]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.14
authorSasha Levin <sashal@kernel.org>
Mon, 12 Apr 2021 03:51:17 +0000 (23:51 -0400)
committerSasha Levin <sashal@kernel.org>
Mon, 12 Apr 2021 03:51:17 +0000 (23:51 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
17 files changed:
queue-4.14/amd-xgbe-update-dma-coherency-values.patch [new file with mode: 0644]
queue-4.14/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch [new file with mode: 0644]
queue-4.14/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch [new file with mode: 0644]
queue-4.14/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch [new file with mode: 0644]
queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-register.patch [new file with mode: 0644]
queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch [new file with mode: 0644]
queue-4.14/gianfar-handle-error-code-at-mac-address-change.patch [new file with mode: 0644]
queue-4.14/net-mlx5-fix-placement-of-log_max_flow_counter.patch [new file with mode: 0644]
queue-4.14/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch [new file with mode: 0644]
queue-4.14/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch [new file with mode: 0644]
queue-4.14/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch [new file with mode: 0644]
queue-4.14/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch [new file with mode: 0644]
queue-4.14/s390-cpcmd-fix-inline-assembly-register-clobbering.patch [new file with mode: 0644]
queue-4.14/sch_red-fix-off-by-one-checks-in-red_check_params.patch [new file with mode: 0644]
queue-4.14/series
queue-4.14/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch [new file with mode: 0644]
queue-4.14/workqueue-move-the-position-of-debug_work_activate-i.patch [new file with mode: 0644]

diff --git a/queue-4.14/amd-xgbe-update-dma-coherency-values.patch b/queue-4.14/amd-xgbe-update-dma-coherency-values.patch
new file mode 100644 (file)
index 0000000..3894fd1
--- /dev/null
@@ -0,0 +1,42 @@
+From 92df72aae5f718e3b9f65fdeb9735018fdb539f8 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 08:39:12 +0530
+Subject: amd-xgbe: Update DMA coherency values
+
+From: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+
+[ Upstream commit d75135082698140a26a56defe1bbc1b06f26a41f ]
+
+Based on the IOMMU configuration, the current cache control settings can
+result in possible coherency issues. The hardware team has recommended
+new settings for the PCI device path to eliminate the issue.
+
+Fixes: 6f595959c095 ("amd-xgbe: Adjust register settings to improve performance")
+Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
+Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/xgbe/xgbe.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index 95d4b56448c6..cd0459b0055b 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -176,9 +176,9 @@
+ #define XGBE_DMA_SYS_AWCR     0x30303030
+ /* DMA cache settings - PCI device */
+-#define XGBE_DMA_PCI_ARCR     0x00000003
+-#define XGBE_DMA_PCI_AWCR     0x13131313
+-#define XGBE_DMA_PCI_AWARCR   0x00000313
++#define XGBE_DMA_PCI_ARCR     0x000f0f0f
++#define XGBE_DMA_PCI_AWCR     0x0f0f0f0f
++#define XGBE_DMA_PCI_AWARCR   0x00000f0f
+ /* DMA channel interrupt modes */
+ #define XGBE_IRQ_MODE_EDGE    0
+-- 
+2.30.2
+
diff --git a/queue-4.14/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch b/queue-4.14/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch
new file mode 100644 (file)
index 0000000..e76d2b9
--- /dev/null
@@ -0,0 +1,45 @@
+From e02a98d3040e5e300b859a7f3f3f50b7a8edd814 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 15:01:03 +0200
+Subject: ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces
+
+From: Stefan Riedmueller <s.riedmueller@phytec.de>
+
+[ Upstream commit f57011e72f5fe0421ec7a812beb1b57bdf4bb47f ]
+
+Setting the vmmc supplies is crucial since otherwise the supplying
+regulators get disabled and the SD interfaces are no longer powered
+which leads to system failures if the system is booted from that SD
+interface.
+
+Fixes: 1e44d3f880d5 ("ARM i.MX6Q: dts: Enable I2C1 with EEPROM and PMIC on Phytec phyFLEX-i.MX6 Ouad module")
+Signed-off-by: Stefan Riedmueller <s.riedmueller@phytec.de>
+Reviewed-by: Fabio Estevam <festevam@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+index 25b0704c6054..d2c31eae9fef 100644
+--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi
+@@ -423,6 +423,7 @@
+       pinctrl-0 = <&pinctrl_usdhc2>;
+       cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>;
+       wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>;
++      vmmc-supply = <&vdd_sd1_reg>;
+       status = "disabled";
+ };
+@@ -432,5 +433,6 @@
+                    &pinctrl_usdhc3_cdwp>;
+       cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
+       wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>;
++      vmmc-supply = <&vdd_sd0_reg>;
+       status = "disabled";
+ };
+-- 
+2.30.2
+
diff --git a/queue-4.14/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch b/queue-4.14/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch
new file mode 100644 (file)
index 0000000..f50dd7d
--- /dev/null
@@ -0,0 +1,83 @@
+From 847a6b33b79d34f94e15996f80645e4b2d9d7cd7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 17:18:43 +0200
+Subject: ASoC: sunxi: sun4i-codec: fill ASoC card owner
+
+From: Bastian Germann <bage@linutronix.de>
+
+[ Upstream commit 7c0d6e482062eb5c06ecccfab340abc523bdca00 ]
+
+card->owner is a required property and since commit 81033c6b584b ("ALSA:
+core: Warn on empty module") a warning is issued if it is empty. Add it.
+This fixes following warning observed on Lamobo R1:
+
+WARNING: CPU: 1 PID: 190 at sound/core/init.c:207 snd_card_new+0x430/0x480 [snd]
+Modules linked in: sun4i_codec(E+) sun4i_backend(E+) snd_soc_core(E) ...
+CPU: 1 PID: 190 Comm: systemd-udevd Tainted: G         C  E     5.10.0-1-armmp #1 Debian 5.10.4-1
+Hardware name: Allwinner sun7i (A20) Family
+Call trace:
+ (snd_card_new [snd])
+ (snd_soc_bind_card [snd_soc_core])
+ (snd_soc_register_card [snd_soc_core])
+ (sun4i_codec_probe [sun4i_codec])
+
+Fixes: 45fb6b6f2aa3 ("ASoC: sunxi: add support for the on-chip codec on early Allwinner SoCs")
+Related: commit 3c27ea23ffb4 ("ASoC: qcom: Set card->owner to avoid warnings")
+Related: commit ec653df2a0cb ("drm/vc4/vc4_hdmi: fill ASoC card owner")
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: alsa-devel@alsa-project.org
+Signed-off-by: Bastian Germann <bage@linutronix.de>
+Link: https://lore.kernel.org/r/20210331151843.30583-1-bage@linutronix.de
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/sunxi/sun4i-codec.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c
+index baa9007464ed..700779ca82d0 100644
+--- a/sound/soc/sunxi/sun4i-codec.c
++++ b/sound/soc/sunxi/sun4i-codec.c
+@@ -1199,6 +1199,7 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev)
+               return ERR_PTR(-ENOMEM);
+       card->dev               = dev;
++      card->owner             = THIS_MODULE;
+       card->name              = "sun4i-codec";
+       card->dapm_widgets      = sun4i_codec_card_dapm_widgets;
+       card->num_dapm_widgets  = ARRAY_SIZE(sun4i_codec_card_dapm_widgets);
+@@ -1231,6 +1232,7 @@ static struct snd_soc_card *sun6i_codec_create_card(struct device *dev)
+               return ERR_PTR(-ENOMEM);
+       card->dev               = dev;
++      card->owner             = THIS_MODULE;
+       card->name              = "A31 Audio Codec";
+       card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
+       card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1284,6 +1286,7 @@ static struct snd_soc_card *sun8i_a23_codec_create_card(struct device *dev)
+               return ERR_PTR(-ENOMEM);
+       card->dev               = dev;
++      card->owner             = THIS_MODULE;
+       card->name              = "A23 Audio Codec";
+       card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
+       card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1322,6 +1325,7 @@ static struct snd_soc_card *sun8i_h3_codec_create_card(struct device *dev)
+               return ERR_PTR(-ENOMEM);
+       card->dev               = dev;
++      card->owner             = THIS_MODULE;
+       card->name              = "H3 Audio Codec";
+       card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
+       card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+@@ -1360,6 +1364,7 @@ static struct snd_soc_card *sun8i_v3s_codec_create_card(struct device *dev)
+               return ERR_PTR(-ENOMEM);
+       card->dev               = dev;
++      card->owner             = THIS_MODULE;
+       card->name              = "V3s Audio Codec";
+       card->dapm_widgets      = sun6i_codec_card_dapm_widgets;
+       card->num_dapm_widgets  = ARRAY_SIZE(sun6i_codec_card_dapm_widgets);
+-- 
+2.30.2
+
diff --git a/queue-4.14/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch b/queue-4.14/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch
new file mode 100644 (file)
index 0000000..f8657ab
--- /dev/null
@@ -0,0 +1,54 @@
+From 4cda41c5e46a990321c733720c53486061991bc4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 19 Mar 2021 18:48:46 +0800
+Subject: ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some
+ chips
+
+From: Shengjiu Wang <shengjiu.wang@nxp.com>
+
+[ Upstream commit 16b82e75c15a7dbd564ea3654f3feb61df9e1e6f ]
+
+The input MCLK is 12.288MHz, the desired output sysclk is 11.2896MHz
+and sample rate is 44100Hz, with the configuration pllprescale=2,
+postscale=sysclkdiv=1, some chip may have wrong bclk
+and lrclk output with pll enabled in master mode, but with the
+configuration pllprescale=1, postscale=2, the output clock is correct.
+
+>From Datasheet, the PLL performs best when f2 is between
+90MHz and 100MHz when the desired sysclk output is 11.2896MHz
+or 12.288MHz, so sysclkdiv = 2 (f2/8) is the best choice.
+
+So search available sysclk_divs from 2 to 1 other than from 1 to 2.
+
+Fixes: 84fdc00d519f ("ASoC: codec: wm9860: Refactor PLL out freq search")
+Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
+Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
+Link: https://lore.kernel.org/r/1616150926-22892-1-git-send-email-shengjiu.wang@nxp.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/soc/codecs/wm8960.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 9ed455700954..228ab7bd314d 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -710,7 +710,13 @@ int wm8960_configure_pll(struct snd_soc_codec *codec, int freq_in,
+       best_freq_out = -EINVAL;
+       *sysclk_idx = *dac_idx = *bclk_idx = -1;
+-      for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) {
++      /*
++       * From Datasheet, the PLL performs best when f2 is between
++       * 90MHz and 100MHz, the desired sysclk output is 11.2896MHz
++       * or 12.288MHz, then sysclkdiv = 2 is the best choice.
++       * So search sysclk_divs from 2 to 1 other than from 1 to 2.
++       */
++      for (i = ARRAY_SIZE(sysclk_divs) - 1; i >= 0; --i) {
+               if (sysclk_divs[i] == -1)
+                       continue;
+               for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) {
+-- 
+2.30.2
+
diff --git a/queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-register.patch b/queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-register.patch
new file mode 100644 (file)
index 0000000..e1c78f2
--- /dev/null
@@ -0,0 +1,88 @@
+From 5f806dbaf7c06e8c19d7511edace9cfb688997c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 00:51:48 +0200
+Subject: clk: fix invalid usage of list cursor in register
+
+From: Lukasz Bartosik <lb@semihalf.com>
+
+[ Upstream commit 8d3c0c01cb2e36b2bf3c06a82b18b228d0c8f5d0 ]
+
+Fix invalid usage of a list_for_each_entry cursor in
+clk_notifier_register(). When list is empty or if the list
+is completely traversed (without breaking from the loop on one
+of the entries) then the list cursor does not point to a valid
+entry and therefore should not be used.
+
+The issue was dicovered when running 5.12-rc1 kernel on x86_64
+with KASAN enabled:
+BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
+Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
+
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
+Hardware name: Google Caroline/Caroline,
+BIOS Google_Caroline.7820.430.0 07/20/2018
+Call Trace:
+ dump_stack+0xee/0x15c
+ print_address_description+0x1e/0x2dc
+ kasan_report+0x188/0x1ce
+ ? clk_notifier_register+0xab/0x230
+ ? clk_prepare_lock+0x15/0x7b
+ ? clk_notifier_register+0xab/0x230
+ clk_notifier_register+0xab/0x230
+ dw8250_probe+0xc01/0x10d4
+...
+Memory state around the buggy address:
+ ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
+>ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
+                      ^
+ ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
+ ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
+ ==================================================================
+
+Fixes: b2476490ef11 ("clk: introduce the common clock framework")
+Reported-by: Lukasz Majczak <lma@semihalf.com>
+Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
+Link: https://lore.kernel.org/r/20210401225149.18826-1-lb@semihalf.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 17 ++++++++---------
+ 1 file changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index 4289c519af1b..a0807482ebce 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3018,20 +3018,19 @@ int clk_notifier_register(struct clk *clk, struct notifier_block *nb)
+       /* search the list of notifiers for this clk */
+       list_for_each_entry(cn, &clk_notifier_list, node)
+               if (cn->clk == clk)
+-                      break;
++                      goto found;
+       /* if clk wasn't in the notifier list, allocate new clk_notifier */
+-      if (cn->clk != clk) {
+-              cn = kzalloc(sizeof(*cn), GFP_KERNEL);
+-              if (!cn)
+-                      goto out;
++      cn = kzalloc(sizeof(*cn), GFP_KERNEL);
++      if (!cn)
++              goto out;
+-              cn->clk = clk;
+-              srcu_init_notifier_head(&cn->notifier_head);
++      cn->clk = clk;
++      srcu_init_notifier_head(&cn->notifier_head);
+-              list_add(&cn->node, &clk_notifier_list);
+-      }
++      list_add(&cn->node, &clk_notifier_list);
++found:
+       ret = srcu_notifier_chain_register(&cn->notifier_head, nb);
+       clk->core->notifier_count++;
+-- 
+2.30.2
+
diff --git a/queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch b/queue-4.14/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch
new file mode 100644 (file)
index 0000000..b4ac7c9
--- /dev/null
@@ -0,0 +1,107 @@
+From 2734dda28b6eba40d66bbad4da452a081c99b720 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 2 Apr 2021 00:51:49 +0200
+Subject: clk: fix invalid usage of list cursor in unregister
+
+From: Lukasz Bartosik <lb@semihalf.com>
+
+[ Upstream commit 7045465500e465b09f09d6e5bdc260a9f1aab97b ]
+
+Fix invalid usage of a list_for_each_entry cursor in
+clk_notifier_unregister(). When list is empty or if the list
+is completely traversed (without breaking from the loop on one
+of the entries) then the list cursor does not point to a valid
+entry and therefore should not be used. The patch fixes a logical
+bug that hasn't been seen in pratice however it is analogus
+to the bug fixed in clk_notifier_register().
+
+The issue was dicovered when running 5.12-rc1 kernel on x86_64
+with KASAN enabled:
+BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230
+Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1
+
+CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1
+Hardware name: Google Caroline/Caroline,
+BIOS Google_Caroline.7820.430.0 07/20/2018
+Call Trace:
+ dump_stack+0xee/0x15c
+ print_address_description+0x1e/0x2dc
+ kasan_report+0x188/0x1ce
+ ? clk_notifier_register+0xab/0x230
+ ? clk_prepare_lock+0x15/0x7b
+ ? clk_notifier_register+0xab/0x230
+ clk_notifier_register+0xab/0x230
+ dw8250_probe+0xc01/0x10d4
+ ...
+ Memory state around the buggy address:
+  ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00
+  ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9
+ >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
+                          ^
+  ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
+  ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
+  ==================================================================
+
+Fixes: b2476490ef11 ("clk: introduce the common clock framework")
+Reported-by: Lukasz Majczak <lma@semihalf.com>
+Signed-off-by: Lukasz Bartosik <lb@semihalf.com>
+Link: https://lore.kernel.org/r/20210401225149.18826-2-lb@semihalf.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/clk/clk.c | 30 +++++++++++++-----------------
+ 1 file changed, 13 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
+index a0807482ebce..971a9a5006af 100644
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3055,32 +3055,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register);
+  */
+ int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb)
+ {
+-      struct clk_notifier *cn = NULL;
+-      int ret = -EINVAL;
++      struct clk_notifier *cn;
++      int ret = -ENOENT;
+       if (!clk || !nb)
+               return -EINVAL;
+       clk_prepare_lock();
+-      list_for_each_entry(cn, &clk_notifier_list, node)
+-              if (cn->clk == clk)
+-                      break;
+-
+-      if (cn->clk == clk) {
+-              ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
++      list_for_each_entry(cn, &clk_notifier_list, node) {
++              if (cn->clk == clk) {
++                      ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb);
+-              clk->core->notifier_count--;
++                      clk->core->notifier_count--;
+-              /* XXX the notifier code should handle this better */
+-              if (!cn->notifier_head.head) {
+-                      srcu_cleanup_notifier_head(&cn->notifier_head);
+-                      list_del(&cn->node);
+-                      kfree(cn);
++                      /* XXX the notifier code should handle this better */
++                      if (!cn->notifier_head.head) {
++                              srcu_cleanup_notifier_head(&cn->notifier_head);
++                              list_del(&cn->node);
++                              kfree(cn);
++                      }
++                      break;
+               }
+-
+-      } else {
+-              ret = -ENOENT;
+       }
+       clk_prepare_unlock();
+-- 
+2.30.2
+
diff --git a/queue-4.14/gianfar-handle-error-code-at-mac-address-change.patch b/queue-4.14/gianfar-handle-error-code-at-mac-address-change.patch
new file mode 100644 (file)
index 0000000..cc2ee9f
--- /dev/null
@@ -0,0 +1,39 @@
+From 13d2a66f67d23030b5a46240ce955a85b93f3148 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 17:08:47 +0300
+Subject: gianfar: Handle error code at MAC address change
+
+From: Claudiu Manoil <claudiu.manoil@nxp.com>
+
+[ Upstream commit bff5b62585123823842833ab20b1c0a7fa437f8c ]
+
+Handle return error code of eth_mac_addr();
+
+Fixes: 3d23a05c75c7 ("gianfar: Enable changing mac addr when if up")
+Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/freescale/gianfar.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index b3b7b98eb32c..c89a5a80c9c8 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -485,7 +485,11 @@ static struct net_device_stats *gfar_get_stats(struct net_device *dev)
+ static int gfar_set_mac_addr(struct net_device *dev, void *p)
+ {
+-      eth_mac_addr(dev, p);
++      int ret;
++
++      ret = eth_mac_addr(dev, p);
++      if (ret)
++              return ret;
+       gfar_set_mac_for_addr(dev, 0, dev->dev_addr);
+-- 
+2.30.2
+
diff --git a/queue-4.14/net-mlx5-fix-placement-of-log_max_flow_counter.patch b/queue-4.14/net-mlx5-fix-placement-of-log_max_flow_counter.patch
new file mode 100644 (file)
index 0000000..0361815
--- /dev/null
@@ -0,0 +1,44 @@
+From 103c2bb03ef67dd7aabc5156421adff9bd58bac3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 21 Jan 2021 16:01:37 +0200
+Subject: net/mlx5: Fix placement of log_max_flow_counter
+
+From: Raed Salem <raeds@nvidia.com>
+
+[ Upstream commit a14587dfc5ad2312dabdd42a610d80ecd0dc8bea ]
+
+The cited commit wrongly placed log_max_flow_counter field of
+mlx5_ifc_flow_table_prop_layout_bits, align it to the HW spec intended
+placement.
+
+Fixes: 16f1c5bb3ed7 ("net/mlx5: Check device capability for maximum flow counters")
+Signed-off-by: Raed Salem <raeds@nvidia.com>
+Reviewed-by: Roi Dayan <roid@nvidia.com>
+Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/mlx5/mlx5_ifc.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h
+index 6ffa181598e6..c4b8602ea6f5 100644
+--- a/include/linux/mlx5/mlx5_ifc.h
++++ b/include/linux/mlx5/mlx5_ifc.h
+@@ -324,11 +324,11 @@ struct mlx5_ifc_flow_table_prop_layout_bits {
+       u8         reserved_at_60[0x18];
+       u8         log_max_ft_num[0x8];
+-      u8         reserved_at_80[0x18];
++      u8         reserved_at_80[0x10];
++      u8         log_max_flow_counter[0x8];
+       u8         log_max_destination[0x8];
+-      u8         log_max_flow_counter[0x8];
+-      u8         reserved_at_a8[0x10];
++      u8         reserved_at_a0[0x18];
+       u8         log_max_flow[0x8];
+       u8         reserved_at_c0[0x40];
+-- 
+2.30.2
+
diff --git a/queue-4.14/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch b/queue-4.14/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch
new file mode 100644 (file)
index 0000000..46a327f
--- /dev/null
@@ -0,0 +1,76 @@
+From 86a2441dd24df95ccf777fddfe1a64ebedb2971b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 10:20:39 -0500
+Subject: net/ncsi: Avoid channel_monitor hrtimer deadlock
+
+From: Milton Miller <miltonm@us.ibm.com>
+
+[ Upstream commit 03cb4d05b4ea9a3491674ca40952adb708d549fa ]
+
+Calling ncsi_stop_channel_monitor from channel_monitor is a guaranteed
+deadlock on SMP because stop calls del_timer_sync on the timer that
+invoked channel_monitor as its timer function.
+
+Recognise the inherent race of marking the monitor disabled before
+deleting the timer by just returning if enable was cleared.  After
+a timeout (the default case -- reset to START when response received)
+just mark the monitor.enabled false.
+
+If the channel has an entry on the channel_queue list, or if the
+state is not ACTIVE or INACTIVE, then warn and mark the timer stopped
+and don't restart, as the locking is broken somehow.
+
+Fixes: 0795fb2021f0 ("net/ncsi: Stop monitor if channel times out or is inactive")
+Signed-off-by: Milton Miller <miltonm@us.ibm.com>
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ncsi/ncsi-manage.c | 20 +++++++++++++-------
+ 1 file changed, 13 insertions(+), 7 deletions(-)
+
+diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
+index 28c42b22b748..6b7f9e1f64d3 100644
+--- a/net/ncsi/ncsi-manage.c
++++ b/net/ncsi/ncsi-manage.c
+@@ -203,13 +203,20 @@ static void ncsi_channel_monitor(unsigned long data)
+       monitor_state = nc->monitor.state;
+       spin_unlock_irqrestore(&nc->lock, flags);
+-      if (!enabled || chained) {
+-              ncsi_stop_channel_monitor(nc);
+-              return;
+-      }
++      if (!enabled)
++              return;         /* expected race disabling timer */
++      if (WARN_ON_ONCE(chained))
++              goto bad_state;
++
+       if (state != NCSI_CHANNEL_INACTIVE &&
+           state != NCSI_CHANNEL_ACTIVE) {
+-              ncsi_stop_channel_monitor(nc);
++bad_state:
++              netdev_warn(ndp->ndev.dev,
++                          "Bad NCSI monitor state channel %d 0x%x %s queue\n",
++                          nc->id, state, chained ? "on" : "off");
++              spin_lock_irqsave(&nc->lock, flags);
++              nc->monitor.enabled = false;
++              spin_unlock_irqrestore(&nc->lock, flags);
+               return;
+       }
+@@ -234,10 +241,9 @@ static void ncsi_channel_monitor(unsigned long data)
+                       ndp->flags |= NCSI_DEV_RESHUFFLE;
+               }
+-              ncsi_stop_channel_monitor(nc);
+-
+               ncm = &nc->modes[NCSI_MODE_LINK];
+               spin_lock_irqsave(&nc->lock, flags);
++              nc->monitor.enabled = false;
+               nc->state = NCSI_CHANNEL_INVISIBLE;
+               ncm->data[2] &= ~0x1;
+               spin_unlock_irqrestore(&nc->lock, flags);
+-- 
+2.30.2
+
diff --git a/queue-4.14/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch b/queue-4.14/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch
new file mode 100644 (file)
index 0000000..ab834e8
--- /dev/null
@@ -0,0 +1,44 @@
+From 9ebd733d6aee10847e3007ce37f2661c3cf3750e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 28 Mar 2021 00:30:29 -0700
+Subject: net:tipc: Fix a double free in tipc_sk_mcast_rcv
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+[ Upstream commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046 ]
+
+In the if(skb_peek(arrvq) == skb) branch, it calls __skb_dequeue(arrvq) to get
+the skb by skb = skb_peek(arrvq). Then __skb_dequeue() unlinks the skb from arrvq
+and returns the skb which equals to skb_peek(arrvq). After __skb_dequeue(arrvq)
+finished, the skb is freed by kfree_skb(__skb_dequeue(arrvq)) in the first time.
+
+Unfortunately, the same skb is freed in the second time by kfree_skb(skb) after
+the branch completed.
+
+My patch removes kfree_skb() in the if(skb_peek(arrvq) == skb) branch, because
+this skb will be freed by kfree_skb(skb) finally.
+
+Fixes: cb1b728096f54 ("tipc: eliminate race condition at multicast reception")
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/tipc/socket.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index 44ede9ab7898..6fd5e1a7a336 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -840,7 +840,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq,
+               spin_lock_bh(&inputq->lock);
+               if (skb_peek(arrvq) == skb) {
+                       skb_queue_splice_tail_init(&tmpq, inputq);
+-                      kfree_skb(__skb_dequeue(arrvq));
++                      __skb_dequeue(arrvq);
+               }
+               spin_unlock_bh(&inputq->lock);
+               __skb_queue_purge(&tmpq);
+-- 
+2.30.2
+
diff --git a/queue-4.14/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch b/queue-4.14/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch
new file mode 100644 (file)
index 0000000..f159815
--- /dev/null
@@ -0,0 +1,39 @@
+From 8dc4585ab35cbed4e6557bc7439c5e50ce79e235 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 31 Mar 2021 19:27:15 +0530
+Subject: RDMA/cxgb4: check for ipv6 address properly while destroying listener
+
+From: Potnuri Bharat Teja <bharat@chelsio.com>
+
+[ Upstream commit 603c4690b01aaffe3a6c3605a429f6dac39852ae ]
+
+ipv6 bit is wrongly set by the below which causes fatal adapter lookup
+engine errors for ipv4 connections while destroying a listener.  Fix it to
+properly check the local address for ipv6.
+
+Fixes: 3408be145a5d ("RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server")
+Link: https://lore.kernel.org/r/20210331135715.30072-1-bharat@chelsio.com
+Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/cxgb4/cm.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
+index 72e2031993fb..2ea87fe1184d 100644
+--- a/drivers/infiniband/hw/cxgb4/cm.c
++++ b/drivers/infiniband/hw/cxgb4/cm.c
+@@ -3498,7 +3498,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id)
+               c4iw_init_wr_wait(&ep->com.wr_wait);
+               err = cxgb4_remove_server(
+                               ep->com.dev->rdev.lldi.ports[0], ep->stid,
+-                              ep->com.dev->rdev.lldi.rxq_ids[0], true);
++                              ep->com.dev->rdev.lldi.rxq_ids[0],
++                              ep->com.local_addr.ss_family == AF_INET6);
+               if (err)
+                       goto done;
+               err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait,
+-- 
+2.30.2
+
diff --git a/queue-4.14/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch b/queue-4.14/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch
new file mode 100644 (file)
index 0000000..04378de
--- /dev/null
@@ -0,0 +1,50 @@
+From a4458acaa09675ca268856b2c5afaf99250ebeda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 12 Mar 2021 14:02:40 +0100
+Subject: regulator: bd9571mwv: Fix AVS and DVFS voltage range
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+[ Upstream commit 3b6e7088afc919f5b52e4d2de8501ad34d35b09b ]
+
+According to Table 30 ("DVFS_MoniVDAC [6:0] Setting Table") in the
+BD9571MWV-M Datasheet Rev. 002, the valid voltage range is 600..1100 mV
+(settings 0x3c..0x6e).  While the lower limit is taken into account (by
+setting regulator_desc.linear_min_sel to 0x3c), the upper limit is not.
+
+Fix this by reducing regulator_desc.n_voltages from 0x80 to 0x6f.
+
+Fixes: e85c5a153fe237f2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210312130242.3390038-2-geert+renesas@glider.be
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/regulator/bd9571mwv-regulator.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/regulator/bd9571mwv-regulator.c b/drivers/regulator/bd9571mwv-regulator.c
+index c67a83d53c4c..167c05029f9e 100644
+--- a/drivers/regulator/bd9571mwv-regulator.c
++++ b/drivers/regulator/bd9571mwv-regulator.c
+@@ -119,7 +119,7 @@ static struct regulator_ops vid_ops = {
+ static struct regulator_desc regulators[] = {
+       BD9571MWV_REG("VD09", "vd09", VD09, avs_ops, 0, 0x7f,
+-                    0x80, 600000, 10000, 0x3c),
++                    0x6f, 600000, 10000, 0x3c),
+       BD9571MWV_REG("VD18", "vd18", VD18, vid_ops, BD9571MWV_VD18_VID, 0xf,
+                     16, 1625000, 25000, 0),
+       BD9571MWV_REG("VD25", "vd25", VD25, vid_ops, BD9571MWV_VD25_VID, 0xf,
+@@ -128,7 +128,7 @@ static struct regulator_desc regulators[] = {
+                     11, 2800000, 100000, 0),
+       BD9571MWV_REG("DVFS", "dvfs", DVFS, reg_ops,
+                     BD9571MWV_DVFS_MONIVDAC, 0x7f,
+-                    0x80, 600000, 10000, 0x3c),
++                    0x6f, 600000, 10000, 0x3c),
+ };
+ static int bd9571mwv_regulator_probe(struct platform_device *pdev)
+-- 
+2.30.2
+
diff --git a/queue-4.14/s390-cpcmd-fix-inline-assembly-register-clobbering.patch b/queue-4.14/s390-cpcmd-fix-inline-assembly-register-clobbering.patch
new file mode 100644 (file)
index 0000000..d742d5e
--- /dev/null
@@ -0,0 +1,46 @@
+From e6c340b7888757e782ea69c25e4d33ebbafa4f57 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 29 Mar 2021 18:35:07 +0200
+Subject: s390/cpcmd: fix inline assembly register clobbering
+
+From: Alexander Gordeev <agordeev@linux.ibm.com>
+
+[ Upstream commit 7a2f91441b2c1d81b77c1cd816a4659f4abc9cbe ]
+
+Register variables initialized using arithmetic. That leads to
+kasan instrumentaton code corrupting the registers contents.
+Follow GCC guidlines and use temporary variables for assigning
+init values to register variables.
+
+Fixes: 94c12cc7d196 ("[S390] Inline assembly cleanup.")
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Acked-by: Ilya Leoshkevich <iii@linux.ibm.com>
+Link: https://gcc.gnu.org/onlinedocs/gcc-10.2.0/gcc/Local-Register-Variables.html
+Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/s390/kernel/cpcmd.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c
+index af013b4244d3..2da027359798 100644
+--- a/arch/s390/kernel/cpcmd.c
++++ b/arch/s390/kernel/cpcmd.c
+@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen)
+ static int diag8_response(int cmdlen, char *response, int *rlen)
+ {
++      unsigned long _cmdlen = cmdlen | 0x40000000L;
++      unsigned long _rlen = *rlen;
+       register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf;
+       register unsigned long reg3 asm ("3") = (addr_t) response;
+-      register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L;
+-      register unsigned long reg5 asm ("5") = *rlen;
++      register unsigned long reg4 asm ("4") = _cmdlen;
++      register unsigned long reg5 asm ("5") = _rlen;
+       asm volatile(
+               "       diag    %2,%0,0x8\n"
+-- 
+2.30.2
+
diff --git a/queue-4.14/sch_red-fix-off-by-one-checks-in-red_check_params.patch b/queue-4.14/sch_red-fix-off-by-one-checks-in-red_check_params.patch
new file mode 100644 (file)
index 0000000..4d18e66
--- /dev/null
@@ -0,0 +1,73 @@
+From 826d585831038b405aa6ed60439bb791dc21f2ad Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Mar 2021 11:14:53 -0700
+Subject: sch_red: fix off-by-one checks in red_check_params()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 3a87571f0ffc51ba3bf3ecdb6032861d0154b164 ]
+
+This fixes following syzbot report:
+
+UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23
+shift exponent 32 is too large for 32-bit type 'unsigned int'
+CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0
+Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
+Call Trace:
+ __dump_stack lib/dump_stack.c:79 [inline]
+ dump_stack+0x141/0x1d7 lib/dump_stack.c:120
+ ubsan_epilogue+0xb/0x5a lib/ubsan.c:148
+ __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327
+ red_set_parms include/net/red.h:237 [inline]
+ choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414
+ qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247
+ tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663
+ rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553
+ netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
+ netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
+ netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
+ netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
+ sock_sendmsg_nosec net/socket.c:654 [inline]
+ sock_sendmsg+0xcf/0x120 net/socket.c:674
+ ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
+ ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
+ __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
+ do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
+ entry_SYSCALL_64_after_hwframe+0x44/0xae
+RIP: 0033:0x43f039
+Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
+RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
+RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039
+RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004
+RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488
+R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0
+R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488
+
+Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: syzbot <syzkaller@googlegroups.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/net/red.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/include/net/red.h b/include/net/red.h
+index 8fe55b8b2fb8..ff07a7cedf68 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -171,9 +171,9 @@ static inline void red_set_vars(struct red_vars *v)
+ static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog,
+                                   u8 Scell_log, u8 *stab)
+ {
+-      if (fls(qth_min) + Wlog > 32)
++      if (fls(qth_min) + Wlog >= 32)
+               return false;
+-      if (fls(qth_max) + Wlog > 32)
++      if (fls(qth_max) + Wlog >= 32)
+               return false;
+       if (Scell_log >= 32)
+               return false;
+-- 
+2.30.2
+
index dbca06d5e4dbaa5dd2bd96c4fa097c4d864e1c80..6288d74ac173e8fbb4ebbfba4635a7935e6619ad 100644 (file)
@@ -19,3 +19,19 @@ usbip-add-sysfs_lock-to-synchronize-sysfs-code-paths.patch
 usbip-stub-dev-synchronize-sysfs-code-paths.patch
 usbip-synchronize-event-handler-with-sysfs-code-paths.patch
 i2c-turn-recovery-error-on-init-to-debug.patch
+regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch
+asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch
+amd-xgbe-update-dma-coherency-values.patch
+sch_red-fix-off-by-one-checks-in-red_check_params.patch
+gianfar-handle-error-code-at-mac-address-change.patch
+net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch
+arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch
+net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch
+asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch
+soc-fsl-qbman-fix-conflicting-alignment-attributes.patch
+clk-fix-invalid-usage-of-list-cursor-in-register.patch
+clk-fix-invalid-usage-of-list-cursor-in-unregister.patch
+workqueue-move-the-position-of-debug_work_activate-i.patch
+s390-cpcmd-fix-inline-assembly-register-clobbering.patch
+net-mlx5-fix-placement-of-log_max_flow_counter.patch
+rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch
diff --git a/queue-4.14/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch b/queue-4.14/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch
new file mode 100644 (file)
index 0000000..7465746
--- /dev/null
@@ -0,0 +1,44 @@
+From 94bc2fce98e0c74735790a9858b105583d82439d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 23 Mar 2021 14:15:23 +0100
+Subject: soc/fsl: qbman: fix conflicting alignment attributes
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 040f31196e8b2609613f399793b9225271b79471 ]
+
+When building with W=1, gcc points out that the __packed attribute
+on struct qm_eqcr_entry conflicts with the 8-byte alignment
+attribute on struct qm_fd inside it:
+
+drivers/soc/fsl/qbman/qman.c:189:1: error: alignment 1 of 'struct qm_eqcr_entry' is less than 8 [-Werror=packed-not-aligned]
+
+I assume that the alignment attribute is the correct one, and
+that qm_eqcr_entry cannot actually be unaligned in memory,
+so add the same alignment on the outer struct.
+
+Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Link: https://lore.kernel.org/r/20210323131530.2619900-1-arnd@kernel.org'
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qbman/qman.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c
+index 90892a360c61..06b6d7afc567 100644
+--- a/drivers/soc/fsl/qbman/qman.c
++++ b/drivers/soc/fsl/qbman/qman.c
+@@ -146,7 +146,7 @@ struct qm_eqcr_entry {
+       __be32 tag;
+       struct qm_fd fd;
+       u8 __reserved3[32];
+-} __packed;
++} __packed __aligned(8);
+ #define QM_EQCR_VERB_VBIT             0x80
+ #define QM_EQCR_VERB_CMD_MASK         0x61    /* but only one value; */
+ #define QM_EQCR_VERB_CMD_ENQUEUE      0x01
+-- 
+2.30.2
+
diff --git a/queue-4.14/workqueue-move-the-position-of-debug_work_activate-i.patch b/queue-4.14/workqueue-move-the-position-of-debug_work_activate-i.patch
new file mode 100644 (file)
index 0000000..b6c3226
--- /dev/null
@@ -0,0 +1,46 @@
+From e70c6ba8741e9966eac5047754796c1c11940016 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 18 Feb 2021 11:16:49 +0800
+Subject: workqueue: Move the position of debug_work_activate() in
+ __queue_work()
+
+From: Zqiang <qiang.zhang@windriver.com>
+
+[ Upstream commit 0687c66b5f666b5ad433f4e94251590d9bc9d10e ]
+
+The debug_work_activate() is called on the premise that
+the work can be inserted, because if wq be in WQ_DRAINING
+status, insert work may be failed.
+
+Fixes: e41e704bc4f4 ("workqueue: improve destroy_workqueue() debuggability")
+Signed-off-by: Zqiang <qiang.zhang@windriver.com>
+Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/workqueue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 79fcec674485..bc32ed4a4cf3 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1379,7 +1379,6 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
+        */
+       WARN_ON_ONCE(!irqs_disabled());
+-      debug_work_activate(work);
+       /* if draining, only works from the same workqueue are allowed */
+       if (unlikely(wq->flags & __WQ_DRAINING) &&
+@@ -1462,6 +1461,7 @@ retry:
+               worklist = &pwq->delayed_works;
+       }
++      debug_work_activate(work);
+       insert_work(pwq, work, worklist, work_flags);
+       spin_unlock(&pwq->pool->lock);
+-- 
+2.30.2
+