From: Greg Kroah-Hartman Date: Tue, 8 Sep 2020 12:54:27 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.14.197~21 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0580e3541947faac694db3b707b23e520c350ba3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: affs-fix-basic-permission-bits-to-actually-work.patch alsa-ca0106-fix-error-code-handling.patch alsa-firewire-digi00x-exclude-avid-adrenaline-from-detection.patch alsa-hda-hdmi-always-check-pin-power-status-in-i915-pin-fixup.patch alsa-pcm-oss-remove-superfluous-warn_on-for-mulaw-sanity-check.patch block-allow-for_each_bvec-to-support-zero-len-bvec.patch block-move-sector_size-and-sector_shift-definitions-into-linux-blkdev.h.patch dm-cache-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch dm-thin-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch libata-implement-ata_horkage_max_trim_128m-and-apply-to-sandisks.patch mm-slub-fix-conversion-of-freelist_corrupted.patch --- diff --git a/queue-4.14/affs-fix-basic-permission-bits-to-actually-work.patch b/queue-4.14/affs-fix-basic-permission-bits-to-actually-work.patch new file mode 100644 index 00000000000..70967a0c2c5 --- /dev/null +++ b/queue-4.14/affs-fix-basic-permission-bits-to-actually-work.patch @@ -0,0 +1,171 @@ +From d3a84a8d0dde4e26bc084b36ffcbdc5932ac85e2 Mon Sep 17 00:00:00 2001 +From: Max Staudt +Date: Thu, 27 Aug 2020 17:49:00 +0200 +Subject: affs: fix basic permission bits to actually work + +From: Max Staudt + +commit d3a84a8d0dde4e26bc084b36ffcbdc5932ac85e2 upstream. + +The basic permission bits (protection bits in AmigaOS) have been broken +in Linux' AFFS - it would only set bits, but never delete them. +Also, contrary to the documentation, the Archived bit was not handled. + +Let's fix this for good, and set the bits such that Linux and classic +AmigaOS can coexist in the most peaceful manner. + +Also, update the documentation to represent the current state of things. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Max Staudt +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/filesystems/affs.txt | 16 ++++++++++------ + fs/affs/amigaffs.c | 27 +++++++++++++++++++++++++++ + fs/affs/file.c | 26 +++++++++++++++++++++++++- + 3 files changed, 62 insertions(+), 7 deletions(-) + +--- a/Documentation/filesystems/affs.txt ++++ b/Documentation/filesystems/affs.txt +@@ -93,13 +93,15 @@ The Amiga protection flags RWEDRWEDHSPAR + + - R maps to r for user, group and others. On directories, R implies x. + +- - If both W and D are allowed, w will be set. ++ - W maps to w. + + - E maps to x. + +- - H and P are always retained and ignored under Linux. ++ - D is ignored. + +- - A is always reset when a file is written to. ++ - H, S and P are always retained and ignored under Linux. ++ ++ - A is cleared when a file is written to. + + User id and group id will be used unless set[gu]id are given as mount + options. Since most of the Amiga file systems are single user systems +@@ -111,11 +113,13 @@ Linux -> Amiga: + + The Linux rwxrwxrwx file mode is handled as follows: + +- - r permission will set R for user, group and others. ++ - r permission will allow R for user, group and others. ++ ++ - w permission will allow W for user, group and others. + +- - w permission will set W and D for user, group and others. ++ - x permission of the user will allow E for plain files. + +- - x permission of the user will set E for plain files. ++ - D will be allowed for user, group and others. + + - All other flags (suid, sgid, ...) are ignored and will + not be retained. +--- a/fs/affs/amigaffs.c ++++ b/fs/affs/amigaffs.c +@@ -419,24 +419,51 @@ affs_mode_to_prot(struct inode *inode) + u32 prot = AFFS_I(inode)->i_protect; + umode_t mode = inode->i_mode; + ++ /* ++ * First, clear all RWED bits for owner, group, other. ++ * Then, recalculate them afresh. ++ * ++ * We'll always clear the delete-inhibit bit for the owner, as that is ++ * the classic single-user mode AmigaOS protection bit and we need to ++ * stay compatible with all scenarios. ++ * ++ * Since multi-user AmigaOS is an extension, we'll only set the ++ * delete-allow bit if any of the other bits in the same user class ++ * (group/other) are used. ++ */ ++ prot &= ~(FIBF_NOEXECUTE | FIBF_NOREAD ++ | FIBF_NOWRITE | FIBF_NODELETE ++ | FIBF_GRP_EXECUTE | FIBF_GRP_READ ++ | FIBF_GRP_WRITE | FIBF_GRP_DELETE ++ | FIBF_OTR_EXECUTE | FIBF_OTR_READ ++ | FIBF_OTR_WRITE | FIBF_OTR_DELETE); ++ ++ /* Classic single-user AmigaOS flags. These are inverted. */ + if (!(mode & 0100)) + prot |= FIBF_NOEXECUTE; + if (!(mode & 0400)) + prot |= FIBF_NOREAD; + if (!(mode & 0200)) + prot |= FIBF_NOWRITE; ++ ++ /* Multi-user extended flags. Not inverted. */ + if (mode & 0010) + prot |= FIBF_GRP_EXECUTE; + if (mode & 0040) + prot |= FIBF_GRP_READ; + if (mode & 0020) + prot |= FIBF_GRP_WRITE; ++ if (mode & 0070) ++ prot |= FIBF_GRP_DELETE; ++ + if (mode & 0001) + prot |= FIBF_OTR_EXECUTE; + if (mode & 0004) + prot |= FIBF_OTR_READ; + if (mode & 0002) + prot |= FIBF_OTR_WRITE; ++ if (mode & 0007) ++ prot |= FIBF_OTR_DELETE; + + AFFS_I(inode)->i_protect = prot; + } +--- a/fs/affs/file.c ++++ b/fs/affs/file.c +@@ -428,6 +428,24 @@ static int affs_write_begin(struct file + return ret; + } + ++static int affs_write_end(struct file *file, struct address_space *mapping, ++ loff_t pos, unsigned int len, unsigned int copied, ++ struct page *page, void *fsdata) ++{ ++ struct inode *inode = mapping->host; ++ int ret; ++ ++ ret = generic_write_end(file, mapping, pos, len, copied, page, fsdata); ++ ++ /* Clear Archived bit on file writes, as AmigaOS would do */ ++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { ++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; ++ mark_inode_dirty(inode); ++ } ++ ++ return ret; ++} ++ + static sector_t _affs_bmap(struct address_space *mapping, sector_t block) + { + return generic_block_bmap(mapping,block,affs_get_block); +@@ -437,7 +455,7 @@ const struct address_space_operations af + .readpage = affs_readpage, + .writepage = affs_writepage, + .write_begin = affs_write_begin, +- .write_end = generic_write_end, ++ .write_end = affs_write_end, + .direct_IO = affs_direct_IO, + .bmap = _affs_bmap + }; +@@ -794,6 +812,12 @@ done: + if (tmp > inode->i_size) + inode->i_size = AFFS_I(inode)->mmu_private = tmp; + ++ /* Clear Archived bit on file writes, as AmigaOS would do */ ++ if (AFFS_I(inode)->i_protect & FIBF_ARCHIVED) { ++ AFFS_I(inode)->i_protect &= ~FIBF_ARCHIVED; ++ mark_inode_dirty(inode); ++ } ++ + err_first_bh: + unlock_page(page); + put_page(page); diff --git a/queue-4.14/alsa-ca0106-fix-error-code-handling.patch b/queue-4.14/alsa-ca0106-fix-error-code-handling.patch new file mode 100644 index 00000000000..6d177d4fe89 --- /dev/null +++ b/queue-4.14/alsa-ca0106-fix-error-code-handling.patch @@ -0,0 +1,35 @@ +From ee0761d1d8222bcc5c86bf10849dc86cf008557c Mon Sep 17 00:00:00 2001 +From: Tong Zhang +Date: Mon, 24 Aug 2020 18:45:41 -0400 +Subject: ALSA: ca0106: fix error code handling + +From: Tong Zhang + +commit ee0761d1d8222bcc5c86bf10849dc86cf008557c upstream. + +snd_ca0106_spi_write() returns 1 on error, snd_ca0106_pcm_power_dac() +is returning the error code directly, and the caller is expecting an +negative error code + +Signed-off-by: Tong Zhang +Cc: +Link: https://lore.kernel.org/r/20200824224541.1260307-1-ztong0001@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/ca0106/ca0106_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/pci/ca0106/ca0106_main.c ++++ b/sound/pci/ca0106/ca0106_main.c +@@ -551,7 +551,8 @@ static int snd_ca0106_pcm_power_dac(stru + else + /* Power down */ + chip->spi_dac_reg[reg] |= bit; +- return snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]); ++ if (snd_ca0106_spi_write(chip, chip->spi_dac_reg[reg]) != 0) ++ return -ENXIO; + } + return 0; + } diff --git a/queue-4.14/alsa-firewire-digi00x-exclude-avid-adrenaline-from-detection.patch b/queue-4.14/alsa-firewire-digi00x-exclude-avid-adrenaline-from-detection.patch new file mode 100644 index 00000000000..b25c0dbe2bf --- /dev/null +++ b/queue-4.14/alsa-firewire-digi00x-exclude-avid-adrenaline-from-detection.patch @@ -0,0 +1,109 @@ +From acd46a6b6de88569654567810acad2b0a0a25cea Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 23 Aug 2020 16:55:45 +0900 +Subject: ALSA: firewire-digi00x: exclude Avid Adrenaline from detection + +From: Takashi Sakamoto + +commit acd46a6b6de88569654567810acad2b0a0a25cea upstream. + +Avid Adrenaline is reported that ALSA firewire-digi00x driver is bound to. +However, as long as he investigated, the design of this model is hardly +similar to the one of Digi 00x family. It's better to exclude the model +from modalias of ALSA firewire-digi00x driver. + +This commit changes device entries so that the model is excluded. + +$ python3 crpp < ~/git/am-config-rom/misc/avid-adrenaline.img + ROM header and bus information block + ----------------------------------------------------------------- +400 04203a9c bus_info_length 4, crc_length 32, crc 15004 +404 31333934 bus_name "1394" +408 e064a002 irmc 1, cmc 1, isc 1, bmc 0, cyc_clk_acc 100, max_rec 10 (2048) +40c 00a07e01 company_id 00a07e | +410 00085257 device_id 0100085257 | EUI-64 00a07e0100085257 + + root directory + ----------------------------------------------------------------- +414 0005d08c directory_length 5, crc 53388 +418 0300a07e vendor +41c 8100000c --> descriptor leaf at 44c +420 0c008380 node capabilities +424 8d000002 --> eui-64 leaf at 42c +428 d1000004 --> unit directory at 438 + + eui-64 leaf at 42c + ----------------------------------------------------------------- +42c 0002410f leaf_length 2, crc 16655 +430 00a07e01 company_id 00a07e | +434 00085257 device_id 0100085257 | EUI-64 00a07e0100085257 + + unit directory at 438 + ----------------------------------------------------------------- +438 0004d6c9 directory_length 4, crc 54985 +43c 1200a02d specifier id: 1394 TA +440 13014001 version: Vender Unique and AV/C +444 17000001 model +448 81000009 --> descriptor leaf at 46c + + descriptor leaf at 44c + ----------------------------------------------------------------- +44c 00077205 leaf_length 7, crc 29189 +450 00000000 textual descriptor +454 00000000 minimal ASCII +458 41766964 "Avid" +45c 20546563 " Tec" +460 686e6f6c "hnol" +464 6f677900 "ogy" +468 00000000 + + descriptor leaf at 46c + ----------------------------------------------------------------- +46c 000599a5 leaf_length 5, crc 39333 +470 00000000 textual descriptor +474 00000000 minimal ASCII +478 41647265 "Adre" +47c 6e616c69 "nali" +480 6e650000 "ne" + +Reported-by: Simon Wood +Fixes: 9edf723fd858 ("ALSA: firewire-digi00x: add skeleton for Digi 002/003 family") +Cc: # 4.4+ +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20200823075545.56305-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/digi00x/digi00x.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/firewire/digi00x/digi00x.c ++++ b/sound/firewire/digi00x/digi00x.c +@@ -15,6 +15,7 @@ MODULE_LICENSE("GPL v2"); + #define VENDOR_DIGIDESIGN 0x00a07e + #define MODEL_CONSOLE 0x000001 + #define MODEL_RACK 0x000002 ++#define SPEC_VERSION 0x000001 + + static int name_card(struct snd_dg00x *dg00x) + { +@@ -185,14 +186,18 @@ static const struct ieee1394_device_id s + /* Both of 002/003 use the same ID. */ + { + .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_VERSION | + IEEE1394_MATCH_MODEL_ID, + .vendor_id = VENDOR_DIGIDESIGN, ++ .version = SPEC_VERSION, + .model_id = MODEL_CONSOLE, + }, + { + .match_flags = IEEE1394_MATCH_VENDOR_ID | ++ IEEE1394_MATCH_VERSION | + IEEE1394_MATCH_MODEL_ID, + .vendor_id = VENDOR_DIGIDESIGN, ++ .version = SPEC_VERSION, + .model_id = MODEL_RACK, + }, + {} diff --git a/queue-4.14/alsa-hda-hdmi-always-check-pin-power-status-in-i915-pin-fixup.patch b/queue-4.14/alsa-hda-hdmi-always-check-pin-power-status-in-i915-pin-fixup.patch new file mode 100644 index 00000000000..26e75c05e95 --- /dev/null +++ b/queue-4.14/alsa-hda-hdmi-always-check-pin-power-status-in-i915-pin-fixup.patch @@ -0,0 +1,44 @@ +From 858e0ad9301d1270c02b5aca97537d2d6ee9dd68 Mon Sep 17 00:00:00 2001 +From: Kai Vehmanen +Date: Wed, 26 Aug 2020 20:03:06 +0300 +Subject: ALSA: hda/hdmi: always check pin power status in i915 pin fixup + +From: Kai Vehmanen + +commit 858e0ad9301d1270c02b5aca97537d2d6ee9dd68 upstream. + +When system is suspended with active audio playback to HDMI/DP, two +alternative sequences can happen at resume: + a) monitor is detected first and ALSA prepare follows normal + stream setup sequence, or + b) ALSA prepare is called first, but monitor is not yet detected, + so PCM is restarted without a pin, + +In case of (b), on i915 systems, haswell_verify_D0() is not called at +resume and the pin power state may be incorrect. Result is lack of audio +after resume with no error reported back to user-space. + +Fix the problem by always verifying converter and pin state in the +i915_pin_cvt_fixup(). + +BugLink: https://github.com/thesofproject/linux/issues/2388 +Signed-off-by: Kai Vehmanen +Cc: +Link: https://lore.kernel.org/r/20200826170306.701566-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2546,6 +2546,7 @@ static void i915_pin_cvt_fixup(struct hd + hda_nid_t cvt_nid) + { + if (per_pin) { ++ haswell_verify_D0(codec, per_pin->cvt_nid, per_pin->pin_nid); + snd_hda_set_dev_select(codec, per_pin->pin_nid, + per_pin->dev_id); + intel_verify_pin_cvt_connect(codec, per_pin); diff --git a/queue-4.14/alsa-pcm-oss-remove-superfluous-warn_on-for-mulaw-sanity-check.patch b/queue-4.14/alsa-pcm-oss-remove-superfluous-warn_on-for-mulaw-sanity-check.patch new file mode 100644 index 00000000000..776fd0bffcd --- /dev/null +++ b/queue-4.14/alsa-pcm-oss-remove-superfluous-warn_on-for-mulaw-sanity-check.patch @@ -0,0 +1,40 @@ +From 949a1ebe8cea7b342085cb6a4946b498306b9493 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 1 Sep 2020 15:18:02 +0200 +Subject: ALSA: pcm: oss: Remove superfluous WARN_ON() for mulaw sanity check + +From: Takashi Iwai + +commit 949a1ebe8cea7b342085cb6a4946b498306b9493 upstream. + +The PCM OSS mulaw plugin has a check of the format of the counter part +whether it's a linear format. The check is with snd_BUG_ON() that +emits WARN_ON() when the debug config is set, and it confuses +syzkaller as if it were a serious issue. Let's drop snd_BUG_ON() for +avoiding that. + +While we're at it, correct the error code to a more suitable, EINVAL. + +Reported-by: syzbot+23b22dc2e0b81cbfcc95@syzkaller.appspotmail.com +Cc: +Link: https://lore.kernel.org/r/20200901131802.18157-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/oss/mulaw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -329,8 +329,8 @@ int snd_pcm_plugin_build_mulaw(struct sn + snd_BUG(); + return -EINVAL; + } +- if (snd_BUG_ON(!snd_pcm_format_linear(format->format))) +- return -ENXIO; ++ if (!snd_pcm_format_linear(format->format)) ++ return -EINVAL; + + err = snd_pcm_plugin_build(plug, "Mu-Law<->linear conversion", + src_format, dst_format, diff --git a/queue-4.14/block-allow-for_each_bvec-to-support-zero-len-bvec.patch b/queue-4.14/block-allow-for_each_bvec-to-support-zero-len-bvec.patch new file mode 100644 index 00000000000..955ad7e8fd8 --- /dev/null +++ b/queue-4.14/block-allow-for_each_bvec-to-support-zero-len-bvec.patch @@ -0,0 +1,53 @@ +From 7e24969022cbd61ddc586f14824fc205661bb124 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Mon, 17 Aug 2020 18:00:55 +0800 +Subject: block: allow for_each_bvec to support zero len bvec + +From: Ming Lei + +commit 7e24969022cbd61ddc586f14824fc205661bb124 upstream. + +Block layer usually doesn't support or allow zero-length bvec. Since +commit 1bdc76aea115 ("iov_iter: use bvec iterator to implement +iterate_bvec()"), iterate_bvec() switches to bvec iterator. However, +Al mentioned that 'Zero-length segments are not disallowed' in iov_iter. + +Fixes for_each_bvec() so that it can move on after seeing one zero +length bvec. + +Fixes: 1bdc76aea115 ("iov_iter: use bvec iterator to implement iterate_bvec()") +Reported-by: syzbot +Signed-off-by: Ming Lei +Tested-by: Tetsuo Handa +Cc: Al Viro +Cc: Matthew Wilcox +Cc: +Link: https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2262077.html +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/bvec.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/include/linux/bvec.h ++++ b/include/linux/bvec.h +@@ -119,10 +119,17 @@ static inline bool bvec_iter_rewind(cons + return true; + } + ++static inline void bvec_iter_skip_zero_bvec(struct bvec_iter *iter) ++{ ++ iter->bi_bvec_done = 0; ++ iter->bi_idx++; ++} ++ + #define for_each_bvec(bvl, bio_vec, iter, start) \ + for (iter = (start); \ + (iter).bi_size && \ + ((bvl = bvec_iter_bvec((bio_vec), (iter))), 1); \ +- bvec_iter_advance((bio_vec), &(iter), (bvl).bv_len)) ++ (bvl).bv_len ? (void)bvec_iter_advance((bio_vec), &(iter), \ ++ (bvl).bv_len) : bvec_iter_skip_zero_bvec(&(iter))) + + #endif /* __LINUX_BVEC_ITER_H */ diff --git a/queue-4.14/block-move-sector_size-and-sector_shift-definitions-into-linux-blkdev.h.patch b/queue-4.14/block-move-sector_size-and-sector_shift-definitions-into-linux-blkdev.h.patch new file mode 100644 index 00000000000..e9f841eb8b1 --- /dev/null +++ b/queue-4.14/block-move-sector_size-and-sector_shift-definitions-into-linux-blkdev.h.patch @@ -0,0 +1,326 @@ +From 233bde21aa43516baa013ef7ac33f3427056db3e Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Wed, 14 Mar 2018 15:48:06 -0700 +Subject: block: Move SECTOR_SIZE and SECTOR_SHIFT definitions into + +From: Bart Van Assche + +commit 233bde21aa43516baa013ef7ac33f3427056db3e upstream. + +It happens often while I'm preparing a patch for a block driver that +I'm wondering: is a definition of SECTOR_SIZE and/or SECTOR_SHIFT +available for this driver? Do I have to introduce definitions of these +constants before I can use these constants? To avoid this confusion, +move the existing definitions of SECTOR_SIZE and SECTOR_SHIFT into the + header file such that these become available for all +block drivers. Make the SECTOR_SIZE definition in the uapi msdos_fs.h +header file conditional to avoid that including that header file after + causes the compiler to complain about a SECTOR_SIZE +redefinition. + +Note: the SECTOR_SIZE / SECTOR_SHIFT / SECTOR_BITS definitions have +not been removed from uapi header files nor from NAND drivers in +which these constants are used for another purpose than converting +block layer offsets and sizes into a number of sectors. + +Cc: David S. Miller +Cc: Mike Snitzer +Cc: Dan Williams +Cc: Minchan Kim +Cc: Nitin Gupta +Reviewed-by: Sergey Senozhatsky +Reviewed-by: Christoph Hellwig +Reviewed-by: Johannes Thumshirn +Reviewed-by: Martin K. Petersen +Signed-off-by: Bart Van Assche +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/platforms/iss/simdisk.c | 1 + drivers/block/brd.c | 1 + drivers/block/null_blk.c | 2 - + drivers/block/rbd.c | 9 ------- + drivers/block/zram/zram_drv.h | 1 + drivers/ide/ide-cd.c | 8 +++--- + drivers/ide/ide-cd.h | 6 ----- + drivers/nvdimm/nd.h | 1 + drivers/scsi/gdth.h | 3 -- + include/linux/blkdev.h | 42 ++++++++++++++++++++++++++---------- + include/linux/device-mapper.h | 2 - + include/linux/ide.h | 1 + include/uapi/linux/msdos_fs.h | 2 + + 13 files changed, 38 insertions(+), 41 deletions(-) + +--- a/arch/xtensa/platforms/iss/simdisk.c ++++ b/arch/xtensa/platforms/iss/simdisk.c +@@ -21,7 +21,6 @@ + #include + + #define SIMDISK_MAJOR 240 +-#define SECTOR_SHIFT 9 + #define SIMDISK_MINORS 1 + #define MAX_SIMDISK_COUNT 10 + +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -28,7 +28,6 @@ + + #include + +-#define SECTOR_SHIFT 9 + #define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT) + +--- a/drivers/block/null_blk.c ++++ b/drivers/block/null_blk.c +@@ -16,10 +16,8 @@ + #include + #include + +-#define SECTOR_SHIFT 9 + #define PAGE_SECTORS_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define PAGE_SECTORS (1 << PAGE_SECTORS_SHIFT) +-#define SECTOR_SIZE (1 << SECTOR_SHIFT) + #define SECTOR_MASK (PAGE_SECTORS - 1) + + #define FREE_BATCH 16 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -51,15 +51,6 @@ + #define RBD_DEBUG /* Activate rbd_assert() calls */ + + /* +- * The basic unit of block I/O is a sector. It is interpreted in a +- * number of contexts in Linux (blk, bio, genhd), but the default is +- * universally 512 bytes. These symbols are just slightly more +- * meaningful than the bare numbers they represent. +- */ +-#define SECTOR_SHIFT 9 +-#define SECTOR_SIZE (1ULL << SECTOR_SHIFT) +- +-/* + * Increment the given counter and return its updated value. + * If the counter is already 0 it will not be incremented. + * If the counter is already at its maximum value returns +--- a/drivers/block/zram/zram_drv.h ++++ b/drivers/block/zram/zram_drv.h +@@ -37,7 +37,6 @@ static const size_t max_zpage_size = PAG + + /*-- End of configurable params */ + +-#define SECTOR_SHIFT 9 + #define SECTORS_PER_PAGE_SHIFT (PAGE_SHIFT - SECTOR_SHIFT) + #define SECTORS_PER_PAGE (1 << SECTORS_PER_PAGE_SHIFT) + #define ZRAM_LOGICAL_BLOCK_SHIFT 12 +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -712,7 +712,7 @@ static ide_startstop_t cdrom_start_rw(id + struct request_queue *q = drive->queue; + int write = rq_data_dir(rq) == WRITE; + unsigned short sectors_per_frame = +- queue_logical_block_size(q) >> SECTOR_BITS; ++ queue_logical_block_size(q) >> SECTOR_SHIFT; + + ide_debug_log(IDE_DBG_RQ, "rq->cmd[0]: 0x%x, rq->cmd_flags: 0x%x, " + "secs_per_frame: %u", +@@ -919,7 +919,7 @@ static int cdrom_read_capacity(ide_drive + * end up being bogus. + */ + blocklen = be32_to_cpu(capbuf.blocklen); +- blocklen = (blocklen >> SECTOR_BITS) << SECTOR_BITS; ++ blocklen = (blocklen >> SECTOR_SHIFT) << SECTOR_SHIFT; + switch (blocklen) { + case 512: + case 1024: +@@ -935,7 +935,7 @@ static int cdrom_read_capacity(ide_drive + } + + *capacity = 1 + be32_to_cpu(capbuf.lba); +- *sectors_per_frame = blocklen >> SECTOR_BITS; ++ *sectors_per_frame = blocklen >> SECTOR_SHIFT; + + ide_debug_log(IDE_DBG_PROBE, "cap: %lu, sectors_per_frame: %lu", + *capacity, *sectors_per_frame); +@@ -1012,7 +1012,7 @@ int ide_cd_read_toc(ide_drive_t *drive, + drive->probed_capacity = toc->capacity * sectors_per_frame; + + blk_queue_logical_block_size(drive->queue, +- sectors_per_frame << SECTOR_BITS); ++ sectors_per_frame << SECTOR_SHIFT); + + /* first read just the header, so we know how long the TOC is */ + stat = cdrom_read_tocentry(drive, 0, 1, 0, (char *) &toc->hdr, +--- a/drivers/ide/ide-cd.h ++++ b/drivers/ide/ide-cd.h +@@ -21,11 +21,7 @@ + + /************************************************************************/ + +-#define SECTOR_BITS 9 +-#ifndef SECTOR_SIZE +-#define SECTOR_SIZE (1 << SECTOR_BITS) +-#endif +-#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_BITS) ++#define SECTORS_PER_FRAME (CD_FRAMESIZE >> SECTOR_SHIFT) + #define SECTOR_BUFFER_SIZE (CD_FRAMESIZE * 32) + + /* Capabilities Page size including 8 bytes of Mode Page Header */ +--- a/drivers/nvdimm/nd.h ++++ b/drivers/nvdimm/nd.h +@@ -29,7 +29,6 @@ enum { + * BTT instance + */ + ND_MAX_LANES = 256, +- SECTOR_SHIFT = 9, + INT_LBASIZE_ALIGNMENT = 64, + NVDIMM_IO_ATOMIC = 1, + }; +--- a/drivers/scsi/gdth.h ++++ b/drivers/scsi/gdth.h +@@ -178,9 +178,6 @@ + #define MSG_SIZE 34 /* size of message structure */ + #define MSG_REQUEST 0 /* async. event: message */ + +-/* cacheservice defines */ +-#define SECTOR_SIZE 0x200 /* always 512 bytes per sec. */ +- + /* DPMEM constants */ + #define DPMEM_MAGIC 0xC0FFEE11 + #define IC_HEADER_BYTES 48 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1016,6 +1016,19 @@ static inline struct request_queue *bdev + } + + /* ++ * The basic unit of block I/O is a sector. It is used in a number of contexts ++ * in Linux (blk, bio, genhd). The size of one sector is 512 = 2**9 ++ * bytes. Variables of type sector_t represent an offset or size that is a ++ * multiple of 512 bytes. Hence these two constants. ++ */ ++#ifndef SECTOR_SHIFT ++#define SECTOR_SHIFT 9 ++#endif ++#ifndef SECTOR_SIZE ++#define SECTOR_SIZE (1 << SECTOR_SHIFT) ++#endif ++ ++/* + * blk_rq_pos() : the current sector + * blk_rq_bytes() : bytes left in the entire request + * blk_rq_cur_bytes() : bytes left in the current segment +@@ -1042,12 +1055,12 @@ extern unsigned int blk_rq_err_bytes(con + + static inline unsigned int blk_rq_sectors(const struct request *rq) + { +- return blk_rq_bytes(rq) >> 9; ++ return blk_rq_bytes(rq) >> SECTOR_SHIFT; + } + + static inline unsigned int blk_rq_cur_sectors(const struct request *rq) + { +- return blk_rq_cur_bytes(rq) >> 9; ++ return blk_rq_cur_bytes(rq) >> SECTOR_SHIFT; + } + + /* +@@ -1067,7 +1080,8 @@ static inline unsigned int blk_queue_get + int op) + { + if (unlikely(op == REQ_OP_DISCARD || op == REQ_OP_SECURE_ERASE)) +- return min(q->limits.max_discard_sectors, UINT_MAX >> 9); ++ return min(q->limits.max_discard_sectors, ++ UINT_MAX >> SECTOR_SHIFT); + + if (unlikely(op == REQ_OP_WRITE_SAME)) + return q->limits.max_write_same_sectors; +@@ -1376,16 +1390,21 @@ extern int blkdev_issue_zeroout(struct b + static inline int sb_issue_discard(struct super_block *sb, sector_t block, + sector_t nr_blocks, gfp_t gfp_mask, unsigned long flags) + { +- return blkdev_issue_discard(sb->s_bdev, block << (sb->s_blocksize_bits - 9), +- nr_blocks << (sb->s_blocksize_bits - 9), ++ return blkdev_issue_discard(sb->s_bdev, ++ block << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), ++ nr_blocks << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), + gfp_mask, flags); + } + static inline int sb_issue_zeroout(struct super_block *sb, sector_t block, + sector_t nr_blocks, gfp_t gfp_mask) + { + return blkdev_issue_zeroout(sb->s_bdev, +- block << (sb->s_blocksize_bits - 9), +- nr_blocks << (sb->s_blocksize_bits - 9), ++ block << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), ++ nr_blocks << (sb->s_blocksize_bits - ++ SECTOR_SHIFT), + gfp_mask, 0); + } + +@@ -1492,7 +1511,8 @@ static inline int queue_alignment_offset + static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector) + { + unsigned int granularity = max(lim->physical_block_size, lim->io_min); +- unsigned int alignment = sector_div(sector, granularity >> 9) << 9; ++ unsigned int alignment = sector_div(sector, granularity >> SECTOR_SHIFT) ++ << SECTOR_SHIFT; + + return (granularity + lim->alignment_offset - alignment) % granularity; + } +@@ -1526,8 +1546,8 @@ static inline int queue_limit_discard_al + return 0; + + /* Why are these in bytes, not sectors? */ +- alignment = lim->discard_alignment >> 9; +- granularity = lim->discard_granularity >> 9; ++ alignment = lim->discard_alignment >> SECTOR_SHIFT; ++ granularity = lim->discard_granularity >> SECTOR_SHIFT; + if (!granularity) + return 0; + +@@ -1538,7 +1558,7 @@ static inline int queue_limit_discard_al + offset = (granularity + alignment - offset) % granularity; + + /* Turn it back into bytes, gaah */ +- return offset << 9; ++ return offset << SECTOR_SHIFT; + } + + static inline int bdev_discard_alignment(struct block_device *bdev) +--- a/include/linux/device-mapper.h ++++ b/include/linux/device-mapper.h +@@ -577,8 +577,6 @@ do { \ + #define DMEMIT(x...) sz += ((sz >= maxlen) ? \ + 0 : scnprintf(result + sz, maxlen - sz, x)) + +-#define SECTOR_SHIFT 9 +- + /* + * Definitions of return values from target end_io function. + */ +--- a/include/linux/ide.h ++++ b/include/linux/ide.h +@@ -165,7 +165,6 @@ struct ide_io_ports { + */ + #define PARTN_BITS 6 /* number of minor dev bits for partitions */ + #define MAX_DRIVES 2 /* per interface; 2 assumed by lots of code */ +-#define SECTOR_SIZE 512 + + /* + * Timeouts for various operations: +--- a/include/uapi/linux/msdos_fs.h ++++ b/include/uapi/linux/msdos_fs.h +@@ -10,7 +10,9 @@ + * The MS-DOS filesystem constants/structures + */ + ++#ifndef SECTOR_SIZE + #define SECTOR_SIZE 512 /* sector size (bytes) */ ++#endif + #define SECTOR_BITS 9 /* log2(SECTOR_SIZE) */ + #define MSDOS_DPB (MSDOS_DPS) /* dir entries per block */ + #define MSDOS_DPB_BITS 4 /* log2(MSDOS_DPB) */ diff --git a/queue-4.14/dm-cache-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch b/queue-4.14/dm-cache-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch new file mode 100644 index 00000000000..ce8bec66fed --- /dev/null +++ b/queue-4.14/dm-cache-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch @@ -0,0 +1,42 @@ +From d16ff19e69ab57e08bf908faaacbceaf660249de Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Tue, 1 Sep 2020 14:25:42 +0800 +Subject: dm cache metadata: Avoid returning cmd->bm wild pointer on error + +From: Ye Bin + +commit d16ff19e69ab57e08bf908faaacbceaf660249de upstream. + +Maybe __create_persistent_data_objects() caller will use PTR_ERR as a +pointer, it will lead to some strange things. + +Signed-off-by: Ye Bin +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-cache-metadata.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -536,12 +536,16 @@ static int __create_persistent_data_obje + CACHE_MAX_CONCURRENT_LOCKS); + if (IS_ERR(cmd->bm)) { + DMERR("could not create block manager"); +- return PTR_ERR(cmd->bm); ++ r = PTR_ERR(cmd->bm); ++ cmd->bm = NULL; ++ return r; + } + + r = __open_or_format_metadata(cmd, may_format_device); +- if (r) ++ if (r) { + dm_block_manager_destroy(cmd->bm); ++ cmd->bm = NULL; ++ } + + return r; + } diff --git a/queue-4.14/dm-thin-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch b/queue-4.14/dm-thin-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch new file mode 100644 index 00000000000..98051953137 --- /dev/null +++ b/queue-4.14/dm-thin-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch @@ -0,0 +1,42 @@ +From 219403d7e56f9b716ad80ab87db85d29547ee73e Mon Sep 17 00:00:00 2001 +From: Ye Bin +Date: Tue, 1 Sep 2020 14:25:43 +0800 +Subject: dm thin metadata: Avoid returning cmd->bm wild pointer on error + +From: Ye Bin + +commit 219403d7e56f9b716ad80ab87db85d29547ee73e upstream. + +Maybe __create_persistent_data_objects() caller will use PTR_ERR as a +pointer, it will lead to some strange things. + +Signed-off-by: Ye Bin +Cc: stable@vger.kernel.org +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin-metadata.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -698,12 +698,16 @@ static int __create_persistent_data_obje + THIN_MAX_CONCURRENT_LOCKS); + if (IS_ERR(pmd->bm)) { + DMERR("could not create block manager"); +- return PTR_ERR(pmd->bm); ++ r = PTR_ERR(pmd->bm); ++ pmd->bm = NULL; ++ return r; + } + + r = __open_or_format_metadata(pmd, format_device); +- if (r) ++ if (r) { + dm_block_manager_destroy(pmd->bm); ++ pmd->bm = NULL; ++ } + + return r; + } diff --git a/queue-4.14/libata-implement-ata_horkage_max_trim_128m-and-apply-to-sandisks.patch b/queue-4.14/libata-implement-ata_horkage_max_trim_128m-and-apply-to-sandisks.patch new file mode 100644 index 00000000000..e0a4164576d --- /dev/null +++ b/queue-4.14/libata-implement-ata_horkage_max_trim_128m-and-apply-to-sandisks.patch @@ -0,0 +1,79 @@ +From 3b5455636fe26ea21b4189d135a424a6da016418 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 2 Sep 2020 12:32:45 -0400 +Subject: libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks + +From: Tejun Heo + +commit 3b5455636fe26ea21b4189d135a424a6da016418 upstream. + +All three generations of Sandisk SSDs lock up hard intermittently. +Experiments showed that disabling NCQ lowered the failure rate significantly +and the kernel has been disabling NCQ for some models of SD7's and 8's, +which is obviously undesirable. + +Karthik worked with Sandisk to root cause the hard lockups to trim commands +larger than 128M. This patch implements ATA_HORKAGE_MAX_TRIM_128M which +limits max trim size to 128M and applies it to all three generations of +Sandisk SSDs. + +Signed-off-by: Tejun Heo +Cc: Karthik Shivaram +Cc: stable@vger.kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 5 ++--- + drivers/ata/libata-scsi.c | 8 +++++++- + include/linux/libata.h | 1 + + 3 files changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4488,9 +4488,8 @@ static const struct ata_blacklist_entry + /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ + { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, + +- /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on +- SD7SN6S256G and SD8SN8U256G */ +- { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, }, ++ /* Sandisk SD7/8/9s lock up hard on large trims */ ++ { "SanDisk SD[789]*", NULL, ATA_HORKAGE_MAX_TRIM_128M, }, + + /* devices which puke on READ_NATIVE_MAX */ + { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, }, +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -2392,6 +2392,7 @@ static unsigned int ata_scsiop_inq_89(st + + static unsigned int ata_scsiop_inq_b0(struct ata_scsi_args *args, u8 *rbuf) + { ++ struct ata_device *dev = args->dev; + u16 min_io_sectors; + + rbuf[1] = 0xb0; +@@ -2417,7 +2418,12 @@ static unsigned int ata_scsiop_inq_b0(st + * with the unmap bit set. + */ + if (ata_id_has_trim(args->id)) { +- put_unaligned_be64(65535 * ATA_MAX_TRIM_RNUM, &rbuf[36]); ++ u64 max_blocks = 65535 * ATA_MAX_TRIM_RNUM; ++ ++ if (dev->horkage & ATA_HORKAGE_MAX_TRIM_128M) ++ max_blocks = 128 << (20 - SECTOR_SHIFT); ++ ++ put_unaligned_be64(max_blocks, &rbuf[36]); + put_unaligned_be32(1, &rbuf[28]); + } + +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -440,6 +440,7 @@ enum { + ATA_HORKAGE_NO_DMA_LOG = (1 << 23), /* don't use DMA for log read */ + ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */ + ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */ ++ ATA_HORKAGE_MAX_TRIM_128M = (1 << 26), /* Limit max trim size to 128M */ + + /* DMA mask for user DMA control: User visible values; DO NOT + renumber */ diff --git a/queue-4.14/mm-slub-fix-conversion-of-freelist_corrupted.patch b/queue-4.14/mm-slub-fix-conversion-of-freelist_corrupted.patch new file mode 100644 index 00000000000..8e5f309fce8 --- /dev/null +++ b/queue-4.14/mm-slub-fix-conversion-of-freelist_corrupted.patch @@ -0,0 +1,76 @@ +From dc07a728d49cf025f5da2c31add438d839d076c0 Mon Sep 17 00:00:00 2001 +From: Eugeniu Rosca +Date: Fri, 4 Sep 2020 16:35:30 -0700 +Subject: mm: slub: fix conversion of freelist_corrupted() + +From: Eugeniu Rosca + +commit dc07a728d49cf025f5da2c31add438d839d076c0 upstream. + +Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in +deactivate_slab()") suffered an update when picked up from LKML [1]. + +Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()' +created a no-op statement. Fix it by sticking to the behavior intended +in the original patch [1]. In addition, make freelist_corrupted() +immune to passing NULL instead of &freelist. + +The issue has been spotted via static analysis and code review. + +[1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle.com/ + +Fixes: 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()") +Signed-off-by: Eugeniu Rosca +Signed-off-by: Andrew Morton +Cc: Dongli Zhang +Cc: Joe Jin +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: David Rientjes +Cc: Joonsoo Kim +Cc: +Link: https://lkml.kernel.org/r/20200824130643.10291-1-erosca@de.adit-jv.com +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/slub.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -659,12 +659,12 @@ static void slab_fix(struct kmem_cache * + } + + static bool freelist_corrupted(struct kmem_cache *s, struct page *page, +- void *freelist, void *nextfree) ++ void **freelist, void *nextfree) + { + if ((s->flags & SLAB_CONSISTENCY_CHECKS) && +- !check_valid_pointer(s, page, nextfree)) { +- object_err(s, page, freelist, "Freechain corrupt"); +- freelist = NULL; ++ !check_valid_pointer(s, page, nextfree) && freelist) { ++ object_err(s, page, *freelist, "Freechain corrupt"); ++ *freelist = NULL; + slab_fix(s, "Isolate corrupted freechain"); + return true; + } +@@ -1354,7 +1354,7 @@ static inline void dec_slabs_node(struct + int objects) {} + + static bool freelist_corrupted(struct kmem_cache *s, struct page *page, +- void *freelist, void *nextfree) ++ void **freelist, void *nextfree) + { + return false; + } +@@ -2053,7 +2053,7 @@ static void deactivate_slab(struct kmem_ + * 'freelist' is already corrupted. So isolate all objects + * starting at 'freelist'. + */ +- if (freelist_corrupted(s, page, freelist, nextfree)) ++ if (freelist_corrupted(s, page, &freelist, nextfree)) + break; + + do { diff --git a/queue-4.14/series b/queue-4.14/series index a688ab2e32e..6b87169beb9 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -44,3 +44,14 @@ uaccess-add-non-pagefault-user-space-write-function.patch btrfs-fix-potential-deadlock-in-the-search-ioctl.patch net-usb-qmi_wwan-add-telit-0x1050-composition.patch usb-qmi_wwan-add-d-link-dwm-222-a2-device-id.patch +alsa-ca0106-fix-error-code-handling.patch +alsa-pcm-oss-remove-superfluous-warn_on-for-mulaw-sanity-check.patch +alsa-hda-hdmi-always-check-pin-power-status-in-i915-pin-fixup.patch +alsa-firewire-digi00x-exclude-avid-adrenaline-from-detection.patch +affs-fix-basic-permission-bits-to-actually-work.patch +block-allow-for_each_bvec-to-support-zero-len-bvec.patch +block-move-sector_size-and-sector_shift-definitions-into-linux-blkdev.h.patch +libata-implement-ata_horkage_max_trim_128m-and-apply-to-sandisks.patch +dm-cache-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch +dm-thin-metadata-avoid-returning-cmd-bm-wild-pointer-on-error.patch +mm-slub-fix-conversion-of-freelist_corrupted.patch