From: Greg Kroah-Hartman Date: Sun, 6 Feb 2022 13:05:00 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.9.300~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1e3e105d3292184eb7c43ca22191f5adee0e39f5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: asoc-cpcap-check-for-null-pointer-after-calling-of_get_child_by_name.patch asoc-fsl-add-missing-error-handling-in-pcm030_fabric_probe.patch asoc-max9759-fix-underflow-in-speaker_gain_control_put.patch asoc-xilinx-xlnx_formatter_pcm-make-buffer-bytes-multiple-of-period-bytes.patch drm-i915-overlay-prevent-divide-by-zero-bugs-in-scaling.patch ib-rdmavt-validate-remote_addr-during-loopback-atomic-tests.patch iommu-amd-fix-loop-timeout-issue-in-iommu_ga_log_enable.patch iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping.patch net-ieee802154-ca8210-stop-leaking-skb-s.patch net-ieee802154-hwsim-ensure-proper-channel-selection-at-probe-time.patch net-ieee802154-mcr20a-fix-lifs-sifs-periods.patch net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch net-macsec-verify-that-send_sci-is-on-when-setting-tx-sci-explicitly.patch net-stmmac-dump-gmac4-dma-registers-correctly.patch net-stmmac-ensure-ptp-time-register-reads-are-consistent.patch nfsd-nfsd4_setclientid_confirm-mistakenly-expires-confirmed-client.patch pinctrl-bcm2835-fix-a-few-error-paths.patch rdma-mlx4-don-t-continue-event-handler-after-memory-allocation-failure.patch rdma-siw-fix-broken-rdma-read-fence-resume-logic.patch scsi-bnx2fc-make-bnx2fc_recv_frame-mp-safe.patch selftests-futex-use-variable-make-instead-of-make.patch spi-bcm-qspi-check-for-valid-cs-before-applying-chip-select.patch spi-mediatek-avoid-null-pointer-crash-in-interrupt.patch spi-meson-spicc-add-irq-check-in-meson_spicc_probe.patch --- diff --git a/queue-5.4/asoc-cpcap-check-for-null-pointer-after-calling-of_get_child_by_name.patch b/queue-5.4/asoc-cpcap-check-for-null-pointer-after-calling-of_get_child_by_name.patch new file mode 100644 index 00000000000..93acb46abad --- /dev/null +++ b/queue-5.4/asoc-cpcap-check-for-null-pointer-after-calling-of_get_child_by_name.patch @@ -0,0 +1,36 @@ +From f7a6021aaf02088870559f82fc13c58cda7fea1a Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Tue, 11 Jan 2022 10:50:48 +0800 +Subject: ASoC: cpcap: Check for NULL pointer after calling of_get_child_by_name + +From: Jiasheng Jiang + +commit f7a6021aaf02088870559f82fc13c58cda7fea1a upstream. + +If the device does not exist, of_get_child_by_name() will return NULL +pointer. +And devm_snd_soc_register_component() does not check it. +Also, I have noticed that cpcap_codec_driver has not been used yet. +Therefore, it should be better to check it in order to avoid the future +dereference of the NULL pointer. + +Fixes: f6cdf2d3445d ("ASoC: cpcap: new codec") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220111025048.524134-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/cpcap.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/soc/codecs/cpcap.c ++++ b/sound/soc/codecs/cpcap.c +@@ -1541,6 +1541,8 @@ static int cpcap_codec_probe(struct plat + { + struct device_node *codec_node = + of_get_child_by_name(pdev->dev.parent->of_node, "audio-codec"); ++ if (!codec_node) ++ return -ENODEV; + + pdev->dev.of_node = codec_node; + diff --git a/queue-5.4/asoc-fsl-add-missing-error-handling-in-pcm030_fabric_probe.patch b/queue-5.4/asoc-fsl-add-missing-error-handling-in-pcm030_fabric_probe.patch new file mode 100644 index 00000000000..cf5abd02742 --- /dev/null +++ b/queue-5.4/asoc-fsl-add-missing-error-handling-in-pcm030_fabric_probe.patch @@ -0,0 +1,48 @@ +From fb25621da5702c104ce0a48de5b174ced09e5b4e Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 27 Jan 2022 13:13:34 +0000 +Subject: ASoC: fsl: Add missing error handling in pcm030_fabric_probe + +From: Miaoqian Lin + +commit fb25621da5702c104ce0a48de5b174ced09e5b4e upstream. + +Add the missing platform_device_put() and platform_device_del() +before return from pcm030_fabric_probe in the error handling case. + +Fixes: c912fa913446 ("ASoC: fsl: register the wm9712-codec") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220127131336.30214-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/pcm030-audio-fabric.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/sound/soc/fsl/pcm030-audio-fabric.c ++++ b/sound/soc/fsl/pcm030-audio-fabric.c +@@ -93,16 +93,21 @@ static int pcm030_fabric_probe(struct pl + dev_err(&op->dev, "platform_device_alloc() failed\n"); + + ret = platform_device_add(pdata->codec_device); +- if (ret) ++ if (ret) { + dev_err(&op->dev, "platform_device_add() failed: %d\n", ret); ++ platform_device_put(pdata->codec_device); ++ } + + ret = snd_soc_register_card(card); +- if (ret) ++ if (ret) { + dev_err(&op->dev, "snd_soc_register_card() failed: %d\n", ret); ++ platform_device_del(pdata->codec_device); ++ platform_device_put(pdata->codec_device); ++ } + + platform_set_drvdata(op, pdata); +- + return ret; ++ + } + + static int pcm030_fabric_remove(struct platform_device *op) diff --git a/queue-5.4/asoc-max9759-fix-underflow-in-speaker_gain_control_put.patch b/queue-5.4/asoc-max9759-fix-underflow-in-speaker_gain_control_put.patch new file mode 100644 index 00000000000..24d66558c9a --- /dev/null +++ b/queue-5.4/asoc-max9759-fix-underflow-in-speaker_gain_control_put.patch @@ -0,0 +1,36 @@ +From 4c907bcd9dcd233da6707059d777ab389dcbd964 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 19 Jan 2022 15:31:01 +0300 +Subject: ASoC: max9759: fix underflow in speaker_gain_control_put() + +From: Dan Carpenter + +commit 4c907bcd9dcd233da6707059d777ab389dcbd964 upstream. + +Check for negative values of "priv->gain" to prevent an out of bounds +access. The concern is that these might come from the user via: + -> snd_ctl_elem_write_user() + -> snd_ctl_elem_write() + -> kctl->put() + +Fixes: fa8d915172b8 ("ASoC: max9759: Add Amplifier Driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20220119123101.GA9509@kili +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/max9759.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/soc/codecs/max9759.c ++++ b/sound/soc/codecs/max9759.c +@@ -64,7 +64,8 @@ static int speaker_gain_control_put(stru + struct snd_soc_component *c = snd_soc_kcontrol_component(kcontrol); + struct max9759 *priv = snd_soc_component_get_drvdata(c); + +- if (ucontrol->value.integer.value[0] > 3) ++ if (ucontrol->value.integer.value[0] < 0 || ++ ucontrol->value.integer.value[0] > 3) + return -EINVAL; + + priv->gain = ucontrol->value.integer.value[0]; diff --git a/queue-5.4/asoc-xilinx-xlnx_formatter_pcm-make-buffer-bytes-multiple-of-period-bytes.patch b/queue-5.4/asoc-xilinx-xlnx_formatter_pcm-make-buffer-bytes-multiple-of-period-bytes.patch new file mode 100644 index 00000000000..87276c79414 --- /dev/null +++ b/queue-5.4/asoc-xilinx-xlnx_formatter_pcm-make-buffer-bytes-multiple-of-period-bytes.patch @@ -0,0 +1,90 @@ +From e958b5884725dac86d36c1e7afe5a55f31feb0b2 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Fri, 7 Jan 2022 15:47:06 -0600 +Subject: ASoC: xilinx: xlnx_formatter_pcm: Make buffer bytes multiple of period bytes + +From: Robert Hancock + +commit e958b5884725dac86d36c1e7afe5a55f31feb0b2 upstream. + +This patch is based on one in the Xilinx kernel tree, "ASoc: xlnx: Make +buffer bytes multiple of period bytes" by Devarsh Thakkar. The same +issue exists in the mainline version of the driver. The original +patch description is as follows: + +"The Xilinx Audio Formatter IP has a constraint on period +bytes to be multiple of 64. This leads to driver changing +the period size to suitable frames such that period bytes +are multiple of 64. + +Now since period bytes and period size are updated but not +the buffer bytes, this may make the buffer bytes unaligned +and not multiple of period bytes. + +When this happens we hear popping noise as while DMA is being +done the buffer bytes are not enough to complete DMA access +for last period of frame within the application buffer boundary. + +To avoid this, align buffer bytes too as multiple of 64, and +set another constraint to always enforce number of periods as +integer. Now since, there is already a rule in alsa core +to enforce Buffer size = Number of Periods * Period Size +this automatically aligns buffer bytes as multiple of period +bytes." + +Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver") +Cc: Devarsh Thakkar +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20220107214711.1100162-2-robert.hancock@calian.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/xilinx/xlnx_formatter_pcm.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +--- a/sound/soc/xilinx/xlnx_formatter_pcm.c ++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c +@@ -37,6 +37,7 @@ + #define XLNX_AUD_XFER_COUNT 0x28 + #define XLNX_AUD_CH_STS_START 0x2C + #define XLNX_BYTES_PER_CH 0x44 ++#define XLNX_AUD_ALIGN_BYTES 64 + + #define AUD_STS_IOC_IRQ_MASK BIT(31) + #define AUD_STS_CH_STS_MASK BIT(29) +@@ -370,12 +371,32 @@ static int xlnx_formatter_pcm_open(struc + snd_soc_set_runtime_hwparams(substream, &xlnx_pcm_hardware); + runtime->private_data = stream_data; + +- /* Resize the period size divisible by 64 */ ++ /* Resize the period bytes as divisible by 64 */ + err = snd_pcm_hw_constraint_step(runtime, 0, +- SNDRV_PCM_HW_PARAM_PERIOD_BYTES, 64); ++ SNDRV_PCM_HW_PARAM_PERIOD_BYTES, ++ XLNX_AUD_ALIGN_BYTES); + if (err) { + dev_err(component->dev, +- "unable to set constraint on period bytes\n"); ++ "Unable to set constraint on period bytes\n"); ++ return err; ++ } ++ ++ /* Resize the buffer bytes as divisible by 64 */ ++ err = snd_pcm_hw_constraint_step(runtime, 0, ++ SNDRV_PCM_HW_PARAM_BUFFER_BYTES, ++ XLNX_AUD_ALIGN_BYTES); ++ if (err) { ++ dev_err(component->dev, ++ "Unable to set constraint on buffer bytes\n"); ++ return err; ++ } ++ ++ /* Set periods as integer multiple */ ++ err = snd_pcm_hw_constraint_integer(runtime, ++ SNDRV_PCM_HW_PARAM_PERIODS); ++ if (err < 0) { ++ dev_err(component->dev, ++ "Unable to set constraint on periods to be integer\n"); + return err; + } + diff --git a/queue-5.4/drm-i915-overlay-prevent-divide-by-zero-bugs-in-scaling.patch b/queue-5.4/drm-i915-overlay-prevent-divide-by-zero-bugs-in-scaling.patch new file mode 100644 index 00000000000..360108c7425 --- /dev/null +++ b/queue-5.4/drm-i915-overlay-prevent-divide-by-zero-bugs-in-scaling.patch @@ -0,0 +1,44 @@ +From 90a3d22ff02b196d5884e111f39271a1d4ee8e3e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 24 Jan 2022 15:24:09 +0300 +Subject: drm/i915/overlay: Prevent divide by zero bugs in scaling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +commit 90a3d22ff02b196d5884e111f39271a1d4ee8e3e upstream. + +Smatch detected a divide by zero bug in check_overlay_scaling(). + + drivers/gpu/drm/i915/display/intel_overlay.c:976 check_overlay_scaling() + error: potential divide by zero bug '/ rec->dst_height'. + drivers/gpu/drm/i915/display/intel_overlay.c:980 check_overlay_scaling() + error: potential divide by zero bug '/ rec->dst_width'. + +Prevent this by ensuring that the dst height and width are non-zero. + +Fixes: 02e792fbaadb ("drm/i915: implement drmmode overlay support v4") +Signed-off-by: Dan Carpenter +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220124122409.GA31673@kili +(cherry picked from commit cf5b64f7f10b28bebb9b7c9d25e7aee5cbe43918) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_overlay.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_overlay.c ++++ b/drivers/gpu/drm/i915/display/intel_overlay.c +@@ -913,6 +913,9 @@ static int check_overlay_dst(struct inte + const struct intel_crtc_state *pipe_config = + overlay->crtc->config; + ++ if (rec->dst_height == 0 || rec->dst_width == 0) ++ return -EINVAL; ++ + if (rec->dst_x < pipe_config->pipe_src_w && + rec->dst_x + rec->dst_width <= pipe_config->pipe_src_w && + rec->dst_y < pipe_config->pipe_src_h && diff --git a/queue-5.4/ib-rdmavt-validate-remote_addr-during-loopback-atomic-tests.patch b/queue-5.4/ib-rdmavt-validate-remote_addr-during-loopback-atomic-tests.patch new file mode 100644 index 00000000000..902b78a2b04 --- /dev/null +++ b/queue-5.4/ib-rdmavt-validate-remote_addr-during-loopback-atomic-tests.patch @@ -0,0 +1,42 @@ +From 4028bccb003cf67e46632dee7f97ddc5d7b6e685 Mon Sep 17 00:00:00 2001 +From: Mike Marciniszyn +Date: Wed, 19 Jan 2022 04:28:09 -0500 +Subject: IB/rdmavt: Validate remote_addr during loopback atomic tests + +From: Mike Marciniszyn + +commit 4028bccb003cf67e46632dee7f97ddc5d7b6e685 upstream. + +The rdma-core test suite sends an unaligned remote address and expects a +failure. + +ERROR: test_atomic_non_aligned_addr (tests.test_atomic.AtomicTest) + +The qib/hfi1 rc handling validates properly, but the test has the client +and server on the same system. + +The loopback of these operations is a distinct code path. + +Fix by syntaxing the proposed remote address in the loopback code path. + +Fixes: 15703461533a ("IB/{hfi1, qib, rdmavt}: Move ruc_loopback to rdmavt") +Link: https://lore.kernel.org/r/1642584489-141005-1-git-send-email-mike.marciniszyn@cornelisnetworks.com +Reviewed-by: Dennis Dalessandro +Signed-off-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rdmavt/qp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/infiniband/sw/rdmavt/qp.c ++++ b/drivers/infiniband/sw/rdmavt/qp.c +@@ -3110,6 +3110,8 @@ do_write: + case IB_WR_ATOMIC_FETCH_AND_ADD: + if (unlikely(!(qp->qp_access_flags & IB_ACCESS_REMOTE_ATOMIC))) + goto inv_err; ++ if (unlikely(wqe->atomic_wr.remote_addr & (sizeof(u64) - 1))) ++ goto inv_err; + if (unlikely(!rvt_rkey_ok(qp, &qp->r_sge.sge, sizeof(u64), + wqe->atomic_wr.remote_addr, + wqe->atomic_wr.rkey, diff --git a/queue-5.4/iommu-amd-fix-loop-timeout-issue-in-iommu_ga_log_enable.patch b/queue-5.4/iommu-amd-fix-loop-timeout-issue-in-iommu_ga_log_enable.patch new file mode 100644 index 00000000000..d9772594fc0 --- /dev/null +++ b/queue-5.4/iommu-amd-fix-loop-timeout-issue-in-iommu_ga_log_enable.patch @@ -0,0 +1,45 @@ +From 9b45a7738eec52bf0f5d8d3d54e822962781c5f2 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Fri, 4 Feb 2022 12:55:37 +0100 +Subject: iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() + +From: Joerg Roedel + +commit 9b45a7738eec52bf0f5d8d3d54e822962781c5f2 upstream. + +The polling loop for the register change in iommu_ga_log_enable() needs +to have a udelay() in it. Otherwise the CPU might be faster than the +IOMMU hardware and wrongly trigger the WARN_ON() further down the code +stream. Use a 10us for udelay(), has there is some hardware where +activation of the GA log can take more than a 100ms. + +A future optimization should move the activation check of the GA log +to the point where it gets used for the first time. But that is a +bigger change and not suitable for a fix. + +Fixes: 8bda0cfbdc1a ("iommu/amd: Detect and initialize guest vAPIC log") +Signed-off-by: Joerg Roedel +Link: https://lore.kernel.org/r/20220204115537.3894-1-joro@8bytes.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/amd_iommu_init.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -759,6 +760,7 @@ static int iommu_ga_log_enable(struct am + status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET); + if (status & (MMIO_STATUS_GALOG_RUN_MASK)) + break; ++ udelay(10); + } + + if (i >= LOOP_TIMEOUT) diff --git a/queue-5.4/iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping.patch b/queue-5.4/iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping.patch new file mode 100644 index 00000000000..e42ed5033ba --- /dev/null +++ b/queue-5.4/iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping.patch @@ -0,0 +1,69 @@ +From 99e675d473eb8cf2deac1376a0f840222fc1adcf Mon Sep 17 00:00:00 2001 +From: Guoqing Jiang +Date: Fri, 28 Jan 2022 11:10:02 +0800 +Subject: iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() + +From: Guoqing Jiang + +commit 99e675d473eb8cf2deac1376a0f840222fc1adcf upstream. + +After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node +unconditionally allocated"). For tear down scenario, fn is only freed +after fail to allocate ir_domain, though it also should be freed in case +dmar_enable_qi returns error. + +Besides free fn, irq_domain and ir_msi_domain need to be removed as well +if intel_setup_irq_remapping fails to enable queued invalidation. + +Improve the rewinding path by add out_free_ir_domain and out_free_fwnode +lables per Baolu's suggestion. + +Fixes: e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated") +Suggested-by: Lu Baolu +Signed-off-by: Guoqing Jiang +Link: https://lore.kernel.org/r/20220119063640.16864-1-guoqing.jiang@linux.dev +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20220128031002.2219155-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/intel_irq_remapping.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -570,9 +570,8 @@ static int intel_setup_irq_remapping(str + fn, &intel_ir_domain_ops, + iommu); + if (!iommu->ir_domain) { +- irq_domain_free_fwnode(fn); + pr_err("IR%d: failed to allocate irqdomain\n", iommu->seq_id); +- goto out_free_bitmap; ++ goto out_free_fwnode; + } + iommu->ir_msi_domain = + arch_create_remap_msi_irq_domain(iommu->ir_domain, +@@ -596,7 +595,7 @@ static int intel_setup_irq_remapping(str + + if (dmar_enable_qi(iommu)) { + pr_err("Failed to enable queued invalidation\n"); +- goto out_free_bitmap; ++ goto out_free_ir_domain; + } + } + +@@ -620,6 +619,14 @@ static int intel_setup_irq_remapping(str + + return 0; + ++out_free_ir_domain: ++ if (iommu->ir_msi_domain) ++ irq_domain_remove(iommu->ir_msi_domain); ++ iommu->ir_msi_domain = NULL; ++ irq_domain_remove(iommu->ir_domain); ++ iommu->ir_domain = NULL; ++out_free_fwnode: ++ irq_domain_free_fwnode(fn); + out_free_bitmap: + bitmap_free(bitmap); + out_free_pages: diff --git a/queue-5.4/net-ieee802154-ca8210-stop-leaking-skb-s.patch b/queue-5.4/net-ieee802154-ca8210-stop-leaking-skb-s.patch new file mode 100644 index 00000000000..68737ed1d7d --- /dev/null +++ b/queue-5.4/net-ieee802154-ca8210-stop-leaking-skb-s.patch @@ -0,0 +1,35 @@ +From 621b24b09eb61c63f262da0c9c5f0e93348897e5 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Tue, 25 Jan 2022 13:14:24 +0100 +Subject: net: ieee802154: ca8210: Stop leaking skb's + +From: Miquel Raynal + +commit 621b24b09eb61c63f262da0c9c5f0e93348897e5 upstream. + +Upon error the ieee802154_xmit_complete() helper is not called. Only +ieee802154_wake_queue() is called manually. We then leak the skb +structure. + +Free the skb structure upon error before returning. + +Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver") +Signed-off-by: Miquel Raynal +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20220125121426.848337-5-miquel.raynal@bootlin.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/ca8210.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1770,6 +1770,7 @@ static int ca8210_async_xmit_complete( + status + ); + if (status != MAC_TRANSACTION_OVERFLOW) { ++ dev_kfree_skb_any(priv->tx_skb); + ieee802154_wake_queue(priv->hw); + return 0; + } diff --git a/queue-5.4/net-ieee802154-hwsim-ensure-proper-channel-selection-at-probe-time.patch b/queue-5.4/net-ieee802154-hwsim-ensure-proper-channel-selection-at-probe-time.patch new file mode 100644 index 00000000000..b79ea6b860c --- /dev/null +++ b/queue-5.4/net-ieee802154-hwsim-ensure-proper-channel-selection-at-probe-time.patch @@ -0,0 +1,37 @@ +From 1293fccc9e892712d910ec96079d3717307f1d2d Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Tue, 25 Jan 2022 13:14:21 +0100 +Subject: net: ieee802154: hwsim: Ensure proper channel selection at probe time + +From: Miquel Raynal + +commit 1293fccc9e892712d910ec96079d3717307f1d2d upstream. + +Drivers are expected to set the PHY current_channel and current_page +according to their default state. The hwsim driver is advertising being +configured on channel 13 by default but that is not reflected in its own +internal pib structure. In order to ensure that this driver consider the +current channel as being 13 internally, we at least need to set the +pib->channel field to 13. + +Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") +Signed-off-by: Miquel Raynal +[stefan@datenfreihafen.org: fixed assigment from page to channel] +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20220125121426.848337-2-miquel.raynal@bootlin.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/mac802154_hwsim.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -786,6 +786,7 @@ static int hwsim_add_one(struct genl_inf + goto err_pib; + } + ++ pib->channel = 13; + rcu_assign_pointer(phy->pib, pib); + phy->idx = idx; + INIT_LIST_HEAD(&phy->edges); diff --git a/queue-5.4/net-ieee802154-mcr20a-fix-lifs-sifs-periods.patch b/queue-5.4/net-ieee802154-mcr20a-fix-lifs-sifs-periods.patch new file mode 100644 index 00000000000..4405e89dd25 --- /dev/null +++ b/queue-5.4/net-ieee802154-mcr20a-fix-lifs-sifs-periods.patch @@ -0,0 +1,37 @@ +From d753c4004820a888ec007dd88b271fa9c3172c5c Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Tue, 25 Jan 2022 13:14:22 +0100 +Subject: net: ieee802154: mcr20a: Fix lifs/sifs periods + +From: Miquel Raynal + +commit d753c4004820a888ec007dd88b271fa9c3172c5c upstream. + +These periods are expressed in time units (microseconds) while 40 and 12 +are the number of symbol durations these periods will last. We need to +multiply them both with phy->symbol_duration in order to get these +values in microseconds. + +Fixes: 8c6ad9cc5157 ("ieee802154: Add NXP MCR20A IEEE 802.15.4 transceiver driver") +Signed-off-by: Miquel Raynal +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20220125121426.848337-3-miquel.raynal@bootlin.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ieee802154/mcr20a.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ieee802154/mcr20a.c ++++ b/drivers/net/ieee802154/mcr20a.c +@@ -976,8 +976,8 @@ static void mcr20a_hw_setup(struct mcr20 + dev_dbg(printdev(lp), "%s\n", __func__); + + phy->symbol_duration = 16; +- phy->lifs_period = 40; +- phy->sifs_period = 12; ++ phy->lifs_period = 40 * phy->symbol_duration; ++ phy->sifs_period = 12 * phy->symbol_duration; + + hw->flags = IEEE802154_HW_TX_OMIT_CKSUM | + IEEE802154_HW_AFILT | diff --git a/queue-5.4/net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch b/queue-5.4/net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch new file mode 100644 index 00000000000..34a0ea6bc34 --- /dev/null +++ b/queue-5.4/net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch @@ -0,0 +1,61 @@ +From 79c37ca73a6e9a33f7b2b7783ba6af07a448c8a9 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Tue, 25 Jan 2022 13:14:25 +0100 +Subject: net: ieee802154: Return meaningful error codes from the netlink helpers + +From: Miquel Raynal + +commit 79c37ca73a6e9a33f7b2b7783ba6af07a448c8a9 upstream. + +Returning -1 does not indicate anything useful. + +Use a standard and meaningful error code instead. + +Fixes: a26c5fd7622d ("nl802154: add support for security layer") +Signed-off-by: Miquel Raynal +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20220125121426.848337-6-miquel.raynal@bootlin.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/nl802154.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ieee802154/nl802154.c ++++ b/net/ieee802154/nl802154.c +@@ -1457,7 +1457,7 @@ static int nl802154_send_key(struct sk_b + + hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); + if (!hdr) +- return -1; ++ return -ENOBUFS; + + if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) + goto nla_put_failure; +@@ -1650,7 +1650,7 @@ static int nl802154_send_device(struct s + + hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); + if (!hdr) +- return -1; ++ return -ENOBUFS; + + if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) + goto nla_put_failure; +@@ -1828,7 +1828,7 @@ static int nl802154_send_devkey(struct s + + hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); + if (!hdr) +- return -1; ++ return -ENOBUFS; + + if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) + goto nla_put_failure; +@@ -2004,7 +2004,7 @@ static int nl802154_send_seclevel(struct + + hdr = nl802154hdr_put(msg, portid, seq, flags, cmd); + if (!hdr) +- return -1; ++ return -ENOBUFS; + + if (nla_put_u32(msg, NL802154_ATTR_IFINDEX, dev->ifindex)) + goto nla_put_failure; diff --git a/queue-5.4/net-macsec-verify-that-send_sci-is-on-when-setting-tx-sci-explicitly.patch b/queue-5.4/net-macsec-verify-that-send_sci-is-on-when-setting-tx-sci-explicitly.patch new file mode 100644 index 00000000000..a2d9cde3712 --- /dev/null +++ b/queue-5.4/net-macsec-verify-that-send_sci-is-on-when-setting-tx-sci-explicitly.patch @@ -0,0 +1,47 @@ +From d0cfa548dbde354de986911d3913897b5448faad Mon Sep 17 00:00:00 2001 +From: Lior Nahmanson +Date: Sun, 30 Jan 2022 13:37:52 +0200 +Subject: net: macsec: Verify that send_sci is on when setting Tx sci explicitly + +From: Lior Nahmanson + +commit d0cfa548dbde354de986911d3913897b5448faad upstream. + +When setting Tx sci explicit, the Rx side is expected to use this +sci and not recalculate it from the packet.However, in case of Tx sci +is explicit and send_sci is off, the receiver is wrongly recalculate +the sci from the source MAC address which most likely be different +than the explicit sci. + +Fix by preventing such configuration when macsec newlink is established +and return EINVAL error code on such cases. + +Fixes: c09440f7dcb3 ("macsec: introduce IEEE 802.1AE driver") +Signed-off-by: Lior Nahmanson +Reviewed-by: Raed Salem +Signed-off-by: Raed Salem +Link: https://lore.kernel.org/r/1643542672-29403-1-git-send-email-raeds@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/macsec.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -3247,6 +3247,15 @@ static int macsec_newlink(struct net *ne + + macsec->real_dev = real_dev; + ++ /* send_sci must be set to true when transmit sci explicitly is set */ ++ if ((data && data[IFLA_MACSEC_SCI]) && ++ (data && data[IFLA_MACSEC_INC_SCI])) { ++ u8 send_sci = !!nla_get_u8(data[IFLA_MACSEC_INC_SCI]); ++ ++ if (!send_sci) ++ return -EINVAL; ++ } ++ + if (data && data[IFLA_MACSEC_ICV_LEN]) + icv_len = nla_get_u8(data[IFLA_MACSEC_ICV_LEN]); + mtu = real_dev->mtu - icv_len - macsec_extra_len(true); diff --git a/queue-5.4/net-stmmac-dump-gmac4-dma-registers-correctly.patch b/queue-5.4/net-stmmac-dump-gmac4-dma-registers-correctly.patch new file mode 100644 index 00000000000..f0cf5d0d230 --- /dev/null +++ b/queue-5.4/net-stmmac-dump-gmac4-dma-registers-correctly.patch @@ -0,0 +1,95 @@ +From 7af037c39b600bac2c716dd1228e8ddbe149573f Mon Sep 17 00:00:00 2001 +From: Camel Guo +Date: Mon, 31 Jan 2022 09:38:40 +0100 +Subject: net: stmmac: dump gmac4 DMA registers correctly + +From: Camel Guo + +commit 7af037c39b600bac2c716dd1228e8ddbe149573f upstream. + +Unlike gmac100, gmac1000, gmac4 has 27 DMA registers and they are +located at DMA_CHAN_BASE_ADDR (0x1100). In order for ethtool to dump +gmac4 DMA registers correctly, this commit checks if a net_device has +gmac4 and uses different logic to dump its DMA registers. + +This fixes the following KASAN warning, which can normally be triggered +by a command similar like "ethtool -d eth0": + +BUG: KASAN: vmalloc-out-of-bounds in dwmac4_dump_dma_regs+0x6d4/0xb30 +Write of size 4 at addr ffffffc010177100 by task ethtool/1839 + kasan_report+0x200/0x21c + __asan_report_store4_noabort+0x34/0x60 + dwmac4_dump_dma_regs+0x6d4/0xb30 + stmmac_ethtool_gregs+0x110/0x204 + ethtool_get_regs+0x200/0x4b0 + dev_ethtool+0x1dac/0x3800 + dev_ioctl+0x7c0/0xb50 + sock_ioctl+0x298/0x6c4 + ... + +Fixes: fbf68229ffe7 ("net: stmmac: unify registers dumps methods") +Signed-off-by: Camel Guo +Link: https://lore.kernel.org/r/20220131083841.3346801-1-camel.guo@axis.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h | 1 + + drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 19 +++++++++++++++++-- + 2 files changed, 18 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac_dma.h +@@ -128,6 +128,7 @@ + + #define NUM_DWMAC100_DMA_REGS 9 + #define NUM_DWMAC1000_DMA_REGS 23 ++#define NUM_DWMAC4_DMA_REGS 27 + + void dwmac_enable_dma_transmission(void __iomem *ioaddr); + void dwmac_enable_dma_irq(void __iomem *ioaddr, u32 chan); +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +@@ -21,10 +21,18 @@ + #include "dwxgmac2.h" + + #define REG_SPACE_SIZE 0x1060 ++#define GMAC4_REG_SPACE_SIZE 0x116C + #define MAC100_ETHTOOL_NAME "st_mac100" + #define GMAC_ETHTOOL_NAME "st_gmac" + #define XGMAC_ETHTOOL_NAME "st_xgmac" + ++/* Same as DMA_CHAN_BASE_ADDR defined in dwmac4_dma.h ++ * ++ * It is here because dwmac_dma.h and dwmac4_dam.h can not be included at the ++ * same time due to the conflicting macro names. ++ */ ++#define GMAC4_DMA_CHAN_BASE_ADDR 0x00001100 ++ + #define ETHTOOL_DMA_OFFSET 55 + + struct stmmac_stats { +@@ -413,6 +421,8 @@ static int stmmac_ethtool_get_regs_len(s + + if (priv->plat->has_xgmac) + return XGMAC_REGSIZE * 4; ++ else if (priv->plat->has_gmac4) ++ return GMAC4_REG_SPACE_SIZE; + return REG_SPACE_SIZE; + } + +@@ -425,8 +435,13 @@ static void stmmac_ethtool_gregs(struct + stmmac_dump_mac_regs(priv, priv->hw, reg_space); + stmmac_dump_dma_regs(priv, priv->ioaddr, reg_space); + +- if (!priv->plat->has_xgmac) { +- /* Copy DMA registers to where ethtool expects them */ ++ /* Copy DMA registers to where ethtool expects them */ ++ if (priv->plat->has_gmac4) { ++ /* GMAC4 dumps its DMA registers at its DMA_CHAN_BASE_ADDR */ ++ memcpy(®_space[ETHTOOL_DMA_OFFSET], ++ ®_space[GMAC4_DMA_CHAN_BASE_ADDR / 4], ++ NUM_DWMAC4_DMA_REGS * 4); ++ } else if (!priv->plat->has_xgmac) { + memcpy(®_space[ETHTOOL_DMA_OFFSET], + ®_space[DMA_BUS_MODE / 4], + NUM_DWMAC1000_DMA_REGS * 4); diff --git a/queue-5.4/net-stmmac-ensure-ptp-time-register-reads-are-consistent.patch b/queue-5.4/net-stmmac-ensure-ptp-time-register-reads-are-consistent.patch new file mode 100644 index 00000000000..7dfa91af009 --- /dev/null +++ b/queue-5.4/net-stmmac-ensure-ptp-time-register-reads-are-consistent.patch @@ -0,0 +1,55 @@ +From 80d4609008e6d696a279e39ae7458c916fcd44c1 Mon Sep 17 00:00:00 2001 +From: Yannick Vignon +Date: Thu, 3 Feb 2022 17:00:25 +0100 +Subject: net: stmmac: ensure PTP time register reads are consistent + +From: Yannick Vignon + +commit 80d4609008e6d696a279e39ae7458c916fcd44c1 upstream. + +Even if protected from preemption and interrupts, a small time window +remains when the 2 register reads could return inconsistent values, +each time the "seconds" register changes. This could lead to an about +1-second error in the reported time. + +Add logic to ensure the "seconds" and "nanoseconds" values are consistent. + +Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver") +Signed-off-by: Yannick Vignon +Reviewed-by: Russell King (Oracle) +Link: https://lore.kernel.org/r/20220203160025.750632-1-yannick.vignon@oss.nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -149,15 +149,20 @@ static int adjust_systime(void __iomem * + + static void get_systime(void __iomem *ioaddr, u64 *systime) + { +- u64 ns; ++ u64 ns, sec0, sec1; + +- /* Get the TSSS value */ +- ns = readl(ioaddr + PTP_STNSR); +- /* Get the TSS and convert sec time value to nanosecond */ +- ns += readl(ioaddr + PTP_STSR) * 1000000000ULL; ++ /* Get the TSS value */ ++ sec1 = readl_relaxed(ioaddr + PTP_STSR); ++ do { ++ sec0 = sec1; ++ /* Get the TSSS value */ ++ ns = readl_relaxed(ioaddr + PTP_STNSR); ++ /* Get the TSS value */ ++ sec1 = readl_relaxed(ioaddr + PTP_STSR); ++ } while (sec0 != sec1); + + if (systime) +- *systime = ns; ++ *systime = ns + (sec1 * 1000000000ULL); + } + + const struct stmmac_hwtimestamp stmmac_ptp = { diff --git a/queue-5.4/nfsd-nfsd4_setclientid_confirm-mistakenly-expires-confirmed-client.patch b/queue-5.4/nfsd-nfsd4_setclientid_confirm-mistakenly-expires-confirmed-client.patch new file mode 100644 index 00000000000..abb0adb6e46 --- /dev/null +++ b/queue-5.4/nfsd-nfsd4_setclientid_confirm-mistakenly-expires-confirmed-client.patch @@ -0,0 +1,45 @@ +From ab451ea952fe9d7afefae55ddb28943a148247fe Mon Sep 17 00:00:00 2001 +From: Dai Ngo +Date: Wed, 26 Jan 2022 13:13:38 -0800 +Subject: nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. + +From: Dai Ngo + +commit ab451ea952fe9d7afefae55ddb28943a148247fe upstream. + +From RFC 7530 Section 16.34.5: + +o The server has not recorded an unconfirmed { v, x, c, *, * } and + has recorded a confirmed { v, x, c, *, s }. If the principals of + the record and of SETCLIENTID_CONFIRM do not match, the server + returns NFS4ERR_CLID_INUSE without removing any relevant leased + client state, and without changing recorded callback and + callback_ident values for client { x }. + +The current code intends to do what the spec describes above but +it forgot to set 'old' to NULL resulting to the confirmed client +to be expired. + +Fixes: 2b63482185e6 ("nfsd: fix clid_inuse on mount with security change") +Signed-off-by: Dai Ngo +Signed-off-by: Chuck Lever +Reviewed-by: Bruce Fields +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4state.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3941,8 +3941,10 @@ nfsd4_setclientid_confirm(struct svc_rqs + status = nfserr_clid_inuse; + if (client_has_state(old) + && !same_creds(&unconf->cl_cred, +- &old->cl_cred)) ++ &old->cl_cred)) { ++ old = NULL; + goto out; ++ } + status = mark_client_expired_locked(old); + if (status) { + old = NULL; diff --git a/queue-5.4/pinctrl-bcm2835-fix-a-few-error-paths.patch b/queue-5.4/pinctrl-bcm2835-fix-a-few-error-paths.patch new file mode 100644 index 00000000000..afe10c78dfd --- /dev/null +++ b/queue-5.4/pinctrl-bcm2835-fix-a-few-error-paths.patch @@ -0,0 +1,78 @@ +From 5297c693d8c8e08fa742e3112cf70723f7a04da2 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 27 Jan 2022 13:50:31 -0800 +Subject: pinctrl: bcm2835: Fix a few error paths + +From: Florian Fainelli + +commit 5297c693d8c8e08fa742e3112cf70723f7a04da2 upstream. + +After commit 266423e60ea1 ("pinctrl: bcm2835: Change init order for gpio +hogs") a few error paths would not unwind properly the registration of +gpio ranges. Correct that by assigning a single error label and goto it +whenever we encounter a fatal error. + +Fixes: 266423e60ea1 ("pinctrl: bcm2835: Change init order for gpio hogs") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220127215033.267227-1-f.fainelli@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -1261,16 +1261,18 @@ static int bcm2835_pinctrl_probe(struct + sizeof(*girq->parents), + GFP_KERNEL); + if (!girq->parents) { +- pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); +- return -ENOMEM; ++ err = -ENOMEM; ++ goto out_remove; + } + + if (is_7211) { + pc->wake_irq = devm_kcalloc(dev, BCM2835_NUM_IRQS, + sizeof(*pc->wake_irq), + GFP_KERNEL); +- if (!pc->wake_irq) +- return -ENOMEM; ++ if (!pc->wake_irq) { ++ err = -ENOMEM; ++ goto out_remove; ++ } + } + + /* +@@ -1294,8 +1296,10 @@ static int bcm2835_pinctrl_probe(struct + + len = strlen(dev_name(pc->dev)) + 16; + name = devm_kzalloc(pc->dev, len, GFP_KERNEL); +- if (!name) +- return -ENOMEM; ++ if (!name) { ++ err = -ENOMEM; ++ goto out_remove; ++ } + + snprintf(name, len, "%s:bank%d", dev_name(pc->dev), i); + +@@ -1314,11 +1318,14 @@ static int bcm2835_pinctrl_probe(struct + err = gpiochip_add_data(&pc->gpio_chip, pc); + if (err) { + dev_err(dev, "could not add GPIO chip\n"); +- pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); +- return err; ++ goto out_remove; + } + + return 0; ++ ++out_remove: ++ pinctrl_remove_gpio_range(pc->pctl_dev, &pc->gpio_range); ++ return err; + } + + static struct platform_driver bcm2835_pinctrl_driver = { diff --git a/queue-5.4/rdma-mlx4-don-t-continue-event-handler-after-memory-allocation-failure.patch b/queue-5.4/rdma-mlx4-don-t-continue-event-handler-after-memory-allocation-failure.patch new file mode 100644 index 00000000000..7d2910870ec --- /dev/null +++ b/queue-5.4/rdma-mlx4-don-t-continue-event-handler-after-memory-allocation-failure.patch @@ -0,0 +1,40 @@ +From f3136c4ce7acf64bee43135971ca52a880572e32 Mon Sep 17 00:00:00 2001 +From: Leon Romanovsky +Date: Mon, 31 Jan 2022 11:45:26 +0200 +Subject: RDMA/mlx4: Don't continue event handler after memory allocation failure +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +commit f3136c4ce7acf64bee43135971ca52a880572e32 upstream. + +The failure to allocate memory during MLX4_DEV_EVENT_PORT_MGMT_CHANGE +event handler will cause skip the assignment logic, but +ib_dispatch_event() will be called anyway. + +Fix it by calling to return instead of break after memory allocation +failure. + +Fixes: 00f5ce99dc6e ("mlx4: Use port management change event instead of smp_snoop") +Link: https://lore.kernel.org/r/12a0e83f18cfad4b5f62654f141e240d04915e10.1643622264.git.leonro@nvidia.com +Signed-off-by: Leon Romanovsky +Reviewed-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -3291,7 +3291,7 @@ static void mlx4_ib_event(struct mlx4_de + case MLX4_DEV_EVENT_PORT_MGMT_CHANGE: + ew = kmalloc(sizeof *ew, GFP_ATOMIC); + if (!ew) +- break; ++ return; + + INIT_WORK(&ew->work, handle_port_mgmt_change_event); + memcpy(&ew->ib_eqe, eqe, sizeof *eqe); diff --git a/queue-5.4/rdma-siw-fix-broken-rdma-read-fence-resume-logic.patch b/queue-5.4/rdma-siw-fix-broken-rdma-read-fence-resume-logic.patch new file mode 100644 index 00000000000..2f956e16106 --- /dev/null +++ b/queue-5.4/rdma-siw-fix-broken-rdma-read-fence-resume-logic.patch @@ -0,0 +1,97 @@ +From b43a76f423aa304037603fd6165c4a534d2c09a7 Mon Sep 17 00:00:00 2001 +From: Bernard Metzler +Date: Sun, 30 Jan 2022 18:08:15 +0100 +Subject: RDMA/siw: Fix broken RDMA Read Fence/Resume logic. + +From: Bernard Metzler + +commit b43a76f423aa304037603fd6165c4a534d2c09a7 upstream. + +Code unconditionally resumed fenced SQ processing after next RDMA Read +completion, even if other RDMA Read responses are still outstanding, or +ORQ is full. Also adds comments for better readability of fence +processing, and removes orq_get_tail() helper, which is not needed +anymore. + +Fixes: 8b6a361b8c48 ("rdma/siw: receive path") +Fixes: a531975279f3 ("rdma/siw: main include file") +Link: https://lore.kernel.org/r/20220130170815.1940-1-bmt@zurich.ibm.com +Reported-by: Jared Holzman +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/siw/siw.h | 7 +------ + drivers/infiniband/sw/siw/siw_qp_rx.c | 20 +++++++++++--------- + 2 files changed, 12 insertions(+), 15 deletions(-) + +--- a/drivers/infiniband/sw/siw/siw.h ++++ b/drivers/infiniband/sw/siw/siw.h +@@ -658,14 +658,9 @@ static inline struct siw_sqe *orq_get_cu + return &qp->orq[qp->orq_get % qp->attrs.orq_size]; + } + +-static inline struct siw_sqe *orq_get_tail(struct siw_qp *qp) +-{ +- return &qp->orq[qp->orq_put % qp->attrs.orq_size]; +-} +- + static inline struct siw_sqe *orq_get_free(struct siw_qp *qp) + { +- struct siw_sqe *orq_e = orq_get_tail(qp); ++ struct siw_sqe *orq_e = &qp->orq[qp->orq_put % qp->attrs.orq_size]; + + if (READ_ONCE(orq_e->flags) == 0) + return orq_e; +--- a/drivers/infiniband/sw/siw/siw_qp_rx.c ++++ b/drivers/infiniband/sw/siw/siw_qp_rx.c +@@ -1153,11 +1153,12 @@ static int siw_check_tx_fence(struct siw + + spin_lock_irqsave(&qp->orq_lock, flags); + +- rreq = orq_get_current(qp); +- + /* free current orq entry */ ++ rreq = orq_get_current(qp); + WRITE_ONCE(rreq->flags, 0); + ++ qp->orq_get++; ++ + if (qp->tx_ctx.orq_fence) { + if (unlikely(tx_waiting->wr_status != SIW_WR_QUEUED)) { + pr_warn("siw: [QP %u]: fence resume: bad status %d\n", +@@ -1165,10 +1166,12 @@ static int siw_check_tx_fence(struct siw + rv = -EPROTO; + goto out; + } +- /* resume SQ processing */ ++ /* resume SQ processing, if possible */ + if (tx_waiting->sqe.opcode == SIW_OP_READ || + tx_waiting->sqe.opcode == SIW_OP_READ_LOCAL_INV) { +- rreq = orq_get_tail(qp); ++ ++ /* SQ processing was stopped because of a full ORQ */ ++ rreq = orq_get_free(qp); + if (unlikely(!rreq)) { + pr_warn("siw: [QP %u]: no ORQE\n", qp_id(qp)); + rv = -EPROTO; +@@ -1181,15 +1184,14 @@ static int siw_check_tx_fence(struct siw + resume_tx = 1; + + } else if (siw_orq_empty(qp)) { ++ /* ++ * SQ processing was stopped by fenced work request. ++ * Resume since all previous Read's are now completed. ++ */ + qp->tx_ctx.orq_fence = 0; + resume_tx = 1; +- } else { +- pr_warn("siw: [QP %u]: fence resume: orq idx: %d:%d\n", +- qp_id(qp), qp->orq_get, qp->orq_put); +- rv = -EPROTO; + } + } +- qp->orq_get++; + out: + spin_unlock_irqrestore(&qp->orq_lock, flags); + diff --git a/queue-5.4/scsi-bnx2fc-make-bnx2fc_recv_frame-mp-safe.patch b/queue-5.4/scsi-bnx2fc-make-bnx2fc_recv_frame-mp-safe.patch new file mode 100644 index 00000000000..dc6916c5025 --- /dev/null +++ b/queue-5.4/scsi-bnx2fc-make-bnx2fc_recv_frame-mp-safe.patch @@ -0,0 +1,92 @@ +From 936bd03405fc83ba039d42bc93ffd4b88418f1d3 Mon Sep 17 00:00:00 2001 +From: John Meneghini +Date: Mon, 24 Jan 2022 09:51:10 -0500 +Subject: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe + +From: John Meneghini + +commit 936bd03405fc83ba039d42bc93ffd4b88418f1d3 upstream. + +Running tests with a debug kernel shows that bnx2fc_recv_frame() is +modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot +a debug kernel and run the bnx2fc driver with the hardware enabled. + +[ 1391.699147] BUG: using smp_processor_id() in preemptible [00000000] code: bnx2fc_ +[ 1391.699160] caller is bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] +[ 1391.699174] CPU: 2 PID: 4355 Comm: bnx2fc_l2_threa Kdump: loaded Tainted: G B +[ 1391.699180] Hardware name: HP ProLiant DL120 G7, BIOS J01 07/01/2013 +[ 1391.699183] Call Trace: +[ 1391.699188] dump_stack_lvl+0x57/0x7d +[ 1391.699198] check_preemption_disabled+0xc8/0xd0 +[ 1391.699205] bnx2fc_recv_frame+0xbf9/0x1760 [bnx2fc] +[ 1391.699215] ? do_raw_spin_trylock+0xb5/0x180 +[ 1391.699221] ? bnx2fc_npiv_create_vports.isra.0+0x4e0/0x4e0 [bnx2fc] +[ 1391.699229] ? bnx2fc_l2_rcv_thread+0xb7/0x3a0 [bnx2fc] +[ 1391.699240] bnx2fc_l2_rcv_thread+0x1af/0x3a0 [bnx2fc] +[ 1391.699250] ? bnx2fc_ulp_init+0xc0/0xc0 [bnx2fc] +[ 1391.699258] kthread+0x364/0x420 +[ 1391.699263] ? _raw_spin_unlock_irq+0x24/0x50 +[ 1391.699268] ? set_kthread_struct+0x100/0x100 +[ 1391.699273] ret_from_fork+0x22/0x30 + +Restore the old get_cpu/put_cpu code with some modifications to reduce the +size of the critical section. + +Link: https://lore.kernel.org/r/20220124145110.442335-1-jmeneghi@redhat.com +Fixes: d576a5e80cd0 ("bnx2fc: Improve stats update mechanism") +Tested-by: Guangwu Zhang +Acked-by: Saurav Kashyap +Signed-off-by: John Meneghini +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -506,7 +506,8 @@ static int bnx2fc_l2_rcv_thread(void *ar + + static void bnx2fc_recv_frame(struct sk_buff *skb) + { +- u32 fr_len; ++ u64 crc_err; ++ u32 fr_len, fr_crc; + struct fc_lport *lport; + struct fcoe_rcv_info *fr; + struct fc_stats *stats; +@@ -540,6 +541,11 @@ static void bnx2fc_recv_frame(struct sk_ + skb_pull(skb, sizeof(struct fcoe_hdr)); + fr_len = skb->len - sizeof(struct fcoe_crc_eof); + ++ stats = per_cpu_ptr(lport->stats, get_cpu()); ++ stats->RxFrames++; ++ stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; ++ put_cpu(); ++ + fp = (struct fc_frame *)skb; + fc_frame_init(fp); + fr_dev(fp) = lport; +@@ -622,16 +628,15 @@ static void bnx2fc_recv_frame(struct sk_ + return; + } + +- stats = per_cpu_ptr(lport->stats, smp_processor_id()); +- stats->RxFrames++; +- stats->RxWords += fr_len / FCOE_WORD_TO_BYTE; ++ fr_crc = le32_to_cpu(fr_crc(fp)); + +- if (le32_to_cpu(fr_crc(fp)) != +- ~crc32(~0, skb->data, fr_len)) { +- if (stats->InvalidCRCCount < 5) ++ if (unlikely(fr_crc != ~crc32(~0, skb->data, fr_len))) { ++ stats = per_cpu_ptr(lport->stats, get_cpu()); ++ crc_err = (stats->InvalidCRCCount++); ++ put_cpu(); ++ if (crc_err < 5) + printk(KERN_WARNING PFX "dropping frame with " + "CRC error\n"); +- stats->InvalidCRCCount++; + kfree_skb(skb); + return; + } diff --git a/queue-5.4/selftests-futex-use-variable-make-instead-of-make.patch b/queue-5.4/selftests-futex-use-variable-make-instead-of-make.patch new file mode 100644 index 00000000000..8cfcdc3db63 --- /dev/null +++ b/queue-5.4/selftests-futex-use-variable-make-instead-of-make.patch @@ -0,0 +1,46 @@ +From b9199181a9ef8252e47e207be8c23e1f50662620 Mon Sep 17 00:00:00 2001 +From: Muhammad Usama Anjum +Date: Thu, 27 Jan 2022 22:44:46 +0500 +Subject: selftests: futex: Use variable MAKE instead of make +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Muhammad Usama Anjum + +commit b9199181a9ef8252e47e207be8c23e1f50662620 upstream. + +Recursive make commands should always use the variable MAKE, not the +explicit command name ‘make’. This has benefits and removes the +following warning when multiple jobs are used for the build: + +make[2]: warning: jobserver unavailable: using -j1. Add '+' to parent make rule. + +Fixes: a8ba798bc8ec ("selftests: enable O and KBUILD_OUTPUT") +Signed-off-by: Muhammad Usama Anjum +Reviewed-by: André Almeida +Signed-off-by: Shuah Khan +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/futex/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/futex/Makefile ++++ b/tools/testing/selftests/futex/Makefile +@@ -11,7 +11,7 @@ all: + @for DIR in $(SUBDIRS); do \ + BUILD_TARGET=$(OUTPUT)/$$DIR; \ + mkdir $$BUILD_TARGET -p; \ +- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ ++ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ + if [ -e $$DIR/$(TEST_PROGS) ]; then \ + rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \ + fi \ +@@ -32,6 +32,6 @@ override define CLEAN + @for DIR in $(SUBDIRS); do \ + BUILD_TARGET=$(OUTPUT)/$$DIR; \ + mkdir $$BUILD_TARGET -p; \ +- make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ ++ $(MAKE) OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ + done + endef diff --git a/queue-5.4/series b/queue-5.4/series index 99ca66b2363..7a61cfaa99d 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -13,3 +13,27 @@ mm-kmemleak-avoid-scanning-potential-huge-holes.patch block-bio-integrity-advance-seed-correctly-for-larger-interval-sizes.patch revert-asoc-mediatek-check-for-error-clk-pointer.patch memcg-charge-fs_context-and-legacy_fs_context.patch +ib-rdmavt-validate-remote_addr-during-loopback-atomic-tests.patch +rdma-siw-fix-broken-rdma-read-fence-resume-logic.patch +rdma-mlx4-don-t-continue-event-handler-after-memory-allocation-failure.patch +iommu-vt-d-fix-potential-memory-leak-in-intel_setup_irq_remapping.patch +iommu-amd-fix-loop-timeout-issue-in-iommu_ga_log_enable.patch +spi-bcm-qspi-check-for-valid-cs-before-applying-chip-select.patch +spi-mediatek-avoid-null-pointer-crash-in-interrupt.patch +spi-meson-spicc-add-irq-check-in-meson_spicc_probe.patch +net-ieee802154-hwsim-ensure-proper-channel-selection-at-probe-time.patch +net-ieee802154-mcr20a-fix-lifs-sifs-periods.patch +net-ieee802154-ca8210-stop-leaking-skb-s.patch +net-ieee802154-return-meaningful-error-codes-from-the-netlink-helpers.patch +net-macsec-verify-that-send_sci-is-on-when-setting-tx-sci-explicitly.patch +net-stmmac-dump-gmac4-dma-registers-correctly.patch +net-stmmac-ensure-ptp-time-register-reads-are-consistent.patch +drm-i915-overlay-prevent-divide-by-zero-bugs-in-scaling.patch +asoc-fsl-add-missing-error-handling-in-pcm030_fabric_probe.patch +asoc-xilinx-xlnx_formatter_pcm-make-buffer-bytes-multiple-of-period-bytes.patch +asoc-cpcap-check-for-null-pointer-after-calling-of_get_child_by_name.patch +asoc-max9759-fix-underflow-in-speaker_gain_control_put.patch +pinctrl-bcm2835-fix-a-few-error-paths.patch +scsi-bnx2fc-make-bnx2fc_recv_frame-mp-safe.patch +nfsd-nfsd4_setclientid_confirm-mistakenly-expires-confirmed-client.patch +selftests-futex-use-variable-make-instead-of-make.patch diff --git a/queue-5.4/spi-bcm-qspi-check-for-valid-cs-before-applying-chip-select.patch b/queue-5.4/spi-bcm-qspi-check-for-valid-cs-before-applying-chip-select.patch new file mode 100644 index 00000000000..ebf26511d89 --- /dev/null +++ b/queue-5.4/spi-bcm-qspi-check-for-valid-cs-before-applying-chip-select.patch @@ -0,0 +1,36 @@ +From 2cbd27267ffe020af1442b95ec57f59a157ba85c Mon Sep 17 00:00:00 2001 +From: Kamal Dasu +Date: Thu, 27 Jan 2022 13:53:59 -0500 +Subject: spi: bcm-qspi: check for valid cs before applying chip select + +From: Kamal Dasu + +commit 2cbd27267ffe020af1442b95ec57f59a157ba85c upstream. + +Apply only valid chip select value. This change fixes case where chip +select is set to initial value of '-1' during probe and PM supend and +subsequent resume can try to use the value with undefined behaviour. +Also in case where gpio based chip select, the check in +bcm_qspi_chip_select() shall prevent undefined behaviour on resume. + +Fixes: fa236a7ef240 ("spi: bcm-qspi: Add Broadcom MSPI driver") +Signed-off-by: Kamal Dasu +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220127185359.27322-1-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-bcm-qspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -509,7 +509,7 @@ static void bcm_qspi_chip_select(struct + u32 rd = 0; + u32 wr = 0; + +- if (qspi->base[CHIP_SELECT]) { ++ if (cs >= 0 && qspi->base[CHIP_SELECT]) { + rd = bcm_qspi_read(qspi, CHIP_SELECT, 0); + wr = (rd & ~0xff) | (1 << cs); + if (rd == wr) diff --git a/queue-5.4/spi-mediatek-avoid-null-pointer-crash-in-interrupt.patch b/queue-5.4/spi-mediatek-avoid-null-pointer-crash-in-interrupt.patch new file mode 100644 index 00000000000..8fb670fc278 --- /dev/null +++ b/queue-5.4/spi-mediatek-avoid-null-pointer-crash-in-interrupt.patch @@ -0,0 +1,34 @@ +From f83a96e5f033fbbd21764705cb9c04234b96218e Mon Sep 17 00:00:00 2001 +From: Benjamin Gaignard +Date: Mon, 31 Jan 2022 15:17:08 +0100 +Subject: spi: mediatek: Avoid NULL pointer crash in interrupt + +From: Benjamin Gaignard + +commit f83a96e5f033fbbd21764705cb9c04234b96218e upstream. + +In some case, like after a transfer timeout, master->cur_msg pointer +is NULL which led to a kernel crash when trying to use master->cur_msg->spi. +mtk_spi_can_dma(), pointed by master->can_dma, doesn't use this parameter +avoid the problem by setting NULL as second parameter. + +Fixes: a568231f46322 ("spi: mediatek: Add spi bus for Mediatek MT8173") +Signed-off-by: Benjamin Gaignard +Link: https://lore.kernel.org/r/20220131141708.888710-1-benjamin.gaignard@collabora.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-mt65xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-mt65xx.c ++++ b/drivers/spi/spi-mt65xx.c +@@ -533,7 +533,7 @@ static irqreturn_t mtk_spi_interrupt(int + else + mdata->state = MTK_SPI_IDLE; + +- if (!master->can_dma(master, master->cur_msg->spi, trans)) { ++ if (!master->can_dma(master, NULL, trans)) { + if (trans->rx_buf) { + cnt = mdata->xfer_len / 4; + ioread32_rep(mdata->base + SPI_RX_DATA_REG, diff --git a/queue-5.4/spi-meson-spicc-add-irq-check-in-meson_spicc_probe.patch b/queue-5.4/spi-meson-spicc-add-irq-check-in-meson_spicc_probe.patch new file mode 100644 index 00000000000..1c980185253 --- /dev/null +++ b/queue-5.4/spi-meson-spicc-add-irq-check-in-meson_spicc_probe.patch @@ -0,0 +1,37 @@ +From e937440f7fc444a3e3f1fb75ea65292d6f433a44 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Wed, 26 Jan 2022 11:04:47 +0000 +Subject: spi: meson-spicc: add IRQ check in meson_spicc_probe + +From: Miaoqian Lin + +commit e937440f7fc444a3e3f1fb75ea65292d6f433a44 upstream. + +This check misses checking for platform_get_irq()'s call and may passes +the negative error codes to devm_request_irq(), which takes unsigned IRQ #, +causing it to fail with -EINVAL, overriding an original error code. +Stop calling devm_request_irq() with invalid IRQ #s. + +Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220126110447.24549-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -527,6 +527,11 @@ static int meson_spicc_probe(struct plat + writel_relaxed(0, spicc->base + SPICC_INTREG); + + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { ++ ret = irq; ++ goto out_master; ++ } ++ + ret = devm_request_irq(&pdev->dev, irq, meson_spicc_irq, + 0, NULL, spicc); + if (ret) {