>
Tested-by: Andrew Goodbody <andrew.goodbody@cambrionix.com>
Reviewed-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/cpsw.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2060,7 +2060,11 @@ static int cpsw_probe_dt(struct cpsw_pla
 		slave_data->phy_node = of_parse_phandle(slave_node,
 							"phy-handle", 0);
 		parp = of_get_property(slave_node, "phy_id", &lenp);
-		if (of_phy_is_fixed_link(slave_node)) {
+		if (slave_data->phy_node) {
+			dev_dbg(&pdev->dev,
+				"slave[%d] using phy-handle=\"%s\"\n",
+				i, slave_data->phy_node->full_name);
+		} else if (of_phy_is_fixed_link(slave_node)) {
 			struct device_node *phy_node;
 			struct phy_device *phy_dev;
 
@@ -2097,7 +2101,9 @@ static int cpsw_probe_dt(struct cpsw_pla
 				 PHY_ID_FMT, mdio->name, phyid);
 			put_device(&mdio->dev);
 		} else {
-			dev_err(&pdev->dev, "No slave[%d] phy_id or fixed-link property\n", i);
+			dev_err(&pdev->dev,
+				"No slave[%d] phy_id, phy-handle, or fixed-link property\n",
+				i);
 			goto no_phy_slave;
 		}
 		slave_data->phy_if = of_get_phy_mode(slave_node);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 159/312] iommu/dma: Respect IOMMU aperture when allocating
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (157 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 158/312] drivers: net: cpsw: dont ignore phy-mode if phy-handle is used Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 160/312] mdio-sun4i: oops in error handling in probe Greg Kroah-Hartman
                   ` (154 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Robin Murphy, Joerg Roedel

From: Robin Murphy <robin.murphy@arm.com>

commit c987ff0d3cb37d7fe1ddaa370811dfd9f73643fa upstream.

Where a device driver has set a 64-bit DMA mask to indicate the absence
of addressing limitations, we still need to ensure that we don't
allocate IOVAs beyond the actual input size of the IOMMU. The reported
aperture is the most reliable way we have of inferring that input
address size, so use that to enforce a hard upper limit where available.

Fixes: 0db2e5d18f76 ("iommu: Implement common IOMMU ops for DMA mapping")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/dma-iommu.c |   11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -152,12 +152,15 @@ int dma_direction_to_prot(enum dma_data_
 	}
 }
 
-static struct iova *__alloc_iova(struct iova_domain *iovad, size_t size,
+static struct iova *__alloc_iova(struct iommu_domain *domain, size_t size,
 		dma_addr_t dma_limit)
 {
+	struct iova_domain *iovad = domain->iova_cookie;
 	unsigned long shift = iova_shift(iovad);
 	unsigned long length = iova_align(iovad, size) >> shift;
 
+	if (domain->geometry.force_aperture)
+		dma_limit = min(dma_limit, domain->geometry.aperture_end);
 	/*
 	 * Enforce size-alignment to be safe - there could perhaps be an
 	 * attribute to control this per-device, or at least per-domain...
@@ -297,7 +300,7 @@ struct page **iommu_dma_alloc(struct dev
 	if (!pages)
 		return NULL;
 
-	iova = __alloc_iova(iovad, size, dev->coherent_dma_mask);
+	iova = __alloc_iova(domain, size, dev->coherent_dma_mask);
 	if (!iova)
 		goto out_free_pages;
 
@@ -369,7 +372,7 @@ dma_addr_t iommu_dma_map_page(struct dev
 	phys_addr_t phys = page_to_phys(page) + offset;
 	size_t iova_off = iova_offset(iovad, phys);
 	size_t len = iova_align(iovad, size + iova_off);
-	struct iova *iova = __alloc_iova(iovad, len, dma_get_mask(dev));
+	struct iova *iova = __alloc_iova(domain, len, dma_get_mask(dev));
 
 	if (!iova)
 		return DMA_ERROR_CODE;
@@ -483,7 +486,7 @@ int iommu_dma_map_sg(struct device *dev,
 		prev = s;
 	}
 
-	iova = __alloc_iova(iovad, iova_len, dma_get_mask(dev));
+	iova = __alloc_iova(domain, iova_len, dma_get_mask(dev));
 	if (!iova)
 		goto out_restore_sg;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 160/312] mdio-sun4i: oops in error handling in probe
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (158 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 159/312] iommu/dma: Respect IOMMU aperture when allocating Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 161/312] iio:ad7797: Use correct attribute_group Greg Kroah-Hartman
                   ` (153 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Chen-Yu Tsai, David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 227f33beab746aeec4ef3305bd17b1d374df09e7 upstream.

We could end up dereferencing an error pointer when we call
regulator_disable().

Fixes: 4bdcb1dd9feb ('net: Add MDIO bus driver for the Allwinner EMAC')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/mdio-sun4i.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/phy/mdio-sun4i.c
+++ b/drivers/net/phy/mdio-sun4i.c
@@ -134,6 +134,7 @@ static int sun4i_mdio_probe(struct platf
 		}
 
 		dev_info(&pdev->dev, "no regulator found\n");
+		data->regulator = NULL;
 	} else {
 		ret = regulator_enable(data->regulator);
 		if (ret)
@@ -149,7 +150,8 @@ static int sun4i_mdio_probe(struct platf
 	return 0;
 
 err_out_disable_regulator:
-	regulator_disable(data->regulator);
+	if (data->regulator)
+		regulator_disable(data->regulator);
 err_out_free_mdiobus:
 	mdiobus_free(bus);
 	return ret;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 161/312] iio:ad7797: Use correct attribute_group
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (159 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 160/312] mdio-sun4i: oops in error handling in probe Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 162/312] selftests/ipc: Fix test failure seen after initial test run Greg Kroah-Hartman
                   ` (152 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, YueHaibing, Lars-Peter Clausen,
	Jonathan Cameron, Sasha Levin

From: YueHaibing <yuehaibing@huawei.com>

[ Upstream commit 28535877ac5b2b84f0d394fd67a5ec71c0c48b10 ]

It should use ad7797_attribute_group in ad7797_info,
according to commit ("iio:ad7793: Add support for the ad7796 and ad7797").

Scale is fixed for the ad7796 and not programmable, hence
should not have the scale_available attribute.

Fixes: fd1a8b912841 ("iio:ad7793: Add support for the ad7796 and ad7797")
Signed-off-by: YueHaibing <yuehaibing@huawei.com>
Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/iio/adc/ad7793.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
index 91d34ed756eaf..fe0c5a155e211 100644
--- a/drivers/iio/adc/ad7793.c
+++ b/drivers/iio/adc/ad7793.c
@@ -579,7 +579,7 @@ static const struct iio_info ad7797_info = {
 	.read_raw = &ad7793_read_raw,
 	.write_raw = &ad7793_write_raw,
 	.write_raw_get_fmt = &ad7793_write_raw_get_fmt,
-	.attrs = &ad7793_attribute_group,
+	.attrs = &ad7797_attribute_group,
 	.validate_trigger = ad_sd_validate_trigger,
 	.driver_module = THIS_MODULE,
 };
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 162/312] selftests/ipc: Fix test failure seen after initial test run
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (160 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 161/312] iio:ad7797: Use correct attribute_group Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 163/312] wimax/i2400m: Fix potential urb refcnt leak Greg Kroah-Hartman
                   ` (151 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tyler Hicks, Shuah Khan, Sasha Levin

From: Tyler Hicks <tyhicks@linux.microsoft.com>

[ Upstream commit b87080eab4c1377706c113fc9c0157f19ea8fed1 ]

After successfully running the IPC msgque test once, subsequent runs
result in a test failure:

  $ sudo ./run_kselftest.sh
  TAP version 13
  1..1
  # selftests: ipc: msgque
  # Failed to get stats for IPC queue with id 0
  # Failed to dump queue: -22
  # Bail out!
  # # Pass 0 Fail 0 Xfail 0 Xpass 0 Skip 0 Error 0
  not ok 1 selftests: ipc: msgque # exit=1

The dump_queue() function loops through the possible message queue index
values using calls to msgctl(kern_id, MSG_STAT, ...) where kern_id
represents the index value. The first time the test is ran, the initial
index value of 0 is valid and the test is able to complete. The index
value of 0 is not valid in subsequent test runs and the loop attempts to
try index values of 1, 2, 3, and so on until a valid index value is
found that corresponds to the message queue created earlier in the test.

The msgctl() syscall returns -1 and sets errno to EINVAL when invalid
index values are used. The test failure is caused by incorrectly
comparing errno to -EINVAL when cycling through possible index values.

Fix invalid test failures on subsequent runs of the msgque test by
correctly comparing errno values to a non-negated EINVAL.

Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/testing/selftests/ipc/msgque.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
index 1b2ce334bb3f0..47c074d73e610 100644
--- a/tools/testing/selftests/ipc/msgque.c
+++ b/tools/testing/selftests/ipc/msgque.c
@@ -135,7 +135,7 @@ int dump_queue(struct msgque_data *msgque)
 	for (kern_id = 0; kern_id < 256; kern_id++) {
 		ret = msgctl(kern_id, MSG_STAT, &ds);
 		if (ret < 0) {
-			if (errno == -EINVAL)
+			if (errno == EINVAL)
 				continue;
 			printf("Failed to get stats for IPC queue with id %d\n",
 					kern_id);
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 163/312] wimax/i2400m: Fix potential urb refcnt leak
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (161 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 162/312] selftests/ipc: Fix test failure seen after initial test run Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 164/312] cifs: protect updating server->dstaddr with a spinlock Greg Kroah-Hartman
                   ` (150 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Xiyu Yang, Xin Tan, David S. Miller,
	Sasha Levin

From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]

i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
refcount of the "notif_urb".

When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
becomes invalid, so the refcount should be decreased to keep refcount
balanced.

The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
forget to decrease the refcnt increased by usb_get_urb(), causing a
refcnt leak.

Fix this issue by calling usb_put_urb() before the
i2400mu_bus_bm_wait_for_ack() returns.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wimax/i2400m/usb-fw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
index e74664b84925e..4e4167976acf6 100644
--- a/drivers/net/wimax/i2400m/usb-fw.c
+++ b/drivers/net/wimax/i2400m/usb-fw.c
@@ -354,6 +354,7 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
 		usb_autopm_put_interface(i2400mu->usb_iface);
 	d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
 		i2400m, ack, ack_size, (long) result);
+	usb_put_urb(&notif_urb);
 	return result;
 
 error_exceeded:
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 164/312] cifs: protect updating server->dstaddr with a spinlock
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (162 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 163/312] wimax/i2400m: Fix potential urb refcnt leak Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 165/312] scripts/config: allow colons in option strings for sed Greg Kroah-Hartman
                   ` (149 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Ronnie Sahlberg, Jeff Layton,
	Steve French, Sasha Levin

From: Ronnie Sahlberg <lsahlber@redhat.com>

[ Upstream commit fada37f6f62995cc449b36ebba1220594bfe55fe ]

We use a spinlock while we are reading and accessing the destination address for a server.
We need to also use this spinlock to protect when we are modifying this address from
reconn_set_ipaddr().

Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/cifs/connect.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index cf104bbe30a14..c9793ce0d3368 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -338,8 +338,10 @@ static int reconn_set_ipaddr(struct TCP_Server_Info *server)
 		return rc;
 	}
 
+	spin_lock(&cifs_tcp_ses_lock);
 	rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
 				  strlen(ipaddr));
+	spin_unlock(&cifs_tcp_ses_lock);
 	kfree(ipaddr);
 
 	return !rc ? -1 : 0;
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 165/312] scripts/config: allow colons in option strings for sed
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (163 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 164/312] cifs: protect updating server->dstaddr with a spinlock Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 166/312] lib/mpi: Fix building for powerpc with clang Greg Kroah-Hartman
                   ` (148 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeremie Francois (on alpha),
	Masahiro Yamada, Sasha Levin

From: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>

[ Upstream commit e461bc9f9ab105637b86065d24b0b83f182d477c ]

Sed broke on some strings as it used colon as a separator.
I made it more robust by using \001, which is legit POSIX AFAIK.

E.g. ./config --set-str CONFIG_USBNET_DEVADDR "de:ad:be:ef:00:01"
failed with: sed: -e expression #1, char 55: unknown option to `s'

Signed-off-by: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 scripts/config | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/config b/scripts/config
index 026aeb4f32ee3..73de17d396987 100755
--- a/scripts/config
+++ b/scripts/config
@@ -6,6 +6,9 @@ myname=${0##*/}
 # If no prefix forced, use the default CONFIG_
 CONFIG_="${CONFIG_-CONFIG_}"
 
+# We use an uncommon delimiter for sed substitutions
+SED_DELIM=$(echo -en "\001")
+
 usage() {
 	cat >&2 <<EOL
 Manipulate options in a .config file from the command line.
@@ -82,7 +85,7 @@ txt_subst() {
 	local infile="$3"
 	local tmpfile="$infile.swp"
 
-	sed -e "s:$before:$after:" "$infile" >"$tmpfile"
+	sed -e "s$SED_DELIM$before$SED_DELIM$after$SED_DELIM" "$infile" >"$tmpfile"
 	# replace original file with the edited one
 	mv "$tmpfile" "$infile"
 }
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 166/312] lib/mpi: Fix building for powerpc with clang
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (164 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 165/312] scripts/config: allow colons in option strings for sed Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 167/312] net: bcmgenet: suppress warnings on failed Rx SKB allocations Greg Kroah-Hartman
                   ` (147 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, kbuild test robot, Nathan Chancellor,
	Herbert Xu, Michael Ellerman, Sasha Levin

From: Nathan Chancellor <natechancellor@gmail.com>

[ Upstream commit 5990cdee689c6885b27c6d969a3d58b09002b0bc ]

0day reports over and over on an powerpc randconfig with clang:

lib/mpi/generic_mpih-mul1.c:37:13: error: invalid use of a cast in a
inline asm context requiring an l-value: remove the cast or build with
-fheinous-gnu-extensions

Remove the superfluous casts, which have been done previously for x86
and arm32 in commit dea632cadd12 ("lib/mpi: fix build with clang") and
commit 7b7c1df2883d ("lib/mpi/longlong.h: fix building with 32-bit
x86").

Reported-by: kbuild test robot <lkp@intel.com>
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://github.com/ClangBuiltLinux/linux/issues/991
Link: https://lore.kernel.org/r/20200413195041.24064-1-natechancellor@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/mpi/longlong.h | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
index d2ecf0a09180c..f1f31c754b3e6 100644
--- a/lib/mpi/longlong.h
+++ b/lib/mpi/longlong.h
@@ -756,22 +756,22 @@ do {									\
 do { \
 	if (__builtin_constant_p(bh) && (bh) == 0) \
 		__asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"%r" ((USItype)(al)), \
 		"rI" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
 		__asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"%r" ((USItype)(al)), \
 		"rI" ((USItype)(bl))); \
 	else \
 		__asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "%r" ((USItype)(ah)), \
 		"r" ((USItype)(bh)), \
 		"%r" ((USItype)(al)), \
@@ -781,36 +781,36 @@ do { \
 do { \
 	if (__builtin_constant_p(ah) && (ah) == 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(ah) && (ah) == ~(USItype) 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
 		__asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"rI" ((USItype)(al)), \
 		"r" ((USItype)(bl))); \
 	else \
 		__asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
-		: "=r" ((USItype)(sh)), \
-		"=&r" ((USItype)(sl)) \
+		: "=r" (sh), \
+		"=&r" (sl) \
 		: "r" ((USItype)(ah)), \
 		"r" ((USItype)(bh)), \
 		"rI" ((USItype)(al)), \
@@ -821,7 +821,7 @@ do { \
 do { \
 	USItype __m0 = (m0), __m1 = (m1); \
 	__asm__ ("mulhwu %0,%1,%2" \
-	: "=r" ((USItype) ph) \
+	: "=r" (ph) \
 	: "%r" (__m0), \
 	"r" (__m1)); \
 	(pl) = __m0 * __m1; \
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 167/312] net: bcmgenet: suppress warnings on failed Rx SKB allocations
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (165 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 166/312] lib/mpi: Fix building for powerpc with clang Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 168/312] net: systemport: " Greg Kroah-Hartman
                   ` (146 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Berger, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Doug Berger <opendmb@gmail.com>

[ Upstream commit ecaeceb8a8a145d93c7e136f170238229165348f ]

The driver is designed to drop Rx packets and reclaim the buffers
when an allocation fails, and the network interface needs to safely
handle this packet loss. Therefore, an allocation failure of Rx
SKBs is relatively benign.

However, the output of the warning message occurs with a high
scheduling priority that can cause excessive jitter/latency for
other high priority processing.

This commit suppresses the warning messages to prevent scheduling
problems while retaining the failure count in the statistics of
the network interface.

Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 34fae5576b603..4b3b396bd8ebe 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1575,7 +1575,8 @@ static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
 	dma_addr_t mapping;
 
 	/* Allocate a new Rx skb */
-	skb = netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT);
+	skb = __netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT,
+				 GFP_ATOMIC | __GFP_NOWARN);
 	if (!skb) {
 		priv->mib.alloc_rx_buff_failed++;
 		netif_err(priv, rx_err, priv->dev,
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 168/312] net: systemport: suppress warnings on failed Rx SKB allocations
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (166 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 167/312] net: bcmgenet: suppress warnings on failed Rx SKB allocations Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 169/312] [media] rc: allow rc modules to be loaded if rc-main is not a module Greg Kroah-Hartman
                   ` (145 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Doug Berger, Florian Fainelli,
	David S. Miller, Sasha Levin

From: Doug Berger <opendmb@gmail.com>

[ Upstream commit 3554e54a46125030c534820c297ed7f6c3907e24 ]

The driver is designed to drop Rx packets and reclaim the buffers
when an allocation fails, and the network interface needs to safely
handle this packet loss. Therefore, an allocation failure of Rx
SKBs is relatively benign.

However, the output of the warning message occurs with a high
scheduling priority that can cause excessive jitter/latency for
other high priority processing.

This commit suppresses the warning messages to prevent scheduling
problems while retaining the failure count in the statistics of
the network interface.

Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/broadcom/bcmsysport.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 3cb99ce7325b7..d46ea7a5e0886 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -526,7 +526,8 @@ static struct sk_buff *bcm_sysport_rx_refill(struct bcm_sysport_priv *priv,
 	dma_addr_t mapping;
 
 	/* Allocate a new SKB for a new packet */
-	skb = netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH);
+	skb = __netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH,
+				 GFP_ATOMIC | __GFP_NOWARN);
 	if (!skb) {
 		priv->mib.alloc_rx_buff_failed++;
 		netif_err(priv, rx_err, ndev, "SKB alloc failed\n");
-- 
2.20.1




^ permalink raw reply related	[flat|nested] 319+ messages in thread

* [PATCH 4.4 169/312] [media] rc: allow rc modules to be loaded if rc-main is not a module
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (167 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 168/312] net: systemport: " Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 170/312] [media] lirc_imon: do not leave imon_probe() with mutex held Greg Kroah-Hartman
                   ` (144 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Russell King, Mauro Carvalho Chehab

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit 2ff56fadd94cdaeeaeccbc0a9b703a0101ada128 upstream.

rc-main mistakenly uses #ifdef MODULE to determine whether it should
load the rc keymap modules.  This symbol is only defined if rc-main
is being built as a module itself, and bears no relation to whether
the rc keymaps are modules.

Fix this to use CONFIG_MODULES instead.

Fixes: 631493ecacd8 ("[media] rc-core: merge rc-map.c into rc-main.c")

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/rc-main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -61,7 +61,7 @@ struct rc_map *rc_map_get(const char *na
 	struct rc_map_list *map;
 
 	map = seek_rc_map(name);
-#ifdef MODULE
+#ifdef CONFIG_MODULES
 	if (!map) {
 		int rc = request_module("%s", name);
 		if (rc < 0) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 170/312] [media] lirc_imon: do not leave imon_probe() with mutex held
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (168 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 169/312] [media] rc: allow rc modules to be loaded if rc-main is not a module Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 171/312] [media] am437x-vpfe: fix an uninitialized variable bug Greg Kroah-Hartman
                   ` (143 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Khoroshilov, Mauro Carvalho Chehab

From: Alexey Khoroshilov <khoroshilov@ispras.ru>

commit b833d0df943d70682e288c38c96b8e7bfff4023a upstream.

Commit af8a819a2513 ("[media] lirc_imon: simplify error handling code")
lost mutex_unlock(&context->ctx_lock), so imon_probe() exits with
the context->ctx_lock mutex acquired.

The patch adds mutex_unlock(&context->ctx_lock) back.

Found by Linux Driver Verification project (linuxtesting.org).

Fixes: af8a819a2513 ("[media] lirc_imon: simplify error handling code")

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/media/lirc/lirc_imon.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/staging/media/lirc/lirc_imon.c
+++ b/drivers/staging/media/lirc/lirc_imon.c
@@ -885,12 +885,14 @@ static int imon_probe(struct usb_interfa
 		vendor, product, ifnum, usbdev->bus->busnum, usbdev->devnum);
 
 	/* Everything went fine. Just unlock and return retval (with is 0) */
+	mutex_unlock(&context->ctx_lock);
 	goto driver_unlock;
 
 unregister_lirc:
 	lirc_unregister_driver(driver->minor);
 
 free_tx_urb:
+	mutex_unlock(&context->ctx_lock);
 	usb_free_urb(tx_urb);
 
 free_rx_urb:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 171/312] [media] am437x-vpfe: fix an uninitialized variable bug
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (169 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 170/312] [media] lirc_imon: do not leave imon_probe() with mutex held Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 172/312] [media] cx23885: uninitialized variable in cx23885_av_work_handler() Greg Kroah-Hartman
                   ` (142 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Lad, Prabhakar,
	Hans Verkuil, Mauro Carvalho Chehab

From: Dan Carpenter <dan.carpenter@oracle.com>

commit e4bccada44c177cde31b9a236b7dfd7f76d403ed upstream.

If we are doing V4L2_FIELD_NONE then "ret" is used uninitialized.

Fixes: 417d2e507edc ('[media] media: platform: add VPFE capture driver support for AM437X')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/platform/am437x/am437x-vpfe.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/platform/am437x/am437x-vpfe.c
+++ b/drivers/media/platform/am437x/am437x-vpfe.c
@@ -1047,7 +1047,7 @@ static int vpfe_get_ccdc_image_format(st
 static int vpfe_config_ccdc_image_format(struct vpfe_device *vpfe)
 {
 	enum ccdc_frmfmt frm_fmt = CCDC_FRMFMT_INTERLACED;
-	int ret;
+	int ret = 0;
 
 	vpfe_dbg(2, vpfe, "vpfe_config_ccdc_image_format\n");
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 172/312] [media] cx23885: uninitialized variable in cx23885_av_work_handler()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (170 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 171/312] [media] am437x-vpfe: fix an uninitialized variable bug Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 173/312] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Greg Kroah-Hartman
                   ` (141 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Hans Verkuil,
	Mauro Carvalho Chehab

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 60587bd0680507f48ae3a7360983228fd207de8a upstream.

The "handled" variable could be uninitialized if the
interrupt_service_routine() call back hasn't been implimented or if it
has been implemented but doesn't initialize "handled" to zero at the
start.  For example, adv76xx_isr() only sets "handled" to true.

Fixes: 44b153ca639f ('[media] m5mols: Add ISO sensitivity controls')

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/cx23885/cx23885-av.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/media/pci/cx23885/cx23885-av.c
+++ b/drivers/media/pci/cx23885/cx23885-av.c
@@ -24,7 +24,7 @@ void cx23885_av_work_handler(struct work
 {
 	struct cx23885_dev *dev =
 			   container_of(work, struct cx23885_dev, cx25840_work);
-	bool handled;
+	bool handled = false;
 
 	v4l2_subdev_call(dev->sd_cx25840, core, interrupt_service_routine,
 			 PCI_MSK_AV_CORE, &handled);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 173/312] ath9k_htc: check for underflow in ath9k_htc_rx_msg()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (171 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 172/312] [media] cx23885: uninitialized variable in cx23885_av_work_handler() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 174/312] VFIO: platform: reset: fix a warning message condition Greg Kroah-Hartman
                   ` (140 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Kalle Valo

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 3a318426e09a9c9266fe6440842e11238f640a20 upstream.

We check for overflow here, but we don't check for underflow so it
causes a static checker warning.

Fixes: fb9987d0f748 ('ath9k_htc: Support for AR9271 chipset.')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath9k/htc_hst.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -414,7 +414,7 @@ void ath9k_htc_rx_msg(struct htc_target
 		return;
 	}
 
-	if (epid >= ENDPOINT_MAX) {
+	if (epid < 0 || epid >= ENDPOINT_MAX) {
 		if (pipe_id != USB_REG_IN_PIPE)
 			dev_kfree_skb_any(skb);
 		else



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 174/312] VFIO: platform: reset: fix a warning message condition
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (172 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 173/312] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 175/312] net: moxa: fix an error code Greg Kroah-Hartman
                   ` (139 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Eric Auger, Alex Williamson

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 967628827f404b3063016c138ccc7b06c54350f8 upstream.

This loop ends with count set to -1 and not zero so the warning message
isn't printed when it should be.  I've fixed this by change the postop
to a preop.

Fixes: 0990822c9866 ('VFIO: platform: reset: AMD xgbe reset module')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Eric Auger <eric.auger@linaro.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vfio/platform/reset/vfio_platform_amdxgbe.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/vfio/platform/reset/vfio_platform_amdxgbe.c
+++ b/drivers/vfio/platform/reset/vfio_platform_amdxgbe.c
@@ -110,7 +110,7 @@ int vfio_platform_amdxgbe_reset(struct v
 	usleep_range(10, 15);
 
 	count = 2000;
-	while (count-- && (ioread32(xgmac_regs->ioaddr + DMA_MR) & 1))
+	while (--count && (ioread32(xgmac_regs->ioaddr + DMA_MR) & 1))
 		usleep_range(500, 600);
 
 	if (!count)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 175/312] net: moxa: fix an error code
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (173 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 174/312] VFIO: platform: reset: fix a warning message condition Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 176/312] mfd: lp8788-irq: Uninitialized variable in irq handler Greg Kroah-Hartman
                   ` (138 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Arnd Bergmann,
	David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 1d3cd1773fddfdc9ffb0c2dec9a954c7a54bc207 upstream.

We accidentally return IS_ERR(priv->base) which is 1 instead of
PTR_ERR(priv->base) which is the error code.

Fixes: 6c821bd9edc9 ('net: Add MOXA ART SoCs ethernet driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/moxa/moxart_ether.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/moxa/moxart_ether.c
+++ b/drivers/net/ethernet/moxa/moxart_ether.c
@@ -460,9 +460,9 @@ static int moxart_mac_probe(struct platf
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	ndev->base_addr = res->start;
 	priv->base = devm_ioremap_resource(p_dev, res);
-	ret = IS_ERR(priv->base);
-	if (ret) {
+	if (IS_ERR(priv->base)) {
 		dev_err(p_dev, "devm_ioremap_resource failed\n");
+		ret = PTR_ERR(priv->base);
 		goto init_fail;
 	}
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 176/312] mfd: lp8788-irq: Uninitialized variable in irq handler
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (174 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 175/312] net: moxa: fix an error code Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 177/312] ethernet: micrel: fix some error codes Greg Kroah-Hartman
                   ` (137 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Milo Kim, Lee Jones

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 22aab38e7b59fd79ce1045006be69a9abab58e5a upstream.

Instead to being true/false, the "handled" is true/uninitialized.
Presumably this doesn't cause that many problems in real life because
normally we handle the IRQ.

Fixes: eea6b7cc53aa ('mfd: Add lp8788 mfd driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Milo Kim <milo.kim@ti.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mfd/lp8788-irq.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/mfd/lp8788-irq.c
+++ b/drivers/mfd/lp8788-irq.c
@@ -112,7 +112,7 @@ static irqreturn_t lp8788_irq_handler(in
 	struct lp8788_irq_data *irqd = ptr;
 	struct lp8788 *lp = irqd->lp;
 	u8 status[NUM_REGS], addr, mask;
-	bool handled;
+	bool handled = false;
 	int i;
 
 	if (lp8788_read_multi_bytes(lp, LP8788_INT_1, status, NUM_REGS))



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 177/312] ethernet: micrel: fix some error codes
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (175 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 176/312] mfd: lp8788-irq: Uninitialized variable in irq handler Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 178/312] power: ipaq-micro-battery: freeing the wrong variable Greg Kroah-Hartman
                   ` (136 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 3af0d554c1ce11e9d0953381ff566271f9ab81a9 upstream.

There were two issues here:
1) dma_mapping_error() return true/false but we want to return -ENOMEM
2) If dmaengine_prep_slave_sg() failed then "err" wasn't set but
   presumably that should be -ENOMEM as well.

I changed the success path to "return 0;" instead of "return ret;" for
clarity.

Fixes: 94fe8c683cea ('ks8842: Support DMA when accessed via timberdale')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/micrel/ks8842.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/micrel/ks8842.c
+++ b/drivers/net/ethernet/micrel/ks8842.c
@@ -561,8 +561,8 @@ static int __ks8842_start_new_rx_dma(str
 		sg_init_table(sg, 1);
 		sg_dma_address(sg) = dma_map_single(adapter->dev,
 			ctl->skb->data, DMA_BUFFER_SIZE, DMA_FROM_DEVICE);
-		err = dma_mapping_error(adapter->dev, sg_dma_address(sg));
-		if (unlikely(err)) {
+		if (dma_mapping_error(adapter->dev, sg_dma_address(sg))) {
+			err = -ENOMEM;
 			sg_dma_address(sg) = 0;
 			goto out;
 		}
@@ -572,8 +572,10 @@ static int __ks8842_start_new_rx_dma(str
 		ctl->adesc = dmaengine_prep_slave_sg(ctl->chan,
 			sg, 1, DMA_DEV_TO_MEM, DMA_PREP_INTERRUPT);
 
-		if (!ctl->adesc)
+		if (!ctl->adesc) {
+			err = -ENOMEM;
 			goto out;
+		}
 
 		ctl->adesc->callback_param = netdev;
 		ctl->adesc->callback = ks8842_dma_rx_cb;
@@ -584,7 +586,7 @@ static int __ks8842_start_new_rx_dma(str
 		goto out;
 	}
 
-	return err;
+	return 0;
 out:
 	if (sg_dma_address(sg))
 		dma_unmap_single(adapter->dev, sg_dma_address(sg),



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 178/312] power: ipaq-micro-battery: freeing the wrong variable
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (176 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 177/312] ethernet: micrel: fix some error codes Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 179/312] i40e: fix an uninitialized variable bug Greg Kroah-Hartman
                   ` (135 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Sebastian Reichel

From: Dan Carpenter <dan.carpenter@oracle.com>

commit b9223da41794030a5dfd5106c34ed1b98255e2ae upstream.

We accidentally free "micro_ac_power" which is an error pointer and it
leads to an oops.  We intended to free "micro_batt_power".

Fixes: a2c1d531854c ('power_supply: ipaq_micro_battery: Check return values in probe')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/ipaq_micro_battery.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/power/ipaq_micro_battery.c
+++ b/drivers/power/ipaq_micro_battery.c
@@ -261,7 +261,7 @@ static int micro_batt_probe(struct platf
 	return 0;
 
 ac_err:
-	power_supply_unregister(micro_ac_power);
+	power_supply_unregister(micro_batt_power);
 batt_err:
 	cancel_delayed_work_sync(&mb->update);
 	destroy_workqueue(mb->wq);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 179/312] i40e: fix an uninitialized variable bug
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (177 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 178/312] power: ipaq-micro-battery: freeing the wrong variable Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 180/312] qede: uninitialized variable in qede_start_xmit() Greg Kroah-Hartman
                   ` (134 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Andrew Bowers, Jeff Kirsher

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 1c306f7f62a38ee5f05f0ee994dfe82d654cf47c upstream.

We removed this initialization but it is required.  Let's put it back.

Fixes: 895106a577c4 ('i40e: trivial fixes')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/intel/i40e/i40e_hmc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/intel/i40e/i40e_hmc.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_hmc.c
@@ -49,7 +49,7 @@ i40e_status i40e_add_sd_table_entry(stru
 	struct i40e_hmc_sd_entry *sd_entry;
 	bool dma_mem_alloc_done = false;
 	struct i40e_dma_mem mem;
-	i40e_status ret_code;
+	i40e_status ret_code = I40E_SUCCESS;
 	u64 alloc_len;
 
 	if (NULL == hmc_info->sd_table.sd_entry) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 180/312] qede: uninitialized variable in qede_start_xmit()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (178 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 179/312] i40e: fix an uninitialized variable bug Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 181/312] qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() Greg Kroah-Hartman
                   ` (133 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 810810ffb2f6d46365d0790bbe77698a5534393a upstream.

"data_split" was never set to false.  It's just uninitialized.

Fixes: 2950219d87b0 ('qede: Add basic network device support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/qlogic/qede/qede_main.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -400,7 +400,7 @@ netdev_tx_t qede_start_xmit(struct sk_bu
 	u8 xmit_type;
 	u16 idx;
 	u16 hlen;
-	bool data_split;
+	bool data_split = false;
 
 	/* Get tx-queue context and netdev index */
 	txq_index = skb_get_queue_mapping(skb);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 181/312] qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (179 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 180/312] qede: uninitialized variable in qede_start_xmit() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 182/312] qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() Greg Kroah-Hartman
                   ` (132 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 5f46feab87bb105d6a217d966b327fdc56696802 upstream.

If qlcnic_fw_cmd_get_minidump_temp() fails then "fw_dump->tmpl_hdr" is
NULL or possibly freed.  It can lead to an oops later.

Fixes: d01a6d3c8ae1 ('qlcnic: Add support to enable capability to extend minidump for iSCSI')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c
@@ -1419,6 +1419,7 @@ void qlcnic_83xx_get_minidump_template(s
 	struct qlcnic_fw_dump *fw_dump = &ahw->fw_dump;
 	struct pci_dev *pdev = adapter->pdev;
 	bool extended = false;
+	int ret;
 
 	prev_version = adapter->fw_version;
 	current_version = qlcnic_83xx_get_fw_version(adapter);
@@ -1429,8 +1430,11 @@ void qlcnic_83xx_get_minidump_template(s
 		if (qlcnic_83xx_md_check_extended_dump_capability(adapter))
 			extended = !qlcnic_83xx_extend_md_capab(adapter);
 
-		if (!qlcnic_fw_cmd_get_minidump_temp(adapter))
-			dev_info(&pdev->dev, "Supports FW dump capability\n");
+		ret = qlcnic_fw_cmd_get_minidump_temp(adapter);
+		if (ret)
+			return;
+
+		dev_info(&pdev->dev, "Supports FW dump capability\n");
 
 		/* Once we have minidump template with extended iSCSI dump
 		 * capability, update the minidump capture mask to 0x1f as



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 182/312] qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (180 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 181/312] qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 183/312] target: Fix a memory leak in target_dev_lba_map_store() Greg Kroah-Hartman
                   ` (131 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 5b4d10f5e0369ed79434593b7cd8e85eebbe473f upstream.

There is a static checker warning here "warn: mask and shift to zero"
and the code sets "ring" to zero every time.  From looking at how
QLCNIC_FETCH_RING_ID() is used in qlcnic_83xx_process_rcv_ring() the
qlcnic_83xx_hndl() should be removed.

Fixes: 4be41e92f7c6 ('qlcnic: 83xx data path routines')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -2220,7 +2220,7 @@ void qlcnic_83xx_process_rcv_ring_diag(s
 	if (!opcode)
 		return;
 
-	ring = QLCNIC_FETCH_RING_ID(qlcnic_83xx_hndl(sts_data[0]));
+	ring = QLCNIC_FETCH_RING_ID(sts_data[0]);
 	qlcnic_83xx_process_rcv_diag(adapter, ring, sts_data);
 	desc = &sds_ring->desc_head[consumer];
 	desc->status_desc_data[0] = cpu_to_le64(STATUS_OWNER_PHANTOM);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 183/312] target: Fix a memory leak in target_dev_lba_map_store()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (181 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 182/312] qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 184/312] memory/tegra: Add number of TLB lines for Tegra124 Greg Kroah-Hartman
                   ` (130 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Hannes Reinecke,
	Christoph Hellwig, Andy Grover, Sagi Grimberg,
	Nicholas Bellinger

From: Bart Van Assche <bart.vanassche@sandisk.com>

commit f0a8afecb29ad0005e7e946228a0ef5422058b85 upstream.

strsep() modifies its first argument. Make the pointer passed to kfree()
match the return value of kmalloc().

Fixes: 229d4f112fd6 (commit "target_core_alua: Referrals configfs integration")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_configfs.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -1980,14 +1980,14 @@ static ssize_t target_dev_lba_map_store(
 	struct se_device *dev = to_device(item);
 	struct t10_alua_lba_map *lba_map = NULL;
 	struct list_head lba_list;
-	char *map_entries, *ptr;
+	char *map_entries, *orig, *ptr;
 	char state;
 	int pg_num = -1, pg;
 	int ret = 0, num = 0, pg_id, alua_state;
 	unsigned long start_lba = -1, end_lba = -1;
 	unsigned long segment_size = -1, segment_mult = -1;
 
-	map_entries = kstrdup(page, GFP_KERNEL);
+	orig = map_entries = kstrdup(page, GFP_KERNEL);
 	if (!map_entries)
 		return -ENOMEM;
 
@@ -2085,7 +2085,7 @@ out:
 	} else
 		core_alua_set_lba_map(dev, &lba_list,
 				      segment_size, segment_mult);
-	kfree(map_entries);
+	kfree(orig);
 	return count;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 184/312] memory/tegra: Add number of TLB lines for Tegra124
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (182 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 183/312] target: Fix a memory leak in target_dev_lba_map_store() Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 185/312] pinctrl: bcm2835: Fix memory leak in error path Greg Kroah-Hartman
                   ` (129 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vince Hsu, Tomasz Figa, Thierry Reding

From: Vince Hsu <vince.h@nvidia.com>

commit e2127ae7a5e80eb53ad431c39145767391da40cd upstream.

Tegra124 was accidentally left out when the number of TLB lines was
parameterized in commit 11cec15bf3fb ("iommu/tegra-smmu: Parameterize
number of TLB lines"). Fortunately this doesn't cause any noticeable
regressions upstream, presumably because there aren't any use-cases
that exercise enough pressure on the SMMU. But it is a regression
nonetheless, so let's fix it.

Fixes: 11cec15bf3fb ("iommu/tegra-smmu: Parameterize number of TLB lines")
Signed-off-by: Vince Hsu <vince.h@nvidia.com>
Signed-off-by: Tomasz Figa <tfiga@chromium.org>
[treding@nvidia.com: extract from unrelated patch]
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/memory/tegra/tegra124.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/memory/tegra/tegra124.c
+++ b/drivers/memory/tegra/tegra124.c
@@ -1007,6 +1007,7 @@ static const struct tegra_smmu_soc tegra
 	.num_swgroups = ARRAY_SIZE(tegra124_swgroups),
 	.supports_round_robin_arbitration = true,
 	.supports_request_limit = true,
+	.num_tlb_lines = 32,
 	.num_asids = 128,
 };
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 185/312] pinctrl: bcm2835: Fix memory leak in error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (183 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 184/312] memory/tegra: Add number of TLB lines for Tegra124 Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 186/312] be2net: Dont leak iomapped memory on removal Greg Kroah-Hartman
                   ` (128 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Eric Anholt, Linus Walleij

From: Stefan Wahren <stefan.wahren@i2se.com>

commit 53653c6b91750debba6dc4503003c851257fd340 upstream.

In case of an invalid pin value bcm2835_pctl_dt_node_to_map()
would leak the pull configs of already assigned pins.
So avoid this by calling the free map function in error case.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: e1b2dc70cd5b ("pinctrl: add bcm2835 driver")
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -795,7 +795,7 @@ static int bcm2835_pctl_dt_node_to_map(s
 	return 0;
 
 out:
-	kfree(maps);
+	bcm2835_pctl_dt_free_map(pctldev, maps, num_pins * maps_per_pin);
 	return err;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 186/312] be2net: Dont leak iomapped memory on removal.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (184 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 185/312] pinctrl: bcm2835: Fix memory leak in error path Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 187/312] ipv4: Fix memory leak in exception case for splitting tries Greg Kroah-Hartman
                   ` (127 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Douglas Miller, David S. Miller

From: Douglas Miller <dougmill@linux.vnet.ibm.com>

commit a69bf3c5b49ef488970c74e26ba0ec12f08491c2 upstream.

The adapter->pcicfg resource is either mapped via pci_iomap() or
derived from adapter->db. During be_remove() this resource was ignored
and so could remain mapped after remove.

Add a flag to track whether adapter->pcicfg was mapped or not, then
use that flag in be_unmap_pci_bars() to unmap if required.

Fixes: 25848c901 ("use PCI MMIO read instead of config read for errors")

Signed-off-by: Douglas Miller <dougmill@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/emulex/benet/be.h      |    1 +
 drivers/net/ethernet/emulex/benet/be_main.c |    4 ++++
 2 files changed, 5 insertions(+)

--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -531,6 +531,7 @@ struct be_adapter {
 
 	struct delayed_work be_err_detection_work;
 	u8 err_flags;
+	bool pcicfg_mapped;	/* pcicfg obtained via pci_iomap() */
 	u32 flags;
 	u32 cmd_privileges;
 	/* Ethtool knobs and info */
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -5526,6 +5526,8 @@ static void be_unmap_pci_bars(struct be_
 		pci_iounmap(adapter->pdev, adapter->csr);
 	if (adapter->db)
 		pci_iounmap(adapter->pdev, adapter->db);
+	if (adapter->pcicfg && adapter->pcicfg_mapped)
+		pci_iounmap(adapter->pdev, adapter->pcicfg);
 }
 
 static int db_bar(struct be_adapter *adapter)
@@ -5577,8 +5579,10 @@ static int be_map_pci_bars(struct be_ada
 			if (!addr)
 				goto pci_map_err;
 			adapter->pcicfg = addr;
+			adapter->pcicfg_mapped = true;
 		} else {
 			adapter->pcicfg = adapter->db + SRIOV_VF_PCICFG_OFFSET;
+			adapter->pcicfg_mapped = false;
 		}
 	}
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 187/312] ipv4: Fix memory leak in exception case for splitting tries
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (185 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 186/312] be2net: Dont leak iomapped memory on removal Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:32 ` [PATCH 4.4 188/312] flow_dissector: Check for IP fragmentation even if not using IPv4 address Greg Kroah-Hartman
                   ` (126 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Alexander Duyck,
	David S. Miller

From: Alexander Duyck <alexander.h.duyck@intel.com>

commit 3114cdfe66c156345b0ae34e2990472f277e0c1b upstream.

Fix a small memory leak that can occur where we leak a fib_alias in the
event of us not being able to insert it into the local table.

Fixes: 0ddcf43d5d4a0 ("ipv4: FIB Local/MAIN table collapse")
Reported-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/fib_trie.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1714,8 +1714,10 @@ struct fib_table *fib_trie_unmerge(struc
 				local_l = fib_find_node(lt, &local_tp, l->key);
 
 			if (fib_insert_alias(lt, local_tp, local_l, new_fa,
-					     NULL, l->key))
+					     NULL, l->key)) {
+				kmem_cache_free(fn_alias_kmem, new_fa);
 				goto out;
+			}
 		}
 
 		/* stop loop if key wrapped back to 0 */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 188/312] flow_dissector: Check for IP fragmentation even if not using IPv4 address
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (186 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 187/312] ipv4: Fix memory leak in exception case for splitting tries Greg Kroah-Hartman
@ 2020-05-08 12:32 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 189/312] ipv4: fix checksum annotation in udp4_csum_init Greg Kroah-Hartman
                   ` (125 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:32 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Tom Herbert,
	David S. Miller

From: Alexander Duyck <aduyck@mirantis.com>

commit 918c023f29ab2dd8c63cfcc6a1239ee15933871a upstream.

This patch corrects the logic for the IPv4 parsing so that it is consistent
with how we handle IPv6.  Specifically if we do not have the flow key
indicating we want the addresses we still may need to take a look at the IP
fragmentation bits and to see if we should stop after we have recognized
the L3 header.

Fixes: 807e165dc44f ("flow_dissector: Add control/reporting of fragmentation")
Signed-off-by: Alexander Duyck <aduyck@mirantis.com>
Acked-by: Tom Herbert <tom@herbertland.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/core/flow_dissector.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -178,15 +178,16 @@ ip:
 
 		ip_proto = iph->protocol;
 
-		if (!dissector_uses_key(flow_dissector,
-					FLOW_DISSECTOR_KEY_IPV4_ADDRS))
-			break;
+		if (dissector_uses_key(flow_dissector,
+				       FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
+			key_addrs = skb_flow_dissector_target(flow_dissector,
+							      FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+							      target_container);
 
-		key_addrs = skb_flow_dissector_target(flow_dissector,
-			      FLOW_DISSECTOR_KEY_IPV4_ADDRS, target_container);
-		memcpy(&key_addrs->v4addrs, &iph->saddr,
-		       sizeof(key_addrs->v4addrs));
-		key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+			memcpy(&key_addrs->v4addrs, &iph->saddr,
+			       sizeof(key_addrs->v4addrs));
+			key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+		}
 
 		if (ip_is_fragment(iph)) {
 			key_control->flags |= FLOW_DIS_IS_FRAGMENT;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 189/312] ipv4: fix checksum annotation in udp4_csum_init
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (187 preceding siblings ...)
  2020-05-08 12:32 ` [PATCH 4.4 188/312] flow_dissector: Check for IP fragmentation even if not using IPv4 address Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 190/312] ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() Greg Kroah-Hartman
                   ` (124 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cong Wang, Tom Herbert,
	Hannes Frederic Sowa, David S. Miller

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

commit b46d9f625b07f843c706c2c7d0210a90ccdf143b upstream.

Reported-by: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Cong Wang <xiyou.wangcong@gmail.com>
Cc: Tom Herbert <tom@herbertland.com>
Fixes: 4068579e1e098fa ("net: Implmement RFC 6936 (zero RX csums for UDP/IPv6")
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/udp.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1754,8 +1754,11 @@ static inline int udp4_csum_init(struct
 		}
 	}
 
-	return skb_checksum_init_zero_check(skb, proto, uh->check,
-					    inet_compute_pseudo);
+	/* Note, we are only interested in != 0 or == 0, thus the
+	 * force to int.
+	 */
+	return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+							 inet_compute_pseudo);
 }
 
 /*



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 190/312] ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (188 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 189/312] ipv4: fix checksum annotation in udp4_csum_init Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 191/312] ipv4: accept u8 in IP_TOS ancillary data Greg Kroah-Hartman
                   ` (123 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Nicolas Dichtel,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit fa17806cde76fb1087532f07e72aa757a30e0500 upstream.

inet_forward_change() runs with RTNL held.
We are allowed to sleep if required.

If we use __in_dev_get_rtnl() instead of __in_dev_get_rcu(),
we no longer have to use GFP_ATOMIC allocations in
inet_netconf_notify_devconf(), meaning we are less likely to miss
notifications under memory pressure, and wont touch precious memory
reserves either and risk dropping incoming packets.

inet_netconf_get_devconf() can also use GFP_KERNEL allocation.

Fixes: edc9e748934c ("rtnl/ipv4: use netconf msg to advertise forwarding status")
Fixes: 9e5511106f99 ("rtnl/ipv4: add support of RTM_GETNETCONF")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/devinet.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1814,7 +1814,7 @@ void inet_netconf_notify_devconf(struct
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
 
-	skb = nlmsg_new(inet_netconf_msgsize_devconf(type), GFP_ATOMIC);
+	skb = nlmsg_new(inet_netconf_msgsize_devconf(type), GFP_KERNEL);
 	if (!skb)
 		goto errout;
 
@@ -1826,7 +1826,7 @@ void inet_netconf_notify_devconf(struct
 		kfree_skb(skb);
 		goto errout;
 	}
-	rtnl_notify(skb, net, 0, RTNLGRP_IPV4_NETCONF, NULL, GFP_ATOMIC);
+	rtnl_notify(skb, net, 0, RTNLGRP_IPV4_NETCONF, NULL, GFP_KERNEL);
 	return;
 errout:
 	if (err < 0)
@@ -1883,7 +1883,7 @@ static int inet_netconf_get_devconf(stru
 	}
 
 	err = -ENOBUFS;
-	skb = nlmsg_new(inet_netconf_msgsize_devconf(-1), GFP_ATOMIC);
+	skb = nlmsg_new(inet_netconf_msgsize_devconf(-1), GFP_KERNEL);
 	if (!skb)
 		goto errout;
 
@@ -2007,16 +2007,16 @@ static void inet_forward_change(struct n
 
 	for_each_netdev(net, dev) {
 		struct in_device *in_dev;
+
 		if (on)
 			dev_disable_lro(dev);
-		rcu_read_lock();
-		in_dev = __in_dev_get_rcu(dev);
+
+		in_dev = __in_dev_get_rtnl(dev);
 		if (in_dev) {
 			IN_DEV_CONF_SET(in_dev, FORWARDING, on);
 			inet_netconf_notify_devconf(net, NETCONFA_FORWARDING,
 						    dev->ifindex, &in_dev->cnf);
 		}
-		rcu_read_unlock();
 	}
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 191/312] ipv4: accept u8 in IP_TOS ancillary data
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (189 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 190/312] ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 192/312] net: vrf: Fix dev refcnt leak due to IPv6 prefix route Greg Kroah-Hartman
                   ` (122 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Francesco Fusco,
	Jesper Dangaard Brouer, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit e895cdce683161081e3626c4f5a5c55cb72089f8 upstream.

In commit f02db315b8d8 ("ipv4: IP_TOS and IP_TTL can be specified as
ancillary data") Francesco added IP_TOS values specified as integer.

However, kernel sends to userspace (at recvmsg() time) an IP_TOS value
in a single byte, when IP_RECVTOS is set on the socket.

It can be very useful to reflect all ancillary options as given by the
kernel in a subsequent sendmsg(), instead of aborting the sendmsg() with
EINVAL after Francesco patch.

So this patch extends IP_TOS ancillary to accept an u8, so that an UDP
server can simply reuse same ancillary block without having to mangle
it.

Jesper can then augment
https://github.com/netoptimizer/network-testing/blob/master/src/udp_example02.c
to add TOS reflection ;)

Fixes: f02db315b8d8 ("ipv4: IP_TOS and IP_TTL can be specified as ancillary data")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Francesco Fusco <ffusco@redhat.com>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Acked-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/ip_sockglue.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -279,9 +279,12 @@ int ip_cmsg_send(struct net *net, struct
 			ipc->ttl = val;
 			break;
 		case IP_TOS:
-			if (cmsg->cmsg_len != CMSG_LEN(sizeof(int)))
+			if (cmsg->cmsg_len == CMSG_LEN(sizeof(int)))
+				val = *(int *)CMSG_DATA(cmsg);
+			else if (cmsg->cmsg_len == CMSG_LEN(sizeof(u8)))
+				val = *(u8 *)CMSG_DATA(cmsg);
+			else
 				return -EINVAL;
-			val = *(int *)CMSG_DATA(cmsg);
 			if (val < 0 || val > 255)
 				return -EINVAL;
 			ipc->tos = val;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 192/312] net: vrf: Fix dev refcnt leak due to IPv6 prefix route
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (190 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 191/312] ipv4: accept u8 in IP_TOS ancillary data Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 193/312] ipv6: fix checksum annotation in udp6_csum_init Greg Kroah-Hartman
                   ` (121 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 4f7f34eaab9f68c9bcd45386b15c414c38b40587 upstream.

ifupdown2 found a kernel bug with IPv6 routes and movement from the main
table to the VRF table. Sequence of events:

Create the interface and add addresses:
    ip link add dev eth4.105 link eth4 type vlan id 105
    ip addr add dev eth4.105 8.105.105.10/24
    ip -6 addr add dev eth4.105 2008:105:105::10/64

At this point IPv6 has inserted a prefix route in the main table even
though the interface is 'down'. From there the VRF device is created:
    ip link add dev vrf105 type vrf table 105
    ip addr add dev vrf105 9.9.105.10/32
    ip -6 addr add dev vrf105 2000:9:105::10/128
    ip link set vrf105 up

Then the interface is enslaved, while still in the 'down' state:
    ip link set dev eth4.105 master vrf105

Since the device is down the VRF driver cycling the device does not
send the NETDEV_UP and NETDEV_DOWN but rather the NETDEV_CHANGE event
which does not flush the routes inserted prior.

When the link is brought up
    ip link set dev eth4.105 up

the prefix route is added in the VRF table, but does not remove
the route from the main table.

Fix by handling the NETDEV_CHANGEUPPER event similar what was implemented
for IPv4 in 7f49e7a38b77 ("net: Flush local routes when device changes vrf
association")

Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device")

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/addrconf.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3146,6 +3146,7 @@ static int addrconf_notify(struct notifi
 			   void *ptr)
 {
 	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
+	struct netdev_notifier_changeupper_info *info;
 	struct inet6_dev *idev = __in6_dev_get(dev);
 	struct net *net = dev_net(dev);
 	int run_pending = 0;
@@ -3307,6 +3308,15 @@ static int addrconf_notify(struct notifi
 	case NETDEV_POST_TYPE_CHANGE:
 		addrconf_type_change(dev, event);
 		break;
+
+	case NETDEV_CHANGEUPPER:
+		info = ptr;
+
+		/* flush all routes if dev is linked to or unlinked from
+		 * an L3 master device (e.g., VRF)
+		 */
+		if (info->upper_dev && netif_is_l3_master(info->upper_dev))
+			addrconf_ifdown(dev, 0);
 	}
 
 	return NOTIFY_OK;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 193/312] ipv6: fix checksum annotation in udp6_csum_init
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (191 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 192/312] net: vrf: Fix dev refcnt leak due to IPv6 prefix route Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 194/312] ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() Greg Kroah-Hartman
                   ` (120 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tom Herbert, Hannes Frederic Sowa,
	David S. Miller

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

commit c148d16369ff0095eca950d17968ba1d56a47b53 upstream.

Cc: Tom Herbert <tom@herbertland.com>
Fixes: 4068579e1e098fa ("net: Implmement RFC 6936 (zero RX csums for UDP/IPv6")
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/ip6_checksum.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -84,9 +84,12 @@ int udp6_csum_init(struct sk_buff *skb,
 	 * we accept a checksum of zero here. When we find the socket
 	 * for the UDP packet we'll check if that socket allows zero checksum
 	 * for IPv6 (set by socket option).
+	 *
+	 * Note, we are only interested in != 0 or == 0, thus the
+	 * force to int.
 	 */
-	return skb_checksum_init_zero_check(skb, proto, uh->check,
-					   ip6_compute_pseudo);
+	return (__force int)skb_checksum_init_zero_check(skb, proto, uh->check,
+							 ip6_compute_pseudo);
 }
 EXPORT_SYMBOL(udp6_csum_init);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 194/312] ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (192 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 193/312] ipv6: fix checksum annotation in udp6_csum_init Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 195/312] ipv6: add missing netconf notif when all is updated Greg Kroah-Hartman
                   ` (119 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Nicolas Dichtel,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 927265bc6cd6374c9bafc43408ece4e92311b149 upstream.

All inet6_netconf_notify_devconf() callers are in process context,
so we can use GFP_KERNEL allocations if we take care of not holding
a rwlock while not needed in ip6mr (we hold RTNL there)

Fixes: d67b8c616b48 ("netconf: advertise mc_forwarding status")
Fixes: f3a1bfb11ccb ("rtnl/ipv6: use netconf msg to advertise forwarding status")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/addrconf.c |    4 ++--
 net/ipv6/ip6mr.c    |   13 +++++++------
 2 files changed, 9 insertions(+), 8 deletions(-)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -540,7 +540,7 @@ void inet6_netconf_notify_devconf(struct
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
 
-	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_ATOMIC);
+	skb = nlmsg_new(inet6_netconf_msgsize_devconf(type), GFP_KERNEL);
 	if (!skb)
 		goto errout;
 
@@ -552,7 +552,7 @@ void inet6_netconf_notify_devconf(struct
 		kfree_skb(skb);
 		goto errout;
 	}
-	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_ATOMIC);
+	rtnl_notify(skb, net, 0, RTNLGRP_IPV6_NETCONF, NULL, GFP_KERNEL);
 	return;
 errout:
 	rtnl_set_sk_err(net, RTNLGRP_IPV6_NETCONF, err);
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1594,14 +1594,15 @@ static int ip6mr_sk_init(struct mr6_tabl
 	if (likely(mrt->mroute6_sk == NULL)) {
 		mrt->mroute6_sk = sk;
 		net->ipv6.devconf_all->mc_forwarding++;
-		inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING,
-					     NETCONFA_IFINDEX_ALL,
-					     net->ipv6.devconf_all);
-	}
-	else
+	} else {
 		err = -EADDRINUSE;
+	}
 	write_unlock_bh(&mrt_lock);
 
+	if (!err)
+		inet6_netconf_notify_devconf(net, NETCONFA_MC_FORWARDING,
+					     NETCONFA_IFINDEX_ALL,
+					     net->ipv6.devconf_all);
 	rtnl_unlock();
 
 	return err;
@@ -1619,11 +1620,11 @@ int ip6mr_sk_done(struct sock *sk)
 			write_lock_bh(&mrt_lock);
 			mrt->mroute6_sk = NULL;
 			net->ipv6.devconf_all->mc_forwarding--;
+			write_unlock_bh(&mrt_lock);
 			inet6_netconf_notify_devconf(net,
 						     NETCONFA_MC_FORWARDING,
 						     NETCONFA_IFINDEX_ALL,
 						     net->ipv6.devconf_all);
-			write_unlock_bh(&mrt_lock);
 
 			mroute_clean_tables(mrt, false);
 			err = 0;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 195/312] ipv6: add missing netconf notif when all is updated
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (193 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 194/312] ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 196/312] net: ipv6: Fix processing of RAs in presence of VRF Greg Kroah-Hartman
                   ` (118 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nicolas Dichtel, David S. Miller

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit d26c638c16cb54f6fb1507e27df93ede692db572 upstream.

The 'default' value was not advertised.

Fixes: f3a1bfb11ccb ("rtnl/ipv6: use netconf msg to advertise forwarding status")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/addrconf.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -771,7 +771,14 @@ static int addrconf_fixup_forwarding(str
 	}
 
 	if (p == &net->ipv6.devconf_all->forwarding) {
+		int old_dflt = net->ipv6.devconf_dflt->forwarding;
+
 		net->ipv6.devconf_dflt->forwarding = newf;
+		if ((!newf) ^ (!old_dflt))
+			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,
+						     NETCONFA_IFINDEX_DEFAULT,
+						     net->ipv6.devconf_dflt);
+
 		addrconf_forward_change(net, newf);
 		if ((!newf) ^ (!old))
 			inet6_netconf_notify_devconf(net, NETCONFA_FORWARDING,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 196/312] net: ipv6: Fix processing of RAs in presence of VRF
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (194 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 195/312] ipv6: add missing netconf notif when all is updated Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 197/312] netfilter: nf_tables: fix a wrong check to skip the inactive rules Greg Kroah-Hartman
                   ` (117 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 830218c1add1da16519b71909e5cf21522b7d062 upstream.

rt6_add_route_info and rt6_add_dflt_router were updated to pull the FIB
table from the device index, but the corresponding rt6_get_route_info
and rt6_get_dflt_router functions were not leading to the failure to
process RA's:

    ICMPv6: RA: ndisc_router_discovery failed to add default route

Fix the 'get' functions by using the table id associated with the
device when applicable.

Also, now that default routes can be added to tables other than the
default table, rt6_purge_dflt_routers needs to be updated as well to
look at all tables. To handle that efficiently, add a flag to the table
denoting if it is has a default route via RA.

Fixes: ca254490c8dfd ("net: Add VRF support to IPv6 stack")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/ip6_fib.h |    2 +
 net/ipv6/route.c      |   68 +++++++++++++++++++++++++++++++++++---------------
 2 files changed, 50 insertions(+), 20 deletions(-)

--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -258,6 +258,8 @@ struct fib6_table {
 	rwlock_t		tb6_lock;
 	struct fib6_node	tb6_root;
 	struct inet_peer_base	tb6_peers;
+	unsigned int		flags;
+#define RT6_TABLE_HAS_DFLT_ROUTER	BIT(0)
 };
 
 #define RT6_TABLE_UNSPEC	RT_TABLE_UNSPEC
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -101,11 +101,13 @@ static int rt6_score_route(struct rt6_in
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
 					   const struct in6_addr *prefix, int prefixlen,
-					   const struct in6_addr *gwaddr, int ifindex,
+					   const struct in6_addr *gwaddr,
+					   struct net_device *dev,
 					   unsigned int pref);
 static struct rt6_info *rt6_get_route_info(struct net *net,
 					   const struct in6_addr *prefix, int prefixlen,
-					   const struct in6_addr *gwaddr, int ifindex);
+					   const struct in6_addr *gwaddr,
+					   struct net_device *dev);
 #endif
 
 struct uncached_list {
@@ -801,7 +803,7 @@ int rt6_route_rcv(struct net_device *dev
 		rt = rt6_get_dflt_router(gwaddr, dev);
 	else
 		rt = rt6_get_route_info(net, prefix, rinfo->prefix_len,
-					gwaddr, dev->ifindex);
+					gwaddr, dev);
 
 	if (rt && !lifetime) {
 		ip6_del_rt(rt);
@@ -809,8 +811,8 @@ int rt6_route_rcv(struct net_device *dev
 	}
 
 	if (!rt && lifetime)
-		rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr, dev->ifindex,
-					pref);
+		rt = rt6_add_route_info(net, prefix, rinfo->prefix_len, gwaddr,
+					dev, pref);
 	else if (rt)
 		rt->rt6i_flags = RTF_ROUTEINFO |
 				 (rt->rt6i_flags & ~RTF_PREF_MASK) | RTF_PREF(pref);
@@ -2273,13 +2275,16 @@ static void ip6_rt_copy_init(struct rt6_
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_get_route_info(struct net *net,
 					   const struct in6_addr *prefix, int prefixlen,
-					   const struct in6_addr *gwaddr, int ifindex)
+					   const struct in6_addr *gwaddr,
+					   struct net_device *dev)
 {
+	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO;
+	int ifindex = dev->ifindex;
 	struct fib6_node *fn;
 	struct rt6_info *rt = NULL;
 	struct fib6_table *table;
 
-	table = fib6_get_table(net, RT6_TABLE_INFO);
+	table = fib6_get_table(net, tb_id);
 	if (!table)
 		return NULL;
 
@@ -2305,12 +2310,13 @@ out:
 
 static struct rt6_info *rt6_add_route_info(struct net *net,
 					   const struct in6_addr *prefix, int prefixlen,
-					   const struct in6_addr *gwaddr, int ifindex,
+					   const struct in6_addr *gwaddr,
+					   struct net_device *dev,
 					   unsigned int pref)
 {
 	struct fib6_config cfg = {
 		.fc_metric	= IP6_RT_PRIO_USER,
-		.fc_ifindex	= ifindex,
+		.fc_ifindex	= dev->ifindex,
 		.fc_dst_len	= prefixlen,
 		.fc_flags	= RTF_GATEWAY | RTF_ADDRCONF | RTF_ROUTEINFO |
 				  RTF_UP | RTF_PREF(pref),
@@ -2319,7 +2325,7 @@ static struct rt6_info *rt6_add_route_in
 		.fc_nlinfo.nl_net = net,
 	};
 
-	cfg.fc_table = l3mdev_fib_table_by_index(net, ifindex) ? : RT6_TABLE_INFO;
+	cfg.fc_table = l3mdev_fib_table(dev) ? : RT6_TABLE_INFO,
 	cfg.fc_dst = *prefix;
 	cfg.fc_gateway = *gwaddr;
 
@@ -2329,16 +2335,17 @@ static struct rt6_info *rt6_add_route_in
 
 	ip6_route_add(&cfg);
 
-	return rt6_get_route_info(net, prefix, prefixlen, gwaddr, ifindex);
+	return rt6_get_route_info(net, prefix, prefixlen, gwaddr, dev);
 }
 #endif
 
 struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_device *dev)
 {
+	u32 tb_id = l3mdev_fib_table(dev) ? : RT6_TABLE_DFLT;
 	struct rt6_info *rt;
 	struct fib6_table *table;
 
-	table = fib6_get_table(dev_net(dev), RT6_TABLE_DFLT);
+	table = fib6_get_table(dev_net(dev), tb_id);
 	if (!table)
 		return NULL;
 
@@ -2372,20 +2379,20 @@ struct rt6_info *rt6_add_dflt_router(con
 
 	cfg.fc_gateway = *gwaddr;
 
-	ip6_route_add(&cfg);
+	if (!ip6_route_add(&cfg)) {
+		struct fib6_table *table;
+
+		table = fib6_get_table(dev_net(dev), cfg.fc_table);
+		if (table)
+			table->flags |= RT6_TABLE_HAS_DFLT_ROUTER;
+	}
 
 	return rt6_get_dflt_router(gwaddr, dev);
 }
 
-void rt6_purge_dflt_routers(struct net *net)
+static void __rt6_purge_dflt_routers(struct fib6_table *table)
 {
 	struct rt6_info *rt;
-	struct fib6_table *table;
-
-	/* NOTE: Keep consistent with rt6_get_dflt_router */
-	table = fib6_get_table(net, RT6_TABLE_DFLT);
-	if (!table)
-		return;
 
 restart:
 	read_lock_bh(&table->tb6_lock);
@@ -2399,6 +2406,27 @@ restart:
 		}
 	}
 	read_unlock_bh(&table->tb6_lock);
+
+	table->flags &= ~RT6_TABLE_HAS_DFLT_ROUTER;
+}
+
+void rt6_purge_dflt_routers(struct net *net)
+{
+	struct fib6_table *table;
+	struct hlist_head *head;
+	unsigned int h;
+
+	rcu_read_lock();
+
+	for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
+		head = &net->ipv6.fib_table_hash[h];
+		hlist_for_each_entry_rcu(table, head, tb6_hlist) {
+			if (table->flags & RT6_TABLE_HAS_DFLT_ROUTER)
+				__rt6_purge_dflt_routers(table);
+		}
+	}
+
+	rcu_read_unlock();
 }
 
 static void rtmsg_to_fib6_config(struct net *net,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 197/312] netfilter: nf_tables: fix a wrong check to skip the inactive rules
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (195 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 196/312] net: ipv6: Fix processing of RAs in presence of VRF Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 198/312] netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled Greg Kroah-Hartman
                   ` (116 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Patrick McHardy, Liping Zhang,
	Pablo Neira Ayuso

From: Liping Zhang <liping.zhang@spreadtrum.com>

commit 8fff1722f705ce5023a0d6d77a31a9d013be2a34 upstream.

nft_genmask_cur has already done left-shift operator on the gencursor,
so there's no need to do left-shift operator on it again.

Fixes: ea4bd995b0f2 ("netfilter: nf_tables: add transaction helper functions")
Cc: Patrick McHardy <kaber@trash.net>
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nf_tables_core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -130,7 +130,7 @@ next_rule:
 	list_for_each_entry_continue_rcu(rule, &chain->rules, list) {
 
 		/* This rule is not active, skip. */
-		if (unlikely(rule->genmask & (1 << gencursor)))
+		if (unlikely(rule->genmask & gencursor))
 			continue;
 
 		rulenum++;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 198/312] netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (196 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 197/312] netfilter: nf_tables: fix a wrong check to skip the inactive rules Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 199/312] netfilter: nf_tables: destroy the set if fail to add transaction Greg Kroah-Hartman
                   ` (115 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Liping Zhang, Pablo Neira Ayuso

From: Liping Zhang <zlpnobody@gmail.com>

commit bb6a6e8e091353770074608c1d1bfde0e20b8154 upstream.

When CONFIG_NFT_SET_HASH is not enabled and I input the following rule:
"nft add rule filter output flow table test {ip daddr counter }", kernel
panic happened on my system:
 BUG: unable to handle kernel NULL pointer dereference at (null)
 IP: [<          (null)>]           (null)
 [...]
 Call Trace:
 [<ffffffffa0590466>] ? nft_dynset_eval+0x56/0x100 [nf_tables]
 [<ffffffffa05851bb>] nft_do_chain+0xfb/0x4e0 [nf_tables]
 [<ffffffffa0432f01>] ? nf_conntrack_tuple_taken+0x61/0x210 [nf_conntrack]
 [<ffffffffa0459ea6>] ? get_unique_tuple+0x136/0x560 [nf_nat]
 [<ffffffffa043bca1>] ? __nf_ct_ext_add_length+0x111/0x130 [nf_conntrack]
 [<ffffffffa045a357>] ? nf_nat_setup_info+0x87/0x3b0 [nf_nat]
 [<ffffffff81761e27>] ? ipt_do_table+0x327/0x610
 [<ffffffffa045a6d7>] ? __nf_nat_alloc_null_binding+0x57/0x80 [nf_nat]
 [<ffffffffa059f21f>] nft_ipv4_output+0xaf/0xd0 [nf_tables_ipv4]
 [<ffffffff81702515>] nf_iterate+0x55/0x60
 [<ffffffff81702593>] nf_hook_slow+0x73/0xd0

Because in rbtree type set, ops->update is not implemented. So just keep
it simple, in such case, report -EOPNOTSUPP to the user space.

Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nft_dynset.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c
@@ -121,6 +121,9 @@ static int nft_dynset_init(const struct
 			return PTR_ERR(set);
 	}
 
+	if (set->ops->update == NULL)
+		return -EOPNOTSUPP;
+
 	if (set->flags & NFT_SET_CONSTANT)
 		return -EBUSY;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 199/312] netfilter: nf_tables: destroy the set if fail to add transaction
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (197 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 198/312] netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 200/312] netfilter: nft_dup: do not use sreg_dev if the user doesnt specify it Greg Kroah-Hartman
                   ` (114 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Liping Zhang, Pablo Neira Ayuso

From: Liping Zhang <zlpnobody@gmail.com>

commit c17c3cdff10b9f59ef1244a14604f10949f17117 upstream.

When the memory is exhausted, then we will fail to add the NFT_MSG_NEWSET
transaction. In such case, we should destroy the set before we free it.

Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/netfilter/nf_tables_api.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -2849,12 +2849,14 @@ static int nf_tables_newset(struct net *
 
 	err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set);
 	if (err < 0)
-		goto err2;
+		goto err3;
 
 	list_add_tail_rcu(&set->list, &table->sets);
 	table->use++;
 	return 0;
 
+err3:
+	ops->destroy(set);
 err2:
 	kfree(set);
 err1:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 200/312] netfilter: nft_dup: do not use sreg_dev if the user doesnt specify it
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (198 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 199/312] netfilter: nf_tables: destroy the set if fail to add transaction Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 201/312] udp: restore UDPlite many-cast delivery Greg Kroah-Hartman
                   ` (113 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Liping Zhang, Pablo Neira Ayuso

From: Liping Zhang <zlpnobody@gmail.com>

commit b73b8a1ba598236296a46103d81c10d629d9a470 upstream.

The NFTA_DUP_SREG_DEV attribute is not a must option, so we should use it
in routing lookup only when the user specify it.

Fixes: d877f07112f1 ("netfilter: nf_tables: add nft_dup expression")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/netfilter/nft_dup_ipv4.c |    6 ++++--
 net/ipv6/netfilter/nft_dup_ipv6.c |    6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

--- a/net/ipv4/netfilter/nft_dup_ipv4.c
+++ b/net/ipv4/netfilter/nft_dup_ipv4.c
@@ -28,7 +28,7 @@ static void nft_dup_ipv4_eval(const stru
 	struct in_addr gw = {
 		.s_addr = (__force __be32)regs->data[priv->sreg_addr],
 	};
-	int oif = regs->data[priv->sreg_dev];
+	int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
 	nf_dup_ipv4(pkt->net, pkt->skb, pkt->hook, &gw, oif);
 }
@@ -59,7 +59,9 @@ static int nft_dup_ipv4_dump(struct sk_b
 {
 	struct nft_dup_ipv4 *priv = nft_expr_priv(expr);
 
-	if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+	if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+		goto nla_put_failure;
+	if (priv->sreg_dev &&
 	    nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
 		goto nla_put_failure;
 
--- a/net/ipv6/netfilter/nft_dup_ipv6.c
+++ b/net/ipv6/netfilter/nft_dup_ipv6.c
@@ -26,7 +26,7 @@ static void nft_dup_ipv6_eval(const stru
 {
 	struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 	struct in6_addr *gw = (struct in6_addr *)&regs->data[priv->sreg_addr];
-	int oif = regs->data[priv->sreg_dev];
+	int oif = priv->sreg_dev ? regs->data[priv->sreg_dev] : -1;
 
 	nf_dup_ipv6(pkt->net, pkt->skb, pkt->hook, gw, oif);
 }
@@ -57,7 +57,9 @@ static int nft_dup_ipv6_dump(struct sk_b
 {
 	struct nft_dup_ipv6 *priv = nft_expr_priv(expr);
 
-	if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr) ||
+	if (nft_dump_register(skb, NFTA_DUP_SREG_ADDR, priv->sreg_addr))
+		goto nla_put_failure;
+	if (priv->sreg_dev &&
 	    nft_dump_register(skb, NFTA_DUP_SREG_DEV, priv->sreg_dev))
 		goto nla_put_failure;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 201/312] udp: restore UDPlite many-cast delivery
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (199 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 200/312] netfilter: nft_dup: do not use sreg_dev if the user doesnt specify it Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 202/312] clk: st: avoid uninitialized variable use Greg Kroah-Hartman
                   ` (112 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pablo Neira Ayuso, Eric Dumazet,
	David S. Miller

From: Pablo Neira <pablo@netfilter.org>

commit 73e2d5e34b6cdd1080038daf3d6d6d744a9eefe6 upstream.

Honor udptable parameter that is passed to __udp*_lib_mcast_deliver(),
otherwise udplite broadcast/multicast use the wrong table and it breaks.

Fixes: 2dc41cff7545 ("udp: Use hash2 for long hash1 chains in __udp*_lib_mcast_deliver.")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/udp.c |    6 +++---
 net/ipv6/udp.c |    6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1685,10 +1685,10 @@ static int __udp4_lib_mcast_deliver(stru
 
 	if (use_hash2) {
 		hash2_any = udp4_portaddr_hash(net, htonl(INADDR_ANY), hnum) &
-			    udp_table.mask;
-		hash2 = udp4_portaddr_hash(net, daddr, hnum) & udp_table.mask;
+			    udptable->mask;
+		hash2 = udp4_portaddr_hash(net, daddr, hnum) & udptable->mask;
 start_lookup:
-		hslot = &udp_table.hash2[hash2];
+		hslot = &udptable->hash2[hash2];
 		offset = offsetof(typeof(*sk), __sk_common.skc_portaddr_node);
 	}
 
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -801,10 +801,10 @@ static int __udp6_lib_mcast_deliver(stru
 
 	if (use_hash2) {
 		hash2_any = udp6_portaddr_hash(net, &in6addr_any, hnum) &
-			    udp_table.mask;
-		hash2 = udp6_portaddr_hash(net, daddr, hnum) & udp_table.mask;
+			    udptable->mask;
+		hash2 = udp6_portaddr_hash(net, daddr, hnum) & udptable->mask;
 start_lookup:
-		hslot = &udp_table.hash2[hash2];
+		hslot = &udptable->hash2[hash2];
 		offset = offsetof(typeof(*sk), __sk_common.skc_portaddr_node);
 	}
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 202/312] clk: st: avoid uninitialized variable use
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (200 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 201/312] udp: restore UDPlite many-cast delivery Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 203/312] clk: gpio: handle error codes for of_clk_get_parent_count() Greg Kroah-Hartman
                   ` (111 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Gabriel Fernandez,
	Stephen Boyd

From: Arnd Bergmann <arnd@arndb.de>

commit 2dd52d7f6f9d9d03a82a68040ac3d221dd79af94 upstream.

quadfs_pll_fs660c32_round_rate prints a few structure members
that are never initialized, and also doesn't print the only one
it cares about. We get a gcc warning about the ones that
are printed:

clk/st/clkgen-fsyn.c:560:93: warning: 'params.sdiv' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.mdiv' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.pe' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.nsdiv' may be used uninitialized in this function

This changes the code to no longer print uninitialized data, and
for good measure it also prints the ndiv member that is being
set.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 5f7aa9071e93 ("clk: st: Support for QUADFS inside ClockGenB/C/D/E/F")
Acked-by: Gabriel Fernandez <gabriel.fernandez@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/st/clkgen-fsyn.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

--- a/drivers/clk/st/clkgen-fsyn.c
+++ b/drivers/clk/st/clkgen-fsyn.c
@@ -549,19 +549,20 @@ static int clk_fs660c32_vco_get_params(u
 	return 0;
 }
 
-static long quadfs_pll_fs660c32_round_rate(struct clk_hw *hw, unsigned long rate
-		, unsigned long *prate)
+static long quadfs_pll_fs660c32_round_rate(struct clk_hw *hw,
+					   unsigned long rate,
+					   unsigned long *prate)
 {
 	struct stm_fs params;
 
-	if (!clk_fs660c32_vco_get_params(*prate, rate, &params))
-		clk_fs660c32_vco_get_rate(*prate, &params, &rate);
+	if (clk_fs660c32_vco_get_params(*prate, rate, &params))
+		return rate;
 
-	pr_debug("%s: %s new rate %ld [sdiv=0x%x,md=0x%x,pe=0x%x,nsdiv3=%u]\n",
+	clk_fs660c32_vco_get_rate(*prate, &params, &rate);
+
+	pr_debug("%s: %s new rate %ld [ndiv=%u]\n",
 		 __func__, clk_hw_get_name(hw),
-		 rate, (unsigned int)params.sdiv,
-		 (unsigned int)params.mdiv,
-		 (unsigned int)params.pe, (unsigned int)params.nsdiv);
+		 rate, (unsigned int)params.ndiv);
 
 	return rate;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 203/312] clk: gpio: handle error codes for of_clk_get_parent_count()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (201 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 202/312] clk: st: avoid uninitialized variable use Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 204/312] clk: ti: omap3+: dpll: use non-locking version of clk_get_rate Greg Kroah-Hartman
                   ` (110 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Norris, Jyri Sarha,
	Sergej Sawazki, Stephen Boyd, Michael Turquette

From: Brian Norris <computersforpeace@gmail.com>

commit 0b2e78865d92e2d70542cb1d4d7af1d4ea0a286d upstream.

We might make bad memory allocations if we get (e.g.) -ENOSYS from
of_clk_get_parent_count().

Noticed by Coverity.

Fixes: f66541ba02d5 ("clk: gpio: Get parent clk names in of_gpio_clk_setup()")
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Jyri Sarha <jsarha@ti.com>
Cc: Sergej Sawazki <ce3a@gmx.de>
Cc: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Michael Turquette <mturquette@baylibre.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/clk-gpio.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/drivers/clk/clk-gpio.c
+++ b/drivers/clk/clk-gpio.c
@@ -287,12 +287,14 @@ static void __init of_gpio_clk_setup(str
 	const char **parent_names;
 	int i, num_parents;
 
+	num_parents = of_clk_get_parent_count(node);
+	if (num_parents < 0)
+		return;
+
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return;
 
-	num_parents = of_clk_get_parent_count(node);
-
 	parent_names = kcalloc(num_parents, sizeof(char *), GFP_KERNEL);
 	if (!parent_names)
 		return;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 204/312] clk: ti: omap3+: dpll: use non-locking version of clk_get_rate
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (202 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 203/312] clk: gpio: handle error codes for of_clk_get_parent_count() Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 205/312] clk: multiplier: Prevent the multiplier from under / over flowing Greg Kroah-Hartman
                   ` (109 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tero Kristo, Tony Lindgren, Stephen Boyd

From: Tero Kristo <t-kristo@ti.com>

commit a0d54c3899aaeb047969d9479263c6bcf385c331 upstream.

As the code in this file is being executed within irq context in some
cases, we must avoid the clk_get_rate which uses mutex internally.
Switch the code to use clk_hw_get_rate instead which is non-locking.

This fixes an issue where PM runtime will hang the system if enabled
with a serial console before a suspend-resume cycle.

Signed-off-by: Tero Kristo <t-kristo@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Fixes: a53ad8ef3dcc ("clk: ti: Convert to clk_hw based provider APIs")
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/ti/dpll3xxx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/clk/ti/dpll3xxx.c
+++ b/drivers/clk/ti/dpll3xxx.c
@@ -437,7 +437,8 @@ int omap3_noncore_dpll_enable(struct clk
 
 	parent = clk_hw_get_parent(hw);
 
-	if (clk_hw_get_rate(hw) == clk_get_rate(dd->clk_bypass)) {
+	if (clk_hw_get_rate(hw) ==
+	    clk_hw_get_rate(__clk_get_hw(dd->clk_bypass))) {
 		WARN_ON(parent != __clk_get_hw(dd->clk_bypass));
 		r = _omap3_noncore_dpll_bypass(clk);
 	} else {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 205/312] clk: multiplier: Prevent the multiplier from under / over flowing
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (203 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 204/312] clk: ti: omap3+: dpll: use non-locking version of clk_get_rate Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 206/312] clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit Greg Kroah-Hartman
                   ` (108 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Maxime Ripard, Michael Turquette

From: Maxime Ripard <maxime.ripard@free-electrons.com>

commit 25f77a3aa4cb948666bf8e7fd972533ea487c3bd upstream.

In the current multiplier base clock implementation, if the
CLK_SET_RATE_PARENT flag isn't set, the code will not make sure that the
multiplier computed remains within the boundaries of our clock.

This means that if the clock we want to reach is below the parent rate,
or if the multiplier is above the maximum that we can reach, we will end up
with a completely bogus one that the clock cannot achieve.

Fixes: f2e0a53271a4 ("clk: Add a basic multiplier clock")
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Michael Turquette <mturquette@baylibre.com>
Link: lkml.kernel.org/r/1463402840-17062-3-git-send-email-maxime.ripard@free-electrons.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/clk-multiplier.c |   20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

--- a/drivers/clk/clk-multiplier.c
+++ b/drivers/clk/clk-multiplier.c
@@ -54,14 +54,28 @@ static unsigned long __bestmult(struct c
 				unsigned long *best_parent_rate,
 				u8 width, unsigned long flags)
 {
+	struct clk_multiplier *mult = to_clk_multiplier(hw);
 	unsigned long orig_parent_rate = *best_parent_rate;
 	unsigned long parent_rate, current_rate, best_rate = ~0;
 	unsigned int i, bestmult = 0;
+	unsigned int maxmult = (1 << width) - 1;
 
-	if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT))
-		return rate / *best_parent_rate;
+	if (!(clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
+		bestmult = rate / orig_parent_rate;
 
-	for (i = 1; i < ((1 << width) - 1); i++) {
+		/* Make sure we don't end up with a 0 multiplier */
+		if ((bestmult == 0) &&
+		    !(mult->flags & CLK_MULTIPLIER_ZERO_BYPASS))
+			bestmult = 1;
+
+		/* Make sure we don't overflow the multiplier */
+		if (bestmult > maxmult)
+			bestmult = maxmult;
+
+		return bestmult;
+	}
+
+	for (i = 1; i < maxmult; i++) {
 		if (rate == orig_parent_rate * i) {
 			/*
 			 * This is the best case for us if we have a



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 206/312] clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (204 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 205/312] clk: multiplier: Prevent the multiplier from under / over flowing Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 207/312] clk: xgene: Dont call __pa on ioremaped address Greg Kroah-Hartman
                   ` (107 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dong Aisheng, Shawn Guo

From: Dong Aisheng <aisheng.dong@nxp.com>

commit b3e76bdc0b2190e67427d31cd740debd01c03631 upstream.

After commit f53947456f98 ("ARM: clk: imx: update pllv3 to support imx7"),
the former used BM_PLL_POWER bit is not correct anymore for IMX7 ENET.
Instead, pll->powerdown holds the correct bit, so using powerdown bit
in clk_pllv3_{prepare | unprepare} functions.

Fixes: f53947456f98 ("ARM: clk: imx: update pllv3 to support imx7")
Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/imx/clk-pllv3.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/clk/imx/clk-pllv3.c
+++ b/drivers/clk/imx/clk-pllv3.c
@@ -76,9 +76,9 @@ static int clk_pllv3_prepare(struct clk_
 
 	val = readl_relaxed(pll->base);
 	if (pll->powerup_set)
-		val |= BM_PLL_POWER;
+		val |= pll->powerdown;
 	else
-		val &= ~BM_PLL_POWER;
+		val &= ~pll->powerdown;
 	writel_relaxed(val, pll->base);
 
 	return clk_pllv3_wait_lock(pll);
@@ -91,9 +91,9 @@ static void clk_pllv3_unprepare(struct c
 
 	val = readl_relaxed(pll->base);
 	if (pll->powerup_set)
-		val &= ~BM_PLL_POWER;
+		val &= ~pll->powerdown;
 	else
-		val |= BM_PLL_POWER;
+		val |= pll->powerdown;
 	writel_relaxed(val, pll->base);
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 207/312] clk: xgene: Dont call __pa on ioremaped address
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (205 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 206/312] clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 208/312] cls_bpf: reset class and reuse major in da Greg Kroah-Hartman
                   ` (106 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laura Abbott, Loc Ho, Stephen Boyd

From: Laura Abbott <labbott@redhat.com>

commit 06b113e9f28f8657715919087a3f54b77d1634ed upstream.

ioremaped addresses are not linearly mapped so the physical
address can not be figured out via __pa. More generally, there
is no guarantee that backing value of an ioremapped address
is a physical address at all. The value here is only used
for debugging so just drop the call to __pa on the ioremapped
address.

Fixes: 6ae5fd381251 ("clk: xgene: Silence sparse warnings")
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Loc Ho <lho@apm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/clk-xgene.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

--- a/drivers/clk/clk-xgene.c
+++ b/drivers/clk/clk-xgene.c
@@ -218,22 +218,20 @@ static int xgene_clk_enable(struct clk_h
 	struct xgene_clk *pclk = to_xgene_clk(hw);
 	unsigned long flags = 0;
 	u32 data;
-	phys_addr_t reg;
 
 	if (pclk->lock)
 		spin_lock_irqsave(pclk->lock, flags);
 
 	if (pclk->param.csr_reg != NULL) {
 		pr_debug("%s clock enabled\n", clk_hw_get_name(hw));
-		reg = __pa(pclk->param.csr_reg);
 		/* First enable the clock */
 		data = xgene_clk_read(pclk->param.csr_reg +
 					pclk->param.reg_clk_offset);
 		data |= pclk->param.reg_clk_mask;
 		xgene_clk_write(data, pclk->param.csr_reg +
 					pclk->param.reg_clk_offset);
-		pr_debug("%s clock PADDR base %pa clk offset 0x%08X mask 0x%08X value 0x%08X\n",
-			clk_hw_get_name(hw), &reg,
+		pr_debug("%s clk offset 0x%08X mask 0x%08X value 0x%08X\n",
+			clk_hw_get_name(hw),
 			pclk->param.reg_clk_offset, pclk->param.reg_clk_mask,
 			data);
 
@@ -243,8 +241,8 @@ static int xgene_clk_enable(struct clk_h
 		data &= ~pclk->param.reg_csr_mask;
 		xgene_clk_write(data, pclk->param.csr_reg +
 					pclk->param.reg_csr_offset);
-		pr_debug("%s CSR RESET PADDR base %pa csr offset 0x%08X mask 0x%08X value 0x%08X\n",
-			clk_hw_get_name(hw), &reg,
+		pr_debug("%s csr offset 0x%08X mask 0x%08X value 0x%08X\n",
+			clk_hw_get_name(hw),
 			pclk->param.reg_csr_offset, pclk->param.reg_csr_mask,
 			data);
 	}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 208/312] cls_bpf: reset class and reuse major in da
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (206 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 207/312] clk: xgene: Dont call __pa on ioremaped address Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 209/312] arm64: bpf: jit JMP_JSET_{X,K} Greg Kroah-Hartman
                   ` (105 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Alexei Starovoitov,
	David S. Miller

From: Daniel Borkmann <daniel@iogearbox.net>

commit 3a461da1d03e7a857edfa6a002040d07e118c639 upstream.

There are two issues with the current code. First one is that we need
to set res->class to 0 in case we use non-default classid matching.

This is important for the case where cls_bpf was initially set up with
an optional binding to a default class with tcf_bind_filter(), where
the underlying qdisc implements bind_tcf() that fills res->class and
tests for it later on when doing the classification. Convention for
these cases is that after tc_classify() was called, such qdiscs (atm,
drr, qfq, cbq, hfsc, htb) first test class, and if 0, then they lookup
based on classid.

Second, there's a bug with da mode, where res->classid is only assigned
a 16 bit minor, but it needs to expand to the full 32 bit major/minor
combination instead, therefore we need to expand with the bound major.
This is fine as classes belonging to a classful qdisc must share the
same major.

Fixes: 045efa82ff56 ("cls_bpf: introduce integrated actions")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/cls_bpf.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/net/sched/cls_bpf.c
+++ b/net/sched/cls_bpf.c
@@ -107,8 +107,9 @@ static int cls_bpf_classify(struct sk_bu
 		}
 
 		if (prog->exts_integrated) {
-			res->class = prog->res.class;
-			res->classid = qdisc_skb_cb(skb)->tc_classid;
+			res->class   = 0;
+			res->classid = TC_H_MAJ(prog->res.classid) |
+				       qdisc_skb_cb(skb)->tc_classid;
 
 			ret = cls_bpf_exec_opcode(filter_res);
 			if (ret == TC_ACT_UNSPEC)
@@ -118,10 +119,12 @@ static int cls_bpf_classify(struct sk_bu
 
 		if (filter_res == 0)
 			continue;
-
-		*res = prog->res;
-		if (filter_res != -1)
+		if (filter_res != -1) {
+			res->class   = 0;
 			res->classid = filter_res;
+		} else {
+			*res = prog->res;
+		}
 
 		ret = tcf_exts_exec(skb, &prog->exts, res);
 		if (ret < 0)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 209/312] arm64: bpf: jit JMP_JSET_{X,K}
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (207 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 208/312] cls_bpf: reset class and reuse major in da Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 210/312] bpf, trace: check event type in bpf_perf_event_read Greg Kroah-Hartman
                   ` (104 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Zi Shen Lim, Will Deacon, Yang Shi,
	David S. Miller

From: Zi Shen Lim <zlim.lnx@gmail.com>

commit 98397fc547e3f4553553a30ea56fa34d613f0a4c upstream.

Original implementation commit e54bcde3d69d ("arm64: eBPF JIT compiler")
had the relevant code paths, but due to an oversight always fail jiting.

As a result, we had been falling back to BPF interpreter whenever a BPF
program has JMP_JSET_{X,K} instructions.

With this fix, we confirm that the corresponding tests in lib/test_bpf
continue to pass, and also jited.

...
[    2.784553] test_bpf: #30 JSET jited:1 188 192 197 PASS
[    2.791373] test_bpf: #31 tcpdump port 22 jited:1 325 677 625 PASS
[    2.808800] test_bpf: #32 tcpdump complex jited:1 323 731 991 PASS
...
[    3.190759] test_bpf: #237 JMP_JSET_K: if (0x3 & 0x2) return 1 jited:1 110 PASS
[    3.192524] test_bpf: #238 JMP_JSET_K: if (0x3 & 0xffffffff) return 1 jited:1 98 PASS
[    3.211014] test_bpf: #249 JMP_JSET_X: if (0x3 & 0x2) return 1 jited:1 120 PASS
[    3.212973] test_bpf: #250 JMP_JSET_X: if (0x3 & 0xffffffff) return 1 jited:1 89 PASS
...

Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler")
Signed-off-by: Zi Shen Lim <zlim.lnx@gmail.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Acked-by: Yang Shi <yang.shi@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/net/bpf_jit_comp.c |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -482,6 +482,7 @@ emit_cond_jmp:
 		case BPF_JGE:
 			jmp_cond = A64_COND_CS;
 			break;
+		case BPF_JSET:
 		case BPF_JNE:
 			jmp_cond = A64_COND_NE;
 			break;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 210/312] bpf, trace: check event type in bpf_perf_event_read
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (208 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 209/312] arm64: bpf: jit JMP_JSET_{X,K} Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 211/312] bpf: fix map not being uncharged during map creation failure Greg Kroah-Hartman
                   ` (103 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Alexei Starovoitov,
	David S. Miller

From: Alexei Starovoitov <ast@fb.com>

commit ad572d174787daa59e24b8b5c83028c09cdb5ddb upstream.

similar to bpf_perf_event_output() the bpf_perf_event_read() helper
needs to check the type of the perf_event before reading the counter.

Fixes: a43eec304259 ("bpf: introduce bpf_perf_event_output() helper")
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/bpf_trace.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -206,6 +206,10 @@ static u64 bpf_perf_event_read(u64 r1, u
 	    event->pmu->count)
 		return -EINVAL;
 
+	if (unlikely(event->attr.type != PERF_TYPE_HARDWARE &&
+		     event->attr.type != PERF_TYPE_RAW))
+		return -EINVAL;
+
 	/*
 	 * we don't know if the function is run successfully by the
 	 * return value. It can be judged in other places, such as



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 211/312] bpf: fix map not being uncharged during map creation failure
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (209 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 210/312] bpf, trace: check event type in bpf_perf_event_read Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 212/312] net/mlx4_core: Fix potential corruption in counters database Greg Kroah-Hartman
                   ` (102 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Alexei Starovoitov,
	David S. Miller

From: Daniel Borkmann <daniel@iogearbox.net>

commit 20b2b24f91f70e7d3f0918c077546cb21bd73a87 upstream.

In map_create(), we first find and create the map, then once that
suceeded, we charge it to the user's RLIMIT_MEMLOCK, and then fetch
a new anon fd through anon_inode_getfd(). The problem is, once the
latter fails f.e. due to RLIMIT_NOFILE limit, then we only destruct
the map via map->ops->map_free(), but without uncharging the previously
locked memory first. That means that the user_struct allocation is
leaked as well as the accounted RLIMIT_MEMLOCK memory not released.
Make the label names in the fix consistent with bpf_prog_load().

Fixes: aaac3ba95e4c ("bpf: charge user for creation of BPF maps and programs")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/bpf/syscall.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -152,7 +152,7 @@ static int map_create(union bpf_attr *at
 
 	err = bpf_map_charge_memlock(map);
 	if (err)
-		goto free_map;
+		goto free_map_nouncharge;
 
 	err = bpf_map_new_fd(map);
 	if (err < 0)
@@ -162,6 +162,8 @@ static int map_create(union bpf_attr *at
 	return err;
 
 free_map:
+	bpf_map_uncharge_memlock(map);
+free_map_nouncharge:
 	map->ops->map_free(map);
 	return err;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 212/312] net/mlx4_core: Fix potential corruption in counters database
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (210 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 211/312] bpf: fix map not being uncharged during map creation failure Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 213/312] net/mlx4_core: Fix access to uninitialized index Greg Kroah-Hartman
                   ` (101 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eran Ben Elisha, Jack Morgenstein,
	David S. Miller

From: Eran Ben Elisha <eranbe@mellanox.com>

commit 6b94bab0ee8d5def6a2aac0ef6204ee6e24386b6 upstream.

The error flow in procedure handle_existing_counter() is wrong.

The procedure should exit after encountering the error, not continue
as if everything is OK.

Fixes: 68230242cdbc ('net/mlx4_core: Add port attribute when tracking counters')
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/resource_tracker.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -918,11 +918,13 @@ static int handle_existing_counter(struc
 
 	spin_lock_irq(mlx4_tlock(dev));
 	r = find_res(dev, counter_index, RES_COUNTER);
-	if (!r || r->owner != slave)
+	if (!r || r->owner != slave) {
 		ret = -EINVAL;
-	counter = container_of(r, struct res_counter, com);
-	if (!counter->port)
-		counter->port = port;
+	} else {
+		counter = container_of(r, struct res_counter, com);
+		if (!counter->port)
+			counter->port = port;
+	}
 
 	spin_unlock_irq(mlx4_tlock(dev));
 	return ret;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 213/312] net/mlx4_core: Fix access to uninitialized index
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (211 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 212/312] net/mlx4_core: Fix potential corruption in counters database Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 214/312] net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill Greg Kroah-Hartman
                   ` (100 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Tariq Toukan, Dan Carpenter, David S. Miller

From: Tariq Toukan <tariqt@mellanox.com>

commit 2bb07e155bb3e0c722c806723f737cf8020961ef upstream.

Prevent using uninitialized or negative index when handling
steering entries.

Fixes: b12d93d63c32 ('mlx4: Add support for promiscuous mode in the new steering model.')
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/mcg.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1109,7 +1109,7 @@ int mlx4_qp_attach_common(struct mlx4_de
 	struct mlx4_cmd_mailbox *mailbox;
 	struct mlx4_mgm *mgm;
 	u32 members_count;
-	int index, prev;
+	int index = -1, prev;
 	int link = 0;
 	int i;
 	int err;
@@ -1188,7 +1188,7 @@ int mlx4_qp_attach_common(struct mlx4_de
 		goto out;
 
 out:
-	if (prot == MLX4_PROT_ETH) {
+	if (prot == MLX4_PROT_ETH && index != -1) {
 		/* manage the steering entry for promisc mode */
 		if (new_entry)
 			err = new_steering_entry(dev, port, steer,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 214/312] net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (212 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 213/312] net/mlx4_core: Fix access to uninitialized index Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 215/312] net/mlx4_core: Check device state before unregistering it Greg Kroah-Hartman
                   ` (99 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kamal Heib, Tariq Toukan, David S. Miller

From: Kamal Heib <kamalh@mellanox.com>

commit 93c098af09455ea7bdc6f0f6b08f6ac14fa06cf4 upstream.

Modify mlx4_en_vlan_rx_[add/kill]_vid to return error value in case of
failure.

Fixes: 8e586137e6b6 ('net: make vlan ndo_vlan_rx_[add/kill]_vid return error value')
Signed-off-by: Kamal Heib <kamalh@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c |   18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -424,14 +424,18 @@ static int mlx4_en_vlan_rx_add_vid(struc
 	mutex_lock(&mdev->state_lock);
 	if (mdev->device_up && priv->port_up) {
 		err = mlx4_SET_VLAN_FLTR(mdev->dev, priv);
-		if (err)
+		if (err) {
 			en_err(priv, "Failed configuring VLAN filter\n");
+			goto out;
+		}
 	}
-	if (mlx4_register_vlan(mdev->dev, priv->port, vid, &idx))
-		en_dbg(HW, priv, "failed adding vlan %d\n", vid);
-	mutex_unlock(&mdev->state_lock);
+	err = mlx4_register_vlan(mdev->dev, priv->port, vid, &idx);
+	if (err)
+		en_dbg(HW, priv, "Failed adding vlan %d\n", vid);
 
-	return 0;
+out:
+	mutex_unlock(&mdev->state_lock);
+	return err;
 }
 
 static int mlx4_en_vlan_rx_kill_vid(struct net_device *dev,
@@ -439,7 +443,7 @@ static int mlx4_en_vlan_rx_kill_vid(stru
 {
 	struct mlx4_en_priv *priv = netdev_priv(dev);
 	struct mlx4_en_dev *mdev = priv->mdev;
-	int err;
+	int err = 0;
 
 	en_dbg(HW, priv, "Killing VID:%d\n", vid);
 
@@ -456,7 +460,7 @@ static int mlx4_en_vlan_rx_kill_vid(stru
 	}
 	mutex_unlock(&mdev->state_lock);
 
-	return 0;
+	return err;
 }
 
 static void mlx4_en_u64_to_mac(unsigned char dst_mac[ETH_ALEN + 2], u64 src_mac)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 215/312] net/mlx4_core: Check device state before unregistering it
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (213 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 214/312] net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 216/312] net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec Greg Kroah-Hartman
                   ` (98 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alex Vesker, Tariq Toukan, David S. Miller

From: Alex Vesker <valex@mellanox.com>

commit 9b022a6e0f26af108b9105b16b310393c898d9bd upstream.

Verify that the device state is registered before un-registering it.
This check is required to prevent an OOPS on flows that do
re-registration of the device and its previous state was
unregistered.

Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/intf.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx4/intf.c
+++ b/drivers/net/ethernet/mellanox/mlx4/intf.c
@@ -217,6 +217,9 @@ void mlx4_unregister_device(struct mlx4_
 	struct mlx4_priv *priv = mlx4_priv(dev);
 	struct mlx4_interface *intf;
 
+	if (!(dev->persist->interface_state & MLX4_INTERFACE_STATE_UP))
+		return;
+
 	mlx4_stop_catas_poll(dev);
 	if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION &&
 	    mlx4_is_slave(dev)) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 216/312] net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (214 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 215/312] net/mlx4_core: Check device state before unregistering it Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 217/312] net/mlx4_en: Process all completions in RX rings after port goes up Greg Kroah-Hartman
                   ` (97 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Moshe Shemesh,
	Tariq Toukan, David S. Miller

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit aa0c08feae8161b945520ada753d0dfe62b14fe7 upstream.

The resource type enum in the resource tracker was incorrect.
RES_EQ was put in the position of RES_NPORT_ID (a FC resource).

Since the remaining resources maintain their current values,
and RES_EQ is not passed from slaves to the hypervisor in any
FW command, this change affects only the hypervisor.
Therefore, there is no backwards-compatibility issue.

Fixes: 623ed84b1f95 ("mlx4_core: initial header-file changes for SRIOV support")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/mlx4.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -143,9 +143,10 @@ enum mlx4_resource {
 	RES_MTT,
 	RES_MAC,
 	RES_VLAN,
-	RES_EQ,
+	RES_NPORT_ID,
 	RES_COUNTER,
 	RES_FS_RULE,
+	RES_EQ,
 	MLX4_NUM_OF_RESOURCE_TYPE
 };
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 217/312] net/mlx4_en: Process all completions in RX rings after port goes up
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (215 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 216/312] net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 218/312] net/mlx4_core: Do not access comm channel if it has not yet been initialized Greg Kroah-Hartman
                   ` (96 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Erez Shitrit, Eugenia Emantayev,
	Tariq Toukan, David S. Miller

From: Erez Shitrit <erezsh@mellanox.com>

commit 8d59de8f7bb3db296331c665779c653b0c8d13ba upstream.

Currently there is a race between incoming traffic and
initialization flow. HW is able to receive the packets
after INIT_PORT is done and unicast steering is configured.
Before we set priv->port_up NAPI is not scheduled and
receive queues become full. Therefore we never get
new interrupts about the completions.
This issue could happen if running heavy traffic during
bringing port up.
The resolution is to schedule NAPI once port_up is set.
If receive queues were full this will process all cqes
and release them.

Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC")
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1720,6 +1720,13 @@ int mlx4_en_start_port(struct net_device
 		vxlan_get_rx_port(dev);
 #endif
 	priv->port_up = true;
+
+	/* Process all completions if exist to prevent
+	 * the queues freezing if they are full
+	 */
+	for (i = 0; i < priv->rx_ring_num; i++)
+		napi_schedule(&priv->rx_cq[i]->napi);
+
 	netif_tx_start_all_queues(dev);
 	netif_device_attach(dev);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 218/312] net/mlx4_core: Do not access comm channel if it has not yet been initialized
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (216 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 217/312] net/mlx4_en: Process all completions in RX rings after port goes up Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 219/312] net/mlx4_en: Fix potential deadlock in port statistics flow Greg Kroah-Hartman
                   ` (95 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Tariq Toukan,
	David S. Miller

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit 81d184199e328fdad5633da139a10337327154e0 upstream.

In the Hypervisor, there are several FW commands which are invoked
before the comm channel is initialized (in mlx4_multi_func_init).
These include MOD_STAT_CONFIG, QUERY_DEV_CAP, INIT_HCA, and others.

If any of these commands fails, say with a timeout, the Hypervisor
driver enters the internal error reset flow. In this flow, the driver
attempts to notify all slaves via the comm channel that an internal error
has occurred.

Since the comm channel has not yet been initialized (i.e., mapped via
ioremap), this will cause dereferencing a NULL pointer.

To fix this, do not access the comm channel in the internal error flow
if it has not yet been initialized.

Fixes: 55ad359225b2 ("net/mlx4_core: Enable device recovery flow with SRIOV")
Fixes: ab9c17a009ee ("mlx4_core: Modify driver initialization flow to accommodate SRIOV for Ethernet")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/cmd.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2451,6 +2451,7 @@ err_comm_admin:
 	kfree(priv->mfunc.master.slave_state);
 err_comm:
 	iounmap(priv->mfunc.comm);
+	priv->mfunc.comm = NULL;
 err_vhcr:
 	dma_free_coherent(&dev->persist->pdev->dev, PAGE_SIZE,
 			  priv->mfunc.vhcr,
@@ -2518,6 +2519,13 @@ void mlx4_report_internal_err_comm_event
 	int slave;
 	u32 slave_read;
 
+	/* If the comm channel has not yet been initialized,
+	 * skip reporting the internal error event to all
+	 * the communication channels.
+	 */
+	if (!priv->mfunc.comm)
+		return;
+
 	/* Report an internal error event to all
 	 * communication channels.
 	 */
@@ -2552,6 +2560,7 @@ void mlx4_multi_func_cleanup(struct mlx4
 	}
 
 	iounmap(priv->mfunc.comm);
+	priv->mfunc.comm = NULL;
 }
 
 void mlx4_cmd_cleanup(struct mlx4_dev *dev, int cleanup_mask)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 219/312] net/mlx4_en: Fix potential deadlock in port statistics flow
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (217 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 218/312] net/mlx4_core: Do not access comm channel if it has not yet been initialized Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 220/312] net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering Greg Kroah-Hartman
                   ` (94 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Tariq Toukan,
	David S. Miller

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit d2582a03939ed0a80ffcd3ea5345505bc8067c54 upstream.

mlx4_en_DUMP_ETH_STATS took the *counter mutex* and then
called the FW command, with WRAPPED attribute. As a result, the fw command
is wrapped on the Hypervisor when it calls mlx4_en_DUMP_ETH_STATS.
The FW command wrapper flow on the hypervisor takes the *slave_cmd_mutex*
during processing.

At the same time, a VF could be in the process of coming up, and could
call mlx4_QUERY_FUNC_CAP.  On the hypervisor, the command flow takes the
*slave_cmd_mutex*, then executes mlx4_QUERY_FUNC_CAP_wrapper.
mlx4_QUERY_FUNC_CAP wrapper calls mlx4_get_default_counter_index(),
which takes the *counter mutex*. DEADLOCK.

The fix is that the DUMP_ETH_STATS fw command should be called with
the NATIVE attribute, so that on the hypervisor, this command does not
enter the wrapper flow.

Since the Hypervisor no longer goes through the wrapper code, we also
simply return 0 in mlx4_DUMP_ETH_STATS_wrapper (i.e.the function succeeds,
but the returned data will be all zeroes).
No need to test if it is the Hypervisor going through the wrapper.

Fixes: f9baff509f8a ("mlx4_core: Add "native" argument to mlx4_cmd ...")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/en_port.c |    4 ++--
 drivers/net/ethernet/mellanox/mlx4/mlx4.h    |    2 --
 drivers/net/ethernet/mellanox/mlx4/port.c    |   13 +------------
 3 files changed, 3 insertions(+), 16 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_port.c
@@ -164,7 +164,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_e
 		return PTR_ERR(mailbox);
 	err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma, in_mod, 0,
 			   MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
-			   MLX4_CMD_WRAPPED);
+			   MLX4_CMD_NATIVE);
 	if (err)
 		goto out;
 
@@ -325,7 +325,7 @@ int mlx4_en_DUMP_ETH_STATS(struct mlx4_e
 		err = mlx4_cmd_box(mdev->dev, 0, mailbox->dma,
 				   in_mod | MLX4_DUMP_ETH_STATS_FLOW_CONTROL,
 				   0, MLX4_CMD_DUMP_ETH_STATS,
-				   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_WRAPPED);
+				   MLX4_CMD_TIME_CLASS_B, MLX4_CMD_NATIVE);
 		if (err)
 			goto out;
 	}
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
@@ -1313,8 +1313,6 @@ int mlx4_SET_VLAN_FLTR_wrapper(struct ml
 			       struct mlx4_cmd_info *cmd);
 int mlx4_common_set_vlan_fltr(struct mlx4_dev *dev, int function,
 				     int port, void *buf);
-int mlx4_common_dump_eth_stats(struct mlx4_dev *dev, int slave, u32 in_mod,
-				struct mlx4_cmd_mailbox *outbox);
 int mlx4_DUMP_ETH_STATS_wrapper(struct mlx4_dev *dev, int slave,
 				   struct mlx4_vhcr *vhcr,
 				   struct mlx4_cmd_mailbox *inbox,
--- a/drivers/net/ethernet/mellanox/mlx4/port.c
+++ b/drivers/net/ethernet/mellanox/mlx4/port.c
@@ -1155,24 +1155,13 @@ int mlx4_SET_VLAN_FLTR_wrapper(struct ml
 	return err;
 }
 
-int mlx4_common_dump_eth_stats(struct mlx4_dev *dev, int slave,
-			       u32 in_mod, struct mlx4_cmd_mailbox *outbox)
-{
-	return mlx4_cmd_box(dev, 0, outbox->dma, in_mod, 0,
-			    MLX4_CMD_DUMP_ETH_STATS, MLX4_CMD_TIME_CLASS_B,
-			    MLX4_CMD_NATIVE);
-}
-
 int mlx4_DUMP_ETH_STATS_wrapper(struct mlx4_dev *dev, int slave,
 				struct mlx4_vhcr *vhcr,
 				struct mlx4_cmd_mailbox *inbox,
 				struct mlx4_cmd_mailbox *outbox,
 				struct mlx4_cmd_info *cmd)
 {
-	if (slave != dev->caps.function)
-		return 0;
-	return mlx4_common_dump_eth_stats(dev, slave,
-					  vhcr->in_modifier, outbox);
+	return 0;
 }
 
 int mlx4_get_slave_from_roce_gid(struct mlx4_dev *dev, int port, u8 *gid,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 220/312] net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (218 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 219/312] net/mlx4_en: Fix potential deadlock in port statistics flow Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 221/312] net/mlx4_core: Fix QUERY FUNC CAP flags Greg Kroah-Hartman
                   ` (93 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jack Morgenstein, Tariq Toukan,
	David S. Miller

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit 44b911e77793d686b481608770d0c55c18055ba0 upstream.

In procedure mlx4_flow_steer_promisc_add(), several fields
were left uninitialized in the rule structure.
Correctly initialize these fields.

Fixes: 592e49dda812 ("net/mlx4: Implement promiscuous mode with device managed flow-steering")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/mcg.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -1464,7 +1464,12 @@ EXPORT_SYMBOL_GPL(mlx4_multicast_detach)
 int mlx4_flow_steer_promisc_add(struct mlx4_dev *dev, u8 port,
 				u32 qpn, enum mlx4_net_trans_promisc_mode mode)
 {
-	struct mlx4_net_trans_rule rule;
+	struct mlx4_net_trans_rule rule = {
+		.queue_mode = MLX4_NET_TRANS_Q_FIFO,
+		.exclusive = 0,
+		.allow_loopback = 1,
+	};
+
 	u64 *regid_p;
 
 	switch (mode) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 221/312] net/mlx4_core: Fix QUERY FUNC CAP flags
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (219 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 220/312] net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 222/312] mlxsw: switchx2: Fix misuse of hard_header_len Greg Kroah-Hartman
                   ` (92 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Moshe Shemesh, Tariq Toukan, David S. Miller

From: Moshe Shemesh <moshe@mellanox.com>

commit c9cc599a96a6822c52cd72ed31dd7f813d792b4f upstream.

Separate QUERY_FUNC_CAP flags0 from QUERY_FUNC_CAP flags, as 'flags' is
already used for another set of flags in FUNC CAP, while phv bit should be
part of a different set of flags.
Remove QUERY_FUNC_CAP port_flags field, as it is not in use.

Fixes: 77fc29c4bbbb ('net/mlx4_core: Preparations for 802.1ad VLAN support')
Fixes: 5cc914f10851 ('mlx4_core: Added FW commands and their wrappers for supporting SRIOV')
Signed-off-by: Moshe Shemesh <moshe@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/fw.c |    5 ++---
 drivers/net/ethernet/mellanox/mlx4/fw.h |    2 +-
 2 files changed, 3 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -610,8 +610,7 @@ int mlx4_QUERY_FUNC_CAP(struct mlx4_dev
 		MLX4_GET(func_cap->phys_port_id, outbox,
 			 QUERY_FUNC_CAP_PHYS_PORT_ID);
 
-	MLX4_GET(field, outbox, QUERY_FUNC_CAP_FLAGS0_OFFSET);
-	func_cap->flags |= (field & QUERY_FUNC_CAP_PHV_BIT);
+	MLX4_GET(func_cap->flags0, outbox, QUERY_FUNC_CAP_FLAGS0_OFFSET);
 
 	/* All other resources are allocated by the master, but we still report
 	 * 'num' and 'reserved' capabilities as follows:
@@ -2840,7 +2839,7 @@ int get_phv_bit(struct mlx4_dev *dev, u8
 	memset(&func_cap, 0, sizeof(func_cap));
 	err = mlx4_QUERY_FUNC_CAP(dev, port, &func_cap);
 	if (!err)
-		*phv = func_cap.flags & QUERY_FUNC_CAP_PHV_BIT;
+		*phv = func_cap.flags0 & QUERY_FUNC_CAP_PHV_BIT;
 	return err;
 }
 EXPORT_SYMBOL(get_phv_bit);
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -150,7 +150,7 @@ struct mlx4_func_cap {
 	u32	qp1_proxy_qpn;
 	u32	reserved_lkey;
 	u8	physical_port;
-	u8	port_flags;
+	u8	flags0;
 	u8	flags1;
 	u64	phys_port_id;
 	u32	extra_flags;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 222/312] mlxsw: switchx2: Fix misuse of hard_header_len
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (220 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 221/312] net/mlx4_core: Fix QUERY FUNC CAP flags Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 223/312] mlxsw: switchx2: Fix ethernet port initialization Greg Kroah-Hartman
                   ` (91 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yotam Gigi, Ido Schimmel, Jiri Pirko,
	David S. Miller

From: Yotam Gigi <yotamg@mellanox.com>

commit 251d41c58b765f00d73b1b4230cad256e25f2735 upstream.

In order to specify that the mlxsw switchx2 driver needs additional
headroom for packets, there have been use of the hard_header_len field of
the netdevice struct.

This commit changes that to use needed_headroom instead, as this is the
correct way to do that.

Fixes: 31557f0f9755 ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support")
Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/switchx2.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -993,7 +993,7 @@ static int mlxsw_sx_port_create(struct m
 	/* Each packet needs to have a Tx header (metadata) on top all other
 	 * headers.
 	 */
-	dev->hard_header_len += MLXSW_TXHDR_LEN;
+	dev->needed_headroom = MLXSW_TXHDR_LEN;
 
 	err = mlxsw_sx_port_module_check(mlxsw_sx_port, &usable);
 	if (err) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 223/312] mlxsw: switchx2: Fix ethernet port initialization
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (221 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 222/312] mlxsw: switchx2: Fix misuse of hard_header_len Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 224/312] sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion Greg Kroah-Hartman
                   ` (90 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Elad Raz, Jiri Pirko, Ido Schimmel,
	David S. Miller

From: Elad Raz <eladr@mellanox.com>

commit 7fb6a36bab6b0b158f93eb13faa1b440f8b26009 upstream.

When creating an ethernet port fails, we must move the port to disable,
otherwise putting the port in switch partition 0 (ETH) or 1 (IB) will
always fails.

Fixes: 31557f0f9755 ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support")
Signed-off-by: Elad Raz <eladr@mellanox.com>
Reviewed-by: Jiri Pirko <jiri@mellanox.com>
Reviewed-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlxsw/switchx2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/switchx2.c
@@ -1074,6 +1074,7 @@ err_port_stp_state_set:
 err_port_admin_status_set:
 err_port_mtu_set:
 err_port_speed_set:
+	mlxsw_sx_port_swid_set(mlxsw_sx_port, MLXSW_PORT_SWID_DISABLED_PORT);
 err_port_swid_set:
 err_port_system_port_mapping_set:
 port_not_usable:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 224/312] sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (222 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 223/312] mlxsw: switchx2: Fix ethernet port initialization Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 225/312] net_sched: flower: Avoid dissection of unmasked keys Greg Kroah-Hartman
                   ` (89 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jirka Hladky, Peter Zijlstra (Intel),
	Linus Torvalds, Thomas Gleixner, Ingo Molnar

From: Peter Zijlstra <peterz@infradead.org>

commit ea1dc6fc6242f991656e35e2ed3d90ec1cd13418 upstream.

Commit:

  fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")

did something non-obvious but also did it buggy yet latent.

The problem was exposed for real by a later commit in the v4.7 merge window:

  2159197d6677 ("sched/core: Enable increased load resolution on 64-bit kernels")

... after which tg->load_avg and cfs_rq->load.weight had different
units (10 bit fixed point and 20 bit fixed point resp.).

Add a comment to explain the use of cfs_rq->load.weight over the
'natural' cfs_rq->avg.load_avg and add scale_load_down() to correct
for the difference in unit.

Since this is (now, as per a previous commit) the only user of
calc_tg_weight(), collapse it.

The effects of this bug should be randomly inconsistent SMP-balancing
of cgroups workloads.

Reported-by: Jirka Hladky <jhladky@redhat.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 2159197d6677 ("sched/core: Enable increased load resolution on 64-bit kernels")
Fixes: fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/sched/fair.c |   27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2394,28 +2394,22 @@ account_entity_dequeue(struct cfs_rq *cf
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
 # ifdef CONFIG_SMP
-static inline long calc_tg_weight(struct task_group *tg, struct cfs_rq *cfs_rq)
+static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
 {
-	long tg_weight;
+	long tg_weight, load, shares;
 
 	/*
-	 * Use this CPU's real-time load instead of the last load contribution
-	 * as the updating of the contribution is delayed, and we will use the
-	 * the real-time load to calc the share. See update_tg_load_avg().
+	 * This really should be: cfs_rq->avg.load_avg, but instead we use
+	 * cfs_rq->load.weight, which is its upper bound. This helps ramp up
+	 * the shares for small weight interactive tasks.
 	 */
-	tg_weight = atomic_long_read(&tg->load_avg);
-	tg_weight -= cfs_rq->tg_load_avg_contrib;
-	tg_weight += cfs_rq->load.weight;
-
-	return tg_weight;
-}
+	load = scale_load_down(cfs_rq->load.weight);
 
-static long calc_cfs_shares(struct cfs_rq *cfs_rq, struct task_group *tg)
-{
-	long tg_weight, load, shares;
+	tg_weight = atomic_long_read(&tg->load_avg);
 
-	tg_weight = calc_tg_weight(tg, cfs_rq);
-	load = cfs_rq->load.weight;
+	/* Ensure tg_weight >= load */
+	tg_weight -= cfs_rq->tg_load_avg_contrib;
+	tg_weight += load;
 
 	shares = (tg->shares * load);
 	if (tg_weight)
@@ -2434,6 +2428,7 @@ static inline long calc_cfs_shares(struc
 	return tg->shares;
 }
 # endif /* CONFIG_SMP */
+
 static void reweight_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
 			    unsigned long weight)
 {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 225/312] net_sched: flower: Avoid dissection of unmasked keys
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (223 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 224/312] sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 226/312] pkt_sched: fq: use proper locking in fq_dump_stats() Greg Kroah-Hartman
                   ` (88 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hadar Hen Zion, Jiri Pirko, David S. Miller

From: Hadar Hen Zion <hadarh@mellanox.com>

commit 339ba878cfb01b68de3d281ba33fd5e4c9f76546 upstream.

The current flower implementation checks the mask range and set all the
keys included in that range as "used_keys", even if a specific key in
the range has a zero mask.

This behavior can cause a false positive return value of
dissector_uses_key function and unnecessary dissection in
__skb_flow_dissect.

This patch checks explicitly the mask of each key and "used_keys" will
be set accordingly.

Fixes: 77b9900ef53a ('tc: introduce Flower classifier')
Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/cls_flower.c |   28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -351,12 +351,10 @@ static int fl_init_hashtable(struct cls_
 
 #define FL_KEY_MEMBER_OFFSET(member) offsetof(struct fl_flow_key, member)
 #define FL_KEY_MEMBER_SIZE(member) (sizeof(((struct fl_flow_key *) 0)->member))
-#define FL_KEY_MEMBER_END_OFFSET(member)					\
-	(FL_KEY_MEMBER_OFFSET(member) + FL_KEY_MEMBER_SIZE(member))
 
-#define FL_KEY_IN_RANGE(mask, member)						\
-        (FL_KEY_MEMBER_OFFSET(member) <= (mask)->range.end &&			\
-         FL_KEY_MEMBER_END_OFFSET(member) >= (mask)->range.start)
+#define FL_KEY_IS_MASKED(mask, member)						\
+	memchr_inv(((char *)mask) + FL_KEY_MEMBER_OFFSET(member),		\
+		   0, FL_KEY_MEMBER_SIZE(member))				\
 
 #define FL_KEY_SET(keys, cnt, id, member)					\
 	do {									\
@@ -365,9 +363,9 @@ static int fl_init_hashtable(struct cls_
 		cnt++;								\
 	} while(0);
 
-#define FL_KEY_SET_IF_IN_RANGE(mask, keys, cnt, id, member)			\
+#define FL_KEY_SET_IF_MASKED(mask, keys, cnt, id, member)			\
 	do {									\
-		if (FL_KEY_IN_RANGE(mask, member))				\
+		if (FL_KEY_IS_MASKED(mask, member))				\
 			FL_KEY_SET(keys, cnt, id, member);			\
 	} while(0);
 
@@ -379,14 +377,14 @@ static void fl_init_dissector(struct cls
 
 	FL_KEY_SET(keys, cnt, FLOW_DISSECTOR_KEY_CONTROL, control);
 	FL_KEY_SET(keys, cnt, FLOW_DISSECTOR_KEY_BASIC, basic);
-	FL_KEY_SET_IF_IN_RANGE(mask, keys, cnt,
-			       FLOW_DISSECTOR_KEY_ETH_ADDRS, eth);
-	FL_KEY_SET_IF_IN_RANGE(mask, keys, cnt,
-			       FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);
-	FL_KEY_SET_IF_IN_RANGE(mask, keys, cnt,
-			       FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
-	FL_KEY_SET_IF_IN_RANGE(mask, keys, cnt,
-			       FLOW_DISSECTOR_KEY_PORTS, tp);
+	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+			     FLOW_DISSECTOR_KEY_ETH_ADDRS, eth);
+	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+			     FLOW_DISSECTOR_KEY_IPV4_ADDRS, ipv4);
+	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+			     FLOW_DISSECTOR_KEY_IPV6_ADDRS, ipv6);
+	FL_KEY_SET_IF_MASKED(&mask->key, keys, cnt,
+			     FLOW_DISSECTOR_KEY_PORTS, tp);
 
 	skb_flow_dissector_init(&head->dissector, keys, cnt);
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 226/312] pkt_sched: fq: use proper locking in fq_dump_stats()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (224 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 225/312] net_sched: flower: Avoid dissection of unmasked keys Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 227/312] sched/preempt: Fix preempt_count manipulations Greg Kroah-Hartman
                   ` (87 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Eric Dumazet, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 695b4ec0f0a9cf29deabd3ac075911d58b31f42b upstream.

When fq is used on 32bit kernels, we need to lock the qdisc before
copying 64bit fields.

Otherwise "tc -s qdisc ..." might report bogus values.

Fixes: afe4fd062416 ("pkt_sched: fq: Fair Queue packet scheduler")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_fq.c |   32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

--- a/net/sched/sch_fq.c
+++ b/net/sched/sch_fq.c
@@ -830,20 +830,24 @@ nla_put_failure:
 static int fq_dump_stats(struct Qdisc *sch, struct gnet_dump *d)
 {
 	struct fq_sched_data *q = qdisc_priv(sch);
-	u64 now = ktime_get_ns();
-	struct tc_fq_qd_stats st = {
-		.gc_flows		= q->stat_gc_flows,
-		.highprio_packets	= q->stat_internal_packets,
-		.tcp_retrans		= q->stat_tcp_retrans,
-		.throttled		= q->stat_throttled,
-		.flows_plimit		= q->stat_flows_plimit,
-		.pkts_too_long		= q->stat_pkts_too_long,
-		.allocation_errors	= q->stat_allocation_errors,
-		.flows			= q->flows,
-		.inactive_flows		= q->inactive_flows,
-		.throttled_flows	= q->throttled_flows,
-		.time_next_delayed_flow	= q->time_next_delayed_flow - now,
-	};
+	struct tc_fq_qd_stats st;
+
+	sch_tree_lock(sch);
+
+	st.gc_flows		  = q->stat_gc_flows;
+	st.highprio_packets	  = q->stat_internal_packets;
+	st.tcp_retrans		  = q->stat_tcp_retrans;
+	st.throttled		  = q->stat_throttled;
+	st.flows_plimit		  = q->stat_flows_plimit;
+	st.pkts_too_long	  = q->stat_pkts_too_long;
+	st.allocation_errors	  = q->stat_allocation_errors;
+	st.time_next_delayed_flow = q->time_next_delayed_flow - ktime_get_ns();
+	st.flows		  = q->flows;
+	st.inactive_flows	  = q->inactive_flows;
+	st.throttled_flows	  = q->throttled_flows;
+	st.pad			  = 0;
+
+	sch_tree_unlock(sch);
 
 	return gnet_stats_copy_app(d, &st, sizeof(st));
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 227/312] sched/preempt: Fix preempt_count manipulations
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (225 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 226/312] pkt_sched: fq: use proper locking in fq_dump_stats() Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 228/312] power: bq27xxx: fix reading for bq27000 and bq27010 Greg Kroah-Hartman
                   ` (86 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Vikram Mulukutla,
	Peter Zijlstra (Intel),
	Linus Torvalds, Thomas Gleixner, Ingo Molnar

From: Peter Zijlstra <peterz@infradead.org>

commit 2e636d5e66c35dfcbaf617aa8fa963f6847478fe upstream.

Vikram reported that his ARM64 compiler managed to 'optimize' away the
preempt_count manipulations in code like:

	preempt_enable_no_resched();
	put_user();
	preempt_disable();

Irrespective of that fact that that is horrible code that should be
fixed for many reasons, it does highlight a deficiency in the generic
preempt_count manipulators. As it is never right to combine/elide
preempt_count manipulations like this.

Therefore sprinkle some volatile in the two generic accessors to
ensure the compiler is aware of the fact that the preempt_count is
observed outside of the regular program-order view and thus cannot be
optimized away like this.

x86; the only arch not using the generic code is not affected as we
do all this in asm in order to use the segment base per-cpu stuff.

Reported-by: Vikram Mulukutla <markivx@codeaurora.org>
Tested-by: Vikram Mulukutla <markivx@codeaurora.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: a787870924db ("sched, arch: Create asm/preempt.h")
Link: http://lkml.kernel.org/r/20160516131751.GH3205@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/asm-generic/preempt.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/include/asm-generic/preempt.h
+++ b/include/asm-generic/preempt.h
@@ -7,10 +7,10 @@
 
 static __always_inline int preempt_count(void)
 {
-	return current_thread_info()->preempt_count;
+	return READ_ONCE(current_thread_info()->preempt_count);
 }
 
-static __always_inline int *preempt_count_ptr(void)
+static __always_inline volatile int *preempt_count_ptr(void)
 {
 	return &current_thread_info()->preempt_count;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 228/312] power: bq27xxx: fix reading for bq27000 and bq27010
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (226 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 227/312] sched/preempt: Fix preempt_count manipulations Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 229/312] power: bq27xxx: fix register numbers of bq27500 Greg Kroah-Hartman
                   ` (85 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller,
	Andrew F. Davis, Pali Rohár, Sebastian Reichel

From: H. Nikolaus Schaller <hns@goldelico.com>

commit 549d7b317c761dbf4ed0c2945aec3acc9ca7ae14 upstream.

bug: the driver reports funny capacity values:

root@letux:/sys/class/power_supply/bq27000-battery# cat uevent
POWER_SUPPLY_NAME=bq27000-battery
POWER_SUPPLY_STATUS=Charging
POWER_SUPPLY_PRESENT=1
POWER_SUPPLY_VOLTAGE_NOW=3702000
POWER_SUPPLY_CURRENT_NOW=-464635
POWER_SUPPLY_CAPACITY=1536			<- over 100% is magic
POWER_SUPPLY_CAPACITY_LEVEL=Normal
POWER_SUPPLY_TEMP=311
POWER_SUPPLY_TIME_TO_FULL_NOW=10440
POWER_SUPPLY_TECHNOLOGY=Li-ion
POWER_SUPPLY_CHARGE_FULL=805450
POWER_SUPPLY_CHARGE_NOW=1068
POWER_SUPPLY_CHARGE_FULL_DESIGN=8844998	<- battery has just 1200 mAh
POWER_SUPPLY_CYCLE_COUNT=21
POWER_SUPPLY_ENERGY_NOW=0
POWER_SUPPLY_POWER_AVG=0
POWER_SUPPLY_HEALTH=Good
POWER_SUPPLY_MANUFACTURER=Texas Instruments

reason: the state of charge and the design capacity register are single
byte only. The design capacity returns the higer order byte.

tested: GTA04 with Openmoko/FIC HF08x battery (using hdq)

Fixes: d74534c27775 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Reviewed-by: Pali Rohár <pali.rohar@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/bq27xxx_battery.c |   12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

--- a/drivers/power/bq27xxx_battery.c
+++ b/drivers/power/bq27xxx_battery.c
@@ -471,7 +471,10 @@ static int bq27xxx_battery_read_soc(stru
 {
 	int soc;
 
-	soc = bq27xxx_read(di, BQ27XXX_REG_SOC, false);
+	if (di->chip == BQ27000 || di->chip == BQ27010)
+		soc = bq27xxx_read(di, BQ27XXX_REG_SOC, true);
+	else
+		soc = bq27xxx_read(di, BQ27XXX_REG_SOC, false);
 
 	if (soc < 0)
 		dev_dbg(di->dev, "error reading State-of-Charge\n");
@@ -536,7 +539,10 @@ static int bq27xxx_battery_read_dcap(str
 {
 	int dcap;
 
-	dcap = bq27xxx_read(di, BQ27XXX_REG_DCAP, false);
+	if (di->chip == BQ27000 || di->chip == BQ27010)
+		dcap = bq27xxx_read(di, BQ27XXX_REG_DCAP, true);
+	else
+		dcap = bq27xxx_read(di, BQ27XXX_REG_DCAP, false);
 
 	if (dcap < 0) {
 		dev_dbg(di->dev, "error reading initial last measured discharge\n");
@@ -544,7 +550,7 @@ static int bq27xxx_battery_read_dcap(str
 	}
 
 	if (di->chip == BQ27000 || di->chip == BQ27010)
-		dcap *= BQ27XXX_CURRENT_CONSTANT / BQ27XXX_RS;
+		dcap = (dcap << 8) * BQ27XXX_CURRENT_CONSTANT / BQ27XXX_RS;
 	else
 		dcap *= 1000;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 229/312] power: bq27xxx: fix register numbers of bq27500
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (227 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 228/312] power: bq27xxx: fix reading for bq27000 and bq27010 Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 230/312] power: test_power: correctly handle empty writes Greg Kroah-Hartman
                   ` (84 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller,
	Andrew F. Davis, Sebastian Reichel

From: H. Nikolaus Schaller <hns@goldelico.com>

commit 099867a16a0fa9fd5aafc32e3b1a6f8a90f17834 upstream.

bug: according to data sheet some register numbers are wrong.

tested: no

Fixes: d74534c27775 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/bq27xxx_battery.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/power/bq27xxx_battery.c
+++ b/drivers/power/bq27xxx_battery.c
@@ -198,10 +198,10 @@ static u8 bq27500_regs[] = {
 	INVALID_REG_ADDR,	/* TTECP - NA	*/
 	0x0c,	/* NAC		*/
 	0x12,	/* LMD(FCC)	*/
-	0x1e,	/* CYCT		*/
+	0x2a,	/* CYCT		*/
 	INVALID_REG_ADDR,	/* AE - NA	*/
-	0x20,	/* SOC(RSOC)	*/
-	0x2e,	/* DCAP(ILMD)	*/
+	0x2c,	/* SOC(RSOC)	*/
+	0x3c,	/* DCAP(ILMD)	*/
 	INVALID_REG_ADDR,	/* AP - NA	*/
 };
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 230/312] power: test_power: correctly handle empty writes
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (228 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 229/312] power: bq27xxx: fix register numbers of bq27500 Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 231/312] power: bq27xxx_battery: Fix bq27541 AveragePower register address Greg Kroah-Hartman
                   ` (83 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sasha Levin, Sebastian Reichel

From: Sasha Levin <sasha.levin@oracle.com>

commit 6b9140f39c2aaf76791197fbab0839c0e4af56e8 upstream.

Writing 0 length data into test_power makes it access an invalid array
location and kill the system.

Fixes: f17ef9b2d ("power: Make test_power driver more dynamic.")
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/test_power.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/power/test_power.c
+++ b/drivers/power/test_power.c
@@ -301,6 +301,8 @@ static int map_get_value(struct battery_
 	buf[MAX_KEYLENGTH-1] = '\0';
 
 	cr = strnlen(buf, MAX_KEYLENGTH) - 1;
+	if (cr < 0)
+		return def_val;
 	if (buf[cr] == '\n')
 		buf[cr] = '\0';
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 231/312] power: bq27xxx_battery: Fix bq27541 AveragePower register address
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (229 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 230/312] power: test_power: correctly handle empty writes Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 232/312] power_supply: tps65217-charger: Fix NULL deref during property export Greg Kroah-Hartman
                   ` (82 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Liu Xiang, Andrew F. Davis,
	Sebastian Reichel

From: Liu Xiang <liu.xiang6@zte.com.cn>

commit 265b60497a57da56a4be7d5c72983ae89dc0765e upstream.

Currently in bq27541 driver, the average power register address is
incorrectly set to 0x76, which would result in an error:
bq27xxx-battery 2-0055: error reading average power register  10: -11
According to the bq27541 datasheet, fix this problem by setting
the average power register address to 0x24.

Fixes: d74534c27775 ("power: bq27xxx_battery: Add support for additional bq27xxx family devices")
Signed-off-by: Liu Xiang <liu.xiang6@zte.com.cn>
Acked-by: Andrew F. Davis <afd@ti.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/bq27xxx_battery.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/power/bq27xxx_battery.c
+++ b/drivers/power/bq27xxx_battery.c
@@ -242,7 +242,7 @@ static u8 bq27541_regs[] = {
 	INVALID_REG_ADDR,	/* AE - NA	*/
 	0x2c,	/* SOC(RSOC)	*/
 	0x3c,	/* DCAP		*/
-	0x76,	/* AP		*/
+	0x24,	/* AP		*/
 };
 
 static u8 bq27545_regs[] = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 232/312] power_supply: tps65217-charger: Fix NULL deref during property export
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (230 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 231/312] power: bq27xxx_battery: Fix bq27541 AveragePower register address Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 233/312] net: vrf: Fix dst reference counting Greg Kroah-Hartman
                   ` (81 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marcin Niestroj, Sebastian Reichel

From: Marcin Niestroj <m.niestroj@grinn-global.com>

commit 362761299eea7dfc3a4870551de36e08758b9254 upstream.

This bug leads to:

[    1.906411] Unable to handle kernel NULL pointer dereference at virtual address 0000000c
[    1.914878] pgd = c0004000
[    1.917786] [0000000c] *pgd=00000000
[    1.921536] Internal error: Oops: 5 [#1] SMP ARM
[    1.926357] Modules linked in:
[    1.929556] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.4.5 #18
[    1.936006] Hardware name: Generic AM33XX (Flattened Device Tree)
[    1.942383] Workqueue: events power_supply_changed_work
[    1.947842] task: de2c41c0 ti: de2c8000 task.ti: de2c8000
[    1.953483] PC is at tps65217_ac_get_property+0x14/0x28
[    1.958937] LR is at tps65217_ac_get_property+0x10/0x28

Driver was trying to use drv_data in property get handler. However drv_data
was not set, so it caused NULL pointer dereference. This patch properly
sets drv_data during probe by power_supply_config parameter, so the
property get handler works as desired.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Fixes: 3636859b280c ("power_supply: Add support for tps65217-charger")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/tps65217_charger.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/power/tps65217_charger.c
+++ b/drivers/power/tps65217_charger.c
@@ -197,6 +197,7 @@ static int tps65217_charger_probe(struct
 {
 	struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent);
 	struct tps65217_charger *charger;
+	struct power_supply_config cfg = {};
 	int ret;
 
 	dev_dbg(&pdev->dev, "%s\n", __func__);
@@ -209,9 +210,12 @@ static int tps65217_charger_probe(struct
 	charger->tps = tps;
 	charger->dev = &pdev->dev;
 
+	cfg.of_node = pdev->dev.of_node;
+	cfg.drv_data = charger;
+
 	charger->ac = devm_power_supply_register(&pdev->dev,
 						 &tps65217_charger_desc,
-						 NULL);
+						 &cfg);
 	if (IS_ERR(charger->ac)) {
 		dev_err(&pdev->dev, "failed: power supply register\n");
 		return PTR_ERR(charger->ac);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 233/312] net: vrf: Fix dst reference counting
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (231 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 232/312] power_supply: tps65217-charger: Fix NULL deref during property export Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 234/312] net: Dont delete routes in different VRFs Greg Kroah-Hartman
                   ` (80 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 9ab179d83b4e31ea277a123492e419067c2f129a upstream.

Vivek reported a kernel exception deleting a VRF with an active
connection through it. The root cause is that the socket has a cached
reference to a dst that is destroyed. Converting the dst_destroy to
dst_release and letting proper reference counting kick in does not
work as the dst has a reference to the device which needs to be released
as well.

I talked to Hannes about this at netdev and he pointed out the ipv4 and
ipv6 dst handling has dst_ifdown for just this scenario. Rather than
continuing with the reinvented dst wheel in VRF just remove it and
leverage the ipv4 and ipv6 versions.

Fixes: 193125dbd8eb2 ("net: Introduce VRF device driver")
Fixes: 35402e3136634 ("net: Add IPv6 support to VRF device")

Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/vrf.c       |  177 ++++--------------------------------------------
 include/net/ip6_route.h |    3 
 include/net/route.h     |    3 
 net/ipv4/route.c        |    7 +
 net/ipv6/route.c        |    7 +
 5 files changed, 30 insertions(+), 167 deletions(-)

--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -71,41 +71,6 @@ struct pcpu_dstats {
 	struct u64_stats_sync	syncp;
 };
 
-static struct dst_entry *vrf_ip_check(struct dst_entry *dst, u32 cookie)
-{
-	return dst;
-}
-
-static int vrf_ip_local_out(struct net *net, struct sock *sk, struct sk_buff *skb)
-{
-	return ip_local_out(net, sk, skb);
-}
-
-static unsigned int vrf_v4_mtu(const struct dst_entry *dst)
-{
-	/* TO-DO: return max ethernet size? */
-	return dst->dev->mtu;
-}
-
-static void vrf_dst_destroy(struct dst_entry *dst)
-{
-	/* our dst lives forever - or until the device is closed */
-}
-
-static unsigned int vrf_default_advmss(const struct dst_entry *dst)
-{
-	return 65535 - 40;
-}
-
-static struct dst_ops vrf_dst_ops = {
-	.family		= AF_INET,
-	.local_out	= vrf_ip_local_out,
-	.check		= vrf_ip_check,
-	.mtu		= vrf_v4_mtu,
-	.destroy	= vrf_dst_destroy,
-	.default_advmss	= vrf_default_advmss,
-};
-
 /* neighbor handling is done with actual device; do not want
  * to flip skb->dev for those ndisc packets. This really fails
  * for multiple next protocols (e.g., NEXTHDR_HOP). But it is
@@ -363,46 +328,6 @@ static netdev_tx_t vrf_xmit(struct sk_bu
 }
 
 #if IS_ENABLED(CONFIG_IPV6)
-static struct dst_entry *vrf_ip6_check(struct dst_entry *dst, u32 cookie)
-{
-	return dst;
-}
-
-static struct dst_ops vrf_dst_ops6 = {
-	.family		= AF_INET6,
-	.local_out	= ip6_local_out,
-	.check		= vrf_ip6_check,
-	.mtu		= vrf_v4_mtu,
-	.destroy	= vrf_dst_destroy,
-	.default_advmss	= vrf_default_advmss,
-};
-
-static int init_dst_ops6_kmem_cachep(void)
-{
-	vrf_dst_ops6.kmem_cachep = kmem_cache_create("vrf_ip6_dst_cache",
-						     sizeof(struct rt6_info),
-						     0,
-						     SLAB_HWCACHE_ALIGN,
-						     NULL);
-
-	if (!vrf_dst_ops6.kmem_cachep)
-		return -ENOMEM;
-
-	return 0;
-}
-
-static void free_dst_ops6_kmem_cachep(void)
-{
-	kmem_cache_destroy(vrf_dst_ops6.kmem_cachep);
-}
-
-static int vrf_input6(struct sk_buff *skb)
-{
-	skb->dev->stats.rx_errors++;
-	kfree_skb(skb);
-	return 0;
-}
-
 /* modelled after ip6_finish_output2 */
 static int vrf_finish_output6(struct net *net, struct sock *sk,
 			      struct sk_buff *skb)
@@ -445,67 +370,34 @@ static int vrf_output6(struct net *net,
 			    !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 }
 
-static void vrf_rt6_destroy(struct net_vrf *vrf)
+static void vrf_rt6_release(struct net_vrf *vrf)
 {
-	dst_destroy(&vrf->rt6->dst);
-	free_percpu(vrf->rt6->rt6i_pcpu);
+	dst_release(&vrf->rt6->dst);
 	vrf->rt6 = NULL;
 }
 
 static int vrf_rt6_create(struct net_device *dev)
 {
 	struct net_vrf *vrf = netdev_priv(dev);
-	struct dst_entry *dst;
+	struct net *net = dev_net(dev);
 	struct rt6_info *rt6;
-	int cpu;
 	int rc = -ENOMEM;
 
-	rt6 = dst_alloc(&vrf_dst_ops6, dev, 0,
-			DST_OBSOLETE_NONE,
-			(DST_HOST | DST_NOPOLICY | DST_NOXFRM));
+	rt6 = ip6_dst_alloc(net, dev,
+			    DST_HOST | DST_NOPOLICY | DST_NOXFRM | DST_NOCACHE);
 	if (!rt6)
 		goto out;
 
-	dst = &rt6->dst;
-
-	rt6->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, GFP_KERNEL);
-	if (!rt6->rt6i_pcpu) {
-		dst_destroy(dst);
-		goto out;
-	}
-	for_each_possible_cpu(cpu) {
-		struct rt6_info **p = per_cpu_ptr(rt6->rt6i_pcpu, cpu);
-		*p =  NULL;
-	}
-
-	memset(dst + 1, 0, sizeof(*rt6) - sizeof(*dst));
-
-	INIT_LIST_HEAD(&rt6->rt6i_siblings);
-	INIT_LIST_HEAD(&rt6->rt6i_uncached);
-
-	rt6->dst.input	= vrf_input6;
 	rt6->dst.output	= vrf_output6;
-
-	rt6->rt6i_table = fib6_get_table(dev_net(dev), vrf->tb_id);
-
-	atomic_set(&rt6->dst.__refcnt, 2);
-
+	rt6->rt6i_table = fib6_get_table(net, vrf->tb_id);
+	dst_hold(&rt6->dst);
 	vrf->rt6 = rt6;
 	rc = 0;
 out:
 	return rc;
 }
 #else
-static int init_dst_ops6_kmem_cachep(void)
-{
-	return 0;
-}
-
-static void free_dst_ops6_kmem_cachep(void)
-{
-}
-
-static void vrf_rt6_destroy(struct net_vrf *vrf)
+static void vrf_rt6_release(struct net_vrf *vrf)
 {
 }
 
@@ -577,11 +469,11 @@ static int vrf_output(struct net *net, s
 			    !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
-static void vrf_rtable_destroy(struct net_vrf *vrf)
+static void vrf_rtable_release(struct net_vrf *vrf)
 {
 	struct dst_entry *dst = (struct dst_entry *)vrf->rth;
 
-	dst_destroy(dst);
+	dst_release(dst);
 	vrf->rth = NULL;
 }
 
@@ -590,22 +482,10 @@ static struct rtable *vrf_rtable_create(
 	struct net_vrf *vrf = netdev_priv(dev);
 	struct rtable *rth;
 
-	rth = dst_alloc(&vrf_dst_ops, dev, 2,
-			DST_OBSOLETE_NONE,
-			(DST_HOST | DST_NOPOLICY | DST_NOXFRM));
+	rth = rt_dst_alloc(dev, 0, RTN_UNICAST, 1, 1, 0);
 	if (rth) {
 		rth->dst.output	= vrf_output;
-		rth->rt_genid	= rt_genid_ipv4(dev_net(dev));
-		rth->rt_flags	= 0;
-		rth->rt_type	= RTN_UNICAST;
-		rth->rt_is_input = 0;
-		rth->rt_iif	= 0;
-		rth->rt_pmtu	= 0;
-		rth->rt_gateway	= 0;
-		rth->rt_uses_gateway = 0;
 		rth->rt_table_id = vrf->tb_id;
-		INIT_LIST_HEAD(&rth->rt_uncached);
-		rth->rt_uncached_list = NULL;
 	}
 
 	return rth;
@@ -739,8 +619,8 @@ static void vrf_dev_uninit(struct net_de
 //	struct list_head *head = &queue->all_slaves;
 //	struct slave *slave, *next;
 
-	vrf_rtable_destroy(vrf);
-	vrf_rt6_destroy(vrf);
+	vrf_rtable_release(vrf);
+	vrf_rt6_release(vrf);
 
 //	list_for_each_entry_safe(slave, next, head, list)
 //		vrf_del_slave(dev, slave->dev);
@@ -772,7 +652,7 @@ static int vrf_dev_init(struct net_devic
 	return 0;
 
 out_rth:
-	vrf_rtable_destroy(vrf);
+	vrf_rtable_release(vrf);
 out_stats:
 	free_percpu(dev->dstats);
 	dev->dstats = NULL;
@@ -805,7 +685,7 @@ static struct rtable *vrf_get_rtable(con
 		struct net_vrf *vrf = netdev_priv(dev);
 
 		rth = vrf->rth;
-		atomic_inc(&rth->dst.__refcnt);
+		dst_hold(&rth->dst);
 	}
 
 	return rth;
@@ -856,7 +736,7 @@ static struct dst_entry *vrf_get_rt6_dst
 		struct net_vrf *vrf = netdev_priv(dev);
 
 		rt = vrf->rt6;
-		atomic_inc(&rt->dst.__refcnt);
+		dst_hold(&rt->dst);
 	}
 
 	return (struct dst_entry *)rt;
@@ -1003,19 +883,6 @@ static int __init vrf_init_module(void)
 {
 	int rc;
 
-	vrf_dst_ops.kmem_cachep =
-		kmem_cache_create("vrf_ip_dst_cache",
-				  sizeof(struct rtable), 0,
-				  SLAB_HWCACHE_ALIGN,
-				  NULL);
-
-	if (!vrf_dst_ops.kmem_cachep)
-		return -ENOMEM;
-
-	rc = init_dst_ops6_kmem_cachep();
-	if (rc != 0)
-		goto error2;
-
 	register_netdevice_notifier(&vrf_notifier_block);
 
 	rc = rtnl_link_register(&vrf_link_ops);
@@ -1026,22 +893,10 @@ static int __init vrf_init_module(void)
 
 error:
 	unregister_netdevice_notifier(&vrf_notifier_block);
-	free_dst_ops6_kmem_cachep();
-error2:
-	kmem_cache_destroy(vrf_dst_ops.kmem_cachep);
 	return rc;
 }
 
-static void __exit vrf_cleanup_module(void)
-{
-	rtnl_link_unregister(&vrf_link_ops);
-	unregister_netdevice_notifier(&vrf_notifier_block);
-	kmem_cache_destroy(vrf_dst_ops.kmem_cachep);
-	free_dst_ops6_kmem_cachep();
-}
-
 module_init(vrf_init_module);
-module_exit(vrf_cleanup_module);
 MODULE_AUTHOR("Shrijeet Mukherjee, David Ahern");
 MODULE_DESCRIPTION("Device driver to instantiate VRF domains");
 MODULE_LICENSE("GPL");
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -103,6 +103,9 @@ void fib6_force_start_gc(struct net *net
 struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 				    const struct in6_addr *addr, bool anycast);
 
+struct rt6_info *ip6_dst_alloc(struct net *net, struct net_device *dev,
+			       int flags);
+
 /*
  *	support functions for ND
  *
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -210,6 +210,9 @@ unsigned int inet_addr_type_dev_table(st
 void ip_rt_multicast_event(struct in_device *);
 int ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
 void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
+struct rtable *rt_dst_alloc(struct net_device *dev,
+			     unsigned int flags, u16 type,
+			     bool nopolicy, bool noxfrm, bool will_cache);
 
 struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1500,9 +1500,9 @@ static void rt_set_nexthop(struct rtable
 #endif
 }
 
-static struct rtable *rt_dst_alloc(struct net_device *dev,
-				   unsigned int flags, u16 type,
-				   bool nopolicy, bool noxfrm, bool will_cache)
+struct rtable *rt_dst_alloc(struct net_device *dev,
+			    unsigned int flags, u16 type,
+			    bool nopolicy, bool noxfrm, bool will_cache)
 {
 	struct rtable *rt;
 
@@ -1531,6 +1531,7 @@ static struct rtable *rt_dst_alloc(struc
 
 	return rt;
 }
+EXPORT_SYMBOL(rt_dst_alloc);
 
 /* called in rcu_read_lock() section */
 static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -339,9 +339,9 @@ static struct rt6_info *__ip6_dst_alloc(
 	return rt;
 }
 
-static struct rt6_info *ip6_dst_alloc(struct net *net,
-				      struct net_device *dev,
-				      int flags)
+struct rt6_info *ip6_dst_alloc(struct net *net,
+			       struct net_device *dev,
+			       int flags)
 {
 	struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags);
 
@@ -365,6 +365,7 @@ static struct rt6_info *ip6_dst_alloc(st
 
 	return rt;
 }
+EXPORT_SYMBOL(ip6_dst_alloc);
 
 static void ip6_dst_destroy(struct dst_entry *dst)
 {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 234/312] net: Dont delete routes in different VRFs
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (232 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 233/312] net: vrf: Fix dst reference counting Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 235/312] vti6: fix input path Greg Kroah-Hartman
                   ` (79 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, David Ahern, Mark Tomlinson, David S. Miller

From: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>

commit 5a56a0b3a45dd0cc5b2f7bec6afd053a474ed9f5 upstream.

When deleting an IP address from an interface, there is a clean-up of
routes which refer to this local address. However, there was no check to
see that the VRF matched. This meant that deletion wasn't confined to
the VRF it should have been.

To solve this, a new field has been added to fib_info to hold a table
id. When removing fib entries corresponding to a local ip address, this
table id is also used in the comparison.

The table id is populated when the fib_info is created. This was already
done in some places, but not in ip_rt_ioctl(). This has now been fixed.

Fixes: 021dd3b8a142 ("net: Add routes to the table associated with the device")
Acked-by: David Ahern <dsa@cumulusnetworks.com>
Tested-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/ip_fib.h     |    3 ++-
 net/ipv4/fib_frontend.c  |    3 ++-
 net/ipv4/fib_semantics.c |    8 ++++++--
 3 files changed, 10 insertions(+), 4 deletions(-)

--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -112,6 +112,7 @@ struct fib_info {
 	unsigned char		fib_scope;
 	unsigned char		fib_type;
 	__be32			fib_prefsrc;
+	u32			fib_tb_id;
 	u32			fib_priority;
 	struct dst_metrics	*fib_metrics;
 #define fib_mtu fib_metrics->metrics[RTAX_MTU-1]
@@ -320,7 +321,7 @@ void fib_flush_external(struct net *net)
 /* Exported by fib_semantics.c */
 int ip_fib_check_default(__be32 gw, struct net_device *dev);
 int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force);
-int fib_sync_down_addr(struct net *net, __be32 local);
+int fib_sync_down_addr(struct net_device *dev, __be32 local);
 int fib_sync_up(struct net_device *dev, unsigned int nh_flags);
 void fib_sync_mtu(struct net_device *dev, u32 orig_mtu);
 
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -509,6 +509,7 @@ static int rtentry_to_fib_config(struct
 		if (!dev)
 			return -ENODEV;
 		cfg->fc_oif = dev->ifindex;
+		cfg->fc_table = l3mdev_fib_table(dev);
 		if (colon) {
 			struct in_ifaddr *ifa;
 			struct in_device *in_dev = __in_dev_get_rtnl(dev);
@@ -1034,7 +1035,7 @@ no_promotions:
 			 * First of all, we scan fib_info list searching
 			 * for stray nexthop entries, then ignite fib_flush.
 			 */
-			if (fib_sync_down_addr(dev_net(dev), ifa->ifa_local))
+			if (fib_sync_down_addr(dev, ifa->ifa_local))
 				fib_flush(dev_net(dev));
 		}
 	}
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1069,6 +1069,7 @@ struct fib_info *fib_create_info(struct
 	fi->fib_priority = cfg->fc_priority;
 	fi->fib_prefsrc = cfg->fc_prefsrc;
 	fi->fib_type = cfg->fc_type;
+	fi->fib_tb_id = cfg->fc_table;
 
 	fi->fib_nhs = nhs;
 	change_nexthops(fi) {
@@ -1352,18 +1353,21 @@ nla_put_failure:
  *   referring to it.
  * - device went down -> we must shutdown all nexthops going via it.
  */
-int fib_sync_down_addr(struct net *net, __be32 local)
+int fib_sync_down_addr(struct net_device *dev, __be32 local)
 {
 	int ret = 0;
 	unsigned int hash = fib_laddr_hashfn(local);
 	struct hlist_head *head = &fib_info_laddrhash[hash];
+	struct net *net = dev_net(dev);
+	int tb_id = l3mdev_fib_table(dev);
 	struct fib_info *fi;
 
 	if (!fib_info_laddrhash || local == 0)
 		return 0;
 
 	hlist_for_each_entry(fi, head, fib_lhash) {
-		if (!net_eq(fi->fib_net, net))
+		if (!net_eq(fi->fib_net, net) ||
+		    fi->fib_tb_id != tb_id)
 			continue;
 		if (fi->fib_prefsrc == local) {
 			fi->fib_flags |= RTNH_F_DEAD;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 235/312] vti6: fix input path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (233 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 234/312] net: Dont delete routes in different VRFs Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 236/312] ipv4: Fix table id reference in fib_sync_down_addr Greg Kroah-Hartman
                   ` (78 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Alexey Kodanev, Nicolas Dichtel,
	Steffen Klassert

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit 63c43787d35e45562a6b5927e2edc8f4783d95b8 upstream.

Since commit 1625f4529957, vti6 is broken, all input packets are dropped
(LINUX_MIB_XFRMINNOSTATES is incremented).

XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 is set by vti6_rcv() before calling
xfrm6_rcv()/xfrm6_rcv_spi(), thus we cannot set to NULL that value in
xfrm6_rcv_spi().

A new function xfrm6_rcv_tnl() that enables to pass a value to
xfrm6_rcv_spi() is added, so that xfrm6_rcv() is not touched (this function
is used in several handlers).

CC: Alexey Kodanev <alexey.kodanev@oracle.com>
Fixes: 1625f4529957 ("net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/net/xfrm.h      |    4 +++-
 net/ipv6/ip6_vti.c      |    4 +---
 net/ipv6/xfrm6_input.c  |   16 +++++++++++-----
 net/ipv6/xfrm6_tunnel.c |    2 +-
 4 files changed, 16 insertions(+), 10 deletions(-)

--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1551,8 +1551,10 @@ int xfrm4_tunnel_deregister(struct xfrm_
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
 int xfrm6_extract_header(struct sk_buff *skb);
 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
-int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
+int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
+		  struct ip6_tnl *t);
 int xfrm6_transport_finish(struct sk_buff *skb, int async);
+int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
 int xfrm6_rcv(struct sk_buff *skb);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 		     xfrm_address_t *saddr, u8 proto);
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -324,11 +324,9 @@ static int vti6_rcv(struct sk_buff *skb)
 			goto discard;
 		}
 
-		XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
-
 		rcu_read_unlock();
 
-		return xfrm6_rcv(skb);
+		return xfrm6_rcv_tnl(skb, t);
 	}
 	rcu_read_unlock();
 	return -EINVAL;
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -21,9 +21,10 @@ int xfrm6_extract_input(struct xfrm_stat
 	return xfrm6_extract_header(skb);
 }
 
-int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi)
+int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
+		  struct ip6_tnl *t)
 {
-	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = NULL;
+	XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip6 = t;
 	XFRM_SPI_SKB_CB(skb)->family = AF_INET6;
 	XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct ipv6hdr, daddr);
 	return xfrm_input(skb, nexthdr, spi, 0);
@@ -49,13 +50,18 @@ int xfrm6_transport_finish(struct sk_buf
 	return -1;
 }
 
-int xfrm6_rcv(struct sk_buff *skb)
+int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t)
 {
 	return xfrm6_rcv_spi(skb, skb_network_header(skb)[IP6CB(skb)->nhoff],
-			     0);
+			     0, t);
 }
-EXPORT_SYMBOL(xfrm6_rcv);
+EXPORT_SYMBOL(xfrm6_rcv_tnl);
 
+int xfrm6_rcv(struct sk_buff *skb)
+{
+	return xfrm6_rcv_tnl(skb, NULL);
+}
+EXPORT_SYMBOL(xfrm6_rcv);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 		     xfrm_address_t *saddr, u8 proto)
 {
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -239,7 +239,7 @@ static int xfrm6_tunnel_rcv(struct sk_bu
 	__be32 spi;
 
 	spi = xfrm6_tunnel_spi_lookup(net, (const xfrm_address_t *)&iph->saddr);
-	return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi);
+	return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi, NULL);
 }
 
 static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 236/312] ipv4: Fix table id reference in fib_sync_down_addr
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (234 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 235/312] vti6: fix input path Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 237/312] mlx4: do not call napi_schedule() without care Greg Kroah-Hartman
                   ` (77 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hendrik Donner, David Ahern, David S. Miller

From: David Ahern <dsahern@kernel.org>

commit e0a312629fefa943534fc46f7bfbe6de3fdaf463 upstream.

Hendrik reported routes in the main table using source address are not
removed when the address is removed. The problem is that fib_sync_down_addr
does not account for devices in the default VRF which are associated
with the main table. Fix by updating the table id reference.

Fixes: 5a56a0b3a45d ("net: Don't delete routes in different VRFs")
Reported-by: Hendrik Donner <hd@os-cillation.de>
Signed-off-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/fib_semantics.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1358,8 +1358,8 @@ int fib_sync_down_addr(struct net_device
 	int ret = 0;
 	unsigned int hash = fib_laddr_hashfn(local);
 	struct hlist_head *head = &fib_info_laddrhash[hash];
+	int tb_id = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
 	struct net *net = dev_net(dev);
-	int tb_id = l3mdev_fib_table(dev);
 	struct fib_info *fi;
 
 	if (!fib_info_laddrhash || local == 0)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 237/312] mlx4: do not call napi_schedule() without care
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (235 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 236/312] ipv4: Fix table id reference in fib_sync_down_addr Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 238/312] xprtrdma: Fix backchannel allocation of extra rpcrdma_reps Greg Kroah-Hartman
                   ` (76 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Erez Shitrit,
	Eugenia Emantayev, Tariq Toukan, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 8cf699ec849f4ca1413cea01289bd7d37dbcc626 upstream.

Disable BH around the call to napi_schedule() to avoid following warning

[   52.095499] NOHZ: local_softirq_pending 08
[   52.421291] NOHZ: local_softirq_pending 08
[   52.608313] NOHZ: local_softirq_pending 08

Fixes: 8d59de8f7bb3 ("net/mlx4_en: Process all completions in RX rings after port goes up")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Erez Shitrit <erezsh@mellanox.com>
Cc: Eugenia Emantayev <eugenia@mellanox.com>
Cc: Tariq Toukan <tariqt@mellanox.com>
Acked-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1724,8 +1724,11 @@ int mlx4_en_start_port(struct net_device
 	/* Process all completions if exist to prevent
 	 * the queues freezing if they are full
 	 */
-	for (i = 0; i < priv->rx_ring_num; i++)
+	for (i = 0; i < priv->rx_ring_num; i++) {
+		local_bh_disable();
 		napi_schedule(&priv->rx_cq[i]->napi);
+		local_bh_enable();
+	}
 
 	netif_tx_start_all_queues(dev);
 	netif_device_attach(dev);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 238/312] xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (236 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 237/312] mlx4: do not call napi_schedule() without care Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 239/312] ALSA: fm801: Initialize chip after IRQ handler is registered Greg Kroah-Hartman
                   ` (75 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker

From: Chuck Lever <chuck.lever@oracle.com>

commit d698c4a02ee02053bbebe051322ff427a2dad56a upstream.

The backchannel code uses rpcrdma_recv_buffer_put to add new reps
to the free rep list. This also decrements rb_recv_count, which
spoofs the receive overrun logic in rpcrdma_buffer_get_rep.

Commit 9b06688bc3b9 ("xprtrdma: Fix additional uses of
spin_lock_irqsave(rb_lock)") replaced the original open-coded
list_add with a call to rpcrdma_recv_buffer_put(), but then a year
later, commit 05c974669ece ("xprtrdma: Fix receive buffer
accounting") added rep accounting to rpcrdma_recv_buffer_put.
It was an oversight to let the backchannel continue to use this
function.

The fix this, let's combine the "add to free list" logic with
rpcrdma_create_rep.

Also, do not allocate RPCRDMA_MAX_BC_REQUESTS rpcrdma_reps in
rpcrdma_buffer_create and then allocate additional rpcrdma_reps in
rpcrdma_bc_setup_reps. Allocating the extra reps during backchannel
set-up is sufficient.

Fixes: 05c974669ece ("xprtrdma: Fix receive buffer accounting")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sunrpc/xprtrdma/backchannel.c |   12 ++----------
 net/sunrpc/xprtrdma/verbs.c       |   34 ++++++++++++++++++++--------------
 net/sunrpc/xprtrdma/xprt_rdma.h   |    2 +-
 3 files changed, 23 insertions(+), 25 deletions(-)

--- a/net/sunrpc/xprtrdma/backchannel.c
+++ b/net/sunrpc/xprtrdma/backchannel.c
@@ -84,21 +84,13 @@ out_fail:
 static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
 				 unsigned int count)
 {
-	struct rpcrdma_rep *rep;
 	int rc = 0;
 
 	while (count--) {
-		rep = rpcrdma_create_rep(r_xprt);
-		if (IS_ERR(rep)) {
-			pr_err("RPC:       %s: reply buffer alloc failed\n",
-			       __func__);
-			rc = PTR_ERR(rep);
+		rc = rpcrdma_create_rep(r_xprt);
+		if (rc)
 			break;
-		}
-
-		rpcrdma_recv_buffer_put(rep);
 	}
-
 	return rc;
 }
 
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -911,10 +911,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *
 	return req;
 }
 
-struct rpcrdma_rep *
-rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
+/**
+ * rpcrdma_create_rep - Allocate an rpcrdma_rep object
+ * @r_xprt: controlling transport
+ *
+ * Returns 0 on success or a negative errno on failure.
+ */
+int
+ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt)
 {
 	struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data;
+	struct rpcrdma_buffer *buf = &r_xprt->rx_buf;
 	struct rpcrdma_ia *ia = &r_xprt->rx_ia;
 	struct rpcrdma_rep *rep;
 	int rc;
@@ -934,12 +941,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *
 	rep->rr_device = ia->ri_device;
 	rep->rr_rxprt = r_xprt;
 	INIT_WORK(&rep->rr_work, rpcrdma_receive_worker);
-	return rep;
+
+	spin_lock(&buf->rb_lock);
+	list_add(&rep->rr_list, &buf->rb_recv_bufs);
+	spin_unlock(&buf->rb_lock);
+	return 0;
 
 out_free:
 	kfree(rep);
 out:
-	return ERR_PTR(rc);
+	dprintk("RPC:       %s: reply buffer %d alloc failed\n",
+		__func__, rc);
+	return rc;
 }
 
 int
@@ -975,17 +988,10 @@ rpcrdma_buffer_create(struct rpcrdma_xpr
 	}
 
 	INIT_LIST_HEAD(&buf->rb_recv_bufs);
-	for (i = 0; i < buf->rb_max_requests + 2; i++) {
-		struct rpcrdma_rep *rep;
-
-		rep = rpcrdma_create_rep(r_xprt);
-		if (IS_ERR(rep)) {
-			dprintk("RPC:       %s: reply buffer %d alloc failed\n",
-				__func__, i);
-			rc = PTR_ERR(rep);
+	for (i = 0; i <= buf->rb_max_requests; i++) {
+		rc = rpcrdma_create_rep(r_xprt);
+		if (rc)
 			goto out;
-		}
-		list_add(&rep->rr_list, &buf->rb_recv_bufs);
 	}
 
 	return 0;
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -431,8 +431,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_
  * Buffer calls - xprtrdma/verbs.c
  */
 struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *);
-struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *);
 void rpcrdma_destroy_req(struct rpcrdma_ia *, struct rpcrdma_req *);
+int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt);
 int rpcrdma_buffer_create(struct rpcrdma_xprt *);
 void rpcrdma_buffer_destroy(struct rpcrdma_buffer *);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 239/312] ALSA: fm801: Initialize chip after IRQ handler is registered
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (237 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 238/312] xprtrdma: Fix backchannel allocation of extra rpcrdma_reps Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 240/312] bonding: fix length of actor system Greg Kroah-Hartman
                   ` (74 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Émeric MASCHINO,
	Andy Shevchenko, Takashi Iwai

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 610e1ae9b533be82b3aa118b907e0a703256913d upstream.

The commit b56fa687e02b ("ALSA: fm801: detect FM-only card earlier")
rearranged initialization calls, i.e. it makes snd_fm801_chip_init() to
be called before we register interrupt handler and set PCI bus
mastering.

Somehow it prevents FM801-AU to work properly. Thus, partially revert
initialization order changed by commit mentioned above.

Fixes: b56fa687e02b ("ALSA: fm801: detect FM-only card earlier")
Reported-by: Émeric MASCHINO <emeric.maschino@gmail.com>
Tested-by: Émeric MASCHINO <emeric.maschino@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.5+
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/fm801.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/fm801.c
+++ b/sound/pci/fm801.c
@@ -1225,8 +1225,6 @@ static int snd_fm801_create(struct snd_c
 		}
 	}
 
-	snd_fm801_chip_init(chip);
-
 	if ((chip->tea575x_tuner & TUNER_ONLY) == 0) {
 		if (devm_request_irq(&pci->dev, pci->irq, snd_fm801_interrupt,
 				IRQF_SHARED, KBUILD_MODNAME, chip)) {
@@ -1238,6 +1236,8 @@ static int snd_fm801_create(struct snd_c
 		pci_set_master(pci);
 	}
 
+	snd_fm801_chip_init(chip);
+
 	if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
 		snd_fm801_free(chip);
 		return err;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 240/312] bonding: fix length of actor system
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (238 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 239/312] ALSA: fm801: Initialize chip after IRQ handler is registered Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 241/312] MIPS: perf: Remove incorrect odd/even counter handling for I6400 Greg Kroah-Hartman
                   ` (73 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tobias Jungel, David S. Miller

From: Tobias Jungel <tobias.jungel@gmail.com>

commit 414dd6fb9a1a1b59983aea7bf0f79f0085ecc5b8 upstream.

The attribute IFLA_BOND_AD_ACTOR_SYSTEM is sent to user space having the
length of sizeof(bond->params.ad_actor_system) which is 8 byte. This
patch aligns the length to ETH_ALEN to have the same MAC address exposed
as using sysfs.

Fixes: f87fda00b6ed2 ("bonding: prevent out of bound accesses")
Signed-off-by: Tobias Jungel <tobias.jungel@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/bonding/bond_netlink.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -628,8 +628,7 @@ static int bond_fill_info(struct sk_buff
 				goto nla_put_failure;
 
 			if (nla_put(skb, IFLA_BOND_AD_ACTOR_SYSTEM,
-				    sizeof(bond->params.ad_actor_system),
-				    &bond->params.ad_actor_system))
+				    ETH_ALEN, &bond->params.ad_actor_system))
 				goto nla_put_failure;
 		}
 		if (!bond_3ad_get_active_agg_info(bond, &info)) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 241/312] MIPS: perf: Remove incorrect odd/even counter handling for I6400
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (239 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 240/312] bonding: fix length of actor system Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 242/312] Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" Greg Kroah-Hartman
                   ` (72 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Marcin Nowakowski, linux-mips, Ralf Baechle

From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>

commit f7a31b5e7874f77464a4eae0a8ba84b9ae0b3a54 upstream.

All performance counters on I6400 (odd and even) are capable of counting
any of the available events, so drop current logic of using the extra
bit to determine which counter to use.

Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Fixes: 4e88a8621301 ("MIPS: Add cases for CPU_I6400")
Fixes: fd716fca10fc ("MIPS: perf: Fix I6400 event numbers")
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15991/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/kernel/perf_event_mipsxx.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/arch/mips/kernel/perf_event_mipsxx.c
+++ b/arch/mips/kernel/perf_event_mipsxx.c
@@ -1606,7 +1606,6 @@ static const struct mips_perf_event *mip
 #endif
 		break;
 	case CPU_P5600:
-	case CPU_I6400:
 		/* 8-bit event numbers */
 		raw_id = config & 0x1ff;
 		base_id = raw_id & 0xff;
@@ -1619,6 +1618,11 @@ static const struct mips_perf_event *mip
 		raw_event.range = P;
 #endif
 		break;
+	case CPU_I6400:
+		/* 8-bit event numbers */
+		base_id = config & 0xff;
+		raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;
+		break;
 	case CPU_1004K:
 		if (IS_BOTH_COUNTERS_1004K_EVENT(base_id))
 			raw_event.cntr_mask = CNTR_EVEN | CNTR_ODD;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 242/312] Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (240 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 241/312] MIPS: perf: Remove incorrect odd/even counter handling for I6400 Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 243/312] net: dsa: mv88e6xxx: unlock DSA and CPU ports Greg Kroah-Hartman
                   ` (71 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Viresh Kumar, Juri Lelli,
	Shilpasri G Bhat, Rafael J. Wysocki

From: Viresh Kumar <viresh.kumar@linaro.org>

commit 68e80dae09033d778b98dc88e5bfe8fdade188e5 upstream.

Earlier, when the struct freq-attr was used to represent governor
attributes, the standard cpufreq show/store sysfs attribute callbacks
were applied to the governor tunable attributes and they always acquire
the policy->rwsem lock before carrying out the operation.  That could
have resulted in an ABBA deadlock if governor tunable attributes are
removed under policy->rwsem while one of them is being accessed
concurrently (if sysfs attributes removal wins the race, it will wait
for the access to complete with policy->rwsem held while the attribute
callback will block on policy->rwsem indefinitely).

We attempted to address this issue by dropping policy->rwsem around
governor tunable attributes removal (that is, around invocations of the
->governor callback with the event arg equal to CPUFREQ_GOV_POLICY_EXIT)
in cpufreq_set_policy(), but that opened up race conditions that had not
been possible with policy->rwsem held all the time.

The previous commit, "cpufreq: governor: New sysfs show/store callbacks
for governor tunables", fixed the original ABBA deadlock by adding new
governor specific show/store callbacks.

We don't have to drop rwsem around invocations of governor event
CPUFREQ_GOV_POLICY_EXIT anymore, and original fix can be reverted now.

Fixes: 955ef4833574 (cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT)
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Reported-by: Juri Lelli <juri.lelli@arm.com>
Tested-by: Juri Lelli <juri.lelli@arm.com>
Tested-by: Shilpasri G Bhat <shilpa.bhat@linux.vnet.ibm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpufreq/cpufreq.c |    5 -----
 include/linux/cpufreq.h   |    4 ----
 2 files changed, 9 deletions(-)

--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2171,10 +2171,7 @@ static int cpufreq_set_policy(struct cpu
 			return ret;
 		}
 
-		up_write(&policy->rwsem);
 		ret = __cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
-		down_write(&policy->rwsem);
-
 		if (ret) {
 			pr_err("%s: Failed to Exit Governor: %s (%d)\n",
 			       __func__, old_gov->name, ret);
@@ -2190,9 +2187,7 @@ static int cpufreq_set_policy(struct cpu
 		if (!ret)
 			goto out;
 
-		up_write(&policy->rwsem);
 		__cpufreq_governor(policy, CPUFREQ_GOV_POLICY_EXIT);
-		down_write(&policy->rwsem);
 	}
 
 	/* new governor failed, so re-start old one */
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -100,10 +100,6 @@ struct cpufreq_policy {
 	 * - Any routine that will write to the policy structure and/or may take away
 	 *   the policy altogether (eg. CPU hotplug), will hold this lock in write
 	 *   mode before doing so.
-	 *
-	 * Additional rules:
-	 * - Lock should not be held across
-	 *     __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
 	 */
 	struct rw_semaphore	rwsem;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 243/312] net: dsa: mv88e6xxx: unlock DSA and CPU ports
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (241 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 242/312] Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 244/312] gfs2: fix flock panic issue Greg Kroah-Hartman
                   ` (70 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vivien Didelot, David S. Miller

From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>

commit 65fa40276ac1318e75264e5a204547b57c2cf397 upstream.

Locking a port generates an hardware interrupt when a new SA address is
received. This enables CPU directed learning, which is needed for 802.1X
MAC authentication.

To disable automatic learning on a port, the only configuration needed
is to set its Port Association Vector to all zero.

Clear PAV when SA learning should be disabled instead of locking a port.

Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports")
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/dsa/mv88e6xxx.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -2066,7 +2066,7 @@ static int mv88e6xxx_setup_port(struct d
 	reg = 1 << port;
 	/* Disable learning for DSA and CPU ports */
 	if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port))
-		reg = PORT_ASSOC_VECTOR_LOCKED_PORT;
+		reg = 0;
 
 	ret = _mv88e6xxx_reg_write(ds, REG_PORT(port), PORT_ASSOC_VECTOR, reg);
 	if (ret)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 244/312] gfs2: fix flock panic issue
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (242 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 243/312] net: dsa: mv88e6xxx: unlock DSA and CPU ports Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 245/312] blk-mq: fix undefined behaviour in order_to_size() Greg Kroah-Hartman
                   ` (69 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Junxiao Bi, Bob Peterson

From: Junxiao Bi <junxiao.bi@oracle.com>

commit a93a99838248bdab49db2eaac00236847670bc7f upstream.

Commit 4f6563677ae8 ("Move locks API users to locks_lock_inode_wait()")
moved flock/posix lock identify code to locks_lock_inode_wait(), but
missed to set fl_flags to FL_FLOCK which will cause kernel panic in
locks_lock_inode_wait().

Fixes: 4f6563677ae8 ("Move locks API users to locks_lock_inode_wait()")
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/gfs2/file.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/fs/gfs2/file.c
+++ b/fs/gfs2/file.c
@@ -1035,7 +1035,10 @@ static int do_flock(struct file *file, i
 		if (fl_gh->gh_state == state)
 			goto out;
 		locks_lock_file_wait(file,
-				     &(struct file_lock){.fl_type = F_UNLCK});
+				     &(struct file_lock) {
+					     .fl_type = F_UNLCK,
+					     .fl_flags = FL_FLOCK
+				     });
 		gfs2_glock_dq(fl_gh);
 		gfs2_holder_reinit(state, flags, fl_gh);
 	} else {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 245/312] blk-mq: fix undefined behaviour in order_to_size()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (243 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 244/312] gfs2: fix flock panic issue Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 246/312] dm: fix second blk_delay_queue() parameter to be in msec units not jiffies Greg Kroah-Hartman
                   ` (68 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Meelis Roos,
	Bartlomiej Zolnierkiewicz, Jens Axboe

From: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

commit b3a834b1596ac668df206aa2bb1f191c31f5f5e4 upstream.

When this_order variable in blk_mq_init_rq_map() becomes zero
the code incorrectly decrements the variable and passes the result
to order_to_size() helper causing undefined behaviour:

 UBSAN: Undefined behaviour in block/blk-mq.c:1459:27
 shift exponent 4294967295 is too large for 32-bit type 'unsigned int'
 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.6.0-rc6-00072-g33656a1 #22

Fix the code by checking this_order variable for not having the zero
value first.

Reported-by: Meelis Roos <mroos@linux.ee>
Fixes: 320ae51feed5 ("blk-mq: new multi-queue block IO queueing mechanism")
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/blk-mq.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1491,7 +1491,7 @@ static struct blk_mq_tags *blk_mq_init_r
 		int to_do;
 		void *p;
 
-		while (left < order_to_size(this_order - 1) && this_order)
+		while (this_order && left < order_to_size(this_order - 1))
 			this_order--;
 
 		do {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 246/312] dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (244 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 245/312] blk-mq: fix undefined behaviour in order_to_size() Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 247/312] dmaengine: edma: Add probe callback to edma_tptc_driver Greg Kroah-Hartman
                   ` (67 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tahsin Erdogan, Mike Snitzer

From: Tahsin Erdogan <tahsin@google.com>

commit bd9f55ea1cf6e14eb054b06ea877d2d1fa339514 upstream.

Commit d548b34b062 ("dm: reduce the queue delay used in dm_request_fn
from 100ms to 10ms") always intended the value to be 10 msecs -- it
just expressed it in jiffies because earlier commit 7eaceaccab ("block:
remove per-queue plugging") did.

Signed-off-by: Tahsin Erdogan <tahsin@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Fixes: d548b34b062 ("dm: reduce the queue delay used in dm_request_fn from 100ms to 10ms")
Cc: stable@vger.kernel.org # 4.1+ -- stable@ backports must be applied to drivers/md/dm.c
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -2192,7 +2192,7 @@ static void dm_request_fn(struct request
 	goto out;
 
 delay_and_out:
-	blk_delay_queue(q, HZ / 100);
+	blk_delay_queue(q, 10);
 out:
 	dm_put_live_table(md, srcu_idx);
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 247/312] dmaengine: edma: Add probe callback to edma_tptc_driver
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (245 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 246/312] dm: fix second blk_delay_queue() parameter to be in msec units not jiffies Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:33 ` [PATCH 4.4 248/312] spi: rockchip: modify DMA max burst to 1 Greg Kroah-Hartman
                   ` (66 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Vinod Koul

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

commit 4fa2d09c1ae879c2ee2760ab419a4f97026dd97b upstream.

Due to changes in device and platform code drivers w/o probe will fail to
load. This means that the devices for eDMA TPTCs are goign to be without
driver and omap hwmod code will turn them off after the kernel finished
loading:
[    3.015900] platform 49800000.tptc: omap_device_late_idle: enabled but no driver.  Idling
[    3.024671] platform 49a00000.tptc: omap_device_late_idle: enabled but no driver.  Idling

This will prevent eDMA to work since the TPTCs are not enabled.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Fixes: 34635b1accb9 ("dmaengine: edma: Add dummy driver skeleton for edma3-tptc")
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/dma/edma.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -2439,7 +2439,13 @@ static struct platform_driver edma_drive
 	},
 };
 
+static int edma_tptc_probe(struct platform_device *pdev)
+{
+	return 0;
+}
+
 static struct platform_driver edma_tptc_driver = {
+	.probe		= edma_tptc_probe,
 	.driver = {
 		.name	= "edma3-tptc",
 		.of_match_table = edma_tptc_of_ids,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 248/312] spi: rockchip: modify DMA max burst to 1
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (246 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 247/312] dmaengine: edma: Add probe callback to edma_tptc_driver Greg Kroah-Hartman
@ 2020-05-08 12:33 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 249/312] openvswitch: update checksum in {push,pop}_mpls Greg Kroah-Hartman
                   ` (65 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:33 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Addy ke, Shawn Lin, Heiko Stuebner,
	Olof Johansson, Doug Anderson, Sonny Rao, Mark Brown,
	Caesar Wang, Vinod Koul

From: Addy Ke <addy.ke@rock-chips.com>

commit 80abf8880cc6e1594c11b7c417f22dde60e25312 upstream.

Generic dma controller on Rockchips' platform cannot support
DMAFLUSHP instruction which make dma to flush the req of non-aligned
or non-multiple of what we need. That will cause an unrecoverable
dma bus error. The saftest way is to set dma max burst to 1.

Signed-off-by: Addy ke <addy.ke@rock-chips.com>
Fixes: 64e36824b32b06 ("spi/rockchip: add driver for Rockchip...")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
cc: Heiko Stuebner <heiko@sntech.de>
cc: Olof Johansson <olof@lixom.net>
cc: Doug Anderson <dianders@chromium.org>
cc: Sonny Rao <sonnyrao@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>

---
 drivers/spi/spi-rockchip.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -199,6 +199,7 @@ struct rockchip_spi {
 	struct sg_table rx_sg;
 	struct rockchip_spi_dma_data dma_rx;
 	struct rockchip_spi_dma_data dma_tx;
+	struct dma_slave_caps dma_caps;
 };
 
 static inline void spi_enable_chip(struct rockchip_spi *rs, int enable)
@@ -457,7 +458,10 @@ static void rockchip_spi_prepare_dma(str
 		rxconf.direction = rs->dma_rx.direction;
 		rxconf.src_addr = rs->dma_rx.addr;
 		rxconf.src_addr_width = rs->n_bytes;
-		rxconf.src_maxburst = rs->n_bytes;
+		if (rs->dma_caps.max_burst > 4)
+			rxconf.src_maxburst = 4;
+		else
+			rxconf.src_maxburst = 1;
 		dmaengine_slave_config(rs->dma_rx.ch, &rxconf);
 
 		rxdesc = dmaengine_prep_slave_sg(
@@ -474,7 +478,10 @@ static void rockchip_spi_prepare_dma(str
 		txconf.direction = rs->dma_tx.direction;
 		txconf.dst_addr = rs->dma_tx.addr;
 		txconf.dst_addr_width = rs->n_bytes;
-		txconf.dst_maxburst = rs->n_bytes;
+		if (rs->dma_caps.max_burst > 4)
+			txconf.dst_maxburst = 4;
+		else
+			txconf.dst_maxburst = 1;
 		dmaengine_slave_config(rs->dma_tx.ch, &txconf);
 
 		txdesc = dmaengine_prep_slave_sg(
@@ -738,6 +745,7 @@ static int rockchip_spi_probe(struct pla
 	}
 
 	if (rs->dma_tx.ch && rs->dma_rx.ch) {
+		dma_get_slave_caps(rs->dma_rx.ch, &(rs->dma_caps));
 		rs->dma_tx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_TXDR);
 		rs->dma_rx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_RXDR);
 		rs->dma_tx.direction = DMA_MEM_TO_DEV;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 249/312] openvswitch: update checksum in {push,pop}_mpls
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (247 preceding siblings ...)
  2020-05-08 12:33 ` [PATCH 4.4 248/312] spi: rockchip: modify DMA max burst to 1 Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 250/312] cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled Greg Kroah-Hartman
                   ` (64 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pravin Shelar, Simon Horman,
	Pravin B Shelar, David S. Miller

From: Simon Horman <simon.horman@netronome.com>

commit bc7cc5999fd392cc799630d7e375b2f4e29cc398 upstream.

In the case of CHECKSUM_COMPLETE the skb checksum should be updated in
{push,pop}_mpls() as they the type in the ethernet header.

As suggested by Pravin Shelar.

Cc: Pravin Shelar <pshelar@nicira.com>
Fixes: 25cd9ba0abc0 ("openvswitch: Add basic MPLS support to kernel")
Signed-off-by: Simon Horman <simon.horman@netronome.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/openvswitch/actions.c |   20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -137,11 +137,23 @@ static bool is_flow_key_valid(const stru
 	return !!key->eth.type;
 }
 
+static void update_ethertype(struct sk_buff *skb, struct ethhdr *hdr,
+			     __be16 ethertype)
+{
+	if (skb->ip_summed == CHECKSUM_COMPLETE) {
+		__be16 diff[] = { ~(hdr->h_proto), ethertype };
+
+		skb->csum = ~csum_partial((char *)diff, sizeof(diff),
+					~skb->csum);
+	}
+
+	hdr->h_proto = ethertype;
+}
+
 static int push_mpls(struct sk_buff *skb, struct sw_flow_key *key,
 		     const struct ovs_action_push_mpls *mpls)
 {
 	__be32 *new_mpls_lse;
-	struct ethhdr *hdr;
 
 	/* Networking stack do not allow simultaneous Tunnel and MPLS GSO. */
 	if (skb->encapsulation)
@@ -160,9 +172,7 @@ static int push_mpls(struct sk_buff *skb
 
 	skb_postpush_rcsum(skb, new_mpls_lse, MPLS_HLEN);
 
-	hdr = eth_hdr(skb);
-	hdr->h_proto = mpls->mpls_ethertype;
-
+	update_ethertype(skb, eth_hdr(skb), mpls->mpls_ethertype);
 	if (!skb->inner_protocol)
 		skb_set_inner_protocol(skb, skb->protocol);
 	skb->protocol = mpls->mpls_ethertype;
@@ -193,7 +203,7 @@ static int pop_mpls(struct sk_buff *skb,
 	 * field correctly in the presence of VLAN tags.
 	 */
 	hdr = (struct ethhdr *)(skb_mpls_header(skb) - ETH_HLEN);
-	hdr->h_proto = ethertype;
+	update_ethertype(skb, hdr, ethertype);
 	if (eth_p_mpls(skb->protocol))
 		skb->protocol = ethertype;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 250/312] cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (248 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 249/312] openvswitch: update checksum in {push,pop}_mpls Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 251/312] net: bcmgenet: fix skb_len in bcmgenet_xmit_single() Greg Kroah-Hartman
                   ` (63 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Hariprasad Shenai, David S. Miller

From: Hariprasad Shenai <hariprasad@chelsio.com>

commit 8d09e6b8b9c9969ac59496dc21e10b67fe727e7e upstream.

The commit 637d3e997351 ("cxgb4: Discard the packet if the length is
greater than mtu") introduced a regression in the VLAN interface
performance when Tx VLAN offload is disabled.

Check if skb is tagged, regardless of whether it is hardware accelerated
or not. Presently we were checking only for hardware acclereated one,
which caused performance to drop to ~0.17Mbps on a 10GbE adapter for
VLAN interface, when tx vlan offload is turned off using ethtool.
The ethernet head length calculation was going wrong in this case, and
driver ended up dropping packets.

Fixes: 637d3e997351 ("cxgb4: Discard the packet if the length is greater than mtu")
Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/chelsio/cxgb4/sge.c   |    2 +-
 drivers/net/ethernet/chelsio/cxgb4vf/sge.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -1165,7 +1165,7 @@ out_free:	dev_kfree_skb_any(skb);
 
 	/* Discard the packet if the length is greater than mtu */
 	max_pkt_len = ETH_HLEN + dev->mtu;
-	if (skb_vlan_tag_present(skb))
+	if (skb_vlan_tagged(skb))
 		max_pkt_len += VLAN_HLEN;
 	if (!skb_shinfo(skb)->gso_size && (unlikely(skb->len > max_pkt_len)))
 		goto out_free;
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -1188,7 +1188,7 @@ int t4vf_eth_xmit(struct sk_buff *skb, s
 
 	/* Discard the packet if the length is greater than mtu */
 	max_pkt_len = ETH_HLEN + dev->mtu;
-	if (skb_vlan_tag_present(skb))
+	if (skb_vlan_tagged(skb))
 		max_pkt_len += VLAN_HLEN;
 	if (!skb_shinfo(skb)->gso_size && (unlikely(skb->len > max_pkt_len)))
 		goto out_free;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 251/312] net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (249 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 250/312] cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 252/312] net: bcmgenet: device stats are unsigned long Greg Kroah-Hartman
                   ` (62 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Petri Gynther, Eric Dumazet, David S. Miller

From: Petri Gynther <pgynther@google.com>

commit 7dd399130efb5a454daf24075b7563d197114e39 upstream.

skb_len needs to be skb_headlen(skb) in bcmgenet_xmit_single().

Fragmented skbs can have only Ethernet + IP + TCP headers (14+20+20=54 bytes)
in the linear buffer, followed by the rest in fragments. Bumping skb_len to
ETH_ZLEN would be incorrect for this case, as it would introduce garbage
between TCP header and the fragment data.

This also works with regular/non-fragmented small packets < ETH_ZLEN bytes.
Successfully tested this on GENETv3 with 42-byte ARP frames.

For testing, I used:
ethtool -K eth0 tx-checksum-ipv4 off
ethtool -K eth0 tx-checksum-ipv6 off
echo 0 > /proc/sys/net/ipv4/tcp_timestamps

Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Petri Gynther <pgynther@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1346,7 +1346,7 @@ static int bcmgenet_xmit_single(struct n
 
 	tx_cb_ptr->skb = skb;
 
-	skb_len = skb_headlen(skb) < ETH_ZLEN ? ETH_ZLEN : skb_headlen(skb);
+	skb_len = skb_headlen(skb);
 
 	mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
 	ret = dma_mapping_error(kdev, mapping);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 252/312] net: bcmgenet: device stats are unsigned long
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (250 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 251/312] net: bcmgenet: fix skb_len in bcmgenet_xmit_single() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 253/312] ovs/gre: fix rtnl notifications on iface deletion Greg Kroah-Hartman
                   ` (61 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Florian Fainelli,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 6517eb59b03965689e6bb16bb2d480096b3ef95d upstream.

On 64bit kernels, device stats are 64bit wide, not 32bit.

Fixes: 1c1008c793fa4 ("net: bcmgenet: add main driver file")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/broadcom/genet/bcmgenet.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -927,7 +927,11 @@ static void bcmgenet_get_ethtool_stats(s
 		else
 			p = (char *)priv;
 		p += s->stat_offset;
-		data[i] = *(u32 *)p;
+		if (sizeof(unsigned long) != sizeof(u32) &&
+		    s->stat_sizeof == sizeof(unsigned long))
+			data[i] = *(unsigned long *)p;
+		else
+			data[i] = *(u32 *)p;
 	}
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 253/312] ovs/gre: fix rtnl notifications on iface deletion
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (251 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 252/312] net: bcmgenet: device stats are unsigned long Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 254/312] gre: do not assign header_ops in collect metadata mode Greg Kroah-Hartman
                   ` (60 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Graf, Pravin B Shelar,
	Nicolas Dichtel, David S. Miller

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit da6f1da819d4b9c081a477dec74dc468a0b44290 upstream.

The function gretap_fb_dev_create() (only used by ovs) never calls
rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
never set to RTNL_LINK_INITIALIZED.
During the deletion phase, the function rollback_registered_many() sends
a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.

Fixes: b2acd1dc3949 ("openvswitch: Use regular GRE net_device instead of vport")
CC: Thomas Graf <tgraf@suug.ch>
CC: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/ip_gre.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1265,6 +1265,10 @@ struct net_device *gretap_fb_dev_create(
 	if (err)
 		goto out;
 
+	err = rtnl_configure_link(dev, NULL);
+	if (err < 0)
+		goto out;
+
 	return dev;
 out:
 	ip_tunnel_dellink(dev, &list_kill);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 254/312] gre: do not assign header_ops in collect metadata mode
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (252 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 253/312] ovs/gre: fix rtnl notifications on iface deletion Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 255/312] gre: build header correctly for collect metadata tunnels Greg Kroah-Hartman
                   ` (59 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Benc, David S. Miller

From: Jiri Benc <jbenc@redhat.com>

commit a64b04d86d14c81f50f68e102f79ef301e3d0a0e upstream.

In ipgre mode (i.e. not gretap) with collect metadata flag set, the tunnel
is incorrectly assumed to be mGRE in NBMA mode (see commit 6a5f44d7a048c).
This is not the case, we're controlling the encapsulation addresses by
lwtunnel metadata. And anyway, assigning dev->header_ops in collect metadata
mode does not make sense.

Although it would be more user firendly to reject requests that specify
both the collect metadata flag and a remote/local IP address, this would
break current users of gretap or introduce ugly code and differences in
handling ipgre and gretap configuration. Keep the current behavior of
remote/local IP address being ignored in such case.

v3: Back to v1, added explanation paragraph.
v2: Reject configuration specifying both remote/local address and collect
    metadata flag.

Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/ip_gre.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -882,7 +882,7 @@ static int ipgre_tunnel_init(struct net_
 	netif_keep_dst(dev);
 	dev->addr_len		= 4;
 
-	if (iph->daddr) {
+	if (iph->daddr && !tunnel->collect_md) {
 #ifdef CONFIG_NET_IPGRE_BROADCAST
 		if (ipv4_is_multicast(iph->daddr)) {
 			if (!iph->saddr)
@@ -891,8 +891,9 @@ static int ipgre_tunnel_init(struct net_
 			dev->header_ops = &ipgre_header_ops;
 		}
 #endif
-	} else
+	} else if (!tunnel->collect_md) {
 		dev->header_ops = &ipgre_header_ops;
+	}
 
 	return ip_tunnel_init(dev);
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 255/312] gre: build header correctly for collect metadata tunnels
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (253 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 254/312] gre: do not assign header_ops in collect metadata mode Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 256/312] gre: reject GUE and FOU in collect metadata mode Greg Kroah-Hartman
                   ` (58 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jiri Benc, Pravin B Shelar,
	Simon Horman, David S. Miller

From: Jiri Benc <jbenc@redhat.com>

commit 2090714e1d6e80979dd6926be22b0de9ca432273 upstream.

In ipgre (i.e. not gretap) + collect metadata mode, the skb was assumed to
contain Ethernet header and was encapsulated as ETH_P_TEB. This is not the
case, the interface is ARPHRD_IPGRE and the protocol to be used for
encapsulation is skb->protocol.

Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Acked-by: Pravin B Shelar <pshelar@ovn.org>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/ip_gre.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -520,7 +520,8 @@ static struct rtable *gre_get_rt(struct
 	return ip_route_output_key(net, fl);
 }
 
-static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev)
+static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
+			__be16 proto)
 {
 	struct ip_tunnel_info *tun_info;
 	const struct ip_tunnel_key *key;
@@ -563,7 +564,7 @@ static void gre_fb_xmit(struct sk_buff *
 	}
 
 	flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY);
-	build_header(skb, tunnel_hlen, flags, htons(ETH_P_TEB),
+	build_header(skb, tunnel_hlen, flags, proto,
 		     tunnel_id_to_key(tun_info->key.tun_id), 0);
 
 	df = key->tun_flags & TUNNEL_DONT_FRAGMENT ?  htons(IP_DF) : 0;
@@ -605,7 +606,7 @@ static netdev_tx_t ipgre_xmit(struct sk_
 	const struct iphdr *tnl_params;
 
 	if (tunnel->collect_md) {
-		gre_fb_xmit(skb, dev);
+		gre_fb_xmit(skb, dev, skb->protocol);
 		return NETDEV_TX_OK;
 	}
 
@@ -649,7 +650,7 @@ static netdev_tx_t gre_tap_xmit(struct s
 	struct ip_tunnel *tunnel = netdev_priv(dev);
 
 	if (tunnel->collect_md) {
-		gre_fb_xmit(skb, dev);
+		gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
 		return NETDEV_TX_OK;
 	}
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 256/312] gre: reject GUE and FOU in collect metadata mode
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (254 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 255/312] gre: build header correctly for collect metadata tunnels Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 257/312] sfc: fix potential stack corruption from running past stat bitmask Greg Kroah-Hartman
                   ` (57 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Benc, David S. Miller

From: Jiri Benc <jbenc@redhat.com>

commit 946b636f1730c64e05ff7fe8cf7136422fa8ea70 upstream.

The collect metadata mode does not support GUE nor FOU. This might be
implemented later; until then, we should reject such config.

I think this is okay to be changed. It's unlikely anyone has such
configuration (as it doesn't work anyway) and we may need a way to
distinguish whether it's supported or not by the kernel later.

For backwards compatibility with iproute2, it's not possible to just check
the attribute presence (iproute2 always includes the attribute), the actual
value has to be checked, too.

Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/ip_gre.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -937,6 +937,11 @@ static int ipgre_tunnel_validate(struct
 	if (flags & (GRE_VERSION|GRE_ROUTING))
 		return -EINVAL;
 
+	if (data[IFLA_GRE_COLLECT_METADATA] &&
+	    data[IFLA_GRE_ENCAP_TYPE] &&
+	    nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE)
+		return -EINVAL;
+
 	return 0;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 257/312] sfc: fix potential stack corruption from running past stat bitmask
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (255 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 256/312] gre: reject GUE and FOU in collect metadata mode Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 258/312] sfc: clear napi_hash state when copying channels Greg Kroah-Hartman
                   ` (56 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Edward Cree, David S. Miller

From: Andrew Rybchenko <Andrew.Rybchenko@oktetlabs.ru>

commit e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 upstream.

On 32-bit systems, mask is only an array of 3 longs, not 4, so don't try
to write to mask[3].
Also include build-time checks in case the size of the bitmask changes.

Fixes: 3c36a2aded8c ("sfc: display vadaptor statistics for all interfaces")
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/sfc/ef10.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -1304,13 +1304,14 @@ static void efx_ef10_get_stat_mask(struc
 	}
 
 #if BITS_PER_LONG == 64
+	BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
 	mask[0] = raw_mask[0];
 	mask[1] = raw_mask[1];
 #else
+	BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
 	mask[0] = raw_mask[0] & 0xffffffff;
 	mask[1] = raw_mask[0] >> 32;
 	mask[2] = raw_mask[1] & 0xffffffff;
-	mask[3] = raw_mask[1] >> 32;
 #endif
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 258/312] sfc: clear napi_hash state when copying channels
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (256 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 257/312] sfc: fix potential stack corruption from running past stat bitmask Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 259/312] net: bcmsysport: Device stats are unsigned long Greg Kroah-Hartman
                   ` (55 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bert Kenward, David S. Miller

From: Bert Kenward <bkenward@solarflare.com>

commit 46d054f8f540612f09987a53154aa39ae15f2e4c upstream.

efx_copy_channel() doesn't correctly clear the napi_hash related state.
This means that when napi_hash_add is called for that channel nothing is
done, and we are left with a copy of the napi_hash_node from the old
channel. When we later call napi_hash_del() on this channel we have a
stale napi_hash_node.

Corruption is only seen when there are multiple entries in one of the
napi_hash lists. This is made more likely by having a very large number
of channels. Testing was carried out with 512 channels - 32 channels on
each of 16 ports.

This failure typically appears as protection faults within napi_by_id()
or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring
sizes are changed (ethtool -G).

Fixes: 36763266bbe8 ("sfc: Add support for busy polling")
Signed-off-by: Bert Kenward <bkenward@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/sfc/efx.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -479,6 +479,9 @@ efx_copy_channel(const struct efx_channe
 	*channel = *old_channel;
 
 	channel->napi_dev = NULL;
+	INIT_HLIST_NODE(&channel->napi_str.napi_hash_node);
+	channel->napi_str.napi_id = 0;
+	channel->napi_str.state = 0;
 	memset(&channel->eventq, 0, sizeof(channel->eventq));
 
 	for (j = 0; j < EFX_TXQ_TYPES; j++) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 259/312] net: bcmsysport: Device stats are unsigned long
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (257 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 258/312] sfc: clear napi_hash state when copying channels Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 260/312] cxgbi: fix uninitialized flowi6 Greg Kroah-Hartman
                   ` (54 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit 016eb55157166132b094e53434748cae35e18455 upstream.

On 64bits kernels, device stats are 64bits wide, not 32bits.

Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/broadcom/bcmsysport.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -396,7 +396,7 @@ static void bcm_sysport_get_stats(struct
 		else
 			p = (char *)priv;
 		p += s->stat_offset;
-		data[i] = *(u32 *)p;
+		data[i] = *(unsigned long *)p;
 	}
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 260/312] cxgbi: fix uninitialized flowi6
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (258 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 259/312] net: bcmsysport: Device stats are unsigned long Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 261/312] net: macb: add missing free_netdev() on error in macb_probe() Greg Kroah-Hartman
                   ` (53 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Benc, David S. Miller

From: Jiri Benc <jbenc@redhat.com>

commit 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 upstream.

ip6_route_output looks into different fields in the passed flowi6 structure,
yet cxgbi passes garbage in nearly all those fields. Zero the structure out
first.

Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/cxgbi/libcxgbi.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -692,6 +692,7 @@ static struct rt6_info *find_route_ipv6(
 {
 	struct flowi6 fl;
 
+	memset(&fl, 0, sizeof(fl));
 	if (saddr)
 		memcpy(&fl.saddr, saddr, sizeof(struct in6_addr));
 	if (daddr)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 261/312] net: macb: add missing free_netdev() on error in macb_probe()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (259 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 260/312] cxgbi: fix uninitialized flowi6 Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 262/312] macvtap: segmented packet is consumed Greg Kroah-Hartman
                   ` (52 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wei Yongjun, David S. Miller

From: Wei Yongjun <weiyj.lk@gmail.com>

commit b22ae0b4d9669495158a7fa0fd027bd0fcd8896e upstream.

Add the missing free_netdev() before return from function macb_probe()
in the platform_get_irq() error handling case.

Fixes: c69618b3e4f2 ("net/macb: fix probe sequence to setup clocks earlier")
Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/cadence/macb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -2904,7 +2904,7 @@ static int macb_probe(struct platform_de
 	dev->irq = platform_get_irq(pdev, 0);
 	if (dev->irq < 0) {
 		err = dev->irq;
-		goto err_disable_clocks;
+		goto err_out_free_netdev;
 	}
 
 	mac = of_get_mac_address(np);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 262/312] macvtap: segmented packet is consumed
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (260 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 261/312] net: macb: add missing free_netdev() on error in macb_probe() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 263/312] tipc: fix the error handling in tipc_udp_enable() Greg Kroah-Hartman
                   ` (51 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Vlad Yasevich,
	Shmulik Ladkani, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit be0bd3160165e42783d8215f426e41c07179c08a upstream.

If GSO packet is segmented and its segments are properly queued,
we call consume_skb() instead of kfree_skb() to be drop monitor
friendly.

Fixes: 3e4f8b7873709 ("macvtap: Perform GSO on forwarding path.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Vlad Yasevich <vyasevic@redhat.com>
Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/macvtap.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -373,7 +373,7 @@ static rx_handler_result_t macvtap_handl
 			goto wake_up;
 		}
 
-		kfree_skb(skb);
+		consume_skb(skb);
 		while (segs) {
 			struct sk_buff *nskb = segs->next;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 263/312] tipc: fix the error handling in tipc_udp_enable()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (261 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 262/312] macvtap: segmented packet is consumed Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 264/312] net: icmp6_send should use dst dev to determine L3 domain Greg Kroah-Hartman
                   ` (50 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wei Yongjun, David S. Miller

From: Wei Yongjun <weiyongjun1@huawei.com>

commit a5de125dd46c851fc962806135953c1bd0a0f0df upstream.

Fix to return a negative error code in enable_mcast() error handling
case, and release udp socket when necessary.

Fixes: d0f91938bede ("tipc: add ip/udp media type")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/tipc/udp_media.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c
@@ -405,10 +405,13 @@ static int tipc_udp_enable(struct net *n
 	tuncfg.encap_destroy = NULL;
 	setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg);
 
-	if (enable_mcast(ub, remote))
+	err = enable_mcast(ub, remote);
+	if (err)
 		goto err;
 	return 0;
 err:
+	if (ub->ubsock)
+		udp_tunnel_sock_release(ub->ubsock);
 	kfree(ub);
 	return err;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 264/312] net: icmp6_send should use dst dev to determine L3 domain
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (262 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 263/312] tipc: fix the error handling in tipc_udp_enable() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 265/312] et131x: Fix logical vs bitwise check in et131x_tx_timeout() Greg Kroah-Hartman
                   ` (49 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 5d41ce29e3b91ef305f88d23f72b3359de329cec upstream.

icmp6_send is called in response to some event. The skb may not have
the device set (skb->dev is NULL), but it is expected to have a dst set.
Update icmp6_send to use the dst on the skb to determine L3 domain.

Fixes: ca254490c8dfd ("net: Add VRF support to IPv6 stack")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv6/icmp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -446,7 +446,7 @@ static void icmp6_send(struct sk_buff *s
 	if (__ipv6_addr_needs_scope_id(addr_type))
 		iif = skb->dev->ifindex;
 	else
-		iif = l3mdev_master_ifindex(skb->dev);
+		iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
 
 	/*
 	 *	Must not send error if the source does not uniquely



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 265/312] et131x: Fix logical vs bitwise check in et131x_tx_timeout()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (263 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 264/312] net: icmp6_send should use dst dev to determine L3 domain Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 266/312] net: ethernet: stmmac: dwmac-sti: fix probe error path Greg Kroah-Hartman
                   ` (48 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit de702da7a823ab0c4a1e53ed79a2695f0d453855 upstream.

We should be using a logical check here instead of a bitwise operation
to check if the device is closed already in et131x_tx_timeout().

Reported-by: coverity (CID 146498)
Fixes: 38df6492eb511 ("et131x: Add PCIe gigabit ethernet driver et131x to drivers/net")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/agere/et131x.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/agere/et131x.c
+++ b/drivers/net/ethernet/agere/et131x.c
@@ -3854,7 +3854,7 @@ static void et131x_tx_timeout(struct net
 	unsigned long flags;
 
 	/* If the device is closed, ignore the timeout */
-	if (~(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
+	if (!(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
 		return;
 
 	/* Any nonrecoverable hardware error?



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 266/312] net: ethernet: stmmac: dwmac-sti: fix probe error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (264 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 265/312] et131x: Fix logical vs bitwise check in et131x_tx_timeout() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 267/312] rtnl: reset calcit fptr in rtnl_unregister() Greg Kroah-Hartman
                   ` (47 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 0a9e22715ee384cf2a714c28f24ce8881b9fd815 upstream.

Make sure to disable clocks before returning on late probe errors.

Fixes: 8387ee21f972 ("stmmac: dwmac-sti: turn setup callback into a
probe function")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
@@ -365,7 +365,16 @@ static int sti_dwmac_probe(struct platfo
 	if (ret)
 		return ret;
 
-	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	if (ret)
+		goto err_dwmac_exit;
+
+	return 0;
+
+err_dwmac_exit:
+	sti_dwmac_exit(pdev, plat_dat->bsp_priv);
+
+	return ret;
 }
 
 static const struct sti_dwmac_of_data stih4xx_dwmac_data = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 267/312] rtnl: reset calcit fptr in rtnl_unregister()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (265 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 266/312] net: ethernet: stmmac: dwmac-sti: fix probe error path Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 268/312] net: ethernet: stmmac: dwmac-rk: fix probe error path Greg Kroah-Hartman
                   ` (46 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jeff Kirsher, Greg Rose,
	Mathias Krause, David S. Miller

From: Mathias Krause <minipli@googlemail.com>

commit f567e950bf51290755a2539ff2aaef4c26f735d3 upstream.

To avoid having dangling function pointers left behind, reset calcit in
rtnl_unregister(), too.

This is no issue so far, as only the rtnl core registers a netlink
handler with a calcit hook which won't be unregistered, but may become
one if new code makes use of the calcit hook.

Fixes: c7ac8679bec9 ("rtnetlink: Compute and store minimum ifinfo...")
Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Cc: Greg Rose <gregory.v.rose@intel.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/core/rtnetlink.c |    1 +
 1 file changed, 1 insertion(+)

--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -253,6 +253,7 @@ int rtnl_unregister(int protocol, int ms
 
 	rtnl_msg_handlers[protocol][msgindex].doit = NULL;
 	rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
+	rtnl_msg_handlers[protocol][msgindex].calcit = NULL;
 
 	return 0;
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 268/312] net: ethernet: stmmac: dwmac-rk: fix probe error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (266 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 267/312] rtnl: reset calcit fptr in rtnl_unregister() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 269/312] fq_codel: return non zero qlen in class dumps Greg Kroah-Hartman
                   ` (45 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 2d222656db08b8eef3b53b56cf1ce4a90fe8cd78 upstream.

Make sure to disable runtime PM, power down the PHY, and disable clocks
before returning on late probe errors.

Fixes: 27ffefd2d109 ("stmmac: dwmac-rk: create a new probe function")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c |   11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
@@ -600,7 +600,16 @@ static int rk_gmac_probe(struct platform
 	if (ret)
 		return ret;
 
-	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	if (ret)
+		goto err_gmac_exit;
+
+	return 0;
+
+err_gmac_exit:
+	rk_gmac_exit(pdev, plat_dat->bsp_priv);
+
+	return ret;
 }
 
 static const struct of_device_id rk_gmac_dwmac_match[] = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 269/312] fq_codel: return non zero qlen in class dumps
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (267 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 268/312] net: ethernet: stmmac: dwmac-rk: fix probe error path Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 270/312] net: ethernet: stmmac: dwmac-generic: fix probe error path Greg Kroah-Hartman
                   ` (44 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, John Fastabend,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit aafddbf0cffeb790f919436285328c762279b5d4 upstream.

We properly scan the flow list to count number of packets,
but John passed 0 to gnet_stats_copy_queue() so we report
a zero value to user space instead of the result.

Fixes: 640158536632 ("net: sched: restrict use of qstats qlen")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: John Fastabend <john.r.fastabend@intel.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_fq_codel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sched/sch_fq_codel.c
+++ b/net/sched/sch_fq_codel.c
@@ -588,7 +588,7 @@ static int fq_codel_dump_class_stats(str
 		qs.backlog = q->backlogs[idx];
 		qs.drops = flow->dropped;
 	}
-	if (gnet_stats_copy_queue(d, NULL, &qs, 0) < 0)
+	if (gnet_stats_copy_queue(d, NULL, &qs, qs.qlen) < 0)
 		return -1;
 	if (idx < q->flows_cnt)
 		return gnet_stats_copy_app(d, &xstats, sizeof(xstats));



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 270/312] net: ethernet: stmmac: dwmac-generic: fix probe error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (268 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 269/312] fq_codel: return non zero qlen in class dumps Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 271/312] ovs/geneve: fix rtnl notifications on iface deletion Greg Kroah-Hartman
                   ` (43 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 939b20022765bc338b0f72cbf1eed60a907398d7 upstream.

Make sure to call any exit() callback to undo the effect of init()
before returning on late probe errors.

Fixes: cf3f047b9af4 ("stmmac: move hw init in the probe (v2)")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
@@ -53,7 +53,17 @@ static int dwmac_generic_probe(struct pl
 			return ret;
 	}
 
-	return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+	if (ret)
+		goto err_exit;
+
+	return 0;
+
+err_exit:
+	if (plat_dat->exit)
+		plat_dat->exit(pdev, plat_dat->bsp_priv);
+
+	return ret;
 }
 
 static const struct of_device_id dwmac_generic_match[] = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 271/312] ovs/geneve: fix rtnl notifications on iface deletion
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (269 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 270/312] net: ethernet: stmmac: dwmac-generic: fix probe error path Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 272/312] bnxt: add a missing rcu synchronization Greg Kroah-Hartman
                   ` (42 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Pravin B Shelar, Jesse Gross,
	Thomas Graf, Nicolas Dichtel, David S. Miller

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit 41009481b690493c169ce85f591b9d32c6fd9422 upstream.

The function geneve_dev_create_fb() (only used by ovs) never calls
rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
never set to RTNL_LINK_INITIALIZED.
During the deletion phase, the function rollback_registered_many() sends
a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.

Fixes: e305ac6cf5a1 ("geneve: Add support to collect tunnel metadata.")
CC: Pravin B Shelar <pshelar@nicira.com>
CC: Jesse Gross <jesse@nicira.com>
CC: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/geneve.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1363,6 +1363,10 @@ struct net_device *geneve_dev_create_fb(
 	if (err)
 		goto err;
 
+	err = rtnl_configure_link(dev, NULL);
+	if (err < 0)
+		goto err;
+
 	return dev;
 
  err:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 272/312] bnxt: add a missing rcu synchronization
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (270 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 271/312] ovs/geneve: fix rtnl notifications on iface deletion Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 273/312] qdisc: fix a module refcount leak in qdisc_create_dflt() Greg Kroah-Hartman
                   ` (41 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Michael Chan, David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit e5f6f564fd191d365fcd775c06a732a488205588 upstream.

Add a missing synchronize_net() call to avoid potential use after free,
since we explicitly call napi_hash_del() to factorize the RCU grace
period.

Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Michael Chan <michael.chan@broadcom.com>
Acked-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4250,6 +4250,10 @@ static void bnxt_del_napi(struct bnxt *b
 		napi_hash_del(&bnapi->napi);
 		netif_napi_del(&bnapi->napi);
 	}
+	/* We called napi_hash_del() before netif_napi_del(), we need
+	 * to respect an RCU grace period before freeing napi structures.
+	 */
+	synchronize_net();
 }
 
 static void bnxt_init_napi(struct bnxt *bp)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 273/312] qdisc: fix a module refcount leak in qdisc_create_dflt()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (271 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 272/312] bnxt: add a missing rcu synchronization Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 274/312] net: axienet: Fix return value check in axienet_probe() Greg Kroah-Hartman
                   ` (40 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Eric Dumazet, John Fastabend,
	David S. Miller

From: Eric Dumazet <edumazet@google.com>

commit 166ee5b87866de07a3e56c1b757f2b5cabba72a5 upstream.

Should qdisc_alloc() fail, we must release the module refcount
we got right before.

Fixes: 6da7c8fcbcbd ("qdisc: allow setting default queuing discipline")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: John Fastabend <john.r.fastabend@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sched/sch_generic.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -626,18 +626,19 @@ struct Qdisc *qdisc_create_dflt(struct n
 	struct Qdisc *sch;
 
 	if (!try_module_get(ops->owner))
-		goto errout;
+		return NULL;
 
 	sch = qdisc_alloc(dev_queue, ops);
-	if (IS_ERR(sch))
-		goto errout;
+	if (IS_ERR(sch)) {
+		module_put(ops->owner);
+		return NULL;
+	}
 	sch->parent = parentid;
 
 	if (!ops->init || ops->init(sch, NULL) == 0)
 		return sch;
 
 	qdisc_destroy(sch);
-errout:
 	return NULL;
 }
 EXPORT_SYMBOL(qdisc_create_dflt);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 274/312] net: axienet: Fix return value check in axienet_probe()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (272 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 273/312] qdisc: fix a module refcount leak in qdisc_create_dflt() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 275/312] bnxt_en: Remove locking around txr->dev_state Greg Kroah-Hartman
                   ` (39 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Wei Yongjun, David S. Miller

From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>

commit 3ad7b1477ef9b01988ac052b02be9cd410c95157 upstream.

In case of error, the function of_parse_phandle() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value
check should be replaced with NULL test.

Fixes: 46aa27df8853 ('net: axienet: Use devm_* calls')
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/xilinx/xilinx_axienet_main.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1602,9 +1602,9 @@ static int axienet_probe(struct platform
 
 	/* Find the DMA node, map the DMA registers, and decode the DMA IRQs */
 	np = of_parse_phandle(pdev->dev.of_node, "axistream-connected", 0);
-	if (IS_ERR(np)) {
+	if (!np) {
 		dev_err(&pdev->dev, "could not find DMA node\n");
-		ret = PTR_ERR(np);
+		ret = -ENODEV;
 		goto free_netdev;
 	}
 	ret = of_address_to_resource(np, 0, &dmares);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 275/312] bnxt_en: Remove locking around txr->dev_state
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (273 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 274/312] net: axienet: Fix return value check in axienet_probe() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 276/312] net: ethernet: davinci_emac: Fix devioctl while in fixed link Greg Kroah-Hartman
                   ` (38 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Michael Chan,
	David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit cbce91cad4ee39070bf3c7873767194e4be88e16 upstream.

txr->dev_state was not consistently manipulated with the acquisition of
the per-queue lock, after further inspection the lock does not seem
necessary, either the value is read as BNXT_DEV_STATE_CLOSING or 0.

Reported-by: coverity (CID 1339583)
Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4310,9 +4310,7 @@ static void bnxt_tx_disable(struct bnxt
 			bnapi = bp->bnapi[i];
 			txr = &bnapi->tx_ring;
 			txq = netdev_get_tx_queue(bp->dev, i);
-			__netif_tx_lock(txq, smp_processor_id());
 			txr->dev_state = BNXT_DEV_STATE_CLOSING;
-			__netif_tx_unlock(txq);
 		}
 	}
 	/* Stop all TX queues */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 276/312] net: ethernet: davinci_emac: Fix devioctl while in fixed link
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (274 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 275/312] bnxt_en: Remove locking around txr->dev_state Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 277/312] net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented Greg Kroah-Hartman
                   ` (37 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Hutchinson, Neil Armstrong,
	Mugunthan V N, David S. Miller

From: Neil Armstrong <narmstrong@baylibre.com>

commit 62522ef3c399996f6c8120bfd14b94280bc9f490 upstream.

When configured in fixed link, the DaVinci emac driver sets the
priv->phydev to NULL and further ioctl calls to the phy_mii_ioctl()
causes the kernel to crash.

Cc: Brian Hutchinson <b.hutchman@gmail.com>
Fixes: 1bb6aa56bb38 ("net: davinci_emac: Add support for fixed-link PHY")
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Mugunthan V N <mugunthanvnm@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/davinci_emac.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1512,7 +1512,10 @@ static int emac_devioctl(struct net_devi
 
 	/* TODO: Add phy read and write and private statistics get feature */
 
-	return phy_mii_ioctl(priv->phydev, ifrq, cmd);
+	if (priv->phydev)
+		return phy_mii_ioctl(priv->phydev, ifrq, cmd);
+	else
+		return -EOPNOTSUPP;
 }
 
 static int match_first_device(struct device *dev, void *data)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 277/312] net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (275 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 276/312] net: ethernet: davinci_emac: Fix devioctl while in fixed link Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 278/312] net: ethernet: ti: cpsw: fix device and of_node leaks Greg Kroah-Hartman
                   ` (36 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrew Lunn, David S. Miller

From: Andrew Lunn <andrew@lunn.ch>

commit 97db8afa2ab919fc400fe982f5054060868bdf07 upstream.

The mvneta driver advertises it supports IFF_UNICAST_FLT. However, it
actually does not. The hardware probably does support it, but there is
no code to configure the filter. As a quick and simple fix, remove the
flag. This will cause the core to fall back to promiscuous mode.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Fixes: b50b72de2f2f ("net: mvneta: enable features before registering the driver")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/marvell/mvneta.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3406,7 +3406,7 @@ static int mvneta_probe(struct platform_
 	dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
 	dev->hw_features |= dev->features;
 	dev->vlan_features |= dev->features;
-	dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
+	dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
 	dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
 
 	err = register_netdev(dev);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 278/312] net: ethernet: ti: cpsw: fix device and of_node leaks
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (276 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 277/312] net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 279/312] net: ethernet: ti: cpsw: fix secondary-emac probe error path Greg Kroah-Hartman
                   ` (35 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mugunthan V N, Grygorii Strashko,
	linux-omap, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit c7262aaace1b17a650598063e3b9ee1785fde377 upstream.

Make sure to drop the references taken by of_get_child_by_name() and
bus_find_device() before returning from cpsw_phy_sel().

Note that holding a reference to the cpsw-phy-sel device does not
prevent the devres-managed private data from going away.

Fixes: 5892cd135e16 ("drivers: net: cpsw-phy-sel: Add new driver...")
Cc: Mugunthan V N <mugunthanvnm@ti.com>
Cc: Grygorii Strashko <grygorii.strashko@ti.com>
Cc: linux-omap@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/cpsw-phy-sel.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
+++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
@@ -154,9 +154,12 @@ void cpsw_phy_sel(struct device *dev, ph
 	}
 
 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
+	of_node_put(node);
 	priv = dev_get_drvdata(dev);
 
 	priv->cpsw_phy_sel(priv, phy_mode, slave);
+
+	put_device(dev);
 }
 EXPORT_SYMBOL_GPL(cpsw_phy_sel);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 279/312] net: ethernet: ti: cpsw: fix secondary-emac probe error path
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (277 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 278/312] net: ethernet: ti: cpsw: fix device and of_node leaks Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 280/312] net: hns: fix device reference leaks Greg Kroah-Hartman
                   ` (34 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit a7fe9d466f6a33558a38c7ca9d58bcc83512d577 upstream.

Make sure to deregister the primary device in case the secondary emac
fails to probe.

kernel BUG at /home/johan/work/omicron/src/linux/net/core/dev.c:7743!
...
[<c05b3dec>] (free_netdev) from [<c04fe6c0>] (cpsw_probe+0x9cc/0xe50)
[<c04fe6c0>] (cpsw_probe) from [<c047b28c>] (platform_drv_probe+0x5c/0xc0)

Fixes: d9ba8f9e6298 ("driver: net: ethernet: cpsw: dual emac interface
implementation")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/cpsw.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -2532,12 +2532,14 @@ static int cpsw_probe(struct platform_de
 		ret = cpsw_probe_dual_emac(pdev, priv);
 		if (ret) {
 			cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
-			goto clean_ale_ret;
+			goto clean_unregister_netdev_ret;
 		}
 	}
 
 	return 0;
 
+clean_unregister_netdev_ret:
+	unregister_netdev(ndev);
 clean_ale_ret:
 	cpsw_ale_destroy(priv->ale);
 clean_dma_ret:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 280/312] net: hns: fix device reference leaks
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (278 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 279/312] net: ethernet: ti: cpsw: fix secondary-emac probe error path Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 281/312] net: bridge: dont increment tx_dropped in br_do_proxy_arp Greg Kroah-Hartman
                   ` (33 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Yisen Zhuang, Salil Mehta,
	Johan Hovold, David S. Miller

From: Johan Hovold <johan@kernel.org>

commit 2271150bfb814b72ec57ae2fdf66e39da2eafafd upstream.

Make sure to drop the reference taken by class_find_device() in
hnae_get_handle() on errors and when later releasing the handle.

Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem...")
Cc: Yisen Zhuang <yisen.zhuang@huawei.com>
Cc: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/hisilicon/hns/hnae.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
+++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
@@ -331,8 +331,10 @@ struct hnae_handle *hnae_get_handle(stru
 		return ERR_PTR(-ENODEV);
 
 	handle = dev->ops->get_handle(dev, port_id);
-	if (IS_ERR(handle))
+	if (IS_ERR(handle)) {
+		put_device(&dev->cls_dev);
 		return handle;
+	}
 
 	handle->dev = dev;
 	handle->owner_dev = owner_dev;
@@ -355,6 +357,8 @@ out_when_init_queue:
 	for (j = i - 1; j >= 0; j--)
 		hnae_fini_queue(handle->qs[j]);
 
+	put_device(&dev->cls_dev);
+
 	return ERR_PTR(-ENOMEM);
 }
 EXPORT_SYMBOL(hnae_get_handle);
@@ -376,6 +380,8 @@ void hnae_put_handle(struct hnae_handle
 		dev->ops->put_handle(h);
 
 	module_put(dev->owner);
+
+	put_device(&dev->cls_dev);
 }
 EXPORT_SYMBOL(hnae_put_handle);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 281/312] net: bridge: dont increment tx_dropped in br_do_proxy_arp
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (279 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 280/312] net: hns: fix device reference leaks Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 282/312] net: dsa: mv88e6xxx: enable SA learning on DSA ports Greg Kroah-Hartman
                   ` (32 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kyeyoon Park, Roopa Prabhu,
	Stephen Hemminger, bridge, Nikolay Aleksandrov, David S. Miller

From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>

commit 85a3d4a9356b595d5440c3f1bf07ee7cecca1567 upstream.

pskb_may_pull may fail due to various reasons (e.g. alloc failure), but the
skb isn't changed/dropped and processing continues so we shouldn't
increment tx_dropped.

CC: Kyeyoon Park <kyeyoonp@codeaurora.org>
CC: Roopa Prabhu <roopa@cumulusnetworks.com>
CC: Stephen Hemminger <stephen@networkplumber.org>
CC: bridge@lists.linux-foundation.org
Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bridge/br_input.c |    7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -78,13 +78,10 @@ static void br_do_proxy_arp(struct sk_bu
 
 	BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
 
-	if (dev->flags & IFF_NOARP)
+	if ((dev->flags & IFF_NOARP) ||
+	    !pskb_may_pull(skb, arp_hdr_len(dev)))
 		return;
 
-	if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
-		dev->stats.tx_dropped++;
-		return;
-	}
 	parp = arp_hdr(skb);
 
 	if (parp->ar_pro != htons(ETH_P_IP) ||



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 282/312] net: dsa: mv88e6xxx: enable SA learning on DSA ports
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (280 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 281/312] net: bridge: dont increment tx_dropped in br_do_proxy_arp Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 283/312] net: ehea: avoid null pointer dereference Greg Kroah-Hartman
                   ` (31 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vivien Didelot, David S. Miller

From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>

commit 996ecb8246676100af2a4dc1cfed747712a3c85f upstream.

In multi-chip systems, DSA Tag ports must learn SA addresses in order to
correctly switch frames between interconnected chips.

This fixes cross-chip hardware bridging in a VLAN filtering aware
system, because a bridge group gets implemented as an hardware 802.1Q
VLAN and thus DSA and user ports share the same FDB.

Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports")
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/dsa/mv88e6xxx.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -2064,8 +2064,8 @@ static int mv88e6xxx_setup_port(struct d
 	 * the other bits clear.
 	 */
 	reg = 1 << port;
-	/* Disable learning for DSA and CPU ports */
-	if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port))
+	/* Disable learning for CPU port */
+	if (dsa_is_cpu_port(ds, port))
 		reg = 0;
 
 	ret = _mv88e6xxx_reg_write(ds, REG_PORT(port), PORT_ASSOC_VECTOR, reg);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 283/312] net: ehea: avoid null pointer dereference
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (281 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 282/312] net: dsa: mv88e6xxx: enable SA learning on DSA ports Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 284/312] l2tp: fix use-after-free during module unload Greg Kroah-Hartman
                   ` (30 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Heinrich Schuchardt,
	Thadeu Lima de Souza Cascardo, David S. Miller

From: xypron.glpk@gmx.de <xypron.glpk@gmx.de>

commit 1740c29a46b30a2f157afc473156f157e599d4c2 upstream.

ehea_get_port may return NULL. Do not dereference NULL value.

Fixes: 8c4877a4128e ("ehea: Use the standard logging functions")
Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@debian.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ibm/ehea/ehea_main.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
+++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
@@ -1169,16 +1169,15 @@ static void ehea_parse_eqe(struct ehea_a
 	ec = EHEA_BMASK_GET(NEQE_EVENT_CODE, eqe);
 	portnum = EHEA_BMASK_GET(NEQE_PORTNUM, eqe);
 	port = ehea_get_port(adapter, portnum);
+	if (!port) {
+		netdev_err(NULL, "unknown portnum %x\n", portnum);
+		return;
+	}
 	dev = port->netdev;
 
 	switch (ec) {
 	case EHEA_EC_PORTSTATE_CHG:	/* port state change */
 
-		if (!port) {
-			netdev_err(dev, "unknown portnum %x\n", portnum);
-			break;
-		}
-
 		if (EHEA_BMASK_GET(NEQE_PORT_UP, eqe)) {
 			if (!netif_carrier_ok(dev)) {
 				ret = ehea_sense_port_attr(port);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 284/312] l2tp: fix use-after-free during module unload
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (282 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 283/312] net: ehea: avoid null pointer dereference Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 285/312] hwrng: exynos - Disable runtime PM on driver unbind Greg Kroah-Hartman
                   ` (29 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sabrina Dubroca, David S. Miller

From: Sabrina Dubroca <sd@queasysnail.net>

commit 2f86953e7436c9b9a4690909c5e2db24799e173b upstream.

Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq
 -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU ->
l2tp_tunnel_destruct).

By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish
destroying the socket, the private data reserved via the net_generic
mechanism has already been freed, but l2tp_tunnel_destruct() actually
uses this data.

Make sure tunnel deletion for the netns has completed before returning
from l2tp_exit_net() by first flushing the tunnel removal workqueue, and
then waiting for RCU callbacks to complete.

Fixes: 167eb17e0b17 ("l2tp: create tunnel sockets in the right namespace")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/l2tp/l2tp_core.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1953,6 +1953,9 @@ static __net_exit void l2tp_exit_net(str
 		l2tp_tunnel_delete(tunnel);
 	}
 	rcu_read_unlock_bh();
+
+	flush_workqueue(l2tp_wq);
+	rcu_barrier();
 }
 
 static struct pernet_operations l2tp_net_ops = {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 285/312] hwrng: exynos - Disable runtime PM on driver unbind
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (283 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 284/312] l2tp: fix use-after-free during module unload Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 286/312] net: icmp_route_lookup should use rt dev to determine L3 domain Greg Kroah-Hartman
                   ` (28 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Herbert Xu

From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

commit 27d80fa8bccf8d28bef4f89709638efc624fef9a upstream.

Driver enabled runtime PM but did not revert this on removal. Re-binding
of a device triggered warning:
	exynos-rng 10830400.rng: Unbalanced pm_runtime_enable!

Fixes: b329669ea0b5 ("hwrng: exynos - Add support for Exynos random number generator")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/hw_random/exynos-rng.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/char/hw_random/exynos-rng.c
+++ b/drivers/char/hw_random/exynos-rng.c
@@ -155,6 +155,14 @@ static int exynos_rng_probe(struct platf
 	return ret;
 }
 
+static int exynos_rng_remove(struct platform_device *pdev)
+{
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
+	pm_runtime_disable(&pdev->dev);
+
+	return 0;
+}
+
 static int __maybe_unused exynos_rng_runtime_suspend(struct device *dev)
 {
 	struct platform_device *pdev = to_platform_device(dev);
@@ -212,6 +220,7 @@ static struct platform_driver exynos_rng
 		.of_match_table = exynos_rng_dt_match,
 	},
 	.probe		= exynos_rng_probe,
+	.remove		= exynos_rng_remove,
 };
 
 module_platform_driver(exynos_rng_driver);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 286/312] net: icmp_route_lookup should use rt dev to determine L3 domain
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (284 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 285/312] hwrng: exynos - Disable runtime PM on driver unbind Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 287/312] net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats Greg Kroah-Hartman
                   ` (27 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Ahern, David S. Miller

From: David Ahern <dsa@cumulusnetworks.com>

commit 9d1a6c4ea43e48c7880c85971c17939b56832d8a upstream.

icmp_send is called in response to some event. The skb may not have
the device set (skb->dev is NULL), but it is expected to have an rt.
Update icmp_route_lookup to use the rt on the skb to determine L3
domain.

Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX")
Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/ipv4/icmp.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -478,7 +478,7 @@ static struct rtable *icmp_route_lookup(
 	fl4->flowi4_proto = IPPROTO_ICMP;
 	fl4->fl4_icmp_type = type;
 	fl4->fl4_icmp_code = code;
-	fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev);
+	fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
 
 	security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
 	rt = __ip_route_output_key_hash(net, fl4,
@@ -503,7 +503,7 @@ static struct rtable *icmp_route_lookup(
 	if (err)
 		goto relookup_failed;
 
-	if (inet_addr_type_dev_table(net, skb_in->dev,
+	if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
 				     fl4_dec.saddr) == RTN_LOCAL) {
 		rt2 = __ip_route_output_key(net, &fl4_dec);
 		if (IS_ERR(rt2))



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 287/312] net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (285 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 286/312] net: icmp_route_lookup should use rt dev to determine L3 domain Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 288/312] net: macb: replace macb_writel() call by queue_writel() to update queue ISR Greg Kroah-Hartman
                   ` (26 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jisheng Zhang, David S. Miller

From: Jisheng Zhang <jszhang@marvell.com>

commit 2c832293e09be2f998ea916650927c8ccd5b4b3b upstream.

When s->type is T_REG_64, the high 32bits are lost in val. This patch
fixes this trivial issue.

Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
Fixes: 9b0cdefa4cd5 ("net: mvneta: add ethtool statistics")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/marvell/mvneta.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -3058,26 +3058,25 @@ static void mvneta_ethtool_update_stats(
 	const struct mvneta_statistic *s;
 	void __iomem *base = pp->base;
 	u32 high, low, val;
+	u64 val64;
 	int i;
 
 	for (i = 0, s = mvneta_statistics;
 	     s < mvneta_statistics + ARRAY_SIZE(mvneta_statistics);
 	     s++, i++) {
-		val = 0;
-
 		switch (s->type) {
 		case T_REG_32:
 			val = readl_relaxed(base + s->offset);
+			pp->ethtool_stats[i] += val;
 			break;
 		case T_REG_64:
 			/* Docs say to read low 32-bit then high */
 			low = readl_relaxed(base + s->offset);
 			high = readl_relaxed(base + s->offset + 4);
-			val = (u64)high << 32 | low;
+			val64 = (u64)high << 32 | low;
+			pp->ethtool_stats[i] += val64;
 			break;
 		}
-
-		pp->ethtool_stats[i] += val;
 	}
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 288/312] net: macb: replace macb_writel() call by queue_writel() to update queue ISR
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (286 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 287/312] net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 289/312] ravb: Add missing free_irq() call to ravb_close() Greg Kroah-Hartman
                   ` (25 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Cyrille Pitchen, Nicolas Ferre,
	David S. Miller

From: Cyrille Pitchen <cyrille.pitchen@atmel.com>

commit ba5049945421b8d2f3e2af786a15d13b82316503 upstream.

macb_interrupt() should not use macb_writel(bp, ISR, <value>) but only
queue_writel(queue, ISR, <value>).

There is one IRQ and one set of {ISR, IER, IDR, IMR} [1] registers per
queue on gem hardware, though only queue0 is actually used for now to
receive frames: other queues can already be used to transmit frames.

The queue_readl() and queue_writel() helper macros are designed to access
the relevant IRQ registers.

[1]
ISR: Interrupt Status Register
IER: Interrupt Enable Register
IDR: Interrupt Disable Register
IMR: Interrupt Mask Register

Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Fixes: bfbb92c44670 ("net: macb: Handle the RXUBR interrupt on all devices")
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/cadence/macb.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -1104,7 +1104,7 @@ static irqreturn_t macb_interrupt(int ir
 			macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
 
 			if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
-				macb_writel(bp, ISR, MACB_BIT(RXUBR));
+				queue_writel(queue, ISR, MACB_BIT(RXUBR));
 		}
 
 		if (status & MACB_BIT(ISR_ROVR)) {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 289/312] ravb: Add missing free_irq() call to ravb_close()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (287 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 288/312] net: macb: replace macb_writel() call by queue_writel() to update queue ISR Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 290/312] mvpp2: use correct size for memset Greg Kroah-Hartman
                   ` (24 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Geert Uytterhoeven, Sergei Shtylyov,
	David S. Miller

From: Geert Uytterhoeven <geert+renesas@glider.be>

commit 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 upstream.

When reopening the network device on ra7795/salvator-x, e.g. after a
DHCP timeout:

    IP-Config: Reopening network devices...
    genirq: Flags mismatch irq 139. 00000000 (eth0:ch24:emac) vs. 00000000 (eth0:ch24:emac)
    ravb e6800000.ethernet eth0: cannot request IRQ eth0:ch24:emac
    IP-Config: Failed to open eth0
    IP-Config: No network devices available

The "mismatch" is due to requesting an IRQ that is already in use,
while IRQF_PROBE_SHARED wasn't set.

However, the real cause is that ravb_close() doesn't release the R-Car
Gen3-specific secondary IRQ.

Add the missing free_irq() call to fix this.

Fixes: 22d4df8ff3a3cc72 ("ravb: Add support for r8a7795 SoC")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/renesas/ravb_main.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1528,6 +1528,8 @@ static int ravb_close(struct net_device
 		priv->phydev = NULL;
 	}
 
+	if (priv->chip_id == RCAR_GEN3)
+		free_irq(priv->emac_irq, ndev);
 	free_irq(ndev->irq, ndev);
 
 	napi_disable(&priv->napi[RAVB_NC]);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 290/312] mvpp2: use correct size for memset
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (288 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 289/312] ravb: Add missing free_irq() call to ravb_close() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 291/312] net: vxlan: lwt: Fix vxlan local traffic Greg Kroah-Hartman
                   ` (23 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, David S. Miller

From: Arnd Bergmann <arnd@arndb.de>

commit e8f967c3d88489fc1562a31d4e44d905ac1d3aff upstream.

gcc-7 detects a short memset in mvpp2, introduced in the original
merge of the driver:

drivers/net/ethernet/marvell/mvpp2.c: In function 'mvpp2_cls_init':
drivers/net/ethernet/marvell/mvpp2.c:3296:2: error: 'memset' used with length equal to number of elements without multiplication by element size [-Werror=memset-elt-size]

The result seems to be that we write uninitialized data into the
flow table registers, although we did not get any warning about
that uninitialized data usage.

Using sizeof() lets us initialize then entire array instead.

Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/marvell/mvpp2.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -3305,7 +3305,7 @@ static void mvpp2_cls_init(struct mvpp2
 	mvpp2_write(priv, MVPP2_CLS_MODE_REG, MVPP2_CLS_MODE_ACTIVE_MASK);
 
 	/* Clear classifier flow table */
-	memset(&fe.data, 0, MVPP2_CLS_FLOWS_TBL_DATA_WORDS);
+	memset(&fe.data, 0, sizeof(fe.data));
 	for (index = 0; index < MVPP2_CLS_FLOWS_TBL_SIZE; index++) {
 		fe.index = index;
 		mvpp2_cls_flow_write(priv, &fe);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 291/312] net: vxlan: lwt: Fix vxlan local traffic.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (289 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 290/312] mvpp2: use correct size for memset Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 292/312] net: ethoc: Fix early error paths Greg Kroah-Hartman
                   ` (22 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jakub Libosvar, Pravin B Shelar,
	Jiri Benc, David S. Miller

From: pravin shelar <pshelar@ovn.org>

commit bbec7802c6948c8626b71a4fe31283cb4691c358 upstream.

vxlan driver has bypass for local vxlan traffic, but that
depends on information about all VNIs on local system in
vxlan driver. This is not available in case of LWT.
Therefore following patch disable encap bypass for LWT
vxlan traffic.

Fixes: ee122c79d42 ("vxlan: Flow based tunneling").
Reported-by: Jakub Libosvar <jlibosva@redhat.com>
Signed-off-by: Pravin B Shelar <pshelar@ovn.org>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/vxlan.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2054,7 +2054,7 @@ static void vxlan_xmit_one(struct sk_buf
 		}
 
 		/* Bypass encapsulation if the destination is local */
-		if (rt->rt_flags & RTCF_LOCAL &&
+		if (!info && rt->rt_flags & RTCF_LOCAL &&
 		    !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
 			struct vxlan_dev *dst_vxlan;
 
@@ -2112,7 +2112,7 @@ static void vxlan_xmit_one(struct sk_buf
 
 		/* Bypass encapsulation if the destination is local */
 		rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
-		if (rt6i_flags & RTF_LOCAL &&
+		if (!info && rt6i_flags & RTF_LOCAL &&
 		    !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
 			struct vxlan_dev *dst_vxlan;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 292/312] net: ethoc: Fix early error paths
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (290 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 291/312] net: vxlan: lwt: Fix vxlan local traffic Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 293/312] ovs/vxlan: fix rtnl notifications on iface deletion Greg Kroah-Hartman
                   ` (21 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit 386512d18b268c6182903239f9f3390f03ce4c7b upstream.

In case any operation fails before we can successfully go the point
where we would register a MDIO bus, we would be going to an error label
which involves unregistering then freeing this yet to be created MDIO
bus. Update all error paths to go to label free which is the only one
valid until either the clock is enabled, or the MDIO bus is allocated
and registered. This fixes kernel oops observed while trying to
dereference the MDIO bus structure which is not yet allocated.

Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ethoc.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1088,7 +1088,7 @@ static int ethoc_probe(struct platform_d
 	if (!priv->iobase) {
 		dev_err(&pdev->dev, "cannot remap I/O memory space\n");
 		ret = -ENXIO;
-		goto error;
+		goto free;
 	}
 
 	if (netdev->mem_end) {
@@ -1097,7 +1097,7 @@ static int ethoc_probe(struct platform_d
 		if (!priv->membase) {
 			dev_err(&pdev->dev, "cannot remap memory space\n");
 			ret = -ENXIO;
-			goto error;
+			goto free;
 		}
 	} else {
 		/* Allocate buffer memory */
@@ -1108,7 +1108,7 @@ static int ethoc_probe(struct platform_d
 			dev_err(&pdev->dev, "cannot allocate %dB buffer\n",
 				buffer_size);
 			ret = -ENOMEM;
-			goto error;
+			goto free;
 		}
 		netdev->mem_end = netdev->mem_start + buffer_size;
 		priv->dma_alloc = buffer_size;
@@ -1122,7 +1122,7 @@ static int ethoc_probe(struct platform_d
 		128, (netdev->mem_end - netdev->mem_start + 1) / ETHOC_BUFSIZ);
 	if (num_bd < 4) {
 		ret = -ENODEV;
-		goto error;
+		goto free;
 	}
 	priv->num_bd = num_bd;
 	/* num_tx must be a power of two */
@@ -1135,7 +1135,7 @@ static int ethoc_probe(struct platform_d
 	priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL);
 	if (!priv->vma) {
 		ret = -ENOMEM;
-		goto error;
+		goto free;
 	}
 
 	/* Allow the platform setup code to pass in a MAC address. */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 293/312] ovs/vxlan: fix rtnl notifications on iface deletion
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (291 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 292/312] net: ethoc: Fix early error paths Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 294/312] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets Greg Kroah-Hartman
                   ` (20 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Thomas Graf, Pravin B Shelar,
	Nicolas Dichtel, David S. Miller

From: Nicolas Dichtel <nicolas.dichtel@6wind.com>

commit cf5da330bbdd0c06b05c525a3d1d58ccd82c87a6 upstream.

The function vxlan_dev_create() (only used by ovs) never calls
rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
never set to RTNL_LINK_INITIALIZED.
During the deletion phase, the function rollback_registered_many() sends
a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.

Note that the function vxlan_dev_create() is moved after the rtnl stuff so
that vxlan_dellink() can be called in this function.

Fixes: dcc38c033b32 ("openvswitch: Re-add CONFIG_OPENVSWITCH_VXLAN")
CC: Thomas Graf <tgraf@suug.ch>
CC: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/vxlan.c |   58 ++++++++++++++++++++++++++++++----------------------
 1 file changed, 34 insertions(+), 24 deletions(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2927,30 +2927,6 @@ static int vxlan_dev_configure(struct ne
 	return 0;
 }
 
-struct net_device *vxlan_dev_create(struct net *net, const char *name,
-				    u8 name_assign_type, struct vxlan_config *conf)
-{
-	struct nlattr *tb[IFLA_MAX+1];
-	struct net_device *dev;
-	int err;
-
-	memset(&tb, 0, sizeof(tb));
-
-	dev = rtnl_create_link(net, name, name_assign_type,
-			       &vxlan_link_ops, tb);
-	if (IS_ERR(dev))
-		return dev;
-
-	err = vxlan_dev_configure(net, dev, conf);
-	if (err < 0) {
-		free_netdev(dev);
-		return ERR_PTR(err);
-	}
-
-	return dev;
-}
-EXPORT_SYMBOL_GPL(vxlan_dev_create);
-
 static int vxlan_newlink(struct net *src_net, struct net_device *dev,
 			 struct nlattr *tb[], struct nlattr *data[])
 {
@@ -3218,6 +3194,40 @@ static struct rtnl_link_ops vxlan_link_o
 	.get_link_net	= vxlan_get_link_net,
 };
 
+struct net_device *vxlan_dev_create(struct net *net, const char *name,
+				    u8 name_assign_type,
+				    struct vxlan_config *conf)
+{
+	struct nlattr *tb[IFLA_MAX + 1];
+	struct net_device *dev;
+	int err;
+
+	memset(&tb, 0, sizeof(tb));
+
+	dev = rtnl_create_link(net, name, name_assign_type,
+			       &vxlan_link_ops, tb);
+	if (IS_ERR(dev))
+		return dev;
+
+	err = vxlan_dev_configure(net, dev, conf);
+	if (err < 0) {
+		free_netdev(dev);
+		return ERR_PTR(err);
+	}
+
+	err = rtnl_configure_link(dev, NULL);
+	if (err < 0) {
+		LIST_HEAD(list_kill);
+
+		vxlan_dellink(dev, &list_kill);
+		unregister_netdevice_many(&list_kill);
+		return ERR_PTR(err);
+	}
+
+	return dev;
+}
+EXPORT_SYMBOL_GPL(vxlan_dev_create);
+
 static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
 					     struct net_device *dev)
 {



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 294/312] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (292 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 293/312] ovs/vxlan: fix rtnl notifications on iface deletion Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 295/312] regulator: core: Rely on regulator_dev_release to free constraints Greg Kroah-Hartman
                   ` (19 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Nicolas Schichan, Philipp Kirchhofer,
	David S. Miller

From: Nicolas Schichan <nschichan@freebox.fr>

commit 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 upstream.

The code in txq_put_data() would use txq->tx_curr_desc to index the
tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
fragments, which is already moved to the next descriptor at the
beginning of the function.

If that fragment was the last of the the skb, the next skb would use
that same space to place the ip headers, overwritting that small
fragment data.

Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
Reviewed-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/marvell/mv643xx_eth.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev,
 
 	if (length <= 8 && (uintptr_t)data & 0x7) {
 		/* Copy unaligned small data fragment to TSO header data area */
-		memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE,
+		memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE,
 		       data, length);
 		desc->buf_ptr = txq->tso_hdrs_dma
-			+ txq->tx_curr_desc * TSO_HEADER_SIZE;
+			+ tx_index * TSO_HEADER_SIZE;
 	} else {
 		/* Alignment is okay, map buffer and hand off to hardware */
 		txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 295/312] regulator: core: Rely on regulator_dev_release to free constraints
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (293 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 294/312] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 296/312] net: dsa: mv88e6xxx: fix port VLAN maps Greg Kroah-Hartman
                   ` (18 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown

From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>

commit 6333ef46bbe514a8ece6c432aab6bcf8637b2d7c upstream.

As we now free the constraints in regulator_dev_release we will still
call free on the constraints pointer even if we went down an error
path in regulator_register, because it is only allocated after the
device_register. As such we no longer need to free rdev->constraints
on the error paths, so this patch removes said frees.

Fixes: 29f5f4860a8e ("regulator: core: Move more deallocation into class unregister")
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |   29 ++++++++++++-----------------
 1 file changed, 12 insertions(+), 17 deletions(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1057,18 +1057,18 @@ static int set_machine_constraints(struc
 
 	ret = machine_constraints_voltage(rdev, rdev->constraints);
 	if (ret != 0)
-		goto out;
+		return ret;
 
 	ret = machine_constraints_current(rdev, rdev->constraints);
 	if (ret != 0)
-		goto out;
+		return ret;
 
 	if (rdev->constraints->ilim_uA && ops->set_input_current_limit) {
 		ret = ops->set_input_current_limit(rdev,
 						   rdev->constraints->ilim_uA);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set input limit\n");
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1077,21 +1077,20 @@ static int set_machine_constraints(struc
 		ret = suspend_prepare(rdev, rdev->constraints->initial_state);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set suspend state\n");
-			goto out;
+			return ret;
 		}
 	}
 
 	if (rdev->constraints->initial_mode) {
 		if (!ops->set_mode) {
 			rdev_err(rdev, "no set_mode operation\n");
-			ret = -EINVAL;
-			goto out;
+			return -EINVAL;
 		}
 
 		ret = ops->set_mode(rdev, rdev->constraints->initial_mode);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set initial mode: %d\n", ret);
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1102,7 +1101,7 @@ static int set_machine_constraints(struc
 		ret = _regulator_do_enable(rdev);
 		if (ret < 0 && ret != -EINVAL) {
 			rdev_err(rdev, "failed to enable\n");
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1111,7 +1110,7 @@ static int set_machine_constraints(struc
 		ret = ops->set_ramp_delay(rdev, rdev->constraints->ramp_delay);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set ramp_delay\n");
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1119,7 +1118,7 @@ static int set_machine_constraints(struc
 		ret = ops->set_pull_down(rdev);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set pull down\n");
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1127,7 +1126,7 @@ static int set_machine_constraints(struc
 		ret = ops->set_soft_start(rdev);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set soft start\n");
-			goto out;
+			return ret;
 		}
 	}
 
@@ -1136,16 +1135,12 @@ static int set_machine_constraints(struc
 		ret = ops->set_over_current_protection(rdev);
 		if (ret < 0) {
 			rdev_err(rdev, "failed to set over current protection\n");
-			goto out;
+			return ret;
 		}
 	}
 
 	print_constraints(rdev);
 	return 0;
-out:
-	kfree(rdev->constraints);
-	rdev->constraints = NULL;
-	return ret;
 }
 
 /**
@@ -3983,7 +3978,7 @@ unset_supplies:
 
 scrub:
 	regulator_ena_gpio_free(rdev);
-	kfree(rdev->constraints);
+
 wash:
 	device_unregister(&rdev->dev);
 	/* device core frees rdev */



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 296/312] net: dsa: mv88e6xxx: fix port VLAN maps
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (294 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 295/312] regulator: core: Rely on regulator_dev_release to free constraints Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 297/312] at803x: fix reset handling Greg Kroah-Hartman
                   ` (17 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Kevin Smith, Vivien Didelot,
	Andrew Lunn, David S. Miller

From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>

commit be1faa92e83b1252d9200c59d8c98aab44463f1e upstream.

Currently the port based VLAN maps should be configured to allow every
port to egress frames on all other ports, except themselves.

The debugfs interface shows that they are misconfigured. For instance, a
7-port switch has the following content in the related register 0x06:

       GLOBAL GLOBAL2 SERDES   0    1    2    3    4    5    6
    ...
    6:  1fa4    1f0f       4   7f   7e   7d   7c   7b   7a   79
    ...

This means that port 3 is allowed to talk to port 2-6, but cannot talk
to ports 0 and 1. With this fix, port 3 can correctly talk to all ports
except 3 itself:

       GLOBAL GLOBAL2 SERDES   0    1    2    3    4    5    6
    ...
    6:  1fa4    1f0f       4   7e   7d   7b   77   6f   5f   3f
    ...

Fixes: ede8098d0fef ("net: dsa: mv88e6xxx: bridges do not need an FID")
Reported-by: Kevin Smith <kevin.smith@elecsyscorp.com>
Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Tested-by: Kevin Smith <kevin.smith@elecsyscorp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/dsa/mv88e6xxx.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/dsa/mv88e6xxx.c
+++ b/drivers/net/dsa/mv88e6xxx.c
@@ -2150,7 +2150,8 @@ static int mv88e6xxx_setup_port(struct d
 	 * database, and allow every port to egress frames on all other ports.
 	 */
 	reg = BIT(ps->num_ports) - 1; /* all ports */
-	ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg & ~port);
+	reg &= ~BIT(port); /* except itself */
+	ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg);
 	if (ret)
 		goto abort;
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 297/312] at803x: fix reset handling
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (295 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 296/312] net: dsa: mv88e6xxx: fix port VLAN maps Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 298/312] regulator: Try to resolve regulators supplies on registration Greg Kroah-Hartman
                   ` (16 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov,
	Uwe Kleine-König, David S. Miller

From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

commit d57019d1858a6f9b3ca05d76d793466ae428cfa3 upstream.

The driver of course "knows" that the chip's reset signal is active low,
so  it drives the GPIO to 0  to reset the PHY and to 1 otherwise; however
all this will only work iff the GPIO  is  specified as active-high in the
device tree!  I think both the driver and the device trees (if there are
any -- I was unable to find them) need to be fixed in this case...

Fixes: 13a56b449325 ("net: phy: at803x: Add support for hardware reset")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/phy/at803x.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -198,7 +198,7 @@ static int at803x_probe(struct phy_devic
 	if (!priv)
 		return -ENOMEM;
 
-	gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+	gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
 	if (IS_ERR(gpiod_reset))
 		return PTR_ERR(gpiod_reset);
 
@@ -274,10 +274,10 @@ static void at803x_link_change_notify(st
 
 				at803x_context_save(phydev, &context);
 
-				gpiod_set_value(priv->gpiod_reset, 0);
-				msleep(1);
 				gpiod_set_value(priv->gpiod_reset, 1);
 				msleep(1);
+				gpiod_set_value(priv->gpiod_reset, 0);
+				msleep(1);
 
 				at803x_context_restore(phydev, &context);
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 298/312] regulator: Try to resolve regulators supplies on registration
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (296 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 297/312] at803x: fix reset handling Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 299/312] cxl: Fix DAR check & use REGION_ID instead of opencoding Greg Kroah-Hartman
                   ` (15 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Mark Brown, Javier Martinez Canillas

From: Javier Martinez Canillas <javier@osg.samsung.com>

commit 5e3ca2b349b1e2c80b060b51bbf2af37448fad85 upstream.

Commit 6261b06de565 ("regulator: Defer lookup of supply to regulator_get")
moved the regulator supplies lookup logic from the regulators registration
to the regulators get time.

Unfortunately, that changed the behavior of the regulator core since now a
parent supply with a child regulator marked as always-on, won't be enabled
unless a client driver attempts to get the child regulator during boot.

This patch tries to resolve the parent supply for the already registered
regulators each time that a new regulator is registered. So the regulators
that have child regulators marked as always on will be enabled regardless
if a driver gets the child regulator or not.

That was the behavior before the mentioned commit, since parent supplies
were looked up at regulator registration time instead of during child get.

Since regulator_resolve_supply() checks for rdev->supply, most of the times
it will be a no-op. Errors aren't checked to keep the possible out of order
dependencies which was the motivation for the mentioned commit.

Also, the supply being available will be enforced on regulator get anyways
in case the resolve fails on regulators registration.

Fixes: 6261b06de565 ("regulator: Defer lookup of supply to regulator_get")
Suggested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: <stable@vger.kernel.org> # 4.1+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3822,6 +3822,11 @@ static void rdev_init_debugfs(struct reg
 			   &rdev->bypass_count);
 }
 
+static int regulator_register_resolve_supply(struct device *dev, void *data)
+{
+	return regulator_resolve_supply(dev_to_rdev(dev));
+}
+
 /**
  * regulator_register - register regulator
  * @regulator_desc: regulator to register
@@ -3968,6 +3973,10 @@ regulator_register(const struct regulato
 	}
 
 	rdev_init_debugfs(rdev);
+
+	/* try to resolve regulators supply since a new one was registered */
+	class_for_each_device(&regulator_class, NULL, NULL,
+			      regulator_register_resolve_supply);
 out:
 	mutex_unlock(&regulator_list_mutex);
 	kfree(config);



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 299/312] cxl: Fix DAR check & use REGION_ID instead of opencoding
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (297 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 298/312] regulator: Try to resolve regulators supplies on registration Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 300/312] net: ethernet: davinci_emac: Fix platform_data overwrite Greg Kroah-Hartman
                   ` (14 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Andrew Donnellan, Ian Munsie,
	Aneesh Kumar K.V, Michael Ellerman

From: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>

commit 3b1dbfa14f97188ec33fdfc7acb66bea59a3bb21 upstream.

The current code will set _PAGE_USER to the access flags for any
fault address, because the ~ operation will be true for all address we
take a fault on. But setting _PAGE_USER also means that the fault will
be handled only if the page table have _PAGE_USER set. Hence there is
no security hole with the current code.

Now if it is an user space access, then the change in this patch really
don't have an impact because we have (!ctx->kernel) set true
and we take the if condition true.

Now kernel context created fault on an address in the kernel range
will result in a fault loop because we will not insert the
hash pte due to access and pte permission mismatch. This patch fix
the above issue.

Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for userspace access")
Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/cxl/fault.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -152,7 +152,7 @@ static void cxl_handle_page_fault(struct
 	access = _PAGE_PRESENT;
 	if (dsisr & CXL_PSL_DSISR_An_S)
 		access |= _PAGE_RW;
-	if ((!ctx->kernel) || ~(dar & (1ULL << 63)))
+	if ((!ctx->kernel) || (REGION_ID(dar) == USER_REGION_ID))
 		access |= _PAGE_USER;
 
 	if (dsisr & DSISR_NOHPTE)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 300/312] net: ethernet: davinci_emac: Fix platform_data overwrite
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (298 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 299/312] cxl: Fix DAR check & use REGION_ID instead of opencoding Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 301/312] ata: sata_dwc_460ex: remove incorrect locking Greg Kroah-Hartman
                   ` (13 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Brian Hutchinson, Neil Armstrong,
	David S. Miller

From: Neil Armstrong <narmstrong@baylibre.com>

commit 210990b05a1247886539078e857cd038881bb2d6 upstream.

When the DaVinci emac driver is removed and re-probed, the actual
pdev->dev.platform_data is populated with an unwanted valid pointer saved by
the previous davinci_emac_of_get_pdata() call, causing a kernel crash when
calling priv->int_disable() in emac_int_disable().

Unable to handle kernel paging request at virtual address c8622a80
...
[<c0426fb4>] (emac_int_disable) from [<c0427700>] (emac_dev_open+0x290/0x5f8)
[<c0427700>] (emac_dev_open) from [<c04c00ec>] (__dev_open+0xb8/0x120)
[<c04c00ec>] (__dev_open) from [<c04c0370>] (__dev_change_flags+0x88/0x14c)
[<c04c0370>] (__dev_change_flags) from [<c04c044c>] (dev_change_flags+0x18/0x48)
[<c04c044c>] (dev_change_flags) from [<c052bafc>] (devinet_ioctl+0x6b4/0x7ac)
[<c052bafc>] (devinet_ioctl) from [<c04a1428>] (sock_ioctl+0x1d8/0x2c0)
[<c04a1428>] (sock_ioctl) from [<c014f054>] (do_vfs_ioctl+0x41c/0x600)
[<c014f054>] (do_vfs_ioctl) from [<c014f2a4>] (SyS_ioctl+0x6c/0x7c)
[<c014f2a4>] (SyS_ioctl) from [<c000ff60>] (ret_fast_syscall+0x0/0x1c)

Fixes: 42f59967a091 ("net: ethernet: davinci_emac: add OF support")
Cc: Brian Hutchinson <b.hutchman@gmail.com>
Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/ti/davinci_emac.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1888,8 +1888,6 @@ davinci_emac_of_get_pdata(struct platfor
 		pdata->hw_ram_addr = auxdata->hw_ram_addr;
 	}
 
-	pdev->dev.platform_data = pdata;
-
 	return  pdata;
 }
 



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 301/312] ata: sata_dwc_460ex: remove incorrect locking
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (299 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 300/312] net: ethernet: davinci_emac: Fix platform_data overwrite Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 302/312] pinctrl: tegra: Correctly check the supported configuration Greg Kroah-Hartman
                   ` (12 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Christian Lamparter, Mans Rullgard,
	Tejun Heo

From: Mans Rullgard <mans@mansr.com>

commit 55e610cdd28c0ad3dce0652030c0296d549673f3 upstream.

This lock is already taken in ata_scsi_queuecmd() a few levels up the
call stack so attempting to take it here is an error.  Moreover, it is
pointless in the first place since it only protects a single, atomic
assignment.

Enabling lock debugging gives the following output:

=============================================
[ INFO: possible recursive locking detected ]
4.4.0-rc5+ #189 Not tainted
---------------------------------------------
kworker/u2:3/37 is trying to acquire lock:
 (&(&host->lock)->rlock){-.-...}, at: [<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c

but task is already holding lock:
 (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&(&host->lock)->rlock);
  lock(&(&host->lock)->rlock);

 *** DEADLOCK ***
 May be due to missing lock nesting notation

4 locks held by kworker/u2:3/37:
 #0:  ("events_unbound"){.+.+.+}, at: [<9003a0a4>] process_one_work+0x12c/0x430
 #1:  ((&entry->work)){+.+.+.}, at: [<9003a0a4>] process_one_work+0x12c/0x430
 #2:  (&bdev->bd_mutex){+.+.+.}, at: [<9011fd54>] __blkdev_get+0x50/0x380
 #3:  (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330

stack backtrace:
CPU: 0 PID: 37 Comm: kworker/u2:3 Not tainted 4.4.0-rc5+ #189
Workqueue: events_unbound async_run_entry_fn
Stack : 90b38e30 00000021 00000003 9b2a6040 00000000 9005f3f0 904fc8dc 00000025
        906b96e4 00000000 90528648 9b3336c4 904fc8dc 9009bf18 00000002 00000004
        00000000 00000000 9b3336c4 9b3336e4 904fc8dc 9003d074 00000000 90500000
        9005e738 00000000 00000000 00000000 00000000 00000000 00000000 00000000
        6e657665 755f7374 756f626e 0000646e 00000000 00000000 9b00ca00 9b025000
          ...
Call Trace:
[<90009d6c>] show_stack+0x88/0xa4
[<90057744>] __lock_acquire+0x1ce8/0x2154
[<900583e4>] lock_acquire+0x64/0x8c
[<9045ff10>] _raw_spin_lock_irqsave+0x54/0x78
[<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c
[<90283484>] sata_dwc_qc_issue+0x1a8/0x24c
[<9026b39c>] ata_qc_issue+0x1f0/0x410
[<90273c6c>] ata_scsi_translate+0xb4/0x200
[<90276234>] ata_scsi_queuecmd+0xb4/0x330
[<9025800c>] scsi_dispatch_cmd+0xd0/0x128
[<90259934>] scsi_request_fn+0x58c/0x638
[<901a3e50>] __blk_run_queue+0x40/0x5c
[<901a83d4>] blk_queue_bio+0x27c/0x28c
[<901a5914>] generic_make_request+0xf0/0x188
[<901a5a54>] submit_bio+0xa8/0x194
[<9011adcc>] submit_bh_wbc.isra.23+0x15c/0x17c
[<9011c908>] block_read_full_page+0x3e4/0x428
[<9009e2e0>] do_read_cache_page+0xac/0x210
[<9009fd90>] read_cache_page+0x18/0x24
[<901bbd18>] read_dev_sector+0x38/0xb0
[<901bd174>] msdos_partition+0xb4/0x5c0
[<901bcb8c>] check_partition+0x140/0x274
[<901bba60>] rescan_partitions+0xa0/0x2b0
[<9011ff68>] __blkdev_get+0x264/0x380
[<901201ac>] blkdev_get+0x128/0x36c
[<901b9378>] add_disk+0x3c0/0x4bc
[<90268268>] sd_probe_async+0x100/0x224
[<90043a44>] async_run_entry_fn+0x50/0x124
[<9003a11c>] process_one_work+0x1a4/0x430
[<9003a4f4>] worker_thread+0x14c/0x4fc
[<900408f4>] kthread+0xd0/0xe8
[<90004338>] ret_from_kernel_thread+0x14/0x1c

Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
Tested-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: Mans Rullgard <mans@mansr.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/ata/sata_dwc_460ex.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -924,15 +924,13 @@ static void sata_dwc_exec_command_by_tag
 					 struct ata_taskfile *tf,
 					 u8 tag, u32 cmd_issued)
 {
-	unsigned long flags;
 	struct sata_dwc_device_port *hsdevp = HSDEVP_FROM_AP(ap);
 
 	dev_dbg(ap->dev, "%s cmd(0x%02x): %s tag=%d\n", __func__, tf->command,
 		ata_get_cmd_descript(tf->command), tag);
 
-	spin_lock_irqsave(&ap->host->lock, flags);
 	hsdevp->cmd_issued[tag] = cmd_issued;
-	spin_unlock_irqrestore(&ap->host->lock, flags);
+
 	/*
 	 * Clear SError before executing a new command.
 	 * sata_dwc_scr_write and read can not be used here. Clearing the PM



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 302/312] pinctrl: tegra: Correctly check the supported configuration
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (300 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 301/312] ata: sata_dwc_460ex: remove incorrect locking Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 303/312] brcmfmac: add fallback for devices that do not report per-chain values Greg Kroah-Hartman
                   ` (11 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Laxman Dewangan, Stephen Warren,
	Linus Walleij

From: Laxman Dewangan <ldewangan@nvidia.com>

commit b22ef2a0979f2b91cfeeabb086e4d665183a93a1 upstream.

The pincontrol registers of Tegra chips has multiple filed per
registers. There is two type of registers mux and drive. All
configurations belongs to one of these registers.

If any configurations are supported then <config>_bit is set to
bit position of these registers otherwise -1 to not support it.
The member is defined as
	s32 <config>_bit:6;

So if config is not supported ifor given SoC then it is set to -1
in soc pinmmux table.
In common driver code, to find out that given config is supported
or not, it is checked as:

s8 bit = <config>_bit;
if (bit > 31) {
	/* Not supported config */
}

But in this case, bit is s8 and hence for non supporting it is -1.

Correct the check as:
if (bit < 0) {
	/* Not supported config */
}

Fixes: e4c02dced975cb ("pinctrl: tegra: use signed bitfields for optional fields")
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Acked-by: Stephen Warren <swarren@nvidia.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pinctrl/pinctrl-tegra.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/pinctrl/pinctrl-tegra.c
+++ b/drivers/pinctrl/pinctrl-tegra.c
@@ -418,7 +418,7 @@ static int tegra_pinconf_reg(struct tegr
 		return -ENOTSUPP;
 	}
 
-	if (*reg < 0 || *bit > 31) {
+	if (*reg < 0 || *bit < 0)  {
 		if (report_err) {
 			const char *prop = "unknown";
 			int i;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 303/312] brcmfmac: add fallback for devices that do not report per-chain values
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (301 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 302/312] pinctrl: tegra: Correctly check the supported configuration Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 304/312] brcmfmac: restore stopping netdev queue when bus clogs up Greg Kroah-Hartman
                   ` (10 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jaap Jan Meijer, Arend van Spriel,
	Kalle Valo

From: Jaap Jan Meijer <jjmeijer88@gmail.com>

commit 94abd778a7bb00ed5d00f56d9fbfcbf5b7c02a5c upstream.

If brcmf_cfg80211_get_station fails to determine the RSSI from the
per-chain values get the value individually as a fallback.

Fixes: 1f0dc59a6de9 ("brcmfmac: rework .get_station() callback")
Signed-off-by: Jaap Jan Meijer <jjmeijer88@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c |   16 ++++++++++++++++
 1 file changed, 16 insertions(+)

--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -2419,12 +2419,14 @@ brcmf_cfg80211_get_station(struct wiphy
 			   const u8 *mac, struct station_info *sinfo)
 {
 	struct brcmf_if *ifp = netdev_priv(ndev);
+	struct brcmf_scb_val_le scb_val;
 	s32 err = 0;
 	struct brcmf_sta_info_le sta_info_le;
 	u32 sta_flags;
 	u32 is_tdls_peer;
 	s32 total_rssi;
 	s32 count_rssi;
+	int rssi;
 	u32 i;
 
 	brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
@@ -2505,6 +2507,20 @@ brcmf_cfg80211_get_station(struct wiphy
 			sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
 			total_rssi /= count_rssi;
 			sinfo->signal = total_rssi;
+		} else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
+			&ifp->vif->sme_state)) {
+			memset(&scb_val, 0, sizeof(scb_val));
+			err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
+						     &scb_val, sizeof(scb_val));
+			if (err) {
+				brcmf_err("Could not get rssi (%d)\n", err);
+				goto done;
+			} else {
+				rssi = le32_to_cpu(scb_val.val);
+				sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+				sinfo->signal = rssi;
+				brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
+			}
 		}
 	}
 done:



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 304/312] brcmfmac: restore stopping netdev queue when bus clogs up
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (302 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 303/312] brcmfmac: add fallback for devices that do not report per-chain values Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 305/312] bridge: Fix problems around fdb entries pointing to the bridge device Greg Kroah-Hartman
                   ` (9 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Per Förlin, Hante Meuleman,
	Pieter-Paul Giesberts, Franky Lin, Arend van Spriel, Kalle Valo

From: Arend Van Spriel <arend.vanspriel@broadcom.com>

commit 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 upstream.

When the host-interface bus has hard time handling transmit packets
it informs higher layer about this and it would stop the netdev
queue when needed. However, since commit 9cd18359d31e ("brcmfmac:
Make FWS queueing configurable.") this was broken. With this patch
the behaviour is restored.

Cc: stable@vger.kernel.org # v4.5, v4.6, v4.7
Fixes: 9cd18359d31e ("brcmfmac: Make FWS queueing configurable.")
Tested-by: Per Förlin <per.forlin@gmail.com>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c |   22 ++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -2262,10 +2262,22 @@ void brcmf_fws_bustxfail(struct brcmf_fw
 void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
 {
 	struct brcmf_fws_info *fws = drvr->fws;
+	struct brcmf_if *ifp;
+	int i;
 
-	fws->bus_flow_blocked = flow_blocked;
-	if (!flow_blocked)
-		brcmf_fws_schedule_deq(fws);
-	else
-		fws->stats.bus_flow_block++;
+	if (fws->avoid_queueing) {
+		for (i = 0; i < BRCMF_MAX_IFS; i++) {
+			ifp = drvr->iflist[i];
+			if (!ifp || !ifp->ndev)
+				continue;
+			brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
+					     flow_blocked);
+		}
+	} else {
+		fws->bus_flow_blocked = flow_blocked;
+		if (!flow_blocked)
+			brcmf_fws_schedule_deq(fws);
+		else
+			fws->stats.bus_flow_block++;
+	}
 }



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 305/312] bridge: Fix problems around fdb entries pointing to the bridge device
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (303 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 304/312] brcmfmac: restore stopping netdev queue when bus clogs up Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 306/312] bna: add missing per queue ethtool stat Greg Kroah-Hartman
                   ` (8 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Toshiaki Makita, Roopa Prabhu,
	David S. Miller

From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>

commit 7bb90c3715a496c650b2e879225030f9dd9cfafb upstream.

Adding fdb entries pointing to the bridge device uses fdb_insert(),
which lacks various checks and does not respect added_by_user flag.

As a result, some inconsistent behavior can happen:
* Adding temporary entries succeeds but results in permanent entries.
* Same goes for "dynamic" and "use".
* Changing mac address of the bridge device causes deletion of
  user-added entries.
* Replacing existing entries looks successful from userspace but actually
  not, regardless of NLM_F_EXCL flag.

Use the same logic as other entries and fix them.

Fixes: 3741873b4f73 ("bridge: allow adding of fdb entries pointing to the bridge device")
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/bridge/br_fdb.c |   52 +++++++++++++++++++++++++++-------------------------
 1 file changed, 27 insertions(+), 25 deletions(-)

--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -266,7 +266,7 @@ void br_fdb_change_mac_address(struct ne
 
 	/* If old entry was unassociated with any port, then delete it. */
 	f = __br_fdb_get(br, br->dev->dev_addr, 0);
-	if (f && f->is_local && !f->dst)
+	if (f && f->is_local && !f->dst && !f->added_by_user)
 		fdb_delete_local(br, NULL, f);
 
 	fdb_insert(br, NULL, newaddr, 0);
@@ -281,7 +281,7 @@ void br_fdb_change_mac_address(struct ne
 		if (!br_vlan_should_use(v))
 			continue;
 		f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
-		if (f && f->is_local && !f->dst)
+		if (f && f->is_local && !f->dst && !f->added_by_user)
 			fdb_delete_local(br, NULL, f);
 		fdb_insert(br, NULL, newaddr, v->vid);
 	}
@@ -758,20 +758,25 @@ out:
 }
 
 /* Update (create or replace) forwarding database entry */
-static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
-			 __u16 state, __u16 flags, __u16 vid)
+static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
+			 const __u8 *addr, __u16 state, __u16 flags, __u16 vid)
 {
-	struct net_bridge *br = source->br;
 	struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
 	struct net_bridge_fdb_entry *fdb;
 	bool modified = false;
 
 	/* If the port cannot learn allow only local and static entries */
-	if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
+	if (source && !(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
 	    !(source->state == BR_STATE_LEARNING ||
 	      source->state == BR_STATE_FORWARDING))
 		return -EPERM;
 
+	if (!source && !(state & NUD_PERMANENT)) {
+		pr_info("bridge: RTM_NEWNEIGH %s without NUD_PERMANENT\n",
+			br->dev->name);
+		return -EINVAL;
+	}
+
 	fdb = fdb_find(head, addr, vid);
 	if (fdb == NULL) {
 		if (!(flags & NLM_F_CREATE))
@@ -826,22 +831,28 @@ static int fdb_add_entry(struct net_brid
 	return 0;
 }
 
-static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
-	       const unsigned char *addr, u16 nlh_flags, u16 vid)
+static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
+			struct net_bridge_port *p, const unsigned char *addr,
+			u16 nlh_flags, u16 vid)
 {
 	int err = 0;
 
 	if (ndm->ndm_flags & NTF_USE) {
+		if (!p) {
+			pr_info("bridge: RTM_NEWNEIGH %s with NTF_USE is not supported\n",
+				br->dev->name);
+			return -EINVAL;
+		}
 		local_bh_disable();
 		rcu_read_lock();
-		br_fdb_update(p->br, p, addr, vid, true);
+		br_fdb_update(br, p, addr, vid, true);
 		rcu_read_unlock();
 		local_bh_enable();
 	} else {
-		spin_lock_bh(&p->br->hash_lock);
-		err = fdb_add_entry(p, addr, ndm->ndm_state,
+		spin_lock_bh(&br->hash_lock);
+		err = fdb_add_entry(br, p, addr, ndm->ndm_state,
 				    nlh_flags, vid);
-		spin_unlock_bh(&p->br->hash_lock);
+		spin_unlock_bh(&br->hash_lock);
 	}
 
 	return err;
@@ -878,6 +889,7 @@ int br_fdb_add(struct ndmsg *ndm, struct
 				dev->name);
 			return -EINVAL;
 		}
+		br = p->br;
 		vg = nbp_vlan_group(p);
 	}
 
@@ -889,15 +901,9 @@ int br_fdb_add(struct ndmsg *ndm, struct
 		}
 
 		/* VID was specified, so use it. */
-		if (dev->priv_flags & IFF_EBRIDGE)
-			err = br_fdb_insert(br, NULL, addr, vid);
-		else
-			err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
+		err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid);
 	} else {
-		if (dev->priv_flags & IFF_EBRIDGE)
-			err = br_fdb_insert(br, NULL, addr, 0);
-		else
-			err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+		err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0);
 		if (err || !vg || !vg->num_vlans)
 			goto out;
 
@@ -908,11 +914,7 @@ int br_fdb_add(struct ndmsg *ndm, struct
 		list_for_each_entry(v, &vg->vlan_list, vlist) {
 			if (!br_vlan_should_use(v))
 				continue;
-			if (dev->priv_flags & IFF_EBRIDGE)
-				err = br_fdb_insert(br, NULL, addr, v->vid);
-			else
-				err = __br_fdb_add(ndm, p, addr, nlh_flags,
-						   v->vid);
+			err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid);
 			if (err)
 				goto out;
 		}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 306/312] bna: add missing per queue ethtool stat
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (304 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 305/312] bridge: Fix problems around fdb entries pointing to the bridge device Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 307/312] net: skbuff: Remove errornous length validation in skb_vlan_pop() Greg Kroah-Hartman
                   ` (7 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ivan Vecera, David S. Miller

From: Ivan Vecera <ivecera@redhat.com>

commit 2835d2d9e366a2985b24051d228333bfba82f3a7 upstream.

Commit ba5ca784 "bna: check for dma mapping errors" added besides other
things a statistic that counts number of DMA buffer mapping failures
per each Rx queue. This counter is not included in ethtool stats output.

Fixes: ba5ca784 "bna: check for dma mapping errors"
Signed-off-by: Ivan Vecera <ivecera@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/brocade/bna/bnad_ethtool.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
@@ -31,7 +31,7 @@
 #define BNAD_NUM_TXF_COUNTERS 12
 #define BNAD_NUM_RXF_COUNTERS 10
 #define BNAD_NUM_CQ_COUNTERS (3 + 5)
-#define BNAD_NUM_RXQ_COUNTERS 6
+#define BNAD_NUM_RXQ_COUNTERS 7
 #define BNAD_NUM_TXQ_COUNTERS 5
 
 #define BNAD_ETHTOOL_STATS_NUM						\
@@ -658,6 +658,8 @@ bnad_get_strings(struct net_device *netd
 				string += ETH_GSTRING_LEN;
 				sprintf(string, "rxq%d_allocbuf_failed", q_num);
 				string += ETH_GSTRING_LEN;
+				sprintf(string, "rxq%d_mapbuf_failed", q_num);
+				string += ETH_GSTRING_LEN;
 				sprintf(string, "rxq%d_producer_index", q_num);
 				string += ETH_GSTRING_LEN;
 				sprintf(string, "rxq%d_consumer_index", q_num);
@@ -678,6 +680,9 @@ bnad_get_strings(struct net_device *netd
 					sprintf(string, "rxq%d_allocbuf_failed",
 								q_num);
 					string += ETH_GSTRING_LEN;
+					sprintf(string, "rxq%d_mapbuf_failed",
+						q_num);
+					string += ETH_GSTRING_LEN;
 					sprintf(string, "rxq%d_producer_index",
 								q_num);
 					string += ETH_GSTRING_LEN;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 307/312] net: skbuff: Remove errornous length validation in skb_vlan_pop()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (305 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 306/312] bna: add missing per queue ethtool stat Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:34 ` [PATCH 4.4 308/312] net: ep93xx_eth: Do not crash unloading module Greg Kroah-Hartman
                   ` (6 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Shmulik Ladkani, Pravin Shelar,
	David S. Miller

From: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>

commit 636c2628086e40c86dac7ddc84a1c4b4fcccc6e3 upstream.

In 93515d53b1
  "net: move vlan pop/push functions into common code"
skb_vlan_pop was moved from its private location in openvswitch to
skbuff common code.

In case skb has non hw-accel vlan tag, the original 'pop_vlan()' assured
that skb->len is sufficient (if skb->len < VLAN_ETH_HLEN then pop was
considered a no-op).

This validation was moved as is into the new common 'skb_vlan_pop'.

Alas, in its original location (openvswitch), there was a guarantee that
'data' points to the mac_header, therefore the 'skb->len < VLAN_ETH_HLEN'
condition made sense.
However there's no such guarantee in the generic 'skb_vlan_pop'.

For short packets received in rx path going through 'skb_vlan_pop',
this causes 'skb_vlan_pop' to fail pop-ing a valid vlan hdr (in the non
hw-accel case) or to fail moving next tag into hw-accel tag.

Remove the 'skb->len < VLAN_ETH_HLEN' condition entirely:
It is superfluous since inner '__skb_vlan_pop' already verifies there
are VLAN_ETH_HLEN writable bytes at the mac_header.

Note this presents a slight change to skb_vlan_pop() users:
In case total length is smaller than VLAN_ETH_HLEN, skb_vlan_pop() now
returns an error, as opposed to previous "no-op" behavior.
Existing callers (e.g. tc act vlan, ovs) usually drop the packet if
'skb_vlan_pop' fails.

Fixes: 93515d53b1 ("net: move vlan pop/push functions into common code")
Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
Cc: Pravin Shelar <pshelar@ovn.org>
Reviewed-by: Pravin B Shelar <pshelar@ovn.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/core/skbuff.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4451,9 +4451,8 @@ int skb_vlan_pop(struct sk_buff *skb)
 	if (likely(skb_vlan_tag_present(skb))) {
 		skb->vlan_tci = 0;
 	} else {
-		if (unlikely((skb->protocol != htons(ETH_P_8021Q) &&
-			      skb->protocol != htons(ETH_P_8021AD)) ||
-			     skb->len < VLAN_ETH_HLEN))
+		if (unlikely(skb->protocol != htons(ETH_P_8021Q) &&
+			     skb->protocol != htons(ETH_P_8021AD)))
 			return 0;
 
 		err = __skb_vlan_pop(skb, &vlan_tci);
@@ -4461,9 +4460,8 @@ int skb_vlan_pop(struct sk_buff *skb)
 			return err;
 	}
 	/* move next vlan tag to hw accel tag */
-	if (likely((skb->protocol != htons(ETH_P_8021Q) &&
-		    skb->protocol != htons(ETH_P_8021AD)) ||
-		   skb->len < VLAN_ETH_HLEN))
+	if (likely(skb->protocol != htons(ETH_P_8021Q) &&
+		   skb->protocol != htons(ETH_P_8021AD)))
 		return 0;
 
 	vlan_proto = skb->protocol;



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 308/312] net: ep93xx_eth: Do not crash unloading module
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (306 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 307/312] net: skbuff: Remove errornous length validation in skb_vlan_pop() Greg Kroah-Hartman
@ 2020-05-08 12:34 ` Greg Kroah-Hartman
  2020-05-08 12:35 ` [PATCH 4.4 309/312] macvlan: Fix potential use-after free for broadcasts Greg Kroah-Hartman
                   ` (5 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Florian Fainelli, David S. Miller

From: Florian Fainelli <f.fainelli@gmail.com>

commit c823abac17926767fb50175e098f087a6ac684c3 upstream.

When we unload the ep93xx_eth, whether we have opened the network
interface or not, we will either hit a kernel paging request error, or a
simple NULL pointer de-reference because:

- if ep93xx_open has been called, we have created a valid DMA mapping
  for ep->descs, when we call ep93xx_stop, we also call
  ep93xx_free_buffers, ep->descs now has a stale value

- if ep93xx_open has not been called, we have a NULL pointer for
  ep->descs, so performing any operation against that address just won't
  work

Fix this by adding a NULL pointer check for ep->descs which means that
ep93xx_free_buffers() was able to successfully tear down the descriptors
and free the DMA cookie as well.

Fixes: 1d22e05df818 ("[PATCH] Cirrus Logic ep93xx ethernet driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/ethernet/cirrus/ep93xx_eth.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
+++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct e
 	struct device *dev = ep->dev->dev.parent;
 	int i;
 
+	if (!ep->descs)
+		return;
+
 	for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
 		dma_addr_t d;
 
@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct e
 
 	dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
 							ep->descs_dma_addr);
+	ep->descs = NULL;
 }
 
 static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 309/312] macvlan: Fix potential use-after free for broadcasts
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (307 preceding siblings ...)
  2020-05-08 12:34 ` [PATCH 4.4 308/312] net: ep93xx_eth: Do not crash unloading module Greg Kroah-Hartman
@ 2020-05-08 12:35 ` Greg Kroah-Hartman
  2020-05-08 12:35 ` [PATCH 4.4 310/312] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case Greg Kroah-Hartman
                   ` (4 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Herbert Xu, David S. Miller

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 260916dfb48c374f7840f3b86e69afd3afdb6e96 upstream.

When we postpone a broadcast packet we save the source port in
the skb if it is local.  However, the source port can disappear
before we get a chance to process the packet.

This patch fixes this by holding a ref count on the netdev.

It also delays the skb->cb modification until after we allocate
the new skb as you should not modify shared skbs.

Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/macvlan.c |   10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -305,6 +305,8 @@ static void macvlan_process_broadcast(st
 
 		rcu_read_unlock();
 
+		if (src)
+			dev_put(src->dev);
 		kfree_skb(skb);
 
 		cond_resched();
@@ -312,6 +314,7 @@ static void macvlan_process_broadcast(st
 }
 
 static void macvlan_broadcast_enqueue(struct macvlan_port *port,
+				      const struct macvlan_dev *src,
 				      struct sk_buff *skb)
 {
 	struct sk_buff *nskb;
@@ -321,8 +324,12 @@ static void macvlan_broadcast_enqueue(st
 	if (!nskb)
 		goto err;
 
+	MACVLAN_SKB_CB(nskb)->src = src;
+
 	spin_lock(&port->bc_queue.lock);
 	if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) {
+		if (src)
+			dev_hold(src->dev);
 		__skb_queue_tail(&port->bc_queue, nskb);
 		err = 0;
 	}
@@ -432,8 +439,7 @@ static rx_handler_result_t macvlan_handl
 			goto out;
 		}
 
-		MACVLAN_SKB_CB(skb)->src = src;
-		macvlan_broadcast_enqueue(port, skb);
+		macvlan_broadcast_enqueue(port, src, skb);
 
 		return RX_HANDLER_PASS;
 	}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 310/312] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (308 preceding siblings ...)
  2020-05-08 12:35 ` [PATCH 4.4 309/312] macvlan: Fix potential use-after free for broadcasts Greg Kroah-Hartman
@ 2020-05-08 12:35 ` Greg Kroah-Hartman
  2020-05-08 12:35 ` [PATCH 4.4 311/312] ALSA: hda: Match both PCI ID and SSID for driver blacklist Greg Kroah-Hartman
                   ` (3 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:35 UTC (permalink / raw)
  To: linux-kernel
  Cc: Greg Kroah-Hartman, stable, Jere Leppänen,
	Marcelo Ricardo Leitner, David S. Miller

From: Jere Leppänen <jere.leppanen@nokia.com>

commit 12dfd78e3a74825e6f0bc8df7ef9f938fbc6bfe3 upstream.

When starting shutdown in sctp_sf_do_dupcook_a(), get the value for
SHUTDOWN Cumulative TSN Ack from the new association, which is
reconstructed from the cookie, instead of the old association, which
the peer doesn't have anymore.

Otherwise the SHUTDOWN is either ignored or replied to with an ABORT
by the peer because CTSN Ack doesn't match the peer's Initial TSN.

Fixes: bdf6fa52f01b ("sctp: handle association restarts when the socket is closed.")
Signed-off-by: Jere Leppänen <jere.leppanen@nokia.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/sctp/sm_make_chunk.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -857,7 +857,11 @@ struct sctp_chunk *sctp_make_shutdown(co
 	sctp_shutdownhdr_t shut;
 	__u32 ctsn;
 
-	ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
+	if (chunk && chunk->asoc)
+		ctsn = sctp_tsnmap_get_ctsn(&chunk->asoc->peer.tsn_map);
+	else
+		ctsn = sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map);
+
 	shut.cum_tsn_ack = htonl(ctsn);
 
 	retval = sctp_make_control(asoc, SCTP_CID_SHUTDOWN, 0,



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 311/312] ALSA: hda: Match both PCI ID and SSID for driver blacklist
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (309 preceding siblings ...)
  2020-05-08 12:35 ` [PATCH 4.4 310/312] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case Greg Kroah-Hartman
@ 2020-05-08 12:35 ` Greg Kroah-Hartman
  2020-05-08 12:35 ` [PATCH 4.4 312/312] mac80211: add ieee80211_is_any_nullfunc() Greg Kroah-Hartman
                   ` (2 subsequent siblings)
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai

From: Takashi Iwai <tiwai@suse.de>

commit 977dfef40c8996b69afe23a9094d184049efb7bb upstream.

The commit 3c6fd1f07ed0 ("ALSA: hda: Add driver blacklist") added a
new blacklist for the devices that are known to have empty codecs, and
one of the entries was ASUS ROG Zenith II (PCI SSID 1043:874f).
However, it turned out that the very same PCI SSID is used for the
previous model that does have the valid HD-audio codecs and the change
broke the sound on it.

Since the empty codec problem appear on the certain AMD platform (PCI
ID 1022:1487), this patch changes the blacklist matching to both PCI
ID and SSID using pci_match_id().  Also, the entry that was removed by
the previous fix for ASUS ROG Zenigh II is re-added.

Link: https://lore.kernel.org/r/20200424061222.19792-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/hda_intel.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -1977,9 +1977,10 @@ static const struct hdac_io_ops pci_hda_
  * some HD-audio PCI entries are exposed without any codecs, and such devices
  * should be ignored from the beginning.
  */
-static const struct snd_pci_quirk driver_blacklist[] = {
-	SND_PCI_QUIRK(0x1462, 0xcb59, "MSI TRX40 Creator", 0),
-	SND_PCI_QUIRK(0x1462, 0xcb60, "MSI TRX40", 0),
+static const struct pci_device_id driver_blacklist[] = {
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1043, 0x874f) }, /* ASUS ROG Zenith II / Strix */
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb59) }, /* MSI TRX40 Creator */
+	{ PCI_DEVICE_SUB(0x1022, 0x1487, 0x1462, 0xcb60) }, /* MSI TRX40 */
 	{}
 };
 
@@ -2002,7 +2003,7 @@ static int azx_probe(struct pci_dev *pci
 	bool schedule_probe;
 	int err;
 
-	if (snd_pci_quirk_lookup(pci, driver_blacklist)) {
+	if (pci_match_id(driver_blacklist, pci)) {
 		dev_info(&pci->dev, "Skipping the blacklisted device\n");
 		return -ENODEV;
 	}



^ permalink raw reply	[flat|nested] 319+ messages in thread

* [PATCH 4.4 312/312] mac80211: add ieee80211_is_any_nullfunc()
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (310 preceding siblings ...)
  2020-05-08 12:35 ` [PATCH 4.4 311/312] ALSA: hda: Match both PCI ID and SSID for driver blacklist Greg Kroah-Hartman
@ 2020-05-08 12:35 ` Greg Kroah-Hartman
  2020-05-08 13:37 ` [PATCH 4.4 000/312] 4.4.223-rc1 review Guenter Roeck
  2020-05-08 13:38 ` Naresh Kamboju
  313 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 12:35 UTC (permalink / raw)
  To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Pedersen, Johannes Berg

From: Thomas Pedersen <thomas@adapt-ip.com>

commit 30b2f0be23fb40e58d0ad2caf8702c2a44cda2e1 upstream.

commit 08a5bdde3812 ("mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED")
Fixed a bug where we failed to take into account a
nullfunc frame can be either non-QoS or QoS. It turns out
there is at least one more bug in
ieee80211_sta_tx_notify(), introduced in
commit 7b6ddeaf27ec ("mac80211: use QoS NDP for AP probing"),
where we forgot to check for the QoS variant and so
assumed the QoS nullfunc frame never went out

Fix this by adding a helper ieee80211_is_any_nullfunc()
which consolidates the check for non-QoS and QoS nullfunc
frames. Replace existing compound conditionals and add a
couple more missing checks for QoS variant.

Signed-off-by: Thomas Pedersen <thomas@adapt-ip.com>
Link: https://lore.kernel.org/r/20200114055940.18502-3-thomas@adapt-ip.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/ieee80211.h |    9 +++++++++
 net/mac80211/mlme.c       |    2 +-
 net/mac80211/rx.c         |    8 +++-----
 net/mac80211/status.c     |    5 ++---
 net/mac80211/tx.c         |    2 +-
 5 files changed, 16 insertions(+), 10 deletions(-)

--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -607,6 +607,15 @@ static inline bool ieee80211_is_qos_null
 }
 
 /**
+ * ieee80211_is_any_nullfunc - check if frame is regular or QoS nullfunc frame
+ * @fc: frame control bytes in little-endian byteorder
+ */
+static inline bool ieee80211_is_any_nullfunc(__le16 fc)
+{
+	return (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc));
+}
+
+/**
  * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
  * @fc: frame control field in little-endian byteorder
  */
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2283,7 +2283,7 @@ void ieee80211_sta_tx_notify(struct ieee
 	if (!ieee80211_is_data(hdr->frame_control))
 	    return;
 
-	if (ieee80211_is_nullfunc(hdr->frame_control) &&
+	if (ieee80211_is_any_nullfunc(hdr->frame_control) &&
 	    sdata->u.mgd.probe_send_count > 0) {
 		if (ack)
 			ieee80211_sta_reset_conn_monitor(sdata);
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1110,8 +1110,7 @@ ieee80211_rx_h_check_dup(struct ieee8021
 		return RX_CONTINUE;
 
 	if (ieee80211_is_ctl(hdr->frame_control) ||
-	    ieee80211_is_nullfunc(hdr->frame_control) ||
-	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
+	    ieee80211_is_any_nullfunc(hdr->frame_control) ||
 	    is_multicast_ether_addr(hdr->addr1))
 		return RX_CONTINUE;
 
@@ -1487,8 +1486,7 @@ ieee80211_rx_h_sta_process(struct ieee80
 	 * Drop (qos-)data::nullfunc frames silently, since they
 	 * are used only to control station power saving mode.
 	 */
-	if (ieee80211_is_nullfunc(hdr->frame_control) ||
-	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
+	if (ieee80211_is_any_nullfunc(hdr->frame_control)) {
 		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
 
 		/*
@@ -1977,7 +1975,7 @@ static int ieee80211_drop_unencrypted(st
 
 	/* Drop unencrypted frames if key is set. */
 	if (unlikely(!ieee80211_has_protected(fc) &&
-		     !ieee80211_is_nullfunc(fc) &&
+		     !ieee80211_is_any_nullfunc(fc) &&
 		     ieee80211_is_data(fc) && rx->key))
 		return -EACCES;
 
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -474,8 +474,7 @@ static void ieee80211_report_ack_skb(str
 		rcu_read_lock();
 		sdata = ieee80211_sdata_from_skb(local, skb);
 		if (sdata) {
-			if (ieee80211_is_nullfunc(hdr->frame_control) ||
-			    ieee80211_is_qos_nullfunc(hdr->frame_control))
+			if (ieee80211_is_any_nullfunc(hdr->frame_control))
 				cfg80211_probe_status(sdata->dev, hdr->addr1,
 						      cookie, acked,
 						      GFP_ATOMIC);
@@ -905,7 +904,7 @@ void ieee80211_tx_status(struct ieee8021
 			I802_DEBUG_INC(local->dot11FailedCount);
 	}
 
-	if (ieee80211_is_nullfunc(fc) && ieee80211_has_pm(fc) &&
+	if (ieee80211_is_any_nullfunc(fc) && ieee80211_has_pm(fc) &&
 	    ieee80211_hw_check(&local->hw, REPORTS_TX_ACK_STATUS) &&
 	    !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
 	    local->ps_sdata && !(local->scanning)) {
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -291,7 +291,7 @@ ieee80211_tx_h_check_assoc(struct ieee80
 	if (unlikely(test_bit(SCAN_SW_SCANNING, &tx->local->scanning)) &&
 	    test_bit(SDATA_STATE_OFFCHANNEL, &tx->sdata->state) &&
 	    !ieee80211_is_probe_req(hdr->frame_control) &&
-	    !ieee80211_is_nullfunc(hdr->frame_control))
+	    !ieee80211_is_any_nullfunc(hdr->frame_control))
 		/*
 		 * When software scanning only nullfunc frames (to notify
 		 * the sleep state to the AP) and probe requests (for the



^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (311 preceding siblings ...)
  2020-05-08 12:35 ` [PATCH 4.4 312/312] mac80211: add ieee80211_is_any_nullfunc() Greg Kroah-Hartman
@ 2020-05-08 13:37 ` Guenter Roeck
  2020-05-08 13:44   ` Greg Kroah-Hartman
  2020-05-08 13:38 ` Naresh Kamboju
  313 siblings, 1 reply; 319+ messages in thread
From: Guenter Roeck @ 2020-05-08 13:37 UTC (permalink / raw)
  To: Greg Kroah-Hartman, linux-kernel
  Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable

On 5/8/20 5:29 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.223 release.
> There are 312 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
> Anything received after that time might be too late.
> 

This is not a complete list of errors.

arm64:allmodconfig

drivers/spi/spi-rockchip.c: In function 'rockchip_spi_prepare_dma':
drivers/spi/spi-rockchip.c:461:19: error: 'struct dma_slave_caps' has no member named 'max_burst'

arm:allmodconfig

drivers/mtd/nand/pxa3xx_nand.c: In function 'alloc_nand_resource':
drivers/mtd/nand/pxa3xx_nand.c:1753:7: error: 'np' undeclared

mips:defconfig

Lots of

In file included from ./arch/mips/include/asm/fpu.h:24,
                 from arch/mips/kernel/branch.c:16:
./arch/mips/include/asm/msa.h: In function 'read_msa_ir':
./arch/mips/include/asm/msa.h:204:2: error: expected ':' or ')' before '_ASM_INSN_IF_MIPS'

and similar errors.

arch/mips/mm/tlbex.c: In function 'config_htw_params':
arch/mips/mm/tlbex.c:2334:13: error: 'MIPS_PWSIZE_PS_MASK' undeclared

All mips builds are badly broken.

Guenter

^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
                   ` (312 preceding siblings ...)
  2020-05-08 13:37 ` [PATCH 4.4 000/312] 4.4.223-rc1 review Guenter Roeck
@ 2020-05-08 13:38 ` Naresh Kamboju
  2020-05-08 13:44   ` Greg Kroah-Hartman
  313 siblings, 1 reply; 319+ messages in thread
From: Naresh Kamboju @ 2020-05-08 13:38 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: open list, Shuah Khan, patches, lkft-triage, Ben Hutchings,
	linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck

On Fri, 8 May 2020 at 18:07, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 4.4.223 release.
> There are 312 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
>         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.223-rc1.gz
> or in the git tree and branch at:
>         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
<trim>
> Addy Ke <addy.ke@rock-chips.com>
>     spi: rockchip: modify DMA max burst to 1

While building kernel Image for arm architecture the following error noticed
on stable-rc 4.4 kernel branch

 # make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=arm
CROSS_COMPILE=arm-linux-gnueabihf- HOSTCC=gcc CC="sccache
arm-linux-gnueabihf-gcc" O=build zImage
 #
 #
 # make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=arm
CROSS_COMPILE=arm-linux-gnueabihf- HOSTCC=gcc CC="sccache
arm-linux-gnueabihf-gcc" O=build modules
 #
 ../drivers/spi/spi-rockchip.c: In function ‘rockchip_spi_prepare_dma’:
 ../drivers/spi/spi-rockchip.c:461:19: error: ‘struct dma_slave_caps’
has no member named ‘max_burst’
   461 |   if (rs->dma_caps.max_burst > 4)
       |                   ^
 ../drivers/spi/spi-rockchip.c:481:19: error: ‘struct dma_slave_caps’
has no member named ‘max_burst’
   481 |   if (rs->dma_caps.max_burst > 4)
       |                   ^

full build log,
https://gitlab.com/Linaro/lkft/kernel-runs/-/jobs/544289003

-- 
Linaro LKFT
https://lkft.linaro.org

^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 13:37 ` [PATCH 4.4 000/312] 4.4.223-rc1 review Guenter Roeck
@ 2020-05-08 13:44   ` Greg Kroah-Hartman
  2020-05-08 13:54     ` Guenter Roeck
  0 siblings, 1 reply; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 13:44 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Fri, May 08, 2020 at 06:37:56AM -0700, Guenter Roeck wrote:
> On 5/8/20 5:29 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.4.223 release.
> > There are 312 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
> > Anything received after that time might be too late.
> > 
> 
> This is not a complete list of errors.

Yeah, I knew this was going to be a rough one.  I was hoping the "early
warning" messages from Linaro would have caught most of these, oh well
:(

> 
> arm64:allmodconfig
> 
> drivers/spi/spi-rockchip.c: In function 'rockchip_spi_prepare_dma':
> drivers/spi/spi-rockchip.c:461:19: error: 'struct dma_slave_caps' has no member named 'max_burst'

Now fixed.

> arm:allmodconfig
> 
> drivers/mtd/nand/pxa3xx_nand.c: In function 'alloc_nand_resource':
> drivers/mtd/nand/pxa3xx_nand.c:1753:7: error: 'np' undeclared

Now fixed.

> mips:defconfig
> 
> Lots of
> 
> In file included from ./arch/mips/include/asm/fpu.h:24,
>                  from arch/mips/kernel/branch.c:16:
> ./arch/mips/include/asm/msa.h: In function 'read_msa_ir':
> ./arch/mips/include/asm/msa.h:204:2: error: expected ':' or ')' before '_ASM_INSN_IF_MIPS'
> 
> and similar errors.
> 
> arch/mips/mm/tlbex.c: In function 'config_htw_params':
> arch/mips/mm/tlbex.c:2334:13: error: 'MIPS_PWSIZE_PS_MASK' undeclared
> 
> All mips builds are badly broken.

Odd, I thought I had tested mips locally, I guess I got it completly
wrong...  Let me go through those again...

I'll push out a -rc2 after digging into the mips mess...

greg k-h

^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 13:38 ` Naresh Kamboju
@ 2020-05-08 13:44   ` Greg Kroah-Hartman
  0 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 13:44 UTC (permalink / raw)
  To: Naresh Kamboju
  Cc: open list, Shuah Khan, patches, lkft-triage, Ben Hutchings,
	linux- stable, Andrew Morton, Linus Torvalds, Guenter Roeck

On Fri, May 08, 2020 at 07:08:35PM +0530, Naresh Kamboju wrote:
> On Fri, 8 May 2020 at 18:07, Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > This is the start of the stable review cycle for the 4.4.223 release.
> > There are 312 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> >         https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.223-rc1.gz
> > or in the git tree and branch at:
> >         git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> <trim>
> > Addy Ke <addy.ke@rock-chips.com>
> >     spi: rockchip: modify DMA max burst to 1
> 
> While building kernel Image for arm architecture the following error noticed
> on stable-rc 4.4 kernel branch
> 
>  # make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=arm
> CROSS_COMPILE=arm-linux-gnueabihf- HOSTCC=gcc CC="sccache
> arm-linux-gnueabihf-gcc" O=build zImage
>  #
>  #
>  # make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=arm
> CROSS_COMPILE=arm-linux-gnueabihf- HOSTCC=gcc CC="sccache
> arm-linux-gnueabihf-gcc" O=build modules
>  #
>  ../drivers/spi/spi-rockchip.c: In function ‘rockchip_spi_prepare_dma’:
>  ../drivers/spi/spi-rockchip.c:461:19: error: ‘struct dma_slave_caps’
> has no member named ‘max_burst’
>    461 |   if (rs->dma_caps.max_burst > 4)
>        |                   ^
>  ../drivers/spi/spi-rockchip.c:481:19: error: ‘struct dma_slave_caps’
> has no member named ‘max_burst’
>    481 |   if (rs->dma_caps.max_burst > 4)
>        |                   ^

I just dropped the offending patch, Guenter beat you to it :)

greg k-h

^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 13:44   ` Greg Kroah-Hartman
@ 2020-05-08 13:54     ` Guenter Roeck
  2020-05-08 14:26       ` Greg Kroah-Hartman
  0 siblings, 1 reply; 319+ messages in thread
From: Guenter Roeck @ 2020-05-08 13:54 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On 5/8/20 6:44 AM, Greg Kroah-Hartman wrote:
> On Fri, May 08, 2020 at 06:37:56AM -0700, Guenter Roeck wrote:
>> On 5/8/20 5:29 AM, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 4.4.223 release.
>>> There are 312 patches in this series, all will be posted as a response
>>> to this one.  If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
>>> Anything received after that time might be too late.
>>>
>>
>> This is not a complete list of errors.
> 
> Yeah, I knew this was going to be a rough one.  I was hoping the "early
> warning" messages from Linaro would have caught most of these, oh well
> :(
> 

To be fair, I had noticed the errors yesterday. I just thought this was
so bad that it looked like a stray (bad) push to me, and I didn't send
feedback. Maybe I should always send feedback if I see errors prior to
an -rc release. I don't want to spam people with noise, so I am not sure.
Any thoughts on that ?

Guenter

^ permalink raw reply	[flat|nested] 319+ messages in thread

* Re: [PATCH 4.4 000/312] 4.4.223-rc1 review
  2020-05-08 13:54     ` Guenter Roeck
@ 2020-05-08 14:26       ` Greg Kroah-Hartman
  0 siblings, 0 replies; 319+ messages in thread
From: Greg Kroah-Hartman @ 2020-05-08 14:26 UTC (permalink / raw)
  To: Guenter Roeck
  Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
	lkft-triage, stable

On Fri, May 08, 2020 at 06:54:11AM -0700, Guenter Roeck wrote:
> On 5/8/20 6:44 AM, Greg Kroah-Hartman wrote:
> > On Fri, May 08, 2020 at 06:37:56AM -0700, Guenter Roeck wrote:
> >> On 5/8/20 5:29 AM, Greg Kroah-Hartman wrote:
> >>> This is the start of the stable review cycle for the 4.4.223 release.
> >>> There are 312 patches in this series, all will be posted as a response
> >>> to this one.  If anyone has any issues with these being applied, please
> >>> let me know.
> >>>
> >>> Responses should be made by Sun, 10 May 2020 12:29:44 +0000.
> >>> Anything received after that time might be too late.
> >>>
> >>
> >> This is not a complete list of errors.
> > 
> > Yeah, I knew this was going to be a rough one.  I was hoping the "early
> > warning" messages from Linaro would have caught most of these, oh well
> > :(
> > 
> 
> To be fair, I had noticed the errors yesterday. I just thought this was
> so bad that it looked like a stray (bad) push to me, and I didn't send
> feedback. Maybe I should always send feedback if I see errors prior to
> an -rc release. I don't want to spam people with noise, so I am not sure.
> Any thoughts on that ?

If the tree is broken, I'd like to know about it.  Rarely do I know that
it is broken and leave it alone.  One exception would be last night when
it was too late for me to fix the build issues, but Sasha was kind
enough to do so.

So it's not noise to me, if it's easy enough for you to do so.

I think I fixed up the MIPS stuff, turns out gcc was just crashing on a
filesystem driver with an internal error.  I think I need a different
version of gcc if I want to build more arches...

I'll go push out a -rc with this fixed up now, thanks.

greg k-h

^ permalink raw reply	[flat|nested] 319+ messages in thread

end of thread, other threads:[~2020-05-08 14:26 UTC | newest]

Thread overview: 319+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-08 12:29 [PATCH 4.4 000/312] 4.4.223-rc1 review Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 001/312] mwifiex: fix PCIe register information for 8997 chipset Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 002/312] drm/qxl: qxl_release use after free Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 003/312] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 004/312] staging: rtl8192u: Fix crash due to pointers being "confusing" Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 005/312] usb: gadget: f_acm: Fix configfs attr name Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 006/312] usb: gadged: pch_udc: get rid of redundant assignments Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 007/312] usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock Greg Kroah-Hartman
2020-05-08 12:29 ` [PATCH 4.4 008/312] usb: gadget: udc: core: dont starve DMA resources Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 009/312] MIPS: Fix macro typo Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 010/312] MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[] Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 011/312] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 012/312] MIPS: smp-cps: Stop printing EJTAG exceptions to UART Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 013/312] MIPS: scall: Handle seccomp filters which redirect syscalls Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 014/312] MIPS: BMIPS: BMIPS5000 has I cache filing from D cache Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 015/312] MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 016/312] MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 017/312] MIPS: BMIPS: Pretty print BMIPS5200 processor name Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 018/312] MIPS: Fix HTW config on XPA kernel without LPA enabled Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 019/312] MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 020/312] MIPS: math-emu: Fix BC1{EQ,NE}Z emulation Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 021/312] MIPS: Fix BC1{EQ,NE}Z return offset calculation Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 022/312] MIPS: math-emu: Fix m{add,sub}.s shifts Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 023/312] MIPS: perf: Fix I6400 event numbers Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 024/312] MIPS: Fix 64-bit HTW configuration Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 025/312] MIPS: Fix little endian microMIPS MSA encodings Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 026/312] MIPS: KVM: Fix translation of MFC0 ErrCtl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 027/312] MIPS: SMP: Update cpu_foreign_map on CPU disable Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 028/312] MIPS: c-r4k: Fix protected_writeback_scache_line for EVA Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 029/312] MIPS: Octeon: Off by one in octeon_irq_gpio_map() Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 030/312] bpf, mips: fix off-by-one in ctx offset allocation Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 031/312] MIPS: RM7000: Double locking bug in rm7k_tc_disable() Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 032/312] MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 033/312] mips/panic: replace smp_send_stop() with kdump friendly version in panic path Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 034/312] ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 035/312] ARM: imx: select SRC for i.MX7 Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 036/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 037/312] ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 038/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 039/312] ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 040/312] ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 041/312] ARM: dts: orion5x: fix the missing mtd flash on " Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 042/312] ARM: dts: kirkwood: use unique machine name for ds112 Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 043/312] ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 044/312] ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 045/312] perf/x86: Fix filter_events() bug with event mappings Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 046/312] x86/LDT: Print the real LDT base address Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 047/312] x86/apic/uv: Silence a shift wrapping warning Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 048/312] ALSA: fm801: explicitly free IRQ line Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 049/312] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 050/312] ALSA: fm801: detect FM-only card earlier Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 051/312] netfilter: nfnetlink: use original skbuff when acking batches Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 052/312] xfrm: fix crash in XFRM_MSG_GETSA netlink handler Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 053/312] mwifiex: fix IBSS data path issue Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 054/312] mwifiex: add missing check for PCIe8997 chipset Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 055/312] iwlwifi: set max firmware version of 7265 to 17 Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 056/312] Bluetooth: btmrvl: fix hung task warning dump Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 057/312] dccp: limit sk_filter trim to payload Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 058/312] net/mlx4_core: Do not BUG_ON during reset when PCI is offline Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 059/312] mlxsw: pci: Correctly determine if descriptor queue is full Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 060/312] PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 061/312] net/mlx4_core: Implement pci_resume callback Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 062/312] alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 063/312] vfio/pci: Allow VPD short read Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 064/312] brcmfmac: add eth_type_trans back for PCIe full dongle Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 065/312] mlxsw: Treat local port 64 as valid Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 066/312] IB/mlx4: Initialize hop_limit when creating address handle Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 067/312] ovs/gre,geneve: fix error path when creating an iface Greg Kroah-Hartman
2020-05-08 12:30 ` [PATCH 4.4 068/312] GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 069/312] powerpc/pci/of: Parse unassigned resources Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 070/312] firmware: actually return NULL on failed request_firmware_nowait() Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 071/312] [media] c8sectpfe: Rework firmware loading mechanism Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 072/312] net/mlx5: Avoid passing dma address 0 to firmware Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 073/312] IB/mlx5: Fix RC transport send queue overhead computation Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 074/312] net/mlx5: Make command timeout way shorter Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 075/312] IB/mlx5: Fix FW version diaplay in sysfs Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 076/312] net/mlx5e: Fix MLX5E_100BASE_T define Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 077/312] net/mlx5: Fix the size of modify QP mailbox Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 078/312] net/mlx5: Fix masking of reserved bits in XRCD number Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 079/312] net/mlx5e: Fix blue flame quota logic Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 080/312] net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 081/312] net/mlx5: Avoid calling sleeping function by the health poll thread Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 082/312] net/mlx5: Fix wait_vital for VFs and remove fixed sleep Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 083/312] net/mlx5: Fix potential deadlock in command mode change Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 084/312] net/mlx5: Add timeout handle to commands with callback Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 085/312] net/mlx5: Fix pci error recovery flow Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 086/312] net/mlx5e: Copy all L2 headers into inline segment Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 087/312] net_sched: keep backlog updated with qlen Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 088/312] sch_drr: update backlog as well Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 089/312] sch_hfsc: always keep backlog updated Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 090/312] sch_prio: update backlog as well Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 091/312] sch_qfq: keep backlog updated with qlen Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 092/312] sch_sfb: " Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 093/312] sch_tbf: update backlog as well Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 094/312] btrfs: cleaner_kthread() doesnt need explicit freeze Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 095/312] irda: Free skb on irda_accept error path Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 096/312] phy: fix device reference leaks Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 097/312] bonding: prevent out of bound accesses Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 098/312] mtd: nand: fix ONFI parameter page layout Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 099/312] ath10k: free cached fw bin contents when get board id fails Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 100/312] xprtrdma: checking for NULL instead of IS_ERR() Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 101/312] xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 102/312] xprtrdma: xprt_rdma_free() must not release backchannel reqs Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 103/312] xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 104/312] RDMA/cxgb3: device driver frees DMA memory with different size Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 105/312] mlxsw: spectrum: Dont forward packets when STP state is DISABLED Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 106/312] mlxsw: spectrum: Disable learning according to STP state Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 107/312] mlxsw: spectrum: Dont count internal TX header bytes to stats Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 108/312] mlxsw: spectrum: Indicate support for autonegotiation Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 109/312] mlxsw: spectrum: Fix misuse of hard_header_len Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 110/312] net: tcp_memcontrol: properly detect ancestor socket pressure Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 111/312] tcp: do not set rtt_min to 1 Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 112/312] RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 113/312] net: ipv6: tcp reset, icmp need to consider L3 domain Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 114/312] batman-adv: Fix lockdep annotation of batadv_tlv_container_remove Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 115/312] batman-adv: replace WARN with rate limited output on non-existing VLAN Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 116/312] tty: serial: msm: Support more bauds Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 117/312] serial: samsung: Fix possible out of bounds access on non-DT platform Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 118/312] Drivers: hv: utils: use memdup_user in hvt_op_write Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 119/312] isa: Call isa_bus_init before dependent ISA bus drivers register Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 120/312] Btrfs: clean up an error code in btrfs_init_space_info() Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 121/312] Input: gpio-keys - fix check for disabling unsupported keys Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 122/312] Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 123/312] net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 124/312] xfrm_user: propagate sec ctx allocation errors Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 125/312] xfrm: Fix memory leak of aead algorithm name Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 126/312] mac80211: fix mgmt-tx abort cookie and leak Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 127/312] mac80211: TDLS: always downgrade invalid chandefs Greg Kroah-Hartman
2020-05-08 12:31 ` [PATCH 4.4 128/312] mac80211: TDLS: change BW calculation for WIDER_BW peers Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 129/312] mac80211: Fix BW upgrade for TDLS peers Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 130/312] NFS: Fix an LOCK/OPEN race when unlinking an open file Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 131/312] net: get rid of an signed integer overflow in ip_idents_reserve() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 132/312] mtd: nand: denali: add missing nand_release() call in denali_remove() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 133/312] mtd: nand: pxa3xx_nand: fix dmaengine initialization Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 134/312] ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 135/312] ASoC: tegra_alc5632: check return value Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 136/312] ASoC: fsl_ssi: mark SACNT register volatile Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 137/312] Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()" Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 138/312] mmc: sdhci: restore behavior when setting VDD via external regulator Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 139/312] mmc: sd: limit SD card power limit according to cards capabilities Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 140/312] mmc: debugfs: correct wrong voltage value Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 141/312] mmc: block: return error on failed mmc_blk_get() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 142/312] clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization" Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 143/312] mmc: dw_mmc: rockchip: Set the drive phase properly Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 144/312] mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 145/312] mmc: sdhci: Fix regression setting power on Trats2 board Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 146/312] perf tools: Fix perf regs mask generation Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 147/312] powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 148/312] powerpc/book3s: Fix MCE console messages for unrecoverable MCE Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 149/312] sctp: fix the transports round robin issue when init is retransmitted Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 150/312] sunrpc: Update RPCBIND_MAXNETIDLEN Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 151/312] NFC: nci: memory leak in nci_core_conn_create() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 152/312] net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 153/312] net: phy: Fix phy_mac_interrupt() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 154/312] net: phy: bcm7xxx: Fix shadow mode 2 disabling Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 155/312] of_mdio: fix node leak in of_phy_register_fixed_link error path Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 156/312] phy: micrel: Fix finding PHY properties in MAC node for KSZ9031 Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 157/312] net: dsa: slave: fix of-node leak and phy priority Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 158/312] drivers: net: cpsw: dont ignore phy-mode if phy-handle is used Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 159/312] iommu/dma: Respect IOMMU aperture when allocating Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 160/312] mdio-sun4i: oops in error handling in probe Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 161/312] iio:ad7797: Use correct attribute_group Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 162/312] selftests/ipc: Fix test failure seen after initial test run Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 163/312] wimax/i2400m: Fix potential urb refcnt leak Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 164/312] cifs: protect updating server->dstaddr with a spinlock Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 165/312] scripts/config: allow colons in option strings for sed Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 166/312] lib/mpi: Fix building for powerpc with clang Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 167/312] net: bcmgenet: suppress warnings on failed Rx SKB allocations Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 168/312] net: systemport: " Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 169/312] [media] rc: allow rc modules to be loaded if rc-main is not a module Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 170/312] [media] lirc_imon: do not leave imon_probe() with mutex held Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 171/312] [media] am437x-vpfe: fix an uninitialized variable bug Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 172/312] [media] cx23885: uninitialized variable in cx23885_av_work_handler() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 173/312] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 174/312] VFIO: platform: reset: fix a warning message condition Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 175/312] net: moxa: fix an error code Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 176/312] mfd: lp8788-irq: Uninitialized variable in irq handler Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 177/312] ethernet: micrel: fix some error codes Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 178/312] power: ipaq-micro-battery: freeing the wrong variable Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 179/312] i40e: fix an uninitialized variable bug Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 180/312] qede: uninitialized variable in qede_start_xmit() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 181/312] qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 182/312] qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 183/312] target: Fix a memory leak in target_dev_lba_map_store() Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 184/312] memory/tegra: Add number of TLB lines for Tegra124 Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 185/312] pinctrl: bcm2835: Fix memory leak in error path Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 186/312] be2net: Dont leak iomapped memory on removal Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 187/312] ipv4: Fix memory leak in exception case for splitting tries Greg Kroah-Hartman
2020-05-08 12:32 ` [PATCH 4.4 188/312] flow_dissector: Check for IP fragmentation even if not using IPv4 address Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 189/312] ipv4: fix checksum annotation in udp4_csum_init Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 190/312] ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf() Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 191/312] ipv4: accept u8 in IP_TOS ancillary data Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 192/312] net: vrf: Fix dev refcnt leak due to IPv6 prefix route Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 193/312] ipv6: fix checksum annotation in udp6_csum_init Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 194/312] ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf() Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 195/312] ipv6: add missing netconf notif when all is updated Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 196/312] net: ipv6: Fix processing of RAs in presence of VRF Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 197/312] netfilter: nf_tables: fix a wrong check to skip the inactive rules Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 198/312] netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 199/312] netfilter: nf_tables: destroy the set if fail to add transaction Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 200/312] netfilter: nft_dup: do not use sreg_dev if the user doesnt specify it Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 201/312] udp: restore UDPlite many-cast delivery Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 202/312] clk: st: avoid uninitialized variable use Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 203/312] clk: gpio: handle error codes for of_clk_get_parent_count() Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 204/312] clk: ti: omap3+: dpll: use non-locking version of clk_get_rate Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 205/312] clk: multiplier: Prevent the multiplier from under / over flowing Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 206/312] clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 207/312] clk: xgene: Dont call __pa on ioremaped address Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 208/312] cls_bpf: reset class and reuse major in da Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 209/312] arm64: bpf: jit JMP_JSET_{X,K} Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 210/312] bpf, trace: check event type in bpf_perf_event_read Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 211/312] bpf: fix map not being uncharged during map creation failure Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 212/312] net/mlx4_core: Fix potential corruption in counters database Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 213/312] net/mlx4_core: Fix access to uninitialized index Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 214/312] net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 215/312] net/mlx4_core: Check device state before unregistering it Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 216/312] net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 217/312] net/mlx4_en: Process all completions in RX rings after port goes up Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 218/312] net/mlx4_core: Do not access comm channel if it has not yet been initialized Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 219/312] net/mlx4_en: Fix potential deadlock in port statistics flow Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 220/312] net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 221/312] net/mlx4_core: Fix QUERY FUNC CAP flags Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 222/312] mlxsw: switchx2: Fix misuse of hard_header_len Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 223/312] mlxsw: switchx2: Fix ethernet port initialization Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 224/312] sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 225/312] net_sched: flower: Avoid dissection of unmasked keys Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 226/312] pkt_sched: fq: use proper locking in fq_dump_stats() Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 227/312] sched/preempt: Fix preempt_count manipulations Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 228/312] power: bq27xxx: fix reading for bq27000 and bq27010 Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 229/312] power: bq27xxx: fix register numbers of bq27500 Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 230/312] power: test_power: correctly handle empty writes Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 231/312] power: bq27xxx_battery: Fix bq27541 AveragePower register address Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 232/312] power_supply: tps65217-charger: Fix NULL deref during property export Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 233/312] net: vrf: Fix dst reference counting Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 234/312] net: Dont delete routes in different VRFs Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 235/312] vti6: fix input path Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 236/312] ipv4: Fix table id reference in fib_sync_down_addr Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 237/312] mlx4: do not call napi_schedule() without care Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 238/312] xprtrdma: Fix backchannel allocation of extra rpcrdma_reps Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 239/312] ALSA: fm801: Initialize chip after IRQ handler is registered Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 240/312] bonding: fix length of actor system Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 241/312] MIPS: perf: Remove incorrect odd/even counter handling for I6400 Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 242/312] Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT" Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 243/312] net: dsa: mv88e6xxx: unlock DSA and CPU ports Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 244/312] gfs2: fix flock panic issue Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 245/312] blk-mq: fix undefined behaviour in order_to_size() Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 246/312] dm: fix second blk_delay_queue() parameter to be in msec units not jiffies Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 247/312] dmaengine: edma: Add probe callback to edma_tptc_driver Greg Kroah-Hartman
2020-05-08 12:33 ` [PATCH 4.4 248/312] spi: rockchip: modify DMA max burst to 1 Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 249/312] openvswitch: update checksum in {push,pop}_mpls Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 250/312] cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 251/312] net: bcmgenet: fix skb_len in bcmgenet_xmit_single() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 252/312] net: bcmgenet: device stats are unsigned long Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 253/312] ovs/gre: fix rtnl notifications on iface deletion Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 254/312] gre: do not assign header_ops in collect metadata mode Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 255/312] gre: build header correctly for collect metadata tunnels Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 256/312] gre: reject GUE and FOU in collect metadata mode Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 257/312] sfc: fix potential stack corruption from running past stat bitmask Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 258/312] sfc: clear napi_hash state when copying channels Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 259/312] net: bcmsysport: Device stats are unsigned long Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 260/312] cxgbi: fix uninitialized flowi6 Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 261/312] net: macb: add missing free_netdev() on error in macb_probe() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 262/312] macvtap: segmented packet is consumed Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 263/312] tipc: fix the error handling in tipc_udp_enable() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 264/312] net: icmp6_send should use dst dev to determine L3 domain Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 265/312] et131x: Fix logical vs bitwise check in et131x_tx_timeout() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 266/312] net: ethernet: stmmac: dwmac-sti: fix probe error path Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 267/312] rtnl: reset calcit fptr in rtnl_unregister() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 268/312] net: ethernet: stmmac: dwmac-rk: fix probe error path Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 269/312] fq_codel: return non zero qlen in class dumps Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 270/312] net: ethernet: stmmac: dwmac-generic: fix probe error path Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 271/312] ovs/geneve: fix rtnl notifications on iface deletion Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 272/312] bnxt: add a missing rcu synchronization Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 273/312] qdisc: fix a module refcount leak in qdisc_create_dflt() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 274/312] net: axienet: Fix return value check in axienet_probe() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 275/312] bnxt_en: Remove locking around txr->dev_state Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 276/312] net: ethernet: davinci_emac: Fix devioctl while in fixed link Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 277/312] net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 278/312] net: ethernet: ti: cpsw: fix device and of_node leaks Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 279/312] net: ethernet: ti: cpsw: fix secondary-emac probe error path Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 280/312] net: hns: fix device reference leaks Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 281/312] net: bridge: dont increment tx_dropped in br_do_proxy_arp Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 282/312] net: dsa: mv88e6xxx: enable SA learning on DSA ports Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 283/312] net: ehea: avoid null pointer dereference Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 284/312] l2tp: fix use-after-free during module unload Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 285/312] hwrng: exynos - Disable runtime PM on driver unbind Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 286/312] net: icmp_route_lookup should use rt dev to determine L3 domain Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 287/312] net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 288/312] net: macb: replace macb_writel() call by queue_writel() to update queue ISR Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 289/312] ravb: Add missing free_irq() call to ravb_close() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 290/312] mvpp2: use correct size for memset Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 291/312] net: vxlan: lwt: Fix vxlan local traffic Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 292/312] net: ethoc: Fix early error paths Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 293/312] ovs/vxlan: fix rtnl notifications on iface deletion Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 294/312] net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 295/312] regulator: core: Rely on regulator_dev_release to free constraints Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 296/312] net: dsa: mv88e6xxx: fix port VLAN maps Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 297/312] at803x: fix reset handling Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 298/312] regulator: Try to resolve regulators supplies on registration Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 299/312] cxl: Fix DAR check & use REGION_ID instead of opencoding Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 300/312] net: ethernet: davinci_emac: Fix platform_data overwrite Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 301/312] ata: sata_dwc_460ex: remove incorrect locking Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 302/312] pinctrl: tegra: Correctly check the supported configuration Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 303/312] brcmfmac: add fallback for devices that do not report per-chain values Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 304/312] brcmfmac: restore stopping netdev queue when bus clogs up Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 305/312] bridge: Fix problems around fdb entries pointing to the bridge device Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 306/312] bna: add missing per queue ethtool stat Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 307/312] net: skbuff: Remove errornous length validation in skb_vlan_pop() Greg Kroah-Hartman
2020-05-08 12:34 ` [PATCH 4.4 308/312] net: ep93xx_eth: Do not crash unloading module Greg Kroah-Hartman
2020-05-08 12:35 ` [PATCH 4.4 309/312] macvlan: Fix potential use-after free for broadcasts Greg Kroah-Hartman
2020-05-08 12:35 ` [PATCH 4.4 310/312] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case Greg Kroah-Hartman
2020-05-08 12:35 ` [PATCH 4.4 311/312] ALSA: hda: Match both PCI ID and SSID for driver blacklist Greg Kroah-Hartman
2020-05-08 12:35 ` [PATCH 4.4 312/312] mac80211: add ieee80211_is_any_nullfunc() Greg Kroah-Hartman
2020-05-08 13:37 ` [PATCH 4.4 000/312] 4.4.223-rc1 review Guenter Roeck
2020-05-08 13:44   ` Greg Kroah-Hartman
2020-05-08 13:54     ` Guenter Roeck
2020-05-08 14:26       ` Greg Kroah-Hartman
2020-05-08 13:38 ` Naresh Kamboju
2020-05-08 13:44   ` Greg Kroah-Hartman

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).