From: Sasha Levin Date: Thu, 20 Jun 2019 00:06:57 +0000 (-0400) Subject: fixes for 4.14 X-Git-Tag: v5.1.13~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2a2a4ae204bfabd43064d4011c1e98087cb37c94;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/alsa-hda-force-polling-mode-on-cnl-for-fixing-codec-.patch b/queue-4.14/alsa-hda-force-polling-mode-on-cnl-for-fixing-codec-.patch new file mode 100644 index 00000000000..a80602c2f8c --- /dev/null +++ b/queue-4.14/alsa-hda-force-polling-mode-on-cnl-for-fixing-codec-.patch @@ -0,0 +1,44 @@ +From 4bb6d78da93c6ffa89c4d413092c3c59e4cfd401 Mon Sep 17 00:00:00 2001 +From: Bard Liao +Date: Mon, 27 May 2019 00:58:32 +0800 +Subject: ALSA: hda - Force polling mode on CNL for fixing codec communication + +[ Upstream commit fa763f1b2858752e6150ffff46886a1b7faffc82 ] + +We observed the same issue as reported by commit a8d7bde23e7130686b7662 +("ALSA: hda - Force polling mode on CFL for fixing codec communication") +We don't have a better solution. So apply the same workaround to CNL. + +Signed-off-by: Bard Liao +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 65fb1e7edb9c..d349f69ef03c 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -376,6 +376,7 @@ enum { + + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) + #define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348) ++#define IS_CNL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x9dc8) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", +@@ -1751,8 +1752,8 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, + else + chip->bdl_pos_adj = bdl_pos_adj[dev]; + +- /* Workaround for a communication error on CFL (bko#199007) */ +- if (IS_CFL(pci)) ++ /* Workaround for a communication error on CFL (bko#199007) and CNL */ ++ if (IS_CFL(pci) || IS_CNL(pci)) + chip->polling_mode = 1; + + err = azx_bus_init(chip, model[dev], &pci_hda_io_ops); +-- +2.20.1 + diff --git a/queue-4.14/clk-ti-clkctrl-fix-clkdm_clk-handling.patch b/queue-4.14/clk-ti-clkctrl-fix-clkdm_clk-handling.patch new file mode 100644 index 00000000000..02f9605ee06 --- /dev/null +++ b/queue-4.14/clk-ti-clkctrl-fix-clkdm_clk-handling.patch @@ -0,0 +1,56 @@ +From bd97afdeb176e8f5ba6d0fda4adc25819ab5120f Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 6 May 2019 14:08:54 -0700 +Subject: clk: ti: clkctrl: Fix clkdm_clk handling + +[ Upstream commit 1cc54078d104f5b4d7e9f8d55362efa5a8daffdb ] + +We need to always call clkdm_clk_enable() and clkdm_clk_disable() even +the clkctrl clock(s) enabled for the domain do not have any gate register +bits. Otherwise clockdomains may never get enabled except when devices get +probed with the legacy "ti,hwmods" devicetree property. + +Fixes: 88a172526c32 ("clk: ti: add support for clkctrl clocks") +Signed-off-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clkctrl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 53e71d0503ec..82e4d5cccf84 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -124,9 +124,6 @@ static int _omap4_clkctrl_clk_enable(struct clk_hw *hw) + int ret; + union omap4_timeout timeout = { 0 }; + +- if (!clk->enable_bit) +- return 0; +- + if (clk->clkdm) { + ret = ti_clk_ll_ops->clkdm_clk_enable(clk->clkdm, hw->clk); + if (ret) { +@@ -138,6 +135,9 @@ static int _omap4_clkctrl_clk_enable(struct clk_hw *hw) + } + } + ++ if (!clk->enable_bit) ++ return 0; ++ + val = ti_clk_ll_ops->clk_readl(&clk->enable_reg); + + val &= ~OMAP4_MODULEMODE_MASK; +@@ -166,7 +166,7 @@ static void _omap4_clkctrl_clk_disable(struct clk_hw *hw) + union omap4_timeout timeout = { 0 }; + + if (!clk->enable_bit) +- return; ++ goto exit; + + val = ti_clk_ll_ops->clk_readl(&clk->enable_reg); + +-- +2.20.1 + diff --git a/queue-4.14/configfs-fix-use-after-free-when-accessing-sd-s_dent.patch b/queue-4.14/configfs-fix-use-after-free-when-accessing-sd-s_dent.patch new file mode 100644 index 00000000000..eae27b0e645 --- /dev/null +++ b/queue-4.14/configfs-fix-use-after-free-when-accessing-sd-s_dent.patch @@ -0,0 +1,58 @@ +From 1b602855fcc6d212364599d8593ef0ac6d538b83 Mon Sep 17 00:00:00 2001 +From: Sahitya Tummala +Date: Thu, 3 Jan 2019 16:48:15 +0530 +Subject: configfs: Fix use-after-free when accessing sd->s_dentry + +[ Upstream commit f6122ed2a4f9c9c1c073ddf6308d1b2ac10e0781 ] + +In the vfs_statx() context, during path lookup, the dentry gets +added to sd->s_dentry via configfs_attach_attr(). In the end, +vfs_statx() kills the dentry by calling path_put(), which invokes +configfs_d_iput(). Ideally, this dentry must be removed from +sd->s_dentry but it doesn't if the sd->s_count >= 3. As a result, +sd->s_dentry is holding reference to a stale dentry pointer whose +memory is already freed up. This results in use-after-free issue, +when this stale sd->s_dentry is accessed later in +configfs_readdir() path. + +This issue can be easily reproduced, by running the LTP test case - +sh fs_racer_file_list.sh /config +(https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/fs/racer/fs_racer_file_list.sh) + +Fixes: 76ae281f6307 ('configfs: fix race between dentry put and lookup') +Signed-off-by: Sahitya Tummala +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/configfs/dir.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index d7955dc56737..a1985a9ad2d6 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -58,15 +58,13 @@ static void configfs_d_iput(struct dentry * dentry, + if (sd) { + /* Coordinate with configfs_readdir */ + spin_lock(&configfs_dirent_lock); +- /* Coordinate with configfs_attach_attr where will increase +- * sd->s_count and update sd->s_dentry to new allocated one. +- * Only set sd->dentry to null when this dentry is the only +- * sd owner. +- * If not do so, configfs_d_iput may run just after +- * configfs_attach_attr and set sd->s_dentry to null +- * even it's still in use. ++ /* ++ * Set sd->s_dentry to null only when this dentry is the one ++ * that is going to be killed. Otherwise configfs_d_iput may ++ * run just after configfs_attach_attr and set sd->s_dentry to ++ * NULL even it's still in use. + */ +- if (atomic_read(&sd->s_count) <= 2) ++ if (sd->s_dentry == dentry) + sd->s_dentry = NULL; + + spin_unlock(&configfs_dirent_lock); +-- +2.20.1 + diff --git a/queue-4.14/gpio-fix-gpio-adp5588-build-errors.patch b/queue-4.14/gpio-fix-gpio-adp5588-build-errors.patch new file mode 100644 index 00000000000..fbd915763f1 --- /dev/null +++ b/queue-4.14/gpio-fix-gpio-adp5588-build-errors.patch @@ -0,0 +1,54 @@ +From 118627ee941244542774257ccf0cc23fa1d34ea5 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Thu, 23 May 2019 15:00:41 -0700 +Subject: gpio: fix gpio-adp5588 build errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit e9646f0f5bb62b7d43f0968f39d536cfe7123b53 ] + +The gpio-adp5588 driver uses interfaces that are provided by +GPIOLIB_IRQCHIP, so select that symbol in its Kconfig entry. + +Fixes these build errors: + +../drivers/gpio/gpio-adp5588.c: In function ‘adp5588_irq_handler’: +../drivers/gpio/gpio-adp5588.c:266:26: error: ‘struct gpio_chip’ has no member named ‘irq’ + dev->gpio_chip.irq.domain, gpio)); + ^ +../drivers/gpio/gpio-adp5588.c: In function ‘adp5588_irq_setup’: +../drivers/gpio/gpio-adp5588.c:298:2: error: implicit declaration of function ‘gpiochip_irqchip_add_nested’ [-Werror=implicit-function-declaration] + ret = gpiochip_irqchip_add_nested(&dev->gpio_chip, + ^ +../drivers/gpio/gpio-adp5588.c:307:2: error: implicit declaration of function ‘gpiochip_set_nested_irqchip’ [-Werror=implicit-function-declaration] + gpiochip_set_nested_irqchip(&dev->gpio_chip, + ^ + +Fixes: 459773ae8dbb ("gpio: adp5588-gpio: support interrupt controller") +Reported-by: kbuild test robot +Signed-off-by: Randy Dunlap +Cc: linux-gpio@vger.kernel.org +Reviewed-by: Bartosz Golaszewski +Acked-by: Michael Hennerich +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig +index 3f80f167ed56..2357d2f73c1a 100644 +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -712,6 +712,7 @@ config GPIO_ADP5588 + config GPIO_ADP5588_IRQ + bool "Interrupt controller support for ADP5588" + depends on GPIO_ADP5588=y ++ select GPIOLIB_IRQCHIP + help + Say yes here to enable the adp5588 to be used as an interrupt + controller. It requires the driver to be built in the kernel. +-- +2.20.1 + diff --git a/queue-4.14/i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch b/queue-4.14/i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch new file mode 100644 index 00000000000..930dc2ba5c8 --- /dev/null +++ b/queue-4.14/i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch @@ -0,0 +1,33 @@ +From 199069d2e85cfdc8232124f3273d12b5d58d2d65 Mon Sep 17 00:00:00 2001 +From: Yingjoe Chen +Date: Tue, 7 May 2019 22:20:32 +0800 +Subject: i2c: dev: fix potential memory leak in i2cdev_ioctl_rdwr + +[ Upstream commit a0692f0eef91354b62c2b4c94954536536be5425 ] + +If I2C_M_RECV_LEN check failed, msgs[i].buf allocated by memdup_user +will not be freed. Pump index up so it will be freed. + +Fixes: 838bfa6049fb ("i2c-dev: Add support for I2C_M_RECV_LEN") +Signed-off-by: Yingjoe Chen +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c +index 00e8e675cbeb..eaa312bc3a3c 100644 +--- a/drivers/i2c/i2c-dev.c ++++ b/drivers/i2c/i2c-dev.c +@@ -297,6 +297,7 @@ static noinline int i2cdev_ioctl_rdwr(struct i2c_client *client, + rdwr_pa[i].buf[0] < 1 || + rdwr_pa[i].len < rdwr_pa[i].buf[0] + + I2C_SMBUS_BLOCK_MAX) { ++ i++; + res = -EINVAL; + break; + } +-- +2.20.1 + diff --git a/queue-4.14/ia64-fix-build-errors-by-exporting-paddr_to_nid.patch b/queue-4.14/ia64-fix-build-errors-by-exporting-paddr_to_nid.patch new file mode 100644 index 00000000000..982b7b0b85d --- /dev/null +++ b/queue-4.14/ia64-fix-build-errors-by-exporting-paddr_to_nid.patch @@ -0,0 +1,58 @@ +From 3d35b8981f499bd77bedfbcbb830c6d733156938 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Tue, 28 May 2019 09:14:30 -0700 +Subject: ia64: fix build errors by exporting paddr_to_nid() + +[ Upstream commit 9a626c4a6326da4433a0d4d4a8a7d1571caf1ed3 ] + +Fix build errors on ia64 when DISCONTIGMEM=y and NUMA=y by +exporting paddr_to_nid(). + +Fixes these build errors: + +ERROR: "paddr_to_nid" [sound/core/snd-pcm.ko] undefined! +ERROR: "paddr_to_nid" [net/sunrpc/sunrpc.ko] undefined! +ERROR: "paddr_to_nid" [fs/cifs/cifs.ko] undefined! +ERROR: "paddr_to_nid" [drivers/video/fbdev/core/fb.ko] undefined! +ERROR: "paddr_to_nid" [drivers/usb/mon/usbmon.ko] undefined! +ERROR: "paddr_to_nid" [drivers/usb/core/usbcore.ko] undefined! +ERROR: "paddr_to_nid" [drivers/md/raid1.ko] undefined! +ERROR: "paddr_to_nid" [drivers/md/dm-mod.ko] undefined! +ERROR: "paddr_to_nid" [drivers/md/dm-crypt.ko] undefined! +ERROR: "paddr_to_nid" [drivers/md/dm-bufio.ko] undefined! +ERROR: "paddr_to_nid" [drivers/ide/ide-core.ko] undefined! +ERROR: "paddr_to_nid" [drivers/ide/ide-cd_mod.ko] undefined! +ERROR: "paddr_to_nid" [drivers/gpu/drm/drm.ko] undefined! +ERROR: "paddr_to_nid" [drivers/char/agp/agpgart.ko] undefined! +ERROR: "paddr_to_nid" [drivers/block/nbd.ko] undefined! +ERROR: "paddr_to_nid" [drivers/block/loop.ko] undefined! +ERROR: "paddr_to_nid" [drivers/block/brd.ko] undefined! +ERROR: "paddr_to_nid" [crypto/ccm.ko] undefined! + +Reported-by: kbuild test robot +Signed-off-by: Randy Dunlap +Cc: Tony Luck +Cc: Fenghua Yu +Cc: linux-ia64@vger.kernel.org +Signed-off-by: Tony Luck +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/ia64/mm/numa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/ia64/mm/numa.c b/arch/ia64/mm/numa.c +index aa19b7ac8222..476c7b4be378 100644 +--- a/arch/ia64/mm/numa.c ++++ b/arch/ia64/mm/numa.c +@@ -49,6 +49,7 @@ paddr_to_nid(unsigned long paddr) + + return (i < num_node_memblks) ? node_memblk[i].nid : (num_node_memblks ? -1 : 0); + } ++EXPORT_SYMBOL(paddr_to_nid); + + #if defined(CONFIG_SPARSEMEM) && defined(CONFIG_NUMA) + /* +-- +2.20.1 + diff --git a/queue-4.14/ipvs-fix-use-after-free-in-ip_vs_in.patch b/queue-4.14/ipvs-fix-use-after-free-in-ip_vs_in.patch new file mode 100644 index 00000000000..5e8c43a5190 --- /dev/null +++ b/queue-4.14/ipvs-fix-use-after-free-in-ip_vs_in.patch @@ -0,0 +1,133 @@ +From ac477cf8b336a345386a04f4f6e7e140e22a3098 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 17 May 2019 22:31:49 +0800 +Subject: ipvs: Fix use-after-free in ip_vs_in + +[ Upstream commit 719c7d563c17b150877cee03a4b812a424989dfa ] + +BUG: KASAN: use-after-free in ip_vs_in.part.29+0xe8/0xd20 [ip_vs] +Read of size 4 at addr ffff8881e9b26e2c by task sshd/5603 + +CPU: 0 PID: 5603 Comm: sshd Not tainted 4.19.39+ #30 +Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 +Call Trace: + dump_stack+0x71/0xab + print_address_description+0x6a/0x270 + kasan_report+0x179/0x2c0 + ip_vs_in.part.29+0xe8/0xd20 [ip_vs] + ip_vs_in+0xd8/0x170 [ip_vs] + nf_hook_slow+0x5f/0xe0 + __ip_local_out+0x1d5/0x250 + ip_local_out+0x19/0x60 + __tcp_transmit_skb+0xba1/0x14f0 + tcp_write_xmit+0x41f/0x1ed0 + ? _copy_from_iter_full+0xca/0x340 + __tcp_push_pending_frames+0x52/0x140 + tcp_sendmsg_locked+0x787/0x1600 + ? tcp_sendpage+0x60/0x60 + ? inet_sk_set_state+0xb0/0xb0 + tcp_sendmsg+0x27/0x40 + sock_sendmsg+0x6d/0x80 + sock_write_iter+0x121/0x1c0 + ? sock_sendmsg+0x80/0x80 + __vfs_write+0x23e/0x370 + vfs_write+0xe7/0x230 + ksys_write+0xa1/0x120 + ? __ia32_sys_read+0x50/0x50 + ? __audit_syscall_exit+0x3ce/0x450 + do_syscall_64+0x73/0x200 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x7ff6f6147c60 +Code: 73 01 c3 48 8b 0d 28 12 2d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 5d 73 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 +RSP: 002b:00007ffd772ead18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 +RAX: ffffffffffffffda RBX: 0000000000000034 RCX: 00007ff6f6147c60 +RDX: 0000000000000034 RSI: 000055df30a31270 RDI: 0000000000000003 +RBP: 000055df30a31270 R08: 0000000000000000 R09: 0000000000000000 +R10: 00007ffd772ead70 R11: 0000000000000246 R12: 00007ffd772ead74 +R13: 00007ffd772eae20 R14: 00007ffd772eae24 R15: 000055df2f12ddc0 + +Allocated by task 6052: + kasan_kmalloc+0xa0/0xd0 + __kmalloc+0x10a/0x220 + ops_init+0x97/0x190 + register_pernet_operations+0x1ac/0x360 + register_pernet_subsys+0x24/0x40 + 0xffffffffc0ea016d + do_one_initcall+0x8b/0x253 + do_init_module+0xe3/0x335 + load_module+0x2fc0/0x3890 + __do_sys_finit_module+0x192/0x1c0 + do_syscall_64+0x73/0x200 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 6067: + __kasan_slab_free+0x130/0x180 + kfree+0x90/0x1a0 + ops_free_list.part.7+0xa6/0xc0 + unregister_pernet_operations+0x18b/0x1f0 + unregister_pernet_subsys+0x1d/0x30 + ip_vs_cleanup+0x1d/0xd2f [ip_vs] + __x64_sys_delete_module+0x20c/0x300 + do_syscall_64+0x73/0x200 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The buggy address belongs to the object at ffff8881e9b26600 which belongs to the cache kmalloc-4096 of size 4096 +The buggy address is located 2092 bytes inside of 4096-byte region [ffff8881e9b26600, ffff8881e9b27600) +The buggy address belongs to the page: +page:ffffea0007a6c800 count:1 mapcount:0 mapping:ffff888107c0e600 index:0x0 compound_mapcount: 0 +flags: 0x17ffffc0008100(slab|head) +raw: 0017ffffc0008100 dead000000000100 dead000000000200 ffff888107c0e600 +raw: 0000000000000000 0000000080070007 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +while unregistering ipvs module, ops_free_list calls +__ip_vs_cleanup, then nf_unregister_net_hooks be called to +do remove nf hook entries. It need a RCU period to finish, +however net->ipvs is set to NULL immediately, which will +trigger NULL pointer dereference when a packet is hooked +and handled by ip_vs_in where net->ipvs is dereferenced. + +Another scene is ops_free_list call ops_free to free the +net_generic directly while __ip_vs_cleanup finished, then +calling ip_vs_in will triggers use-after-free. + +This patch moves nf_unregister_net_hooks from __ip_vs_cleanup() +to __ip_vs_dev_cleanup(), where rcu_barrier() is called by +unregister_pernet_device -> unregister_pernet_operations, +that will do the needed grace period. + +Reported-by: Hulk Robot +Fixes: efe41606184e ("ipvs: convert to use pernet nf_hook api") +Suggested-by: Julian Anastasov +Signed-off-by: YueHaibing +Acked-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index d1c0378144f3..ee97ce176b9a 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -2268,7 +2268,6 @@ static void __net_exit __ip_vs_cleanup(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + +- nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); + ip_vs_service_net_cleanup(ipvs); /* ip_vs_flush() with locks */ + ip_vs_conn_net_cleanup(ipvs); + ip_vs_app_net_cleanup(ipvs); +@@ -2283,6 +2282,7 @@ static void __net_exit __ip_vs_dev_cleanup(struct net *net) + { + struct netns_ipvs *ipvs = net_ipvs(net); + EnterFunction(2); ++ nf_unregister_net_hooks(net, ip_vs_ops, ARRAY_SIZE(ip_vs_ops)); + ipvs->enable = 0; /* Disable packet reception */ + smp_wmb(); + ip_vs_sync_net_cleanup(ipvs); +-- +2.20.1 + diff --git a/queue-4.14/kvm-ppc-book3s-hv-don-t-take-kvm-lock-around-kvm_for.patch b/queue-4.14/kvm-ppc-book3s-hv-don-t-take-kvm-lock-around-kvm_for.patch new file mode 100644 index 00000000000..41a302f17e2 --- /dev/null +++ b/queue-4.14/kvm-ppc-book3s-hv-don-t-take-kvm-lock-around-kvm_for.patch @@ -0,0 +1,68 @@ +From a6a711f3db1b4c64f214c3844adf9da3caa0dc61 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Thu, 23 May 2019 16:36:32 +1000 +Subject: KVM: PPC: Book3S HV: Don't take kvm->lock around kvm_for_each_vcpu +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 5a3f49364c3ffa1107bd88f8292406e98c5d206c ] + +Currently the HV KVM code takes the kvm->lock around calls to +kvm_for_each_vcpu() and kvm_get_vcpu_by_id() (which can call +kvm_for_each_vcpu() internally). However, that leads to a lock +order inversion problem, because these are called in contexts where +the vcpu mutex is held, but the vcpu mutexes nest within kvm->lock +according to Documentation/virtual/kvm/locking.txt. Hence there +is a possibility of deadlock. + +To fix this, we simply don't take the kvm->lock mutex around these +calls. This is safe because the implementations of kvm_for_each_vcpu() +and kvm_get_vcpu_by_id() have been designed to be able to be called +locklessly. + +Signed-off-by: Paul Mackerras +Reviewed-by: Cédric Le Goater +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 58746328b9bd..3b7488fce3db 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -392,12 +392,7 @@ static void kvmppc_dump_regs(struct kvm_vcpu *vcpu) + + static struct kvm_vcpu *kvmppc_find_vcpu(struct kvm *kvm, int id) + { +- struct kvm_vcpu *ret; +- +- mutex_lock(&kvm->lock); +- ret = kvm_get_vcpu_by_id(kvm, id); +- mutex_unlock(&kvm->lock); +- return ret; ++ return kvm_get_vcpu_by_id(kvm, id); + } + + static void init_vpa(struct kvm_vcpu *vcpu, struct lppaca *vpa) +@@ -1258,7 +1253,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr, + struct kvmppc_vcore *vc = vcpu->arch.vcore; + u64 mask; + +- mutex_lock(&kvm->lock); + spin_lock(&vc->lock); + /* + * If ILE (interrupt little-endian) has changed, update the +@@ -1298,7 +1292,6 @@ static void kvmppc_set_lpcr(struct kvm_vcpu *vcpu, u64 new_lpcr, + mask &= 0xFFFFFFFF; + vc->lpcr = (vc->lpcr & ~mask) | (new_lpcr & mask); + spin_unlock(&vc->lock); +- mutex_unlock(&kvm->lock); + } + + static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, +-- +2.20.1 + diff --git a/queue-4.14/kvm-ppc-book3s-use-new-mutex-to-synchronize-access-t.patch b/queue-4.14/kvm-ppc-book3s-use-new-mutex-to-synchronize-access-t.patch new file mode 100644 index 00000000000..d13f905db08 --- /dev/null +++ b/queue-4.14/kvm-ppc-book3s-use-new-mutex-to-synchronize-access-t.patch @@ -0,0 +1,125 @@ +From 65ff5ef37b4cb5a58173c359693a0f22f99c8344 Mon Sep 17 00:00:00 2001 +From: Paul Mackerras +Date: Wed, 29 May 2019 11:54:00 +1000 +Subject: KVM: PPC: Book3S: Use new mutex to synchronize access to rtas token + list + +[ Upstream commit 1659e27d2bc1ef47b6d031abe01b467f18cb72d9 ] + +Currently the Book 3S KVM code uses kvm->lock to synchronize access +to the kvm->arch.rtas_tokens list. Because this list is scanned +inside kvmppc_rtas_hcall(), which is called with the vcpu mutex held, +taking kvm->lock cause a lock inversion problem, which could lead to +a deadlock. + +To fix this, we add a new mutex, kvm->arch.rtas_token_lock, which nests +inside the vcpu mutexes, and use that instead of kvm->lock when +accessing the rtas token list. + +This removes the lockdep_assert_held() in kvmppc_rtas_tokens_free(). +At this point we don't hold the new mutex, but that is OK because +kvmppc_rtas_tokens_free() is only called when the whole VM is being +destroyed, and at that point nothing can be looking up a token in +the list. + +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/kvm_host.h | 1 + + arch/powerpc/kvm/book3s.c | 1 + + arch/powerpc/kvm/book3s_rtas.c | 14 ++++++-------- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/include/asm/kvm_host.h b/arch/powerpc/include/asm/kvm_host.h +index e3ba58f64c3d..5070b34b12fd 100644 +--- a/arch/powerpc/include/asm/kvm_host.h ++++ b/arch/powerpc/include/asm/kvm_host.h +@@ -296,6 +296,7 @@ struct kvm_arch { + #ifdef CONFIG_PPC_BOOK3S_64 + struct list_head spapr_tce_tables; + struct list_head rtas_tokens; ++ struct mutex rtas_token_lock; + DECLARE_BITMAP(enabled_hcalls, MAX_HCALL_OPCODE/4 + 1); + #endif + #ifdef CONFIG_KVM_MPIC +diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c +index 72d977e30952..d38280b01ef0 100644 +--- a/arch/powerpc/kvm/book3s.c ++++ b/arch/powerpc/kvm/book3s.c +@@ -836,6 +836,7 @@ int kvmppc_core_init_vm(struct kvm *kvm) + #ifdef CONFIG_PPC64 + INIT_LIST_HEAD_RCU(&kvm->arch.spapr_tce_tables); + INIT_LIST_HEAD(&kvm->arch.rtas_tokens); ++ mutex_init(&kvm->arch.rtas_token_lock); + #endif + + return kvm->arch.kvm_ops->init_vm(kvm); +diff --git a/arch/powerpc/kvm/book3s_rtas.c b/arch/powerpc/kvm/book3s_rtas.c +index 2d3b2b1cc272..8f2355138f80 100644 +--- a/arch/powerpc/kvm/book3s_rtas.c ++++ b/arch/powerpc/kvm/book3s_rtas.c +@@ -146,7 +146,7 @@ static int rtas_token_undefine(struct kvm *kvm, char *name) + { + struct rtas_token_definition *d, *tmp; + +- lockdep_assert_held(&kvm->lock); ++ lockdep_assert_held(&kvm->arch.rtas_token_lock); + + list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) { + if (rtas_name_matches(d->handler->name, name)) { +@@ -167,7 +167,7 @@ static int rtas_token_define(struct kvm *kvm, char *name, u64 token) + bool found; + int i; + +- lockdep_assert_held(&kvm->lock); ++ lockdep_assert_held(&kvm->arch.rtas_token_lock); + + list_for_each_entry(d, &kvm->arch.rtas_tokens, list) { + if (d->token == token) +@@ -206,14 +206,14 @@ int kvm_vm_ioctl_rtas_define_token(struct kvm *kvm, void __user *argp) + if (copy_from_user(&args, argp, sizeof(args))) + return -EFAULT; + +- mutex_lock(&kvm->lock); ++ mutex_lock(&kvm->arch.rtas_token_lock); + + if (args.token) + rc = rtas_token_define(kvm, args.name, args.token); + else + rc = rtas_token_undefine(kvm, args.name); + +- mutex_unlock(&kvm->lock); ++ mutex_unlock(&kvm->arch.rtas_token_lock); + + return rc; + } +@@ -245,7 +245,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu) + orig_rets = args.rets; + args.rets = &args.args[be32_to_cpu(args.nargs)]; + +- mutex_lock(&vcpu->kvm->lock); ++ mutex_lock(&vcpu->kvm->arch.rtas_token_lock); + + rc = -ENOENT; + list_for_each_entry(d, &vcpu->kvm->arch.rtas_tokens, list) { +@@ -256,7 +256,7 @@ int kvmppc_rtas_hcall(struct kvm_vcpu *vcpu) + } + } + +- mutex_unlock(&vcpu->kvm->lock); ++ mutex_unlock(&vcpu->kvm->arch.rtas_token_lock); + + if (rc == 0) { + args.rets = orig_rets; +@@ -282,8 +282,6 @@ void kvmppc_rtas_tokens_free(struct kvm *kvm) + { + struct rtas_token_definition *d, *tmp; + +- lockdep_assert_held(&kvm->lock); +- + list_for_each_entry_safe(d, tmp, &kvm->arch.rtas_tokens, list) { + list_del(&d->list); + kfree(d); +-- +2.20.1 + diff --git a/queue-4.14/misdn-make-sure-device-name-is-nul-terminated.patch b/queue-4.14/misdn-make-sure-device-name-is-nul-terminated.patch new file mode 100644 index 00000000000..2b8760bfe55 --- /dev/null +++ b/queue-4.14/misdn-make-sure-device-name-is-nul-terminated.patch @@ -0,0 +1,56 @@ +From 9d554ebac253c9465a5dbe8c339a0f0f74d41c71 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 22 May 2019 11:45:13 +0300 +Subject: mISDN: make sure device name is NUL terminated + +[ Upstream commit ccfb62f27beb295103e9392462b20a6ed807d0ea ] + +The user can change the device_name with the IMSETDEVNAME ioctl, but we +need to ensure that the user's name is NUL terminated. Otherwise it +could result in a buffer overflow when we copy the name back to the user +with IMGETDEVINFO ioctl. + +I also changed two strcpy() calls which handle the name to strscpy(). +Hopefully, there aren't any other ways to create a too long name, but +it's nice to do this as a kernel hardening measure. + +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/socket.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c +index 65cb4aac8dce..477e07036add 100644 +--- a/drivers/isdn/mISDN/socket.c ++++ b/drivers/isdn/mISDN/socket.c +@@ -394,7 +394,7 @@ data_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + memcpy(di.channelmap, dev->channelmap, + sizeof(di.channelmap)); + di.nrbchan = dev->nrbchan; +- strcpy(di.name, dev_name(&dev->dev)); ++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); + if (copy_to_user((void __user *)arg, &di, sizeof(di))) + err = -EFAULT; + } else +@@ -678,7 +678,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + memcpy(di.channelmap, dev->channelmap, + sizeof(di.channelmap)); + di.nrbchan = dev->nrbchan; +- strcpy(di.name, dev_name(&dev->dev)); ++ strscpy(di.name, dev_name(&dev->dev), sizeof(di.name)); + if (copy_to_user((void __user *)arg, &di, sizeof(di))) + err = -EFAULT; + } else +@@ -692,6 +692,7 @@ base_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + err = -EFAULT; + break; + } ++ dn.name[sizeof(dn.name) - 1] = '\0'; + dev = get_mdevice(dn.id); + if (dev) + err = device_rename(&dev->dev, dn.name); +-- +2.20.1 + diff --git a/queue-4.14/mlxsw-spectrum-prevent-force-of-56g.patch b/queue-4.14/mlxsw-spectrum-prevent-force-of-56g.patch new file mode 100644 index 00000000000..ffa7756674e --- /dev/null +++ b/queue-4.14/mlxsw-spectrum-prevent-force-of-56g.patch @@ -0,0 +1,41 @@ +From d6b80113936b9e5ad34e39bfb4e43e6efc9e1f7b Mon Sep 17 00:00:00 2001 +From: Amit Cohen +Date: Wed, 29 May 2019 10:59:45 +0300 +Subject: mlxsw: spectrum: Prevent force of 56G + +[ Upstream commit 275e928f19117d22f6d26dee94548baf4041b773 ] + +Force of 56G is not supported by hardware in Ethernet devices. This +configuration fails with a bad parameter error from firmware. + +Add check of this case. Instead of trying to set 56G with autoneg off, +return a meaningful error. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Amit Cohen +Acked-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index ab09f9e43c79..5c74787f903b 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -2505,6 +2505,10 @@ mlxsw_sp_port_set_link_ksettings(struct net_device *dev, + mlxsw_reg_ptys_eth_unpack(ptys_pl, ð_proto_cap, NULL, NULL); + + autoneg = cmd->base.autoneg == AUTONEG_ENABLE; ++ if (!autoneg && cmd->base.speed == SPEED_56000) { ++ netdev_err(dev, "56G not supported with autoneg off\n"); ++ return -EINVAL; ++ } + eth_proto_new = autoneg ? + mlxsw_sp_to_ptys_advert_link(cmd) : + mlxsw_sp_to_ptys_speed(cmd->base.speed); +-- +2.20.1 + diff --git a/queue-4.14/net-aquantia-fix-lro-with-fcs-error.patch b/queue-4.14/net-aquantia-fix-lro-with-fcs-error.patch new file mode 100644 index 00000000000..316aebae003 --- /dev/null +++ b/queue-4.14/net-aquantia-fix-lro-with-fcs-error.patch @@ -0,0 +1,104 @@ +From bdeef54f3b4489428521046205246070bc3b57bc Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Sat, 25 May 2019 09:58:03 +0000 +Subject: net: aquantia: fix LRO with FCS error + +[ Upstream commit eaeb3b7494ba9159323814a8ce8af06a9277d99b ] + +Driver stops producing skbs on ring if a packet with FCS error +was coalesced into LRO session. Ring gets hang forever. + +Thats a logical error in driver processing descriptors: +When rx_stat indicates MAC Error, next pointer and eop flags +are not filled. This confuses driver so it waits for descriptor 0 +to be filled by HW. + +Solution is fill next pointer and eop flag even for packets with FCS error. + +Fixes: bab6de8fd180b ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.") +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 61 ++++++++++--------- + 1 file changed, 32 insertions(+), 29 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index f4b3554b0b67..236325f48ec9 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -683,38 +683,41 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + if (is_err || rxd_wb->type & 0x1000U) { + /* status error or DMA error */ + buff->is_error = 1U; +- } else { +- if (self->aq_nic_cfg->is_rss) { +- /* last 4 byte */ +- u16 rss_type = rxd_wb->type & 0xFU; +- +- if (rss_type && rss_type < 0x8U) { +- buff->is_hash_l4 = (rss_type == 0x4 || +- rss_type == 0x5); +- buff->rss_hash = rxd_wb->rss_hash; +- } ++ } ++ if (self->aq_nic_cfg->is_rss) { ++ /* last 4 byte */ ++ u16 rss_type = rxd_wb->type & 0xFU; ++ ++ if (rss_type && rss_type < 0x8U) { ++ buff->is_hash_l4 = (rss_type == 0x4 || ++ rss_type == 0x5); ++ buff->rss_hash = rxd_wb->rss_hash; + } ++ } + +- if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) { +- buff->len = rxd_wb->pkt_len % +- AQ_CFG_RX_FRAME_MAX; +- buff->len = buff->len ? +- buff->len : AQ_CFG_RX_FRAME_MAX; +- buff->next = 0U; +- buff->is_eop = 1U; ++ if (HW_ATL_B0_RXD_WB_STAT2_EOP & rxd_wb->status) { ++ buff->len = rxd_wb->pkt_len % ++ AQ_CFG_RX_FRAME_MAX; ++ buff->len = buff->len ? ++ buff->len : AQ_CFG_RX_FRAME_MAX; ++ buff->next = 0U; ++ buff->is_eop = 1U; ++ } else { ++ buff->len = ++ rxd_wb->pkt_len > AQ_CFG_RX_FRAME_MAX ? ++ AQ_CFG_RX_FRAME_MAX : rxd_wb->pkt_len; ++ ++ if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT & ++ rxd_wb->status) { ++ /* LRO */ ++ buff->next = rxd_wb->next_desc_ptr; ++ ++ring->stats.rx.lro_packets; + } else { +- if (HW_ATL_B0_RXD_WB_STAT2_RSCCNT & +- rxd_wb->status) { +- /* LRO */ +- buff->next = rxd_wb->next_desc_ptr; +- ++ring->stats.rx.lro_packets; +- } else { +- /* jumbo */ +- buff->next = +- aq_ring_next_dx(ring, +- ring->hw_head); +- ++ring->stats.rx.jumbo_packets; +- } ++ /* jumbo */ ++ buff->next = ++ aq_ring_next_dx(ring, ++ ring->hw_head); ++ ++ring->stats.rx.jumbo_packets; + } + } + } +-- +2.20.1 + diff --git a/queue-4.14/net-phy-dp83867-set-up-rgmii-tx-delay.patch b/queue-4.14/net-phy-dp83867-set-up-rgmii-tx-delay.patch new file mode 100644 index 00000000000..4a030e612ef --- /dev/null +++ b/queue-4.14/net-phy-dp83867-set-up-rgmii-tx-delay.patch @@ -0,0 +1,39 @@ +From 0d0f53e24f78fc8870f4c2dc8ca35382a083bad6 Mon Sep 17 00:00:00 2001 +From: Max Uvarov +Date: Tue, 28 May 2019 13:00:52 +0300 +Subject: net: phy: dp83867: Set up RGMII TX delay + +[ Upstream commit 2b892649254fec01678c64f16427622b41fa27f4 ] + +PHY_INTERFACE_MODE_RGMII_RXID is less then TXID +so code to set tx delay is never called. + +Fixes: 2a10154abcb75 ("net: phy: dp83867: Add TI dp83867 phy") +Signed-off-by: Max Uvarov +Cc: Florian Fainelli +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83867.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index c1ab976cc800..12b09e6e03ba 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -249,10 +249,8 @@ static int dp83867_config_init(struct phy_device *phydev) + ret = phy_write(phydev, MII_DP83867_PHYCTRL, val); + if (ret) + return ret; +- } + +- if ((phydev->interface >= PHY_INTERFACE_MODE_RGMII_ID) && +- (phydev->interface <= PHY_INTERFACE_MODE_RGMII_RXID)) { ++ /* Set up RGMII delays */ + val = phy_read_mmd(phydev, DP83867_DEVADDR, DP83867_RGMIICTL); + + if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) +-- +2.20.1 + diff --git a/queue-4.14/net-sh_eth-fix-mdio-access-in-sh_eth_close-for-r-car.patch b/queue-4.14/net-sh_eth-fix-mdio-access-in-sh_eth_close-for-r-car.patch new file mode 100644 index 00000000000..15c7cb49dea --- /dev/null +++ b/queue-4.14/net-sh_eth-fix-mdio-access-in-sh_eth_close-for-r-car.patch @@ -0,0 +1,51 @@ +From aabdf41105fb496d5d4b462a6a2ba1c82330be4d Mon Sep 17 00:00:00 2001 +From: Yoshihiro Shimoda +Date: Tue, 28 May 2019 13:10:46 +0900 +Subject: net: sh_eth: fix mdio access in sh_eth_close() for R-Car Gen2 and + RZ/A1 SoCs + +[ Upstream commit 315ca92dd863fecbffc0bb52ae0ac11e0398726a ] + +The sh_eth_close() resets the MAC and then calls phy_stop() +so that mdio read access result is incorrect without any error +according to kernel trace like below: + +ifconfig-216 [003] .n.. 109.133124: mdio_access: ee700000.ethernet-ffffffff read phy:0x01 reg:0x00 val:0xffff + +According to the hardware manual, the RMII mode should be set to 1 +before operation the Ethernet MAC. However, the previous code was not +set to 1 after the driver issued the soft_reset in sh_eth_dev_exit() +so that the mdio read access result seemed incorrect. To fix the issue, +this patch adds a condition and set the RMII mode register in +sh_eth_dev_exit() for R-Car Gen2 and RZ/A1 SoCs. + +Note that when I have tried to move the sh_eth_dev_exit() calling +after phy_stop() on sh_eth_close(), but it gets worse (kernel panic +happened and it seems that a register is accessed while the clock is +off). + +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index abfb9faadbc4..9b1906a65e11 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1458,6 +1458,10 @@ static void sh_eth_dev_exit(struct net_device *ndev) + sh_eth_get_stats(ndev); + sh_eth_reset(ndev); + ++ /* Set the RMII mode again if required */ ++ if (mdp->cd->rmiimode) ++ sh_eth_write(ndev, 0x1, RMIIMODE); ++ + /* Set MAC address again */ + update_mac_address(ndev); + } +-- +2.20.1 + diff --git a/queue-4.14/net-tulip-de4x5-drop-redundant-module_device_table.patch b/queue-4.14/net-tulip-de4x5-drop-redundant-module_device_table.patch new file mode 100644 index 00000000000..de211c308ee --- /dev/null +++ b/queue-4.14/net-tulip-de4x5-drop-redundant-module_device_table.patch @@ -0,0 +1,54 @@ +From 56c349fba7b4055023a704e5869607912de2bca9 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 24 May 2019 13:20:19 -0700 +Subject: net: tulip: de4x5: Drop redundant MODULE_DEVICE_TABLE() + +[ Upstream commit 3e66b7cc50ef921121babc91487e1fb98af1ba6e ] + +Building with Clang reports the redundant use of MODULE_DEVICE_TABLE(): + +drivers/net/ethernet/dec/tulip/de4x5.c:2110:1: error: redefinition of '__mod_eisa__de4x5_eisa_ids_device_table' +MODULE_DEVICE_TABLE(eisa, de4x5_eisa_ids); +^ +./include/linux/module.h:229:21: note: expanded from macro 'MODULE_DEVICE_TABLE' +extern typeof(name) __mod_##type##__##name##_device_table \ + ^ +:90:1: note: expanded from here +__mod_eisa__de4x5_eisa_ids_device_table +^ +drivers/net/ethernet/dec/tulip/de4x5.c:2100:1: note: previous definition is here +MODULE_DEVICE_TABLE(eisa, de4x5_eisa_ids); +^ +./include/linux/module.h:229:21: note: expanded from macro 'MODULE_DEVICE_TABLE' +extern typeof(name) __mod_##type##__##name##_device_table \ + ^ +:85:1: note: expanded from here +__mod_eisa__de4x5_eisa_ids_device_table +^ + +This drops the one further from the table definition to match the common +use of MODULE_DEVICE_TABLE(). + +Fixes: 07563c711fbc ("EISA bus MODALIAS attributes support") +Signed-off-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/dec/tulip/de4x5.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c +index 0affee9c8aa2..0b1e7a96ff49 100644 +--- a/drivers/net/ethernet/dec/tulip/de4x5.c ++++ b/drivers/net/ethernet/dec/tulip/de4x5.c +@@ -2108,7 +2108,6 @@ static struct eisa_driver de4x5_eisa_driver = { + .remove = de4x5_eisa_remove, + } + }; +-MODULE_DEVICE_TABLE(eisa, de4x5_eisa_ids); + #endif + + #ifdef CONFIG_PCI +-- +2.20.1 + diff --git a/queue-4.14/netfilter-nf_queue-fix-reinject-verdict-handling.patch b/queue-4.14/netfilter-nf_queue-fix-reinject-verdict-handling.patch new file mode 100644 index 00000000000..56898f75d27 --- /dev/null +++ b/queue-4.14/netfilter-nf_queue-fix-reinject-verdict-handling.patch @@ -0,0 +1,37 @@ +From fe22dffe329d1a5a966331627ce94f9ed3411923 Mon Sep 17 00:00:00 2001 +From: Jagdish Motwani +Date: Mon, 13 May 2019 23:47:40 +0530 +Subject: netfilter: nf_queue: fix reinject verdict handling + +[ Upstream commit 946c0d8e6ed43dae6527e878d0077c1e11015db0 ] + +This patch fixes netfilter hook traversal when there are more than 1 hooks +returning NF_QUEUE verdict. When the first queue reinjects the packet, +'nf_reinject' starts traversing hooks with a proper hook_index. However, +if it again receives a NF_QUEUE verdict (by some other netfilter hook), it +queues the packet with a wrong hook_index. So, when the second queue +reinjects the packet, it re-executes hooks in between. + +Fixes: 960632ece694 ("netfilter: convert hook list to an array") +Signed-off-by: Jagdish Motwani +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_queue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c +index f7e21953b1de..8260b1e73bbd 100644 +--- a/net/netfilter/nf_queue.c ++++ b/net/netfilter/nf_queue.c +@@ -193,6 +193,7 @@ static unsigned int nf_iterate(struct sk_buff *skb, + repeat: + verdict = nf_hook_entry_hookfn(hook, skb, state); + if (verdict != NF_ACCEPT) { ++ *index = i; + if (verdict != NF_REPEAT) + return verdict; + goto repeat; +-- +2.20.1 + diff --git a/queue-4.14/perf-data-fix-strncat-may-truncate-build-failure-wit.patch b/queue-4.14/perf-data-fix-strncat-may-truncate-build-failure-wit.patch new file mode 100644 index 00000000000..5b1da7d6bbf --- /dev/null +++ b/queue-4.14/perf-data-fix-strncat-may-truncate-build-failure-wit.patch @@ -0,0 +1,53 @@ +From 927ae49ca8e321d62047ec6a55bb6b5fefb7391f Mon Sep 17 00:00:00 2001 +From: Shawn Landden +Date: Sat, 18 May 2019 15:32:38 -0300 +Subject: perf data: Fix 'strncat may truncate' build failure with recent gcc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 97acec7df172cd1e450f81f5e293c0aa145a2797 ] + +This strncat() is safe because the buffer was allocated with zalloc(), +however gcc doesn't know that. Since the string always has 4 non-null +bytes, just use memcpy() here. + + CC /home/shawn/linux/tools/perf/util/data-convert-bt.o + In file included from /usr/include/string.h:494, + from /home/shawn/linux/tools/lib/traceevent/event-parse.h:27, + from util/data-convert-bt.c:22: + In function ‘strncat’, + inlined from ‘string_set_value’ at util/data-convert-bt.c:274:4: + /usr/include/powerpc64le-linux-gnu/bits/string_fortified.h:136:10: error: ‘__builtin_strncat’ output may be truncated copying 4 bytes from a string of length 4 [-Werror=stringop-truncation] + 136 | return __builtin___strncat_chk (__dest, __src, __len, __bos (__dest)); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Shawn Landden +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Wang Nan +LPU-Reference: 20190518183238.10954-1-shawn@git.icu +Link: https://lkml.kernel.org/n/tip-289f1jice17ta7tr3tstm9jm@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/data-convert-bt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/data-convert-bt.c b/tools/perf/util/data-convert-bt.c +index 2346cecb8ea2..5131304ea3a8 100644 +--- a/tools/perf/util/data-convert-bt.c ++++ b/tools/perf/util/data-convert-bt.c +@@ -271,7 +271,7 @@ static int string_set_value(struct bt_ctf_field *field, const char *string) + if (i > 0) + strncpy(buffer, string, i); + } +- strncat(buffer + p, numstr, 4); ++ memcpy(buffer + p, numstr, 4); + p += 3; + } + } +-- +2.20.1 + diff --git a/queue-4.14/perf-record-fix-s390-missing-module-symbol-and-warni.patch b/queue-4.14/perf-record-fix-s390-missing-module-symbol-and-warni.patch new file mode 100644 index 00000000000..53dd344df2f --- /dev/null +++ b/queue-4.14/perf-record-fix-s390-missing-module-symbol-and-warni.patch @@ -0,0 +1,103 @@ +From ffb5536c65f7f6845061c341a2c79a042bb1fa73 Mon Sep 17 00:00:00 2001 +From: Thomas Richter +Date: Wed, 22 May 2019 16:46:01 +0200 +Subject: perf record: Fix s390 missing module symbol and warning for non-root + users + +[ Upstream commit 6738028dd57df064b969d8392c943ef3b3ae705d ] + +Command 'perf record' and 'perf report' on a system without kernel +debuginfo packages uses /proc/kallsyms and /proc/modules to find +addresses for kernel and module symbols. On x86 this works for root and +non-root users. + +On s390, when invoked as non-root user, many of the following warnings +are shown and module symbols are missing: + + proc/{kallsyms,modules} inconsistency while looking for + "[sha1_s390]" module! + +Command 'perf record' creates a list of module start addresses by +parsing the output of /proc/modules and creates a PERF_RECORD_MMAP +record for the kernel and each module. The following function call +sequence is executed: + + machine__create_kernel_maps + machine__create_module + modules__parse + machine__create_module --> for each line in /proc/modules + arch__fix_module_text_start + +Function arch__fix_module_text_start() is s390 specific. It opens +file /sys/module//sections/.text to extract the module's .text +section start address. On s390 the module loader prepends a header +before the first section, whereas on x86 the module's text section +address is identical the the module's load address. + +However module section files are root readable only. For non-root the +read operation fails and machine__create_module() returns an error. +Command perf record does not generate any PERF_RECORD_MMAP record +for loaded modules. Later command perf report complains about missing +module maps. + +To fix this function arch__fix_module_text_start() always returns +success. For root users there is no change, for non-root users +the module's load address is used as module's text start address +(the prepended header then counts as part of the text section). + +This enable non-root users to use module symbols and avoid the +warning when perf report is executed. + +Output before: + + [tmricht@m83lp54 perf]$ ./perf report -D | fgrep MMAP + 0 0x168 [0x50]: PERF_RECORD_MMAP ... x [kernel.kallsyms]_text + +Output after: + + [tmricht@m83lp54 perf]$ ./perf report -D | fgrep MMAP + 0 0x168 [0x50]: PERF_RECORD_MMAP ... x [kernel.kallsyms]_text + 0 0x1b8 [0x98]: PERF_RECORD_MMAP ... x /lib/modules/.../autofs4.ko.xz + 0 0x250 [0xa8]: PERF_RECORD_MMAP ... x /lib/modules/.../sha_common.ko.xz + 0 0x2f8 [0x98]: PERF_RECORD_MMAP ... x /lib/modules/.../des_generic.ko.xz + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Cc: Heiko Carstens +Link: http://lkml.kernel.org/r/20190522144601.50763-4-tmricht@linux.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/arch/s390/util/machine.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/arch/s390/util/machine.c b/tools/perf/arch/s390/util/machine.c +index 0b2054007314..a19690a17291 100644 +--- a/tools/perf/arch/s390/util/machine.c ++++ b/tools/perf/arch/s390/util/machine.c +@@ -5,16 +5,19 @@ + #include "util.h" + #include "machine.h" + #include "api/fs/fs.h" ++#include "debug.h" + + int arch__fix_module_text_start(u64 *start, const char *name) + { ++ u64 m_start = *start; + char path[PATH_MAX]; + + snprintf(path, PATH_MAX, "module/%.*s/sections/.text", + (int)strlen(name) - 2, name + 1); +- +- if (sysfs__read_ull(path, (unsigned long long *)start) < 0) +- return -1; ++ if (sysfs__read_ull(path, (unsigned long long *)start) < 0) { ++ pr_debug2("Using module %s start:%#lx\n", path, m_start); ++ *start = m_start; ++ } + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/perf-ring-buffer-always-use-read-write-_once-for-rb-.patch b/queue-4.14/perf-ring-buffer-always-use-read-write-_once-for-rb-.patch new file mode 100644 index 00000000000..8ce0bb353a5 --- /dev/null +++ b/queue-4.14/perf-ring-buffer-always-use-read-write-_once-for-rb-.patch @@ -0,0 +1,67 @@ +From 8672d3d861e6ab5cc5a62b247391ca9f32a96ffe Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Fri, 17 May 2019 13:52:33 +0200 +Subject: perf/ring-buffer: Always use {READ,WRITE}_ONCE() for rb->user_page + data + +[ Upstream commit 4d839dd9e4356bbacf3eb0ab13a549b83b008c21 ] + +We must use {READ,WRITE}_ONCE() on rb->user_page data such that +concurrent usage will see whole values. A few key sites were missing +this. + +Suggested-by: Yabin Cui +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: acme@kernel.org +Cc: mark.rutland@arm.com +Cc: namhyung@kernel.org +Fixes: 7b732a750477 ("perf_counter: new output ABI - part 1") +Link: http://lkml.kernel.org/r/20190517115418.394192145@infradead.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/ring_buffer.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index aef2af80a927..f3a69a4f0d57 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -101,7 +101,7 @@ static void perf_output_put_handle(struct perf_output_handle *handle) + * See perf_output_begin(). + */ + smp_wmb(); /* B, matches C */ +- rb->user_page->data_head = head; ++ WRITE_ONCE(rb->user_page->data_head, head); + + /* + * We must publish the head before decrementing the nest count, +@@ -489,7 +489,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size) + handle->aux_flags); + } + +- rb->user_page->aux_head = rb->aux_head; ++ WRITE_ONCE(rb->user_page->aux_head, rb->aux_head); + if (rb_need_aux_wakeup(rb)) + wakeup = true; + +@@ -520,7 +520,7 @@ int perf_aux_output_skip(struct perf_output_handle *handle, unsigned long size) + + rb->aux_head += size; + +- rb->user_page->aux_head = rb->aux_head; ++ WRITE_ONCE(rb->user_page->aux_head, rb->aux_head); + if (rb_need_aux_wakeup(rb)) { + perf_output_wakeup(handle); + handle->wakeup = rb->aux_wakeup + rb->aux_watermark; +-- +2.20.1 + diff --git a/queue-4.14/perf-ring_buffer-add-ordering-to-rb-nest-increment.patch b/queue-4.14/perf-ring_buffer-add-ordering-to-rb-nest-increment.patch new file mode 100644 index 00000000000..2f5cdd65205 --- /dev/null +++ b/queue-4.14/perf-ring_buffer-add-ordering-to-rb-nest-increment.patch @@ -0,0 +1,60 @@ +From 27cc54201727bcc4aedc236c16c91460138f3849 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Fri, 17 May 2019 13:52:32 +0200 +Subject: perf/ring_buffer: Add ordering to rb->nest increment + +[ Upstream commit 3f9fbe9bd86c534eba2faf5d840fd44c6049f50e ] + +Similar to how decrementing rb->next too early can cause data_head to +(temporarily) be observed to go backward, so too can this happen when +we increment too late. + +This barrier() ensures the rb->head load happens after the increment, +both the one in the 'goto again' path, as the one from +perf_output_get_handle() -- albeit very unlikely to matter for the +latter. + +Suggested-by: Yabin Cui +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: acme@kernel.org +Cc: mark.rutland@arm.com +Cc: namhyung@kernel.org +Fixes: ef60777c9abd ("perf: Optimize the perf_output() path by removing IRQ-disables") +Link: http://lkml.kernel.org/r/20190517115418.309516009@infradead.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/ring_buffer.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index fde853270c09..aef2af80a927 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -49,6 +49,15 @@ static void perf_output_put_handle(struct perf_output_handle *handle) + unsigned long head; + + again: ++ /* ++ * In order to avoid publishing a head value that goes backwards, ++ * we must ensure the load of @rb->head happens after we've ++ * incremented @rb->nest. ++ * ++ * Otherwise we can observe a @rb->head value before one published ++ * by an IRQ/NMI happening between the load and the increment. ++ */ ++ barrier(); + head = local_read(&rb->head); + + /* +-- +2.20.1 + diff --git a/queue-4.14/perf-ring_buffer-fix-exposing-a-temporarily-decrease.patch b/queue-4.14/perf-ring_buffer-fix-exposing-a-temporarily-decrease.patch new file mode 100644 index 00000000000..9521630a2b4 --- /dev/null +++ b/queue-4.14/perf-ring_buffer-fix-exposing-a-temporarily-decrease.patch @@ -0,0 +1,97 @@ +From 702734eebe24adfc91a37f30ed7263b8bfa3361c Mon Sep 17 00:00:00 2001 +From: Yabin Cui +Date: Fri, 17 May 2019 13:52:31 +0200 +Subject: perf/ring_buffer: Fix exposing a temporarily decreased data_head + +[ Upstream commit 1b038c6e05ff70a1e66e3e571c2e6106bdb75f53 ] + +In perf_output_put_handle(), an IRQ/NMI can happen in below location and +write records to the same ring buffer: + + ... + local_dec_and_test(&rb->nest) + ... <-- an IRQ/NMI can happen here + rb->user_page->data_head = head; + ... + +In this case, a value A is written to data_head in the IRQ, then a value +B is written to data_head after the IRQ. And A > B. As a result, +data_head is temporarily decreased from A to B. And a reader may see +data_head < data_tail if it read the buffer frequently enough, which +creates unexpected behaviors. + +This can be fixed by moving dec(&rb->nest) to after updating data_head, +which prevents the IRQ/NMI above from updating data_head. + +[ Split up by peterz. ] + +Signed-off-by: Yabin Cui +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: mark.rutland@arm.com +Fixes: ef60777c9abd ("perf: Optimize the perf_output() path by removing IRQ-disables") +Link: http://lkml.kernel.org/r/20190517115418.224478157@infradead.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/ring_buffer.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index 489dc6b60053..fde853270c09 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -52,11 +52,18 @@ static void perf_output_put_handle(struct perf_output_handle *handle) + head = local_read(&rb->head); + + /* +- * IRQ/NMI can happen here, which means we can miss a head update. ++ * IRQ/NMI can happen here and advance @rb->head, causing our ++ * load above to be stale. + */ + +- if (!local_dec_and_test(&rb->nest)) ++ /* ++ * If this isn't the outermost nesting, we don't have to update ++ * @rb->user_page->data_head. ++ */ ++ if (local_read(&rb->nest) > 1) { ++ local_dec(&rb->nest); + goto out; ++ } + + /* + * Since the mmap() consumer (userspace) can run on a different CPU: +@@ -88,9 +95,18 @@ static void perf_output_put_handle(struct perf_output_handle *handle) + rb->user_page->data_head = head; + + /* +- * Now check if we missed an update -- rely on previous implied +- * compiler barriers to force a re-read. ++ * We must publish the head before decrementing the nest count, ++ * otherwise an IRQ/NMI can publish a more recent head value and our ++ * write will (temporarily) publish a stale value. ++ */ ++ barrier(); ++ local_set(&rb->nest, 0); ++ ++ /* ++ * Ensure we decrement @rb->nest before we validate the @rb->head. ++ * Otherwise we cannot be sure we caught the 'last' nested update. + */ ++ barrier(); + if (unlikely(head != local_read(&rb->head))) { + local_inc(&rb->nest); + goto again; +-- +2.20.1 + diff --git a/queue-4.14/perf-x86-intel-ds-fix-event-vs.-uevent-pebs-constrai.patch b/queue-4.14/perf-x86-intel-ds-fix-event-vs.-uevent-pebs-constrai.patch new file mode 100644 index 00000000000..ac97640aced --- /dev/null +++ b/queue-4.14/perf-x86-intel-ds-fix-event-vs.-uevent-pebs-constrai.patch @@ -0,0 +1,153 @@ +From 1f99c2a9b68edcd5d8ab5548aafae4704022a487 Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Mon, 20 May 2019 17:52:46 -0700 +Subject: perf/x86/intel/ds: Fix EVENT vs. UEVENT PEBS constraints + +[ Upstream commit 23e3983a466cd540ffdd2bbc6e0c51e31934f941 ] + +This patch fixes an bug revealed by the following commit: + + 6b89d4c1ae85 ("perf/x86/intel: Fix INTEL_FLAGS_EVENT_CONSTRAINT* masking") + +That patch modified INTEL_FLAGS_EVENT_CONSTRAINT() to only look at the event code +when matching a constraint. If code+umask were needed, then the +INTEL_FLAGS_UEVENT_CONSTRAINT() macro was needed instead. +This broke with some of the constraints for PEBS events. + +Several of them, including the one used for cycles:p, cycles:pp, cycles:ppp +fell in that category and caused the event to be rejected in PEBS mode. +In other words, on some platforms a cmdline such as: + + $ perf top -e cycles:pp + +would fail with -EINVAL. + +This patch fixes this bug by properly using INTEL_FLAGS_UEVENT_CONSTRAINT() +when needed in the PEBS constraint tables. + +Reported-by: Ingo Molnar +Signed-off-by: Stephane Eranian +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: kan.liang@intel.com +Link: http://lkml.kernel.org/r/20190521005246.423-1-eranian@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/ds.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 25386be0d757..3310f9f6c3e1 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -681,7 +681,7 @@ struct event_constraint intel_core2_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x1fc7, 0x1), /* SIMD_INST_RETURED.ANY */ + INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0x1), /* MEM_LOAD_RETIRED.* */ + /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x01), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x01), + EVENT_CONSTRAINT_END + }; + +@@ -690,7 +690,7 @@ struct event_constraint intel_atom_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x00c5, 0x1), /* MISPREDICTED_BRANCH_RETIRED */ + INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0x1), /* MEM_LOAD_RETIRED.* */ + /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x01), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x01), + /* Allow all events as PEBS with no flags */ + INTEL_ALL_EVENT_CONSTRAINT(0, 0x1), + EVENT_CONSTRAINT_END +@@ -698,7 +698,7 @@ struct event_constraint intel_atom_pebs_event_constraints[] = { + + struct event_constraint intel_slm_pebs_event_constraints[] = { + /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x1), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x1), + /* Allow all events as PEBS with no flags */ + INTEL_ALL_EVENT_CONSTRAINT(0, 0x1), + EVENT_CONSTRAINT_END +@@ -729,7 +729,7 @@ struct event_constraint intel_nehalem_pebs_event_constraints[] = { + INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0xf), /* MEM_LOAD_RETIRED.* */ + INTEL_FLAGS_EVENT_CONSTRAINT(0xf7, 0xf), /* FP_ASSIST.* */ + /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f), + EVENT_CONSTRAINT_END + }; + +@@ -746,7 +746,7 @@ struct event_constraint intel_westmere_pebs_event_constraints[] = { + INTEL_FLAGS_EVENT_CONSTRAINT(0xcb, 0xf), /* MEM_LOAD_RETIRED.* */ + INTEL_FLAGS_EVENT_CONSTRAINT(0xf7, 0xf), /* FP_ASSIST.* */ + /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f), + EVENT_CONSTRAINT_END + }; + +@@ -755,7 +755,7 @@ struct event_constraint intel_snb_pebs_event_constraints[] = { + INTEL_PLD_CONSTRAINT(0x01cd, 0x8), /* MEM_TRANS_RETIRED.LAT_ABOVE_THR */ + INTEL_PST_CONSTRAINT(0x02cd, 0x8), /* MEM_TRANS_RETIRED.PRECISE_STORES */ + /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf), + INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOP_RETIRED.* */ + INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */ + INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */ +@@ -770,9 +770,9 @@ struct event_constraint intel_ivb_pebs_event_constraints[] = { + INTEL_PLD_CONSTRAINT(0x01cd, 0x8), /* MEM_TRANS_RETIRED.LAT_ABOVE_THR */ + INTEL_PST_CONSTRAINT(0x02cd, 0x8), /* MEM_TRANS_RETIRED.PRECISE_STORES */ + /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf), + /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2), + INTEL_EXCLEVT_CONSTRAINT(0xd0, 0xf), /* MEM_UOP_RETIRED.* */ + INTEL_EXCLEVT_CONSTRAINT(0xd1, 0xf), /* MEM_LOAD_UOPS_RETIRED.* */ + INTEL_EXCLEVT_CONSTRAINT(0xd2, 0xf), /* MEM_LOAD_UOPS_LLC_HIT_RETIRED.* */ +@@ -786,9 +786,9 @@ struct event_constraint intel_hsw_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */ + INTEL_PLD_CONSTRAINT(0x01cd, 0xf), /* MEM_TRANS_RETIRED.* */ + /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf), + /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2), + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_NA(0x01c2, 0xf), /* UOPS_RETIRED.ALL */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_XLD(0x11d0, 0xf), /* MEM_UOPS_RETIRED.STLB_MISS_LOADS */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_XLD(0x21d0, 0xf), /* MEM_UOPS_RETIRED.LOCK_LOADS */ +@@ -809,9 +809,9 @@ struct event_constraint intel_bdw_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x01c0, 0x2), /* INST_RETIRED.PRECDIST */ + INTEL_PLD_CONSTRAINT(0x01cd, 0xf), /* MEM_TRANS_RETIRED.* */ + /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c2, 0xf), + /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2), + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_NA(0x01c2, 0xf), /* UOPS_RETIRED.ALL */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x11d0, 0xf), /* MEM_UOPS_RETIRED.STLB_MISS_LOADS */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x21d0, 0xf), /* MEM_UOPS_RETIRED.LOCK_LOADS */ +@@ -832,9 +832,9 @@ struct event_constraint intel_bdw_pebs_event_constraints[] = { + struct event_constraint intel_skl_pebs_event_constraints[] = { + INTEL_FLAGS_UEVENT_CONSTRAINT(0x1c0, 0x2), /* INST_RETIRED.PREC_DIST */ + /* INST_RETIRED.PREC_DIST, inv=1, cmask=16 (cycles:ppp). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c0, 0x2), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108001c0, 0x2), + /* INST_RETIRED.TOTAL_CYCLES_PS (inv=1, cmask=16) (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x0f), ++ INTEL_FLAGS_UEVENT_CONSTRAINT(0x108000c0, 0x0f), + INTEL_PLD_CONSTRAINT(0x1cd, 0xf), /* MEM_TRANS_RETIRED.* */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_LD(0x11d0, 0xf), /* MEM_INST_RETIRED.STLB_MISS_LOADS */ + INTEL_FLAGS_UEVENT_CONSTRAINT_DATALA_ST(0x12d0, 0xf), /* MEM_INST_RETIRED.STLB_MISS_STORES */ +-- +2.20.1 + diff --git a/queue-4.14/powerpc-powernv-return-for-invalid-imc-domain.patch b/queue-4.14/powerpc-powernv-return-for-invalid-imc-domain.patch new file mode 100644 index 00000000000..3be91aafee3 --- /dev/null +++ b/queue-4.14/powerpc-powernv-return-for-invalid-imc-domain.patch @@ -0,0 +1,50 @@ +From c444bfe6dbbc71389b20bb43eff9024fd85dd90d Mon Sep 17 00:00:00 2001 +From: Anju T Sudhakar +Date: Mon, 20 May 2019 14:27:53 +0530 +Subject: powerpc/powernv: Return for invalid IMC domain + +[ Upstream commit b59bd3527fe3c1939340df558d7f9d568fc9f882 ] + +Currently init_imc_pmu() can fail either because we try to register an +IMC unit with an invalid domain (i.e an IMC node not supported by the +kernel) or something went wrong while registering a valid IMC unit. In +both the cases kernel provides a 'Register failed' error message. + +For example when trace-imc node is not supported by the kernel, but +skiboot advertises a trace-imc node we print: + + IMC Unknown Device type + IMC PMU (null) Register failed + +To avoid confusion just print the unknown device type message, before +attempting PMU registration, so the second message isn't printed. + +Fixes: 8f95faaac56c ("powerpc/powernv: Detect and create IMC device") +Reported-by: Pavaman Subramaniyam +Signed-off-by: Anju T Sudhakar +Reviewed-by: Madhavan Srinivasan +[mpe: Reword change log a bit] +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-imc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c +index 6914b289c86b..7b93191dc2e3 100644 +--- a/arch/powerpc/platforms/powernv/opal-imc.c ++++ b/arch/powerpc/platforms/powernv/opal-imc.c +@@ -87,6 +87,10 @@ static int imc_pmu_create(struct device_node *parent, int pmu_index, int domain) + struct imc_pmu *pmu_ptr; + u32 offset; + ++ /* Return for unknown domain */ ++ if (domain < 0) ++ return -EINVAL; ++ + /* memory for pmu */ + pmu_ptr = kzalloc(sizeof(struct imc_pmu), GFP_KERNEL); + if (!pmu_ptr) +-- +2.20.1 + diff --git a/queue-4.14/scsi-libcxgbi-add-a-check-for-null-pointer-in-cxgbi_.patch b/queue-4.14/scsi-libcxgbi-add-a-check-for-null-pointer-in-cxgbi_.patch new file mode 100644 index 00000000000..d4dda6bfe56 --- /dev/null +++ b/queue-4.14/scsi-libcxgbi-add-a-check-for-null-pointer-in-cxgbi_.patch @@ -0,0 +1,34 @@ +From a42d0b4a0dc65f304d2db5eac6e21bf05b61693b Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Wed, 22 May 2019 20:10:55 +0530 +Subject: scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() + +[ Upstream commit cc555759117e8349088e0c5d19f2f2a500bafdbd ] + +ip_dev_find() can return NULL so add a check for NULL pointer. + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/cxgbi/libcxgbi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 512c8f1ea5b0..902f5e03ec94 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -640,6 +640,10 @@ cxgbi_check_route(struct sockaddr *dst_addr, int ifindex) + + if (ndev->flags & IFF_LOOPBACK) { + ndev = ip_dev_find(&init_net, daddr->sin_addr.s_addr); ++ if (!ndev) { ++ err = -ENETUNREACH; ++ goto rel_neigh; ++ } + mtu = ndev->mtu; + pr_info("rt dev %s, loopback -> %s, mtu %u.\n", + n->dev->name, ndev->name, mtu); +-- +2.20.1 + diff --git a/queue-4.14/scsi-libsas-delete-sas-port-if-expander-discover-fai.patch b/queue-4.14/scsi-libsas-delete-sas-port-if-expander-discover-fai.patch new file mode 100644 index 00000000000..1a3d34e1cbf --- /dev/null +++ b/queue-4.14/scsi-libsas-delete-sas-port-if-expander-discover-fai.patch @@ -0,0 +1,89 @@ +From a99dc0c61c3e76e0e4cf4038dca1c97d2dd967ae Mon Sep 17 00:00:00 2001 +From: Jason Yan +Date: Tue, 14 May 2019 10:42:39 +0800 +Subject: scsi: libsas: delete sas port if expander discover failed + +[ Upstream commit 3b0541791453fbe7f42867e310e0c9eb6295364d ] + +The sas_port(phy->port) allocated in sas_ex_discover_expander() will not be +deleted when the expander failed to discover. This will cause resource leak +and a further issue of kernel BUG like below: + +[159785.843156] port-2:17:29: trying to add phy phy-2:17:29 fails: it's +already part of another port +[159785.852144] ------------[ cut here ]------------ +[159785.856833] kernel BUG at drivers/scsi/scsi_transport_sas.c:1086! +[159785.863000] Internal error: Oops - BUG: 0 [#1] SMP +[159785.867866] CPU: 39 PID: 16993 Comm: kworker/u96:2 Tainted: G +W OE 4.19.25-vhulk1901.1.0.h111.aarch64 #1 +[159785.878458] Hardware name: Huawei Technologies Co., Ltd. +Hi1620EVBCS/Hi1620EVBCS, BIOS Hi1620 CS B070 1P TA 03/21/2019 +[159785.889231] Workqueue: 0000:74:02.0_disco_q sas_discover_domain +[159785.895224] pstate: 40c00009 (nZcv daif +PAN +UAO) +[159785.900094] pc : sas_port_add_phy+0x188/0x1b8 +[159785.904524] lr : sas_port_add_phy+0x188/0x1b8 +[159785.908952] sp : ffff0001120e3b80 +[159785.912341] x29: ffff0001120e3b80 x28: 0000000000000000 +[159785.917727] x27: ffff802ade8f5400 x26: ffff0000681b7560 +[159785.923111] x25: ffff802adf11a800 x24: ffff0000680e8000 +[159785.928496] x23: ffff802ade8f5728 x22: ffff802ade8f5708 +[159785.933880] x21: ffff802adea2db40 x20: ffff802ade8f5400 +[159785.939264] x19: ffff802adea2d800 x18: 0000000000000010 +[159785.944649] x17: 00000000821bf734 x16: ffff00006714faa0 +[159785.950033] x15: ffff0000e8ab4ecf x14: 7261702079646165 +[159785.955417] x13: 726c612073277469 x12: ffff00006887b830 +[159785.960802] x11: ffff00006773eaa0 x10: 7968702079687020 +[159785.966186] x9 : 0000000000002453 x8 : 726f702072656874 +[159785.971570] x7 : 6f6e6120666f2074 x6 : ffff802bcfb21290 +[159785.976955] x5 : ffff802bcfb21290 x4 : 0000000000000000 +[159785.982339] x3 : ffff802bcfb298c8 x2 : 337752b234c2ab00 +[159785.987723] x1 : 337752b234c2ab00 x0 : 0000000000000000 +[159785.993108] Process kworker/u96:2 (pid: 16993, stack limit = +0x0000000072dae094) +[159786.000576] Call trace: +[159786.003097] sas_port_add_phy+0x188/0x1b8 +[159786.007179] sas_ex_get_linkrate.isra.5+0x134/0x140 +[159786.012130] sas_ex_discover_expander+0x128/0x408 +[159786.016906] sas_ex_discover_dev+0x218/0x4c8 +[159786.021249] sas_ex_discover_devices+0x9c/0x1a8 +[159786.025852] sas_discover_root_expander+0x134/0x160 +[159786.030802] sas_discover_domain+0x1b8/0x1e8 +[159786.035148] process_one_work+0x1b4/0x3f8 +[159786.039230] worker_thread+0x54/0x470 +[159786.042967] kthread+0x134/0x138 +[159786.046269] ret_from_fork+0x10/0x18 +[159786.049918] Code: 91322300 f0004402 91178042 97fe4c9b (d4210000) +[159786.056083] Modules linked in: hns3_enet_ut(OE) hclge(OE) hnae3(OE) +hisi_sas_test_hw(OE) hisi_sas_test_main(OE) serdes(OE) +[159786.067202] ---[ end trace 03622b9e2d99e196 ]--- +[159786.071893] Kernel panic - not syncing: Fatal exception +[159786.077190] SMP: stopping secondary CPUs +[159786.081192] Kernel Offset: disabled +[159786.084753] CPU features: 0x2,a2a00a38 + +Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") +Reported-by: Jian Luo +Signed-off-by: Jason Yan +CC: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_expander.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index ffea620a147d..259ee0d3c3e6 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -989,6 +989,8 @@ static struct domain_device *sas_ex_discover_expander( + list_del(&child->dev_list_node); + spin_unlock_irq(&parent->port->dev_list_lock); + sas_put_device(child); ++ sas_port_delete(phy->port); ++ phy->port = NULL; + return NULL; + } + list_add_tail(&child->siblings, &parent->ex_dev.children); +-- +2.20.1 + diff --git a/queue-4.14/scsi-scsi_dh_alua-fix-possible-null-ptr-deref.patch b/queue-4.14/scsi-scsi_dh_alua-fix-possible-null-ptr-deref.patch new file mode 100644 index 00000000000..06d50e9efb2 --- /dev/null +++ b/queue-4.14/scsi-scsi_dh_alua-fix-possible-null-ptr-deref.patch @@ -0,0 +1,61 @@ +From 0a31f147bf8846d21165a83cbb40fee770660825 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Mon, 27 May 2019 22:22:09 +0800 +Subject: scsi: scsi_dh_alua: Fix possible null-ptr-deref + +[ Upstream commit 12e750bc62044de096ab9a95201213fd912b9994 ] + +If alloc_workqueue fails in alua_init, it should return -ENOMEM, otherwise +it will trigger null-ptr-deref while unloading module which calls +destroy_workqueue dereference +wq->lock like this: + +BUG: KASAN: null-ptr-deref in __lock_acquire+0x6b4/0x1ee0 +Read of size 8 at addr 0000000000000080 by task syz-executor.0/7045 + +CPU: 0 PID: 7045 Comm: syz-executor.0 Tainted: G C 5.1.0+ #28 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 +Call Trace: + dump_stack+0xa9/0x10e + __kasan_report+0x171/0x18d + ? __lock_acquire+0x6b4/0x1ee0 + kasan_report+0xe/0x20 + __lock_acquire+0x6b4/0x1ee0 + lock_acquire+0xb4/0x1b0 + __mutex_lock+0xd8/0xb90 + drain_workqueue+0x25/0x290 + destroy_workqueue+0x1f/0x3f0 + __x64_sys_delete_module+0x244/0x330 + do_syscall_64+0x72/0x2a0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: Hulk Robot +Fixes: 03197b61c5ec ("scsi_dh_alua: Use workqueue for RTPG") +Signed-off-by: YueHaibing +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index 0962fd544401..09c6a16fab93 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -1151,10 +1151,8 @@ static int __init alua_init(void) + int r; + + kaluad_wq = alloc_workqueue("kaluad", WQ_MEM_RECLAIM, 0); +- if (!kaluad_wq) { +- /* Temporary failure, bypass */ +- return SCSI_DH_DEV_TEMP_BUSY; +- } ++ if (!kaluad_wq) ++ return -ENOMEM; + + r = scsi_register_device_handler(&alua_dh); + if (r != 0) { +-- +2.20.1 + diff --git a/queue-4.14/scsi-smartpqi-properly-set-both-the-dma-mask-and-the.patch b/queue-4.14/scsi-smartpqi-properly-set-both-the-dma-mask-and-the.patch new file mode 100644 index 00000000000..3471300954f --- /dev/null +++ b/queue-4.14/scsi-smartpqi-properly-set-both-the-dma-mask-and-the.patch @@ -0,0 +1,57 @@ +From 4ff44e652fbd0c7037c7a9cbc6ae00c8f1ce8724 Mon Sep 17 00:00:00 2001 +From: Lianbo Jiang +Date: Mon, 27 May 2019 08:59:34 +0800 +Subject: scsi: smartpqi: properly set both the DMA mask and the coherent DMA + mask + +[ Upstream commit 1d94f06e7f5df4064ef336b7b710f50143b64a53 ] + +When SME is enabled, the smartpqi driver won't work on the HP DL385 G10 +machine, which causes the failure of kernel boot because it fails to +allocate pqi error buffer. Please refer to the kernel log: +.... +[ 9.431749] usbcore: registered new interface driver uas +[ 9.441524] Microsemi PQI Driver (v1.1.4-130) +[ 9.442956] i40e 0000:04:00.0: fw 6.70.48768 api 1.7 nvm 10.2.5 +[ 9.447237] smartpqi 0000:23:00.0: Microsemi Smart Family Controller found + Starting dracut initqueue hook... +[ OK ] Started Show Plymouth Boot Scre[ 9.471654] Broadcom NetXtreme-C/E driver bnxt_en v1.9.1 +en. +[ OK ] Started Forward Password Requests to Plymouth Directory Watch. +[[0;[ 9.487108] smartpqi 0000:23:00.0: failed to allocate PQI error buffer +.... +[ 139.050544] dracut-initqueue[949]: Warning: dracut-initqueue timeout - starting timeout scripts +[ 139.589779] dracut-initqueue[949]: Warning: dracut-initqueue timeout - starting timeout scripts + +Basically, the fact that the coherent DMA mask value wasn't set caused the +driver to fall back to SWIOTLB when SME is active. + +For correct operation, lets call the dma_set_mask_and_coherent() to +properly set the mask for both streaming and coherent, in order to inform +the kernel about the devices DMA addressing capabilities. + +Signed-off-by: Lianbo Jiang +Acked-by: Don Brace +Tested-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 5ec2898d21cd..d34351c6b9af 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -6392,7 +6392,7 @@ static int pqi_pci_init(struct pqi_ctrl_info *ctrl_info) + else + mask = DMA_BIT_MASK(32); + +- rc = dma_set_mask(&ctrl_info->pci_dev->dev, mask); ++ rc = dma_set_mask_and_coherent(&ctrl_info->pci_dev->dev, mask); + if (rc) { + dev_err(&ctrl_info->pci_dev->dev, "failed to set DMA mask\n"); + goto disable_device; +-- +2.20.1 + diff --git a/queue-4.14/selftests-netfilter-missing-error-check-when-setting.patch b/queue-4.14/selftests-netfilter-missing-error-check-when-setting.patch new file mode 100644 index 00000000000..5f5f0bffa9e --- /dev/null +++ b/queue-4.14/selftests-netfilter-missing-error-check-when-setting.patch @@ -0,0 +1,41 @@ +From 4e953b15ac6f4e9d989e4f00e1b5e53417e1c125 Mon Sep 17 00:00:00 2001 +From: Jeffrin Jose T +Date: Wed, 15 May 2019 12:14:04 +0530 +Subject: selftests: netfilter: missing error check when setting up veth + interface + +[ Upstream commit 82ce6eb1dd13fd12e449b2ee2c2ec051e6f52c43 ] + +A test for the basic NAT functionality uses ip command which needs veth +device. There is a condition where the kernel support for veth is not +compiled into the kernel and the test script breaks. This patch contains +code for reasonable error display and correct code exit. + +Signed-off-by: Jeffrin Jose T +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/netfilter/nft_nat.sh | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/netfilter/nft_nat.sh b/tools/testing/selftests/netfilter/nft_nat.sh +index 8ec76681605c..f25f72a75cf3 100755 +--- a/tools/testing/selftests/netfilter/nft_nat.sh ++++ b/tools/testing/selftests/netfilter/nft_nat.sh +@@ -23,7 +23,11 @@ ip netns add ns0 + ip netns add ns1 + ip netns add ns2 + +-ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 ++ip link add veth0 netns ns0 type veth peer name eth0 netns ns1 > /dev/null 2>&1 ++if [ $? -ne 0 ];then ++ echo "SKIP: No virtual ethernet pair device support in kernel" ++ exit $ksft_skip ++fi + ip link add veth1 netns ns0 type veth peer name eth0 netns ns2 + + ip -net ns0 link set lo up +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index a19f502c943..f982678b078 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -8,3 +8,33 @@ net-openvswitch-do-not-free-vport-if-register_netdevice-is-failed.patch net-phylink-set-the-autoneg-state-in-phylink_phy_change.patch sctp-free-cookie-before-we-memdup-a-new-one.patch sunhv-fix-device-naming-inconsistency-between-sunhv_console-and-sunhv_reg.patch +staging-vc04_services-fix-a-couple-error-codes.patch +perf-x86-intel-ds-fix-event-vs.-uevent-pebs-constrai.patch +netfilter-nf_queue-fix-reinject-verdict-handling.patch +ipvs-fix-use-after-free-in-ip_vs_in.patch +selftests-netfilter-missing-error-check-when-setting.patch +clk-ti-clkctrl-fix-clkdm_clk-handling.patch +powerpc-powernv-return-for-invalid-imc-domain.patch +misdn-make-sure-device-name-is-nul-terminated.patch +x86-cpu-amd-don-t-force-the-cpb-cap-when-running-und.patch +perf-ring_buffer-fix-exposing-a-temporarily-decrease.patch +perf-ring_buffer-add-ordering-to-rb-nest-increment.patch +perf-ring-buffer-always-use-read-write-_once-for-rb-.patch +gpio-fix-gpio-adp5588-build-errors.patch +net-tulip-de4x5-drop-redundant-module_device_table.patch +net-aquantia-fix-lro-with-fcs-error.patch +i2c-dev-fix-potential-memory-leak-in-i2cdev_ioctl_rd.patch +alsa-hda-force-polling-mode-on-cnl-for-fixing-codec-.patch +configfs-fix-use-after-free-when-accessing-sd-s_dent.patch +perf-data-fix-strncat-may-truncate-build-failure-wit.patch +perf-record-fix-s390-missing-module-symbol-and-warni.patch +ia64-fix-build-errors-by-exporting-paddr_to_nid.patch +kvm-ppc-book3s-use-new-mutex-to-synchronize-access-t.patch +kvm-ppc-book3s-hv-don-t-take-kvm-lock-around-kvm_for.patch +net-sh_eth-fix-mdio-access-in-sh_eth_close-for-r-car.patch +net-phy-dp83867-set-up-rgmii-tx-delay.patch +scsi-libcxgbi-add-a-check-for-null-pointer-in-cxgbi_.patch +scsi-smartpqi-properly-set-both-the-dma-mask-and-the.patch +scsi-scsi_dh_alua-fix-possible-null-ptr-deref.patch +scsi-libsas-delete-sas-port-if-expander-discover-fai.patch +mlxsw-spectrum-prevent-force-of-56g.patch diff --git a/queue-4.14/staging-vc04_services-fix-a-couple-error-codes.patch b/queue-4.14/staging-vc04_services-fix-a-couple-error-codes.patch new file mode 100644 index 00000000000..858d2ed0694 --- /dev/null +++ b/queue-4.14/staging-vc04_services-fix-a-couple-error-codes.patch @@ -0,0 +1,44 @@ +From bb9eca0112e7dec7a16bf6940f0dd290dc6a517f Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 13 May 2019 14:07:18 +0300 +Subject: Staging: vc04_services: Fix a couple error codes + +[ Upstream commit ca4e4efbefbbdde0a7bb3023ea08d491f4daf9b9 ] + +These are accidentally returning positive EINVAL instead of negative +-EINVAL. Some of the callers treat positive values as success. + +Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.") +Signed-off-by: Dan Carpenter +Acked-by: Stefan Wahren +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/vc04_services/bcm2835-camera/controls.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/vc04_services/bcm2835-camera/controls.c b/drivers/staging/vc04_services/bcm2835-camera/controls.c +index 77a5d6f4e1eb..8a242f609d3b 100644 +--- a/drivers/staging/vc04_services/bcm2835-camera/controls.c ++++ b/drivers/staging/vc04_services/bcm2835-camera/controls.c +@@ -579,7 +579,7 @@ static int ctrl_set_image_effect(struct bm2835_mmal_dev *dev, + dev->colourfx.enable ? "true" : "false", + dev->colourfx.u, dev->colourfx.v, + ret, (ret == 0 ? 0 : -EINVAL)); +- return (ret == 0 ? 0 : EINVAL); ++ return (ret == 0 ? 0 : -EINVAL); + } + + static int ctrl_set_colfx(struct bm2835_mmal_dev *dev, +@@ -603,7 +603,7 @@ static int ctrl_set_colfx(struct bm2835_mmal_dev *dev, + "%s: After: mmal_ctrl:%p ctrl id:0x%x ctrl val:%d ret %d(%d)\n", + __func__, mmal_ctrl, ctrl->id, ctrl->val, ret, + (ret == 0 ? 0 : -EINVAL)); +- return (ret == 0 ? 0 : EINVAL); ++ return (ret == 0 ? 0 : -EINVAL); + } + + static int ctrl_set_bitrate(struct bm2835_mmal_dev *dev, +-- +2.20.1 + diff --git a/queue-4.14/x86-cpu-amd-don-t-force-the-cpb-cap-when-running-und.patch b/queue-4.14/x86-cpu-amd-don-t-force-the-cpb-cap-when-running-und.patch new file mode 100644 index 00000000000..9bb0d56d87d --- /dev/null +++ b/queue-4.14/x86-cpu-amd-don-t-force-the-cpb-cap-when-running-und.patch @@ -0,0 +1,68 @@ +From ec7a10dff359a03d7be393cbc1a993aed92f2fc5 Mon Sep 17 00:00:00 2001 +From: Frank van der Linden +Date: Wed, 22 May 2019 22:17:45 +0000 +Subject: x86/CPU/AMD: Don't force the CPB cap when running under a hypervisor + +[ Upstream commit 2ac44ab608705948564791ce1d15d43ba81a1e38 ] + +For F17h AMD CPUs, the CPB capability ('Core Performance Boost') is forcibly set, +because some versions of that chip incorrectly report that they do not have it. + +However, a hypervisor may filter out the CPB capability, for good +reasons. For example, KVM currently does not emulate setting the CPB +bit in MSR_K7_HWCR, and unchecked MSR access errors will be thrown +when trying to set it as a guest: + + unchecked MSR access error: WRMSR to 0xc0010015 (tried to write 0x0000000001000011) at rIP: 0xffffffff890638f4 (native_write_msr+0x4/0x20) + + Call Trace: + boost_set_msr+0x50/0x80 [acpi_cpufreq] + cpuhp_invoke_callback+0x86/0x560 + sort_range+0x20/0x20 + cpuhp_thread_fun+0xb0/0x110 + smpboot_thread_fn+0xef/0x160 + kthread+0x113/0x130 + kthread_create_worker_on_cpu+0x70/0x70 + ret_from_fork+0x35/0x40 + +To avoid this issue, don't forcibly set the CPB capability for a CPU +when running under a hypervisor. + +Signed-off-by: Frank van der Linden +Acked-by: Borislav Petkov +Cc: Andy Lutomirski +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: bp@alien8.de +Cc: jiaxun.yang@flygoat.com +Fixes: 0237199186e7 ("x86/CPU/AMD: Set the CPB bit unconditionally on F17h") +Link: http://lkml.kernel.org/r/20190522221745.GA15789@dev-dsk-fllinden-2c-c1893d73.us-west-2.amazon.com +[ Minor edits to the changelog. ] +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/amd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index ecf82859f1c0..bbebcd7a781e 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -792,8 +792,11 @@ static void init_amd_zn(struct cpuinfo_x86 *c) + { + set_cpu_cap(c, X86_FEATURE_ZEN); + +- /* Fix erratum 1076: CPB feature bit not being set in CPUID. */ +- if (!cpu_has(c, X86_FEATURE_CPB)) ++ /* ++ * Fix erratum 1076: CPB feature bit not being set in CPUID. ++ * Always set it, except when running under a hypervisor. ++ */ ++ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) && !cpu_has(c, X86_FEATURE_CPB)) + set_cpu_cap(c, X86_FEATURE_CPB); + } + +-- +2.20.1 +