--- /dev/null
+From 9c25af250214e45f6d1c21ff6239a1ffeeedf20e Mon Sep 17 00:00:00 2001
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Date: Wed, 13 Jan 2021 17:07:15 +0200
+Subject: ASoC: SOF: Intel: fix page fault at probe if i915 init fails
+
+From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+
+commit 9c25af250214e45f6d1c21ff6239a1ffeeedf20e upstream.
+
+The earlier commit to fix runtime PM in case i915 init fails,
+introduces a possibility to hit a page fault.
+
+snd_hdac_ext_bus_device_exit() is designed to be called from
+dev.release(). Calling it outside device reference counting, is
+not safe and may lead to calling the device_exit() function
+twice. Additionally, as part of ext_bus_device_init(), the device
+is also registered with snd_hdac_device_register(). Thus before
+calling device_exit(), the device must be removed from device
+hierarchy first.
+
+Fix the issue by rolling back init actions by calling
+hdac_device_unregister() and then releasing device with put_device().
+This matches with existing code in hdac-ext module.
+
+To complete the fix, add handling for the case where
+hda_codec_load_module() returns -ENODEV, and clean up the hdac_ext
+resources also in this case.
+
+In future work, hdac-ext interface should be extended to allow clients
+more flexibility to handle the life-cycle of individual devices, beyond
+just the current snd_hdac_ext_bus_device_remove(), which removes all
+devices.
+
+BugLink: https://github.com/thesofproject/linux/issues/2646
+Reported-by: Jaroslav Kysela <perex@perex.cz>
+Fixes: 6c63c954e1c5 ("ASoC: SOF: fix a runtime pm issue in SOF when HDMI codec doesn't work")
+Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
+Reviewed-by: Rander Wang <rander.wang@intel.com>
+Reviewed-by: Libin Yang <libin.yang@intel.com>
+Reviewed-by: Bard Liao <bard.liao@intel.com>
+Link: https://lore.kernel.org/r/20210113150715.3992635-1-kai.vehmanen@linux.intel.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/sof/intel/hda-codec.c | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+--- a/sound/soc/sof/intel/hda-codec.c
++++ b/sound/soc/sof/intel/hda-codec.c
+@@ -156,7 +156,8 @@ static int hda_codec_probe(struct snd_so
+ if (!hdev->bus->audio_component) {
+ dev_dbg(sdev->dev,
+ "iDisp hw present but no driver\n");
+- goto error;
++ ret = -ENOENT;
++ goto out;
+ }
+ hda_priv->need_display_power = true;
+ }
+@@ -173,24 +174,23 @@ static int hda_codec_probe(struct snd_so
+ * other return codes without modification
+ */
+ if (ret == 0)
+- goto error;
++ ret = -ENOENT;
+ }
+
+- return ret;
+-
+-error:
+- snd_hdac_ext_bus_device_exit(hdev);
+- return -ENOENT;
+-
++out:
++ if (ret < 0) {
++ snd_hdac_device_unregister(hdev);
++ put_device(&hdev->dev);
++ }
+ #else
+ hdev = devm_kzalloc(sdev->dev, sizeof(*hdev), GFP_KERNEL);
+ if (!hdev)
+ return -ENOMEM;
+
+ ret = snd_hdac_ext_bus_device_init(&hbus->core, address, hdev, HDA_DEV_ASOC);
++#endif
+
+ return ret;
+-#endif
+ }
+
+ /* Codec initialization */
--- /dev/null
+From db58465f1121086b524be80be39d1fedbe5387f3 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Wed, 20 Jan 2021 16:11:12 +0000
+Subject: cachefiles: Drop superfluous readpages aops NULL check
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit db58465f1121086b524be80be39d1fedbe5387f3 upstream.
+
+After the recent actions to convert readpages aops to readahead, the
+NULL checks of readpages aops in cachefiles_read_or_alloc_page() may
+hit falsely. More badly, it's an ASSERT() call, and this panics.
+
+Drop the superfluous NULL checks for fixing this regression.
+
+[DH: Note that cachefiles never actually used readpages, so this check was
+ never actually necessary]
+
+BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208883
+BugLink: https://bugzilla.opensuse.org/show_bug.cgi?id=1175245
+Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Acked-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/cachefiles/rdwr.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -413,7 +413,6 @@ int cachefiles_read_or_alloc_page(struct
+
+ inode = d_backing_inode(object->backer);
+ ASSERT(S_ISREG(inode->i_mode));
+- ASSERT(inode->i_mapping->a_ops->readpages);
+
+ /* calculate the shift required to use bmap */
+ shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
+@@ -713,7 +712,6 @@ int cachefiles_read_or_alloc_pages(struc
+
+ inode = d_backing_inode(object->backer);
+ ASSERT(S_ISREG(inode->i_mode));
+- ASSERT(inode->i_mapping->a_ops->readpages);
+
+ /* calculate the shift required to use bmap */
+ shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits;
--- /dev/null
+From c96adff95619178e2118925578343ad54857c80c Mon Sep 17 00:00:00 2001
+From: Cong Wang <cong.wang@bytedance.com>
+Date: Fri, 15 Jan 2021 10:50:24 -0800
+Subject: cls_flower: call nla_ok() before nla_next()
+
+From: Cong Wang <cong.wang@bytedance.com>
+
+commit c96adff95619178e2118925578343ad54857c80c upstream.
+
+fl_set_enc_opt() simply checks if there are still bytes left to parse,
+but this is not sufficent as syzbot seems to be able to generate
+malformatted netlink messages. nla_ok() is more strict so should be
+used to validate the next nlattr here.
+
+And nla_validate_nested_deprecated() has less strict check too, it is
+probably too late to switch to the strict version, but we can just
+call nla_ok() too after it.
+
+Reported-and-tested-by: syzbot+2624e3778b18fc497c92@syzkaller.appspotmail.com
+Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
+Fixes: 79b1011cb33d ("net: sched: allow flower to match erspan options")
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Cc: Xin Long <lucien.xin@gmail.com>
+Cc: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: Cong Wang <cong.wang@bytedance.com>
+Link: https://lore.kernel.org/r/20210115185024.72298-1-xiyou.wangcong@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/cls_flower.c | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+--- a/net/sched/cls_flower.c
++++ b/net/sched/cls_flower.c
+@@ -1272,6 +1272,10 @@ static int fl_set_enc_opt(struct nlattr
+
+ nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
+ msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]);
++ if (!nla_ok(nla_opt_msk, msk_depth)) {
++ NL_SET_ERR_MSG(extack, "Invalid nested attribute for masks");
++ return -EINVAL;
++ }
+ }
+
+ nla_for_each_attr(nla_opt_key, nla_enc_key,
+@@ -1307,9 +1311,6 @@ static int fl_set_enc_opt(struct nlattr
+ NL_SET_ERR_MSG(extack, "Key and mask miss aligned");
+ return -EINVAL;
+ }
+-
+- if (msk_depth)
+- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth);
+ break;
+ case TCA_FLOWER_KEY_ENC_OPTS_VXLAN:
+ if (key->enc_opts.dst_opt_type) {
+@@ -1340,9 +1341,6 @@ static int fl_set_enc_opt(struct nlattr
+ NL_SET_ERR_MSG(extack, "Key and mask miss aligned");
+ return -EINVAL;
+ }
+-
+- if (msk_depth)
+- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth);
+ break;
+ case TCA_FLOWER_KEY_ENC_OPTS_ERSPAN:
+ if (key->enc_opts.dst_opt_type) {
+@@ -1373,14 +1371,20 @@ static int fl_set_enc_opt(struct nlattr
+ NL_SET_ERR_MSG(extack, "Key and mask miss aligned");
+ return -EINVAL;
+ }
+-
+- if (msk_depth)
+- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth);
+ break;
+ default:
+ NL_SET_ERR_MSG(extack, "Unknown tunnel option type");
+ return -EINVAL;
+ }
++
++ if (!msk_depth)
++ continue;
++
++ if (!nla_ok(nla_opt_msk, msk_depth)) {
++ NL_SET_ERR_MSG(extack, "A mask attribute is invalid");
++ return -EINVAL;
++ }
++ nla_opt_msk = nla_next(nla_opt_msk, &msk_depth);
+ }
+
+ return 0;
--- /dev/null
+From b3c95d0bdb0855b1f28370629e9eebec6bceac17 Mon Sep 17 00:00:00 2001
+From: Anshuman Gupta <anshuman.gupta@intel.com>
+Date: Mon, 11 Jan 2021 13:41:02 +0530
+Subject: drm/i915/hdcp: Update CP property in update_pipe
+
+From: Anshuman Gupta <anshuman.gupta@intel.com>
+
+commit b3c95d0bdb0855b1f28370629e9eebec6bceac17 upstream.
+
+When crtc state need_modeset is true it is not necessary
+it is going to be a real modeset, it can turns to be a
+fastset instead of modeset.
+This turns content protection property to be DESIRED and hdcp
+update_pipe left with property to be in DESIRED state but
+actual hdcp->value was ENABLED.
+
+This issue is caught with DP MST setup, where we have multiple
+connector in same DP_MST topology. When disabling HDCP on one of
+DP MST connector leads to set the crtc state need_modeset to true
+for all other crtc driving the other DP-MST topology connectors.
+This turns up other DP MST connectors CP property to be DESIRED
+despite the actual hdcp->value is ENABLED.
+Above scenario fails the DP MST HDCP IGT test, disabling HDCP on
+one MST stream should not cause to disable HDCP on another MST
+stream on same DP MST topology.
+
+v2:
+- Fixed connector->base.registration_state == DRM_CONNECTOR_REGISTERED
+ WARN_ON.
+
+v3:
+- Commit log improvement. [Uma]
+- Added a comment before scheduling prop_work. [Uma]
+
+Fixes: 33f9a623bfc6 ("drm/i915/hdcp: Update CP as per the kernel internal state")
+Cc: Ramalingam C <ramalingam.c@intel.com>
+Reviewed-by: Uma Shankar <uma.shankar@intel.com>
+Reviewed-by: Ramalingam C <ramalingam.c@intel.com>
+Tested-by: Karthik B S <karthik.b.s@intel.com>
+Signed-off-by: Anshuman Gupta <anshuman.gupta@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20210111081120.28417-2-anshuman.gupta@intel.com
+(cherry picked from commit d276e16702e2d634094f75f69df3b493f359fe31)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/display/intel_hdcp.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_hdcp.c
++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c
+@@ -2198,6 +2198,14 @@ void intel_hdcp_update_pipe(struct intel
+ desired_and_not_enabled =
+ hdcp->value != DRM_MODE_CONTENT_PROTECTION_ENABLED;
+ mutex_unlock(&hdcp->mutex);
++ /*
++ * If HDCP already ENABLED and CP property is DESIRED, schedule
++ * prop_work to update correct CP property to user space.
++ */
++ if (!desired_and_not_enabled && !content_protection_type_changed) {
++ drm_connector_get(&connector->base);
++ schedule_work(&hdcp->prop_work);
++ }
+ }
+
+ if (desired_and_not_enabled || content_protection_type_changed)
--- /dev/null
+From 97784481757fba7570121a70dd37ca74a29f50a8 Mon Sep 17 00:00:00 2001
+From: Pan Bian <bianpan2016@163.com>
+Date: Wed, 20 Jan 2021 23:22:02 -0800
+Subject: lightnvm: fix memory leak when submit fails
+
+From: Pan Bian <bianpan2016@163.com>
+
+commit 97784481757fba7570121a70dd37ca74a29f50a8 upstream.
+
+The allocated page is not released if error occurs in
+nvm_submit_io_sync_raw(). __free_page() is moved ealier to avoid
+possible memory leak issue.
+
+Fixes: aff3fb18f957 ("lightnvm: move bad block and chunk state logic to core")
+Signed-off-by: Pan Bian <bianpan2016@163.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/lightnvm/core.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/lightnvm/core.c
++++ b/drivers/lightnvm/core.c
+@@ -844,11 +844,10 @@ static int nvm_bb_chunk_sense(struct nvm
+ rqd.ppa_addr = generic_to_dev_addr(dev, ppa);
+
+ ret = nvm_submit_io_sync_raw(dev, &rqd);
++ __free_page(page);
+ if (ret)
+ return ret;
+
+- __free_page(page);
+-
+ return rqd.error;
+ }
+
--- /dev/null
+From 0afda3a888dccf12557b41ef42eee942327d122b Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 6 Jan 2021 15:36:22 +0100
+Subject: locking/lockdep: Cure noinstr fail
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 0afda3a888dccf12557b41ef42eee942327d122b upstream.
+
+When the compiler doesn't feel like inlining, it causes a noinstr
+fail:
+
+ vmlinux.o: warning: objtool: lock_is_held_type()+0xb: call to lockdep_enabled() leaves .noinstr.text section
+
+Fixes: 4d004099a668 ("lockdep: Fix lockdep recursion")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20210106144017.592595176@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/locking/lockdep.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -79,7 +79,7 @@ module_param(lock_stat, int, 0644);
+ DEFINE_PER_CPU(unsigned int, lockdep_recursion);
+ EXPORT_PER_CPU_SYMBOL_GPL(lockdep_recursion);
+
+-static inline bool lockdep_enabled(void)
++static __always_inline bool lockdep_enabled(void)
+ {
+ if (!debug_locks)
+ return false;
--- /dev/null
+From 87fe04367d842c4d97a77303242d4dd4ac351e46 Mon Sep 17 00:00:00 2001
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Date: Sat, 16 Jan 2021 03:39:35 +0100
+Subject: net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
+
+From: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+
+commit 87fe04367d842c4d97a77303242d4dd4ac351e46 upstream.
+
+mv88e6xxx_port_vlan_join checks whether the VTU already contains an
+entry for the given vid (via mv88e6xxx_vtu_getnext), and if so, merely
+changes the relevant .member[] element and loads the updated entry
+into the VTU.
+
+However, at least for the mv88e6250, the on-stack struct
+mv88e6xxx_vtu_entry vlan never has its .state[] array explicitly
+initialized, neither in mv88e6xxx_port_vlan_join() nor inside the
+getnext implementation. So the new entry has random garbage for the
+STU bits, breaking VLAN filtering.
+
+When the VTU entry is initially created, those bits are all zero, and
+we should make sure to keep them that way when the entry is updated.
+
+Fixes: 92307069a96c (net: dsa: mv88e6xxx: Avoid VTU corruption on 6097)
+Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Reviewed-by: Tobias Waldekranz <tobias@waldekranz.com>
+Tested-by: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c
++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c
+@@ -351,6 +351,10 @@ int mv88e6250_g1_vtu_getnext(struct mv88
+ if (err)
+ return err;
+
++ err = mv88e6185_g1_stu_data_read(chip, entry);
++ if (err)
++ return err;
++
+ /* VTU DBNum[3:0] are located in VTU Operation 3:0
+ * VTU DBNum[5:4] are located in VTU Operation 9:8
+ */
--- /dev/null
+From 2e5a6266fbb11ae93c468dfecab169aca9c27b43 Mon Sep 17 00:00:00 2001
+From: Guillaume Nault <gnault@redhat.com>
+Date: Sat, 16 Jan 2021 11:44:26 +0100
+Subject: netfilter: rpfilter: mask ecn bits before fib lookup
+
+From: Guillaume Nault <gnault@redhat.com>
+
+commit 2e5a6266fbb11ae93c468dfecab169aca9c27b43 upstream.
+
+RT_TOS() only masks one of the two ECN bits. Therefore rpfilter_mt()
+treats Not-ECT or ECT(1) packets in a different way than those with
+ECT(0) or CE.
+
+Reproducer:
+
+ Create two netns, connected with a veth:
+ $ ip netns add ns0
+ $ ip netns add ns1
+ $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1
+ $ ip -netns ns0 link set dev veth01 up
+ $ ip -netns ns1 link set dev veth10 up
+ $ ip -netns ns0 address add 192.0.2.10/32 dev veth01
+ $ ip -netns ns1 address add 192.0.2.11/32 dev veth10
+
+ Add a route to ns1 in ns0:
+ $ ip -netns ns0 route add 192.0.2.11/32 dev veth01
+
+ In ns1, only packets with TOS 4 can be routed to ns0:
+ $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10
+
+ Ping from ns0 to ns1 works regardless of the ECN bits, as long as TOS
+ is 4:
+ $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT
+ ... 0% packet loss ...
+ $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1)
+ ... 0% packet loss ...
+ $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0)
+ ... 0% packet loss ...
+ $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE
+ ... 0% packet loss ...
+
+ Now use iptable's rpfilter module in ns1:
+ $ ip netns exec ns1 iptables-legacy -t raw -A PREROUTING -m rpfilter --invert -j DROP
+
+ Not-ECT and ECT(1) packets still pass:
+ $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT
+ ... 0% packet loss ...
+ $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1)
+ ... 0% packet loss ...
+
+ But ECT(0) and ECN packets are dropped:
+ $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0)
+ ... 100% packet loss ...
+ $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE
+ ... 100% packet loss ...
+
+After this patch, rpfilter doesn't drop ECT(0) and CE packets anymore.
+
+Fixes: 8f97339d3feb ("netfilter: add ipv4 reverse path filter match")
+Signed-off-by: Guillaume Nault <gnault@redhat.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/netfilter/ipt_rpfilter.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv4/netfilter/ipt_rpfilter.c
++++ b/net/ipv4/netfilter/ipt_rpfilter.c
+@@ -76,7 +76,7 @@ static bool rpfilter_mt(const struct sk_
+ flow.daddr = iph->saddr;
+ flow.saddr = rpfilter_get_saddr(iph->daddr);
+ flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+- flow.flowi4_tos = RT_TOS(iph->tos);
++ flow.flowi4_tos = iph->tos & IPTOS_RT_MASK;
+ flow.flowi4_scope = RT_SCOPE_UNIVERSE;
+ flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par));
+
--- /dev/null
+From fa0732168fa1369dd089e5b06d6158a68229f7b7 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 20 Jan 2021 09:35:01 +0100
+Subject: nvme-pci: fix error unwind in nvme_map_data
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit fa0732168fa1369dd089e5b06d6158a68229f7b7 upstream.
+
+Properly unwind step by step using refactored helpers from nvme_unmap_data
+to avoid a potential double dma_unmap on a mapping failure.
+
+Fixes: 7fe07d14f71f ("nvme-pci: merge nvme_free_iod into nvme_unmap_data")
+Reported-by: Marc Orr <marcorr@google.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Marc Orr <marcorr@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/pci.c | 28 ++++++++++++++++++----------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -682,7 +682,7 @@ static blk_status_t nvme_pci_setup_prps(
+ __le64 *old_prp_list = prp_list;
+ prp_list = dma_pool_alloc(pool, GFP_ATOMIC, &prp_dma);
+ if (!prp_list)
+- return BLK_STS_RESOURCE;
++ goto free_prps;
+ list[iod->npages++] = prp_list;
+ prp_list[0] = old_prp_list[i - 1];
+ old_prp_list[i - 1] = cpu_to_le64(prp_dma);
+@@ -702,14 +702,14 @@ static blk_status_t nvme_pci_setup_prps(
+ dma_addr = sg_dma_address(sg);
+ dma_len = sg_dma_len(sg);
+ }
+-
+ done:
+ cmnd->dptr.prp1 = cpu_to_le64(sg_dma_address(iod->sg));
+ cmnd->dptr.prp2 = cpu_to_le64(iod->first_dma);
+-
+ return BLK_STS_OK;
+-
+- bad_sgl:
++free_prps:
++ nvme_free_prps(dev, req);
++ return BLK_STS_RESOURCE;
++bad_sgl:
+ WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
+ "Invalid SGL for payload:%d nents:%d\n",
+ blk_rq_payload_bytes(req), iod->nents);
+@@ -781,7 +781,7 @@ static blk_status_t nvme_pci_setup_sgls(
+
+ sg_list = dma_pool_alloc(pool, GFP_ATOMIC, &sgl_dma);
+ if (!sg_list)
+- return BLK_STS_RESOURCE;
++ goto free_sgls;
+
+ i = 0;
+ nvme_pci_iod_list(req)[iod->npages++] = sg_list;
+@@ -794,6 +794,9 @@ static blk_status_t nvme_pci_setup_sgls(
+ } while (--entries > 0);
+
+ return BLK_STS_OK;
++free_sgls:
++ nvme_free_sgls(dev, req);
++ return BLK_STS_RESOURCE;
+ }
+
+ static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev,
+@@ -862,7 +865,7 @@ static blk_status_t nvme_map_data(struct
+ sg_init_table(iod->sg, blk_rq_nr_phys_segments(req));
+ iod->nents = blk_rq_map_sg(req->q, req, iod->sg);
+ if (!iod->nents)
+- goto out;
++ goto out_free_sg;
+
+ if (is_pci_p2pdma_page(sg_page(iod->sg)))
+ nr_mapped = pci_p2pdma_map_sg_attrs(dev->dev, iod->sg,
+@@ -871,16 +874,21 @@ static blk_status_t nvme_map_data(struct
+ nr_mapped = dma_map_sg_attrs(dev->dev, iod->sg, iod->nents,
+ rq_dma_dir(req), DMA_ATTR_NO_WARN);
+ if (!nr_mapped)
+- goto out;
++ goto out_free_sg;
+
+ iod->use_sgl = nvme_pci_use_sgls(dev, req);
+ if (iod->use_sgl)
+ ret = nvme_pci_setup_sgls(dev, req, &cmnd->rw, nr_mapped);
+ else
+ ret = nvme_pci_setup_prps(dev, req, &cmnd->rw);
+-out:
+ if (ret != BLK_STS_OK)
+- nvme_unmap_data(dev, req);
++ goto out_unmap_sg;
++ return BLK_STS_OK;
++
++out_unmap_sg:
++ nvme_unmap_sg(dev, req);
++out_free_sg:
++ mempool_free(iod->sg, dev->iod_mempool);
+ return ret;
+ }
+
--- /dev/null
+From 9275c206f88e5c49cb3e71932c81c8561083db9e Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 20 Jan 2021 09:33:52 +0100
+Subject: nvme-pci: refactor nvme_unmap_data
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 9275c206f88e5c49cb3e71932c81c8561083db9e upstream.
+
+Split out three helpers from nvme_unmap_data that will allow finer grained
+unwinding from nvme_map_data.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Marc Orr <marcorr@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvme/host/pci.c | 77 ++++++++++++++++++++++++++++++------------------
+ 1 file changed, 49 insertions(+), 28 deletions(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -542,50 +542,71 @@ static inline bool nvme_pci_use_sgls(str
+ return true;
+ }
+
+-static void nvme_unmap_data(struct nvme_dev *dev, struct request *req)
++static void nvme_free_prps(struct nvme_dev *dev, struct request *req)
+ {
+- struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+ const int last_prp = NVME_CTRL_PAGE_SIZE / sizeof(__le64) - 1;
+- dma_addr_t dma_addr = iod->first_dma, next_dma_addr;
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
++ dma_addr_t dma_addr = iod->first_dma;
+ int i;
+
+- if (iod->dma_len) {
+- dma_unmap_page(dev->dev, dma_addr, iod->dma_len,
+- rq_dma_dir(req));
+- return;
++ for (i = 0; i < iod->npages; i++) {
++ __le64 *prp_list = nvme_pci_iod_list(req)[i];
++ dma_addr_t next_dma_addr = le64_to_cpu(prp_list[last_prp]);
++
++ dma_pool_free(dev->prp_page_pool, prp_list, dma_addr);
++ dma_addr = next_dma_addr;
+ }
+
+- WARN_ON_ONCE(!iod->nents);
++}
+
+- if (is_pci_p2pdma_page(sg_page(iod->sg)))
+- pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
+- rq_dma_dir(req));
+- else
+- dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req));
++static void nvme_free_sgls(struct nvme_dev *dev, struct request *req)
++{
++ const int last_sg = SGES_PER_PAGE - 1;
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
++ dma_addr_t dma_addr = iod->first_dma;
++ int i;
+
++ for (i = 0; i < iod->npages; i++) {
++ struct nvme_sgl_desc *sg_list = nvme_pci_iod_list(req)[i];
++ dma_addr_t next_dma_addr = le64_to_cpu((sg_list[last_sg]).addr);
+
+- if (iod->npages == 0)
+- dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0],
+- dma_addr);
++ dma_pool_free(dev->prp_page_pool, sg_list, dma_addr);
++ dma_addr = next_dma_addr;
++ }
+
+- for (i = 0; i < iod->npages; i++) {
+- void *addr = nvme_pci_iod_list(req)[i];
++}
+
+- if (iod->use_sgl) {
+- struct nvme_sgl_desc *sg_list = addr;
++static void nvme_unmap_sg(struct nvme_dev *dev, struct request *req)
++{
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+
+- next_dma_addr =
+- le64_to_cpu((sg_list[SGES_PER_PAGE - 1]).addr);
+- } else {
+- __le64 *prp_list = addr;
++ if (is_pci_p2pdma_page(sg_page(iod->sg)))
++ pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
++ rq_dma_dir(req));
++ else
++ dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req));
++}
+
+- next_dma_addr = le64_to_cpu(prp_list[last_prp]);
+- }
++static void nvme_unmap_data(struct nvme_dev *dev, struct request *req)
++{
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+
+- dma_pool_free(dev->prp_page_pool, addr, dma_addr);
+- dma_addr = next_dma_addr;
++ if (iod->dma_len) {
++ dma_unmap_page(dev->dev, iod->first_dma, iod->dma_len,
++ rq_dma_dir(req));
++ return;
+ }
+
++ WARN_ON_ONCE(!iod->nents);
++
++ nvme_unmap_sg(dev, req);
++ if (iod->npages == 0)
++ dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0],
++ iod->first_dma);
++ else if (iod->use_sgl)
++ nvme_free_sgls(dev, req);
++ else
++ nvme_free_prps(dev, req);
+ mempool_free(iod->sg, dev->iod_mempool);
+ }
+
--- /dev/null
+From b7ba6cfabc42fc846eb96e33f1edcd3ea6290a27 Mon Sep 17 00:00:00 2001
+From: Yingjie Wang <wangyingjie55@126.com>
+Date: Fri, 15 Jan 2021 06:10:04 -0800
+Subject: octeontx2-af: Fix missing check bugs in rvu_cgx.c
+
+From: Yingjie Wang <wangyingjie55@126.com>
+
+commit b7ba6cfabc42fc846eb96e33f1edcd3ea6290a27 upstream.
+
+In rvu_mbox_handler_cgx_mac_addr_get()
+and rvu_mbox_handler_cgx_mac_addr_set(),
+the msg is expected only from PFs that are mapped to CGX LMACs.
+It should be checked before mapping,
+so we add the is_cgx_config_permitted() in the functions.
+
+Fixes: 96be2e0da85e ("octeontx2-af: Support for MAC address filters in CGX")
+Signed-off-by: Yingjie Wang <wangyingjie55@126.com>
+Reviewed-by: Geetha sowjanya<gakula@marvell.com>
+Link: https://lore.kernel.org/r/1610719804-35230-1-git-send-email-wangyingjie55@126.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
+@@ -454,6 +454,9 @@ int rvu_mbox_handler_cgx_mac_addr_set(st
+ int pf = rvu_get_pf(req->hdr.pcifunc);
+ u8 cgx_id, lmac_id;
+
++ if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc))
++ return -EPERM;
++
+ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id);
+
+ cgx_lmac_addr_set(cgx_id, lmac_id, req->mac_addr);
+@@ -470,6 +473,9 @@ int rvu_mbox_handler_cgx_mac_addr_get(st
+ int rc = 0, i;
+ u64 cfg;
+
++ if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc))
++ return -EPERM;
++
+ rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id);
+
+ rsp->hdr.rc = rc;
+++ /dev/null
-From f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 Mon Sep 17 00:00:00 2001
-From: John Ogness <john.ogness@linutronix.de>
-Date: Thu, 14 Jan 2021 18:10:12 +0106
-Subject: printk: fix buffer overflow potential for print_text()
-
-From: John Ogness <john.ogness@linutronix.de>
-
-commit f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 upstream.
-
-Before the commit 896fbe20b4e2333fb55 ("printk: use the lockless
-ringbuffer"), msg_print_text() would only write up to size-1 bytes
-into the provided buffer. Some callers expect this behavior and
-append a terminator to returned string. In particular:
-
-arch/powerpc/xmon/xmon.c:dump_log_buf()
-arch/um/kernel/kmsg_dump.c:kmsg_dumper_stdout()
-
-msg_print_text() has been replaced by record_print_text(), which
-currently fills the full size of the buffer. This causes a
-buffer overflow for the above callers.
-
-Change record_print_text() so that it will only use size-1 bytes
-for text data. Also, for paranoia sakes, add a terminator after
-the text data.
-
-And finally, document this behavior so that it is clear that only
-size-1 bytes are used and a terminator is added.
-
-Fixes: 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer")
-Cc: stable@vger.kernel.org # 5.10+
-Signed-off-by: John Ogness <john.ogness@linutronix.de>
-Reviewed-by: Petr Mladek <pmladek@suse.com>
-Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
-Signed-off-by: Petr Mladek <pmladek@suse.com>
-Link: https://lore.kernel.org/r/20210114170412.4819-1-john.ogness@linutronix.de
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- kernel/printk/printk.c | 36 +++++++++++++++++++++++++++---------
- 1 file changed, 27 insertions(+), 9 deletions(-)
-
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -1338,11 +1338,16 @@ static size_t info_print_prefix(const st
- * done:
- *
- * - Add prefix for each line.
-+ * - Drop truncated lines that no longer fit into the buffer.
- * - Add the trailing newline that has been removed in vprintk_store().
-- * - Drop truncated lines that do not longer fit into the buffer.
-+ * - Add a string terminator.
-+ *
-+ * Since the produced string is always terminated, the maximum possible
-+ * return value is @r->text_buf_size - 1;
- *
- * Return: The length of the updated/prepared text, including the added
-- * prefixes and the newline. The dropped line(s) are not counted.
-+ * prefixes and the newline. The terminator is not counted. The dropped
-+ * line(s) are not counted.
- */
- static size_t record_print_text(struct printk_record *r, bool syslog,
- bool time)
-@@ -1385,26 +1390,31 @@ static size_t record_print_text(struct p
-
- /*
- * Truncate the text if there is not enough space to add the
-- * prefix and a trailing newline.
-+ * prefix and a trailing newline and a terminator.
- */
-- if (len + prefix_len + text_len + 1 > buf_size) {
-+ if (len + prefix_len + text_len + 1 + 1 > buf_size) {
- /* Drop even the current line if no space. */
-- if (len + prefix_len + line_len + 1 > buf_size)
-+ if (len + prefix_len + line_len + 1 + 1 > buf_size)
- break;
-
-- text_len = buf_size - len - prefix_len - 1;
-+ text_len = buf_size - len - prefix_len - 1 - 1;
- truncated = true;
- }
-
- memmove(text + prefix_len, text, text_len);
- memcpy(text, prefix, prefix_len);
-
-+ /*
-+ * Increment the prepared length to include the text and
-+ * prefix that were just moved+copied. Also increment for the
-+ * newline at the end of this line. If this is the last line,
-+ * there is no newline, but it will be added immediately below.
-+ */
- len += prefix_len + line_len + 1;
--
- if (text_len == line_len) {
- /*
-- * Add the trailing newline removed in
-- * vprintk_store().
-+ * This is the last line. Add the trailing newline
-+ * removed in vprintk_store().
- */
- text[prefix_len + line_len] = '\n';
- break;
-@@ -1429,6 +1439,14 @@ static size_t record_print_text(struct p
- text_len -= line_len + 1;
- }
-
-+ /*
-+ * If a buffer was provided, it will be terminated. Space for the
-+ * string terminator is guaranteed to be available. The terminator is
-+ * not counted in the return value.
-+ */
-+ if (buf_size > 0)
-+ text[len] = 0;
-+
- return len;
- }
-
Link: https://lore.kernel.org/r/20210113164413.1599-1-john.ogness@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- kernel/printk/printk.c | 4 ++--
+ kernel/printk/printk.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index 1246b3b330fd1..807810216492a 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
-@@ -3394,7 +3394,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
+@@ -3376,7 +3376,7 @@ bool kmsg_dump_get_buffer(struct kmsg_du
while (prb_read_valid_info(prb, seq, &info, &line_count)) {
if (r.info->seq >= dumper->next_seq)
break;
seq = r.info->seq + 1;
}
-@@ -3404,7 +3404,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog,
+@@ -3386,7 +3386,7 @@ bool kmsg_dump_get_buffer(struct kmsg_du
&info, &line_count)) {
if (r.info->seq >= dumper->next_seq)
break;
seq = r.info->seq + 1;
}
---
-2.27.0
-
--- /dev/null
+From 92a5e1fdb286851d5bd0eb966b8d075be27cf5ee Mon Sep 17 00:00:00 2001
+From: Sandipan Das <sandipan@linux.ibm.com>
+Date: Mon, 18 Jan 2021 15:01:45 +0530
+Subject: selftests/powerpc: Fix exit status of pkey tests
+
+From: Sandipan Das <sandipan@linux.ibm.com>
+
+commit 92a5e1fdb286851d5bd0eb966b8d075be27cf5ee upstream.
+
+Since main() does not return a value explicitly, the
+return values from FAIL_IF() conditions are ignored
+and the tests can still pass irrespective of failures.
+This makes sure that we always explicitly return the
+correct test exit status.
+
+Fixes: 1addb6444791 ("selftests/powerpc: Add test for execute-disabled pkeys")
+Fixes: c27f2fd1705a ("selftests/powerpc: Add test for pkey siginfo verification")
+Reported-by: Eirik Fuller <efuller@redhat.com>
+Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20210118093145.10134-1-sandipan@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/powerpc/mm/pkey_exec_prot.c | 2 +-
+ tools/testing/selftests/powerpc/mm/pkey_siginfo.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/powerpc/mm/pkey_exec_prot.c
++++ b/tools/testing/selftests/powerpc/mm/pkey_exec_prot.c
+@@ -290,5 +290,5 @@ static int test(void)
+
+ int main(void)
+ {
+- test_harness(test, "pkey_exec_prot");
++ return test_harness(test, "pkey_exec_prot");
+ }
+--- a/tools/testing/selftests/powerpc/mm/pkey_siginfo.c
++++ b/tools/testing/selftests/powerpc/mm/pkey_siginfo.c
+@@ -329,5 +329,5 @@ static int test(void)
+
+ int main(void)
+ {
+- test_harness(test, "pkey_siginfo");
++ return test_harness(test, "pkey_siginfo");
+ }
crypto-xor-fix-divide-error-in-do_xor_speed.patch
dm-crypt-fix-copy-and-paste-bug-in-crypt_alloc_req_aead.patch
acpi-scan-make-acpi_bus_get_device-clear-return-pointer-on-error.patch
-printk-fix-buffer-overflow-potential-for-print_text.patch
btrfs-don-t-get-an-eintr-during-drop_snapshot-for-reloc.patch
btrfs-do-not-double-free-backref-nodes-on-error.patch
btrfs-fix-lockdep-splat-in-btrfs_recover_relocation.patch
driver-core-extend-device_is_dependent.patch
drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch
drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch
+x86-entry-fix-noinstr-fail.patch
+x86-cpu-amd-set-__max_die_per_package-on-amd.patch
+cls_flower-call-nla_ok-before-nla_next.patch
+netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch
+tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch
+tools-gpio-fix-llu-warning-in-gpio-watch.c.patch
+drm-i915-hdcp-update-cp-property-in-update_pipe.patch
+sh-dma-fix-kconfig-dependency-for-g2_dma.patch
+sh-remove-unused-have_copy_thread_tls-macro.patch
+locking-lockdep-cure-noinstr-fail.patch
+asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch
+octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch
+net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch
+selftests-powerpc-fix-exit-status-of-pkey-tests.patch
+sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch
+nvme-pci-refactor-nvme_unmap_data.patch
+nvme-pci-fix-error-unwind-in-nvme_map_data.patch
+cachefiles-drop-superfluous-readpages-aops-null-check.patch
+lightnvm-fix-memory-leak-when-submit-fails.patch
+skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch
--- /dev/null
+From f477a538c14d07f8c45e554c8c5208d588514e98 Mon Sep 17 00:00:00 2001
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Date: Thu, 17 Sep 2020 18:45:48 +0300
+Subject: sh: dma: fix kconfig dependency for G2_DMA
+
+From: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+
+commit f477a538c14d07f8c45e554c8c5208d588514e98 upstream.
+
+When G2_DMA is enabled and SH_DMA is disabled, it results in the following
+Kbuild warning:
+
+WARNING: unmet direct dependencies detected for SH_DMA_API
+ Depends on [n]: SH_DMA [=n]
+ Selected by [y]:
+ - G2_DMA [=y] && SH_DREAMCAST [=y]
+
+The reason is that G2_DMA selects SH_DMA_API without depending on or
+selecting SH_DMA while SH_DMA_API depends on SH_DMA.
+
+When G2_DMA was first introduced with commit 40f49e7ed77f
+("sh: dma: Make G2 DMA configurable."), this wasn't an issue since
+SH_DMA_API didn't have such dependency, and this way was the only way to
+enable it since SH_DMA_API was non-visible. However, later SH_DMA_API was
+made visible and dependent on SH_DMA with commit d8902adcc1a9
+("dmaengine: sh: Add Support SuperH DMA Engine driver").
+
+Let G2_DMA depend on SH_DMA_API instead to avoid Kbuild issues.
+
+Fixes: d8902adcc1a9 ("dmaengine: sh: Add Support SuperH DMA Engine driver")
+Signed-off-by: Necip Fazil Yildiran <fazilyildiran@gmail.com>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/drivers/dma/Kconfig | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/arch/sh/drivers/dma/Kconfig
++++ b/arch/sh/drivers/dma/Kconfig
+@@ -63,8 +63,7 @@ config PVR2_DMA
+
+ config G2_DMA
+ tristate "G2 Bus DMA support"
+- depends on SH_DREAMCAST
+- select SH_DMA_API
++ depends on SH_DREAMCAST && SH_DMA_API
+ help
+ This enables support for the DMA controller for the Dreamcast's
+ G2 bus. Drivers that want this will generally enable this on
--- /dev/null
+From 19170492735be935747b0545b7eed8bb40cc1209 Mon Sep 17 00:00:00 2001
+From: Jinyang He <hejinyang@loongson.cn>
+Date: Mon, 12 Oct 2020 11:50:24 +0800
+Subject: sh: Remove unused HAVE_COPY_THREAD_TLS macro
+
+From: Jinyang He <hejinyang@loongson.cn>
+
+commit 19170492735be935747b0545b7eed8bb40cc1209 upstream.
+
+Fixes: e1cc9d8d596e ("sh: switch to copy_thread_tls()")
+Signed-off-by: Jinyang He <hejinyang@loongson.cn>
+Signed-off-by: Rich Felker <dalias@libc.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/Kconfig | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/sh/Kconfig
++++ b/arch/sh/Kconfig
+@@ -30,7 +30,6 @@ config SUPERH
+ select HAVE_ARCH_KGDB
+ select HAVE_ARCH_SECCOMP_FILTER
+ select HAVE_ARCH_TRACEHOOK
+- select HAVE_COPY_THREAD_TLS
+ select HAVE_DEBUG_BUGVERBOSE
+ select HAVE_DEBUG_KMEMLEAK
+ select HAVE_DYNAMIC_FTRACE
--- /dev/null
+From f6a2e94b3f9d89cb40771ff746b16b5687650cbb Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 18 Jan 2021 16:08:12 +0100
+Subject: sh_eth: Fix power down vs. is_opened flag ordering
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit f6a2e94b3f9d89cb40771ff746b16b5687650cbb upstream.
+
+sh_eth_close() does a synchronous power down of the device before
+marking it closed. Revert the order, to make sure the device is never
+marked opened while suspended.
+
+While at it, use pm_runtime_put() instead of pm_runtime_put_sync(), as
+there is no reason to do a synchronous power down.
+
+Fixes: 7fa2955ff70ce453 ("sh_eth: Fix sleeping function called from invalid context")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Link: https://lore.kernel.org/r/20210118150812.796791-1-geert+renesas@glider.be
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/renesas/sh_eth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -2606,10 +2606,10 @@ static int sh_eth_close(struct net_devic
+ /* Free all the skbuffs in the Rx queue and the DMA buffer. */
+ sh_eth_ring_free(ndev);
+
+- pm_runtime_put_sync(&mdp->pdev->dev);
+-
+ mdp->is_opened = 0;
+
++ pm_runtime_put(&mdp->pdev->dev);
++
+ return 0;
+ }
+
--- /dev/null
+From 66c556025d687dbdd0f748c5e1df89c977b6c02a Mon Sep 17 00:00:00 2001
+From: Alexander Lobakin <alobakin@pm.me>
+Date: Fri, 15 Jan 2021 15:04:40 +0000
+Subject: skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
+
+From: Alexander Lobakin <alobakin@pm.me>
+
+commit 66c556025d687dbdd0f748c5e1df89c977b6c02a upstream.
+
+Commit 3226b158e67c ("net: avoid 32 x truesize under-estimation for
+tiny skbs") ensured that skbs with data size lower than 1025 bytes
+will be kmalloc'ed to avoid excessive page cache fragmentation and
+memory consumption.
+However, the fix adressed only __napi_alloc_skb() (primarily for
+virtio_net and napi_get_frags()), but the issue can still be achieved
+through __netdev_alloc_skb(), which is still used by several drivers.
+Drivers often allocate a tiny skb for headers and place the rest of
+the frame to frags (so-called copybreak).
+Mirror the condition to __netdev_alloc_skb() to handle this case too.
+
+Since v1 [0]:
+ - fix "Fixes:" tag;
+ - refine commit message (mention copybreak usecase).
+
+[0] https://lore.kernel.org/netdev/20210114235423.232737-1-alobakin@pm.me
+
+Fixes: a1c7fff7e18f ("net: netdev_alloc_skb() use build_skb()")
+Signed-off-by: Alexander Lobakin <alobakin@pm.me>
+Link: https://lore.kernel.org/r/20210115150354.85967-1-alobakin@pm.me
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/skbuff.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -432,7 +432,11 @@ struct sk_buff *__netdev_alloc_skb(struc
+
+ len += NET_SKB_PAD;
+
+- if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
++ /* If requested length is either too small or too big,
++ * we use kmalloc() for skb->head allocation.
++ */
++ if (len <= SKB_WITH_OVERHEAD(1024) ||
++ len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
+ (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
+ skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
+ if (!skb)
--- /dev/null
+From 2fe7c2f99440d52613e1cf845c96e8e463c28111 Mon Sep 17 00:00:00 2001
+From: Kent Gibson <warthog618@gmail.com>
+Date: Thu, 7 Jan 2021 12:00:19 +0800
+Subject: tools: gpio: fix %llu warning in gpio-event-mon.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kent Gibson <warthog618@gmail.com>
+
+commit 2fe7c2f99440d52613e1cf845c96e8e463c28111 upstream.
+
+Some platforms, such as mips64, don't map __u64 to long long unsigned
+int so using %llu produces a warning:
+
+gpio-event-mon.c:110:37: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘__u64’ {aka ‘long unsigned int’} [-Wformat=]
+ 110 | fprintf(stdout, "GPIO EVENT at %llu on line %d (%d|%d) ",
+ | ~~~^
+ | |
+ | long long unsigned int
+ | %lu
+ 111 | event.timestamp_ns, event.offset, event.line_seqno,
+ | ~~~~~~~~~~~~~~~~~~
+ | |
+ | __u64 {aka long unsigned int}
+
+Replace the %llu with PRIu64 and cast the argument to uint64_t.
+
+Fixes: 03fd11b03362 ("tools/gpio/gpio-event-mon: fix warning")
+Signed-off-by: Kent Gibson <warthog618@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/gpio/gpio-event-mon.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/gpio/gpio-event-mon.c
++++ b/tools/gpio/gpio-event-mon.c
+@@ -107,8 +107,8 @@ int monitor_device(const char *device_na
+ ret = -EIO;
+ break;
+ }
+- fprintf(stdout, "GPIO EVENT at %llu on line %d (%d|%d) ",
+- event.timestamp_ns, event.offset, event.line_seqno,
++ fprintf(stdout, "GPIO EVENT at %" PRIu64 " on line %d (%d|%d) ",
++ (uint64_t)event.timestamp_ns, event.offset, event.line_seqno,
+ event.seqno);
+ switch (event.id) {
+ case GPIO_V2_LINE_EVENT_RISING_EDGE:
--- /dev/null
+From 1fc7c1ef37f86f207b4db40aba57084bb2f6a69a Mon Sep 17 00:00:00 2001
+From: Kent Gibson <warthog618@gmail.com>
+Date: Thu, 7 Jan 2021 12:00:20 +0800
+Subject: tools: gpio: fix %llu warning in gpio-watch.c
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Kent Gibson <warthog618@gmail.com>
+
+commit 1fc7c1ef37f86f207b4db40aba57084bb2f6a69a upstream.
+
+Some platforms, such as mips64, don't map __u64 to long long unsigned
+int so using %llu produces a warning:
+
+gpio-watch.c: In function ‘main’:
+gpio-watch.c:89:30: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 4 has type ‘__u64’ {aka ‘long unsigned int’} [-Wformat=]
+ 89 | printf("line %u: %s at %llu\n",
+ | ~~~^
+ | |
+ | long long unsigned int
+ | %lu
+ 90 | chg.info.offset, event, chg.timestamp_ns);
+ | ~~~~~~~~~~~~~~~~
+ | |
+ | __u64 {aka long unsigned int}
+
+Replace the %llu with PRIu64 and cast the argument to uint64_t.
+
+Fixes: 33f0c47b8fb4 ("tools: gpio: implement gpio-watch")
+Signed-off-by: Kent Gibson <warthog618@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/gpio/gpio-watch.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/tools/gpio/gpio-watch.c
++++ b/tools/gpio/gpio-watch.c
+@@ -10,6 +10,7 @@
+ #include <ctype.h>
+ #include <errno.h>
+ #include <fcntl.h>
++#include <inttypes.h>
+ #include <linux/gpio.h>
+ #include <poll.h>
+ #include <stdbool.h>
+@@ -86,8 +87,8 @@ int main(int argc, char **argv)
+ return EXIT_FAILURE;
+ }
+
+- printf("line %u: %s at %llu\n",
+- chg.info.offset, event, chg.timestamp_ns);
++ printf("line %u: %s at %" PRIu64 "\n",
++ chg.info.offset, event, (uint64_t)chg.timestamp_ns);
+ }
+ }
+
--- /dev/null
+From 76e2fc63ca40977af893b724b00cc2f8e9ce47a4 Mon Sep 17 00:00:00 2001
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Date: Mon, 11 Jan 2021 11:04:29 +0100
+Subject: x86/cpu/amd: Set __max_die_per_package on AMD
+
+From: Yazen Ghannam <Yazen.Ghannam@amd.com>
+
+commit 76e2fc63ca40977af893b724b00cc2f8e9ce47a4 upstream.
+
+Set the maximum DIE per package variable on AMD using the
+NodesPerProcessor topology value. This will be used by RAPL, among
+others, to determine the maximum number of DIEs on the system in order
+to do per-DIE manipulations.
+
+ [ bp: Productize into a proper patch. ]
+
+Fixes: 028c221ed190 ("x86/CPU/AMD: Save AMD NodeId as cpu_die_id")
+Reported-by: Johnathan Smithinovic <johnathan.smithinovic@gmx.at>
+Reported-by: Rafael Kitover <rkitover@gmail.com>
+Signed-off-by: Yazen Ghannam <Yazen.Ghannam@amd.com>
+Signed-off-by: Borislav Petkov <bp@suse.de>
+Tested-by: Johnathan Smithinovic <johnathan.smithinovic@gmx.at>
+Tested-by: Rafael Kitover <rkitover@gmail.com>
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=210939
+Link: https://lkml.kernel.org/r/20210106112106.GE5729@zn.tnic
+Link: https://lkml.kernel.org/r/20210111101455.1194-1-bp@alien8.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/amd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -569,12 +569,12 @@ static void bsp_init_amd(struct cpuinfo_
+ u32 ecx;
+
+ ecx = cpuid_ecx(0x8000001e);
+- nodes_per_socket = ((ecx >> 8) & 7) + 1;
++ __max_die_per_package = nodes_per_socket = ((ecx >> 8) & 7) + 1;
+ } else if (boot_cpu_has(X86_FEATURE_NODEID_MSR)) {
+ u64 value;
+
+ rdmsrl(MSR_FAM10H_NODE_ID, value);
+- nodes_per_socket = ((value >> 3) & 7) + 1;
++ __max_die_per_package = nodes_per_socket = ((value >> 3) & 7) + 1;
+ }
+
+ if (!boot_cpu_has(X86_FEATURE_AMD_SSBD) &&
--- /dev/null
+From 9caa7ff509add50959a793b811cc7c9339e281cd Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Wed, 6 Jan 2021 15:36:20 +0100
+Subject: x86/entry: Fix noinstr fail
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 9caa7ff509add50959a793b811cc7c9339e281cd upstream.
+
+ vmlinux.o: warning: objtool: __do_fast_syscall_32()+0x47: call to syscall_enter_from_user_mode_work() leaves .noinstr.text section
+
+Fixes: 4facb95b7ada ("x86/entry: Unbreak 32bit fast syscall")
+Reported-by: Randy Dunlap <rdunlap@infradead.org>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/r/20210106144017.472696632@infradead.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/entry/common.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/entry/common.c
++++ b/arch/x86/entry/common.c
+@@ -73,10 +73,8 @@ static __always_inline void do_syscall_3
+ unsigned int nr)
+ {
+ if (likely(nr < IA32_NR_syscalls)) {
+- instrumentation_begin();
+ nr = array_index_nospec(nr, IA32_NR_syscalls);
+ regs->ax = ia32_sys_call_table[nr](regs);
+- instrumentation_end();
+ }
+ }
+
+@@ -91,8 +89,11 @@ __visible noinstr void do_int80_syscall_
+ * or may not be necessary, but it matches the old asm behavior.
+ */
+ nr = (unsigned int)syscall_enter_from_user_mode(regs, nr);
++ instrumentation_begin();
+
+ do_syscall_32_irqs_on(regs, nr);
++
++ instrumentation_end();
+ syscall_exit_to_user_mode(regs);
+ }
+
+@@ -121,11 +122,12 @@ static noinstr bool __do_fast_syscall_32
+ res = get_user(*(u32 *)®s->bp,
+ (u32 __user __force *)(unsigned long)(u32)regs->sp);
+ }
+- instrumentation_end();
+
+ if (res) {
+ /* User code screwed up. */
+ regs->ax = -EFAULT;
++
++ instrumentation_end();
+ syscall_exit_to_user_mode(regs);
+ return false;
+ }
+@@ -135,6 +137,8 @@ static noinstr bool __do_fast_syscall_32
+
+ /* Now this is just like a normal syscall. */
+ do_syscall_32_irqs_on(regs, nr);
++
++ instrumentation_end();
+ syscall_exit_to_user_mode(regs);
+ return true;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
