]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.19-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 16 Nov 2020 17:29:35 +0000 (18:29 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 16 Nov 2020 17:29:35 +0000 (18:29 +0100)
added patches:
don-t-dump-the-threads-that-had-been-already-exiting-when-zapped.patch
drm-gma500-fix-out-of-bounds-access-to-struct-drm_device.vblank.patch
gpio-pcie-idio-24-enable-pex8311-interrupts.patch
gpio-pcie-idio-24-fix-irq-enable-register-value.patch
gpio-pcie-idio-24-fix-irq-mask-when-masking.patch
mmc-renesas_sdhi_core-add-missing-tmio_mmc_host_free-at-remove.patch
selinux-fix-error-return-code-in-sel_ib_pkey_sid_slow.patch

queue-4.19/don-t-dump-the-threads-that-had-been-already-exiting-when-zapped.patch [new file with mode: 0644]
queue-4.19/drm-gma500-fix-out-of-bounds-access-to-struct-drm_device.vblank.patch [new file with mode: 0644]
queue-4.19/gpio-pcie-idio-24-enable-pex8311-interrupts.patch [new file with mode: 0644]
queue-4.19/gpio-pcie-idio-24-fix-irq-enable-register-value.patch [new file with mode: 0644]
queue-4.19/gpio-pcie-idio-24-fix-irq-mask-when-masking.patch [new file with mode: 0644]
queue-4.19/mmc-renesas_sdhi_core-add-missing-tmio_mmc_host_free-at-remove.patch [new file with mode: 0644]
queue-4.19/selinux-fix-error-return-code-in-sel_ib_pkey_sid_slow.patch [new file with mode: 0644]
queue-4.19/series

diff --git a/queue-4.19/don-t-dump-the-threads-that-had-been-already-exiting-when-zapped.patch b/queue-4.19/don-t-dump-the-threads-that-had-been-already-exiting-when-zapped.patch
new file mode 100644 (file)
index 0000000..f7c66d6
--- /dev/null
@@ -0,0 +1,72 @@
+From 77f6ab8b7768cf5e6bdd0e72499270a0671506ee Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 28 Oct 2020 16:39:49 -0400
+Subject: don't dump the threads that had been already exiting when zapped.
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 77f6ab8b7768cf5e6bdd0e72499270a0671506ee upstream.
+
+Coredump logics needs to report not only the registers of the dumping
+thread, but (since 2.5.43) those of other threads getting killed.
+
+Doing that might require extra state saved on the stack in asm glue at
+kernel entry; signal delivery logics does that (we need to be able to
+save sigcontext there, at the very least) and so does seccomp.
+
+That covers all callers of do_coredump().  Secondary threads get hit with
+SIGKILL and caught as soon as they reach exit_mm(), which normally happens
+in signal delivery, so those are also fine most of the time.  Unfortunately,
+it is possible to end up with secondary zapped when it has already entered
+exit(2) (or, worse yet, is oopsing).  In those cases we reach exit_mm()
+when mm->core_state is already set, but the stack contents is not what
+we would have in signal delivery.
+
+At least on two architectures (alpha and m68k) it leads to infoleaks - we
+end up with a chunk of kernel stack written into coredump, with the contents
+consisting of normal C stack frames of the call chain leading to exit_mm()
+instead of the expected copy of userland registers.  In case of alpha we
+leak 312 bytes of stack.  Other architectures (including the regset-using
+ones) might have similar problems - the normal user of regsets is ptrace
+and the state of tracee at the time of such calls is special in the same
+way signal delivery is.
+
+Note that had the zapper gotten to the exiting thread slightly later,
+it wouldn't have been included into coredump anyway - we skip the threads
+that have already cleared their ->mm.  So let's pretend that zapper always
+loses the race.  IOW, have exit_mm() only insert into the dumper list if
+we'd gotten there from handling a fatal signal[*]
+
+As the result, the callers of do_exit() that have *not* gone through get_signal()
+are not seen by coredump logics as secondary threads.  Which excludes voluntary
+exit()/oopsen/traps/etc.  The dumper thread itself is unaffected by that,
+so seccomp is fine.
+
+[*] originally I intended to add a new flag in tsk->flags, but ebiederman pointed
+out that PF_SIGNALED is already doing just what we need.
+
+Cc: stable@vger.kernel.org
+Fixes: d89f3847def4 ("[PATCH] thread-aware coredumps, 2.5.43-C3")
+History-tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
+Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/exit.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -517,7 +517,10 @@ static void exit_mm(void)
+               up_read(&mm->mmap_sem);
+               self.task = current;
+-              self.next = xchg(&core_state->dumper.next, &self);
++              if (self.task->flags & PF_SIGNALED)
++                      self.next = xchg(&core_state->dumper.next, &self);
++              else
++                      self.task = NULL;
+               /*
+                * Implies mb(), the result of xchg() must be visible
+                * to core_state->dumper.
diff --git a/queue-4.19/drm-gma500-fix-out-of-bounds-access-to-struct-drm_device.vblank.patch b/queue-4.19/drm-gma500-fix-out-of-bounds-access-to-struct-drm_device.vblank.patch
new file mode 100644 (file)
index 0000000..e2b5139
--- /dev/null
@@ -0,0 +1,120 @@
+From 06ad8d339524bf94b89859047822c31df6ace239 Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Thu, 5 Nov 2020 20:02:56 +0100
+Subject: drm/gma500: Fix out-of-bounds access to struct drm_device.vblank[]
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit 06ad8d339524bf94b89859047822c31df6ace239 upstream.
+
+The gma500 driver expects 3 pipelines in several it's IRQ functions.
+Accessing struct drm_device.vblank[], this fails with devices that only
+have 2 pipelines. An example KASAN report is shown below.
+
+  [   62.267688] ==================================================================
+  [   62.268856] BUG: KASAN: slab-out-of-bounds in psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
+  [   62.269450] Read of size 1 at addr ffff8880012bc6d0 by task systemd-udevd/285
+  [   62.269949]
+  [   62.270192] CPU: 0 PID: 285 Comm: systemd-udevd Tainted: G            E     5.10.0-rc1-1-default+ #572
+  [   62.270807] Hardware name:  /DN2800MT, BIOS MTCDT10N.86A.0164.2012.1213.1024 12/13/2012
+  [   62.271366] Call Trace:
+  [   62.271705]  dump_stack+0xae/0xe5
+  [   62.272180]  print_address_description.constprop.0+0x17/0xf0
+  [   62.272987]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
+  [   62.273474]  __kasan_report.cold+0x20/0x38
+  [   62.273989]  ? psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
+  [   62.274460]  kasan_report+0x3a/0x50
+  [   62.274891]  psb_irq_postinstall+0x250/0x3c0 [gma500_gfx]
+  [   62.275380]  drm_irq_install+0x131/0x1f0
+  <...>
+  [   62.300751] Allocated by task 285:
+  [   62.301223]  kasan_save_stack+0x1b/0x40
+  [   62.301731]  __kasan_kmalloc.constprop.0+0xbf/0xd0
+  [   62.302293]  drmm_kmalloc+0x55/0x100
+  [   62.302773]  drm_vblank_init+0x77/0x210
+
+Resolve the issue by only handling vblank entries up to the number of
+CRTCs.
+
+I'm adding a Fixes tag for reference, although the bug has been present
+since the driver's initial commit.
+
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Fixes: 5c49fd3aa0ab ("gma500: Add the core DRM files and headers")
+Cc: Alan Cox <alan@linux.intel.com>
+Cc: Dave Airlie <airlied@redhat.com>
+Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Cc: dri-devel@lists.freedesktop.org
+Cc: stable@vger.kernel.org#v3.3+
+Link: https://patchwork.freedesktop.org/patch/msgid/20201105190256.3893-1-tzimmermann@suse.de
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/gma500/psb_irq.c |   34 ++++++++++++----------------------
+ 1 file changed, 12 insertions(+), 22 deletions(-)
+
+--- a/drivers/gpu/drm/gma500/psb_irq.c
++++ b/drivers/gpu/drm/gma500/psb_irq.c
+@@ -350,6 +350,7 @@ int psb_irq_postinstall(struct drm_devic
+ {
+       struct drm_psb_private *dev_priv = dev->dev_private;
+       unsigned long irqflags;
++      unsigned int i;
+       spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+@@ -362,20 +363,12 @@ int psb_irq_postinstall(struct drm_devic
+       PSB_WVDC32(dev_priv->vdc_irq_mask, PSB_INT_ENABLE_R);
+       PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+-      if (dev->vblank[0].enabled)
+-              psb_enable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+-      else
+-              psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+-      if (dev->vblank[1].enabled)
+-              psb_enable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+-      else
+-              psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+-      if (dev->vblank[2].enabled)
+-              psb_enable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
+-      else
+-              psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
++      for (i = 0; i < dev->num_crtcs; ++i) {
++              if (dev->vblank[i].enabled)
++                      psb_enable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++              else
++                      psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++      }
+       if (dev_priv->ops->hotplug_enable)
+               dev_priv->ops->hotplug_enable(dev, true);
+@@ -388,6 +381,7 @@ void psb_irq_uninstall(struct drm_device
+ {
+       struct drm_psb_private *dev_priv = dev->dev_private;
+       unsigned long irqflags;
++      unsigned int i;
+       spin_lock_irqsave(&dev_priv->irqmask_lock, irqflags);
+@@ -396,14 +390,10 @@ void psb_irq_uninstall(struct drm_device
+       PSB_WVDC32(0xFFFFFFFF, PSB_HWSTAM);
+-      if (dev->vblank[0].enabled)
+-              psb_disable_pipestat(dev_priv, 0, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+-      if (dev->vblank[1].enabled)
+-              psb_disable_pipestat(dev_priv, 1, PIPE_VBLANK_INTERRUPT_ENABLE);
+-
+-      if (dev->vblank[2].enabled)
+-              psb_disable_pipestat(dev_priv, 2, PIPE_VBLANK_INTERRUPT_ENABLE);
++      for (i = 0; i < dev->num_crtcs; ++i) {
++              if (dev->vblank[i].enabled)
++                      psb_disable_pipestat(dev_priv, i, PIPE_VBLANK_INTERRUPT_ENABLE);
++      }
+       dev_priv->vdc_irq_mask &= _PSB_IRQ_SGX_FLAG |
+                                 _PSB_IRQ_MSVDX_FLAG |
diff --git a/queue-4.19/gpio-pcie-idio-24-enable-pex8311-interrupts.patch b/queue-4.19/gpio-pcie-idio-24-enable-pex8311-interrupts.patch
new file mode 100644 (file)
index 0000000..3b2f76f
--- /dev/null
@@ -0,0 +1,117 @@
+From 10a2f11d3c9e48363c729419e0f0530dea76e4fe Mon Sep 17 00:00:00 2001
+From: Arnaud de Turckheim <quarium@gmail.com>
+Date: Wed, 4 Nov 2020 16:24:55 +0100
+Subject: gpio: pcie-idio-24: Enable PEX8311 interrupts
+
+From: Arnaud de Turckheim <quarium@gmail.com>
+
+commit 10a2f11d3c9e48363c729419e0f0530dea76e4fe upstream.
+
+This enables the PEX8311 internal PCI wire interrupt and the PEX8311
+local interrupt input so the local interrupts are forwarded to the PCI.
+
+Fixes: 585562046628 ("gpio: Add GPIO support for the ACCES PCIe-IDIO-24 family")
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnaud de Turckheim <quarium@gmail.com>
+Reviewed-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-pcie-idio-24.c |   52 ++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-pcie-idio-24.c
++++ b/drivers/gpio/gpio-pcie-idio-24.c
+@@ -28,6 +28,47 @@
+ #include <linux/spinlock.h>
+ #include <linux/types.h>
++/*
++ * PLX PEX8311 PCI LCS_INTCSR Interrupt Control/Status
++ *
++ * Bit: Description
++ *   0: Enable Interrupt Sources (Bit 0)
++ *   1: Enable Interrupt Sources (Bit 1)
++ *   2: Generate Internal PCI Bus Internal SERR# Interrupt
++ *   3: Mailbox Interrupt Enable
++ *   4: Power Management Interrupt Enable
++ *   5: Power Management Interrupt
++ *   6: Slave Read Local Data Parity Check Error Enable
++ *   7: Slave Read Local Data Parity Check Error Status
++ *   8: Internal PCI Wire Interrupt Enable
++ *   9: PCI Express Doorbell Interrupt Enable
++ *  10: PCI Abort Interrupt Enable
++ *  11: Local Interrupt Input Enable
++ *  12: Retry Abort Enable
++ *  13: PCI Express Doorbell Interrupt Active
++ *  14: PCI Abort Interrupt Active
++ *  15: Local Interrupt Input Active
++ *  16: Local Interrupt Output Enable
++ *  17: Local Doorbell Interrupt Enable
++ *  18: DMA Channel 0 Interrupt Enable
++ *  19: DMA Channel 1 Interrupt Enable
++ *  20: Local Doorbell Interrupt Active
++ *  21: DMA Channel 0 Interrupt Active
++ *  22: DMA Channel 1 Interrupt Active
++ *  23: Built-In Self-Test (BIST) Interrupt Active
++ *  24: Direct Master was the Bus Master during a Master or Target Abort
++ *  25: DMA Channel 0 was the Bus Master during a Master or Target Abort
++ *  26: DMA Channel 1 was the Bus Master during a Master or Target Abort
++ *  27: Target Abort after internal 256 consecutive Master Retrys
++ *  28: PCI Bus wrote data to LCS_MBOX0
++ *  29: PCI Bus wrote data to LCS_MBOX1
++ *  30: PCI Bus wrote data to LCS_MBOX2
++ *  31: PCI Bus wrote data to LCS_MBOX3
++ */
++#define PLX_PEX8311_PCI_LCS_INTCSR  0x68
++#define INTCSR_INTERNAL_PCI_WIRE    BIT(8)
++#define INTCSR_LOCAL_INPUT          BIT(11)
++
+ /**
+  * struct idio_24_gpio_reg - GPIO device registers structure
+  * @out0_7:   Read: FET Outputs 0-7
+@@ -92,6 +133,7 @@ struct idio_24_gpio_reg {
+ struct idio_24_gpio {
+       struct gpio_chip chip;
+       raw_spinlock_t lock;
++      __u8 __iomem *plx;
+       struct idio_24_gpio_reg __iomem *reg;
+       unsigned long irq_mask;
+ };
+@@ -481,6 +523,7 @@ static int idio_24_probe(struct pci_dev
+       struct device *const dev = &pdev->dev;
+       struct idio_24_gpio *idio24gpio;
+       int err;
++      const size_t pci_plx_bar_index = 1;
+       const size_t pci_bar_index = 2;
+       const char *const name = pci_name(pdev);
+@@ -494,12 +537,13 @@ static int idio_24_probe(struct pci_dev
+               return err;
+       }
+-      err = pcim_iomap_regions(pdev, BIT(pci_bar_index), name);
++      err = pcim_iomap_regions(pdev, BIT(pci_plx_bar_index) | BIT(pci_bar_index), name);
+       if (err) {
+               dev_err(dev, "Unable to map PCI I/O addresses (%d)\n", err);
+               return err;
+       }
++      idio24gpio->plx = pcim_iomap_table(pdev)[pci_plx_bar_index];
+       idio24gpio->reg = pcim_iomap_table(pdev)[pci_bar_index];
+       idio24gpio->chip.label = name;
+@@ -520,6 +564,12 @@ static int idio_24_probe(struct pci_dev
+       /* Software board reset */
+       iowrite8(0, &idio24gpio->reg->soft_reset);
++      /*
++       * enable PLX PEX8311 internal PCI wire interrupt and local interrupt
++       * input
++       */
++      iowrite8((INTCSR_INTERNAL_PCI_WIRE | INTCSR_LOCAL_INPUT) >> 8,
++               idio24gpio->plx + PLX_PEX8311_PCI_LCS_INTCSR + 1);
+       err = devm_gpiochip_add_data(dev, &idio24gpio->chip, idio24gpio);
+       if (err) {
diff --git a/queue-4.19/gpio-pcie-idio-24-fix-irq-enable-register-value.patch b/queue-4.19/gpio-pcie-idio-24-fix-irq-enable-register-value.patch
new file mode 100644 (file)
index 0000000..907c09f
--- /dev/null
@@ -0,0 +1,56 @@
+From 23a7fdc06ebcc334fa667f0550676b035510b70b Mon Sep 17 00:00:00 2001
+From: Arnaud de Turckheim <quarium@gmail.com>
+Date: Wed, 4 Nov 2020 16:24:54 +0100
+Subject: gpio: pcie-idio-24: Fix IRQ Enable Register value
+
+From: Arnaud de Turckheim <quarium@gmail.com>
+
+commit 23a7fdc06ebcc334fa667f0550676b035510b70b upstream.
+
+This fixes the COS Enable Register value for enabling/disabling the
+corresponding IRQs bank.
+
+Fixes: 585562046628 ("gpio: Add GPIO support for the ACCES PCIe-IDIO-24 family")
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnaud de Turckheim <quarium@gmail.com>
+Reviewed-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-pcie-idio-24.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpio/gpio-pcie-idio-24.c
++++ b/drivers/gpio/gpio-pcie-idio-24.c
+@@ -360,13 +360,13 @@ static void idio_24_irq_mask(struct irq_
+       unsigned long flags;
+       const unsigned long bit_offset = irqd_to_hwirq(data) - 24;
+       unsigned char new_irq_mask;
+-      const unsigned long bank_offset = bit_offset/8 * 8;
++      const unsigned long bank_offset = bit_offset / 8;
+       unsigned char cos_enable_state;
+       raw_spin_lock_irqsave(&idio24gpio->lock, flags);
+       idio24gpio->irq_mask &= ~BIT(bit_offset);
+-      new_irq_mask = idio24gpio->irq_mask >> bank_offset;
++      new_irq_mask = idio24gpio->irq_mask >> bank_offset * 8;
+       if (!new_irq_mask) {
+               cos_enable_state = ioread8(&idio24gpio->reg->cos_enable);
+@@ -389,12 +389,12 @@ static void idio_24_irq_unmask(struct ir
+       unsigned long flags;
+       unsigned char prev_irq_mask;
+       const unsigned long bit_offset = irqd_to_hwirq(data) - 24;
+-      const unsigned long bank_offset = bit_offset/8 * 8;
++      const unsigned long bank_offset = bit_offset / 8;
+       unsigned char cos_enable_state;
+       raw_spin_lock_irqsave(&idio24gpio->lock, flags);
+-      prev_irq_mask = idio24gpio->irq_mask >> bank_offset;
++      prev_irq_mask = idio24gpio->irq_mask >> bank_offset * 8;
+       idio24gpio->irq_mask |= BIT(bit_offset);
+       if (!prev_irq_mask) {
diff --git a/queue-4.19/gpio-pcie-idio-24-fix-irq-mask-when-masking.patch b/queue-4.19/gpio-pcie-idio-24-fix-irq-mask-when-masking.patch
new file mode 100644 (file)
index 0000000..1605914
--- /dev/null
@@ -0,0 +1,34 @@
+From d8f270efeac850c569c305dc0baa42ac3d607988 Mon Sep 17 00:00:00 2001
+From: Arnaud de Turckheim <quarium@gmail.com>
+Date: Wed, 4 Nov 2020 16:24:53 +0100
+Subject: gpio: pcie-idio-24: Fix irq mask when masking
+
+From: Arnaud de Turckheim <quarium@gmail.com>
+
+commit d8f270efeac850c569c305dc0baa42ac3d607988 upstream.
+
+Fix the bitwise operation to remove only the corresponding bit from the
+mask.
+
+Fixes: 585562046628 ("gpio: Add GPIO support for the ACCES PCIe-IDIO-24 family")
+Cc: stable@vger.kernel.org
+Signed-off-by: Arnaud de Turckheim <quarium@gmail.com>
+Reviewed-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-pcie-idio-24.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-pcie-idio-24.c
++++ b/drivers/gpio/gpio-pcie-idio-24.c
+@@ -365,7 +365,7 @@ static void idio_24_irq_mask(struct irq_
+       raw_spin_lock_irqsave(&idio24gpio->lock, flags);
+-      idio24gpio->irq_mask &= BIT(bit_offset);
++      idio24gpio->irq_mask &= ~BIT(bit_offset);
+       new_irq_mask = idio24gpio->irq_mask >> bank_offset;
+       if (!new_irq_mask) {
diff --git a/queue-4.19/mmc-renesas_sdhi_core-add-missing-tmio_mmc_host_free-at-remove.patch b/queue-4.19/mmc-renesas_sdhi_core-add-missing-tmio_mmc_host_free-at-remove.patch
new file mode 100644 (file)
index 0000000..3db1dc2
--- /dev/null
@@ -0,0 +1,41 @@
+From e8973201d9b281375b5a8c66093de5679423021a Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 6 Nov 2020 18:25:30 +0900
+Subject: mmc: renesas_sdhi_core: Add missing tmio_mmc_host_free() at remove
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit e8973201d9b281375b5a8c66093de5679423021a upstream.
+
+The commit 94b110aff867 ("mmc: tmio: add tmio_mmc_host_alloc/free()")
+added tmio_mmc_host_free(), but missed the function calling in
+the sh_mobile_sdhi_remove() at that time. So, fix it. Otherwise,
+we cannot rebind the sdhi/mmc devices when we use aliases of mmc.
+
+Fixes: 94b110aff867 ("mmc: tmio: add tmio_mmc_host_alloc/free()")
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/1604654730-29914-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/host/renesas_sdhi_core.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mmc/host/renesas_sdhi_core.c
++++ b/drivers/mmc/host/renesas_sdhi_core.c
+@@ -764,6 +764,7 @@ int renesas_sdhi_remove(struct platform_
+       tmio_mmc_host_remove(host);
+       renesas_sdhi_clk_disable(host);
++      tmio_mmc_host_free(host);
+       return 0;
+ }
diff --git a/queue-4.19/selinux-fix-error-return-code-in-sel_ib_pkey_sid_slow.patch b/queue-4.19/selinux-fix-error-return-code-in-sel_ib_pkey_sid_slow.patch
new file mode 100644 (file)
index 0000000..6801552
--- /dev/null
@@ -0,0 +1,38 @@
+From c350f8bea271782e2733419bd2ab9bf4ec2051ef Mon Sep 17 00:00:00 2001
+From: Chen Zhou <chenzhou10@huawei.com>
+Date: Thu, 12 Nov 2020 21:53:32 +0800
+Subject: selinux: Fix error return code in sel_ib_pkey_sid_slow()
+
+From: Chen Zhou <chenzhou10@huawei.com>
+
+commit c350f8bea271782e2733419bd2ab9bf4ec2051ef upstream.
+
+Fix to return a negative error code from the error handling case
+instead of 0 in function sel_ib_pkey_sid_slow(), as done elsewhere
+in this function.
+
+Cc: stable@vger.kernel.org
+Fixes: 409dcf31538a ("selinux: Add a cache for quicker retreival of PKey SIDs")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Chen Zhou <chenzhou10@huawei.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/selinux/ibpkey.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/security/selinux/ibpkey.c
++++ b/security/selinux/ibpkey.c
+@@ -161,8 +161,10 @@ static int sel_ib_pkey_sid_slow(u64 subn
+        * is valid, it just won't be added to the cache.
+        */
+       new = kzalloc(sizeof(*new), GFP_ATOMIC);
+-      if (!new)
++      if (!new) {
++              ret = -ENOMEM;
+               goto out;
++      }
+       new->psec.subnet_prefix = subnet_prefix;
+       new->psec.pkey = pkey_num;
index d09e68949c15484f049c18eb9b2f7c5d8bd63e3d..00f4fdb5ee62e4de18004b1732e88a15f2be76db 100644 (file)
@@ -73,3 +73,10 @@ mei-protect-mei_cl_mtu-from-null-dereference.patch
 futex-don-t-enable-irqs-unconditionally-in-put_pi_state.patch
 ocfs2-initialize-ip_next_orphan.patch
 btrfs-fix-potential-overflow-in-cluster_pages_for_defrag-on-32bit-arch.patch
+selinux-fix-error-return-code-in-sel_ib_pkey_sid_slow.patch
+gpio-pcie-idio-24-fix-irq-mask-when-masking.patch
+gpio-pcie-idio-24-fix-irq-enable-register-value.patch
+gpio-pcie-idio-24-enable-pex8311-interrupts.patch
+mmc-renesas_sdhi_core-add-missing-tmio_mmc_host_free-at-remove.patch
+don-t-dump-the-threads-that-had-been-already-exiting-when-zapped.patch
+drm-gma500-fix-out-of-bounds-access-to-struct-drm_device.vblank.patch