From: Sasha Levin Date: Mon, 13 May 2019 18:42:41 +0000 (-0400) Subject: autosel fixes for 4.4 X-Git-Tag: v5.1.2~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=345c7afc70351831d3aec2c7afb84c22c79eb8a5;p=thirdparty%2Fkernel%2Fstable-queue.git autosel fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/gpu-ipu-v3-dp-fix-csc-handling.patch b/queue-4.4/gpu-ipu-v3-dp-fix-csc-handling.patch new file mode 100644 index 00000000000..bbaf360fff9 --- /dev/null +++ b/queue-4.4/gpu-ipu-v3-dp-fix-csc-handling.patch @@ -0,0 +1,69 @@ +From 93821c5c04f86cebb7862e203394bfb812dcd3ee Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 12 Apr 2019 17:59:40 +0200 +Subject: gpu: ipu-v3: dp: fix CSC handling + +[ Upstream commit d4fad0a426c6e26f48c9a7cdd21a7fe9c198d645 ] + +Initialize the flow input colorspaces to unknown and reset to that value +when the channel gets disabled. This avoids the state getting mixed up +with a previous mode. + +Also keep the CSC settings for the background flow intact when disabling +the foreground flow. + +Root-caused-by: Jonathan Marek +Signed-off-by: Lucas Stach +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-dp.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c +index 98686edbcdbb0..33de3a1bac49f 100644 +--- a/drivers/gpu/ipu-v3/ipu-dp.c ++++ b/drivers/gpu/ipu-v3/ipu-dp.c +@@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp, + ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs, + DP_COM_CONF_CSC_DEF_BOTH); + } else { +- if (flow->foreground.in_cs == flow->out_cs) ++ if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN || ++ flow->foreground.in_cs == flow->out_cs) + /* + * foreground identical to output, apply color + * conversion on background +@@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp) + struct ipu_dp_priv *priv = flow->priv; + u32 reg, csc; + ++ dp->in_cs = IPUV3_COLORSPACE_UNKNOWN; ++ + if (!dp->foreground) + return; + +@@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp) + + reg = readl(flow->base + DP_COM_CONF); + csc = reg & DP_COM_CONF_CSC_DEF_MASK; +- if (csc == DP_COM_CONF_CSC_DEF_FG) +- reg &= ~DP_COM_CONF_CSC_DEF_MASK; ++ reg &= ~DP_COM_CONF_CSC_DEF_MASK; ++ if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG) ++ reg |= DP_COM_CONF_CSC_DEF_BG; + + reg &= ~DP_COM_CONF_FG_EN; + writel(reg, flow->base + DP_COM_CONF); +@@ -350,6 +354,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base) + mutex_init(&priv->mutex); + + for (i = 0; i < IPUV3_NUM_FLOWS; i++) { ++ priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN; ++ priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN; + priv->flow[i].foreground.foreground = true; + priv->flow[i].base = priv->base + ipu_dp_flow_base[i]; + priv->flow[i].priv = priv; +-- +2.20.1 + diff --git a/queue-4.4/hid-input-add-mapping-for-expose-overview-key.patch b/queue-4.4/hid-input-add-mapping-for-expose-overview-key.patch new file mode 100644 index 00000000000..4a2529c283d --- /dev/null +++ b/queue-4.4/hid-input-add-mapping-for-expose-overview-key.patch @@ -0,0 +1,37 @@ +From 9b3d9a41618fbc3f1ae2097698f146eda2f64331 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 18 Jan 2019 13:59:08 -0800 +Subject: HID: input: add mapping for Expose/Overview key +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 96dd86871e1fffbc39e4fa61c9c75ec54ee9af0f ] + +According to HUTRR77 usage 0x29f from the consumer page is reserved for +the Desktop application to present all running user’s application windows. +Linux defines KEY_SCALE to request Compiz Scale (Expose) mode, so let's +add the mapping. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 8d74e691ac90f..01b41ff430564 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -913,6 +913,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT); break; + case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL); break; + ++ case 0x29f: map_key_clear(KEY_SCALE); break; ++ + default: map_key_clear(KEY_UNKNOWN); + } + break; +-- +2.20.1 + diff --git a/queue-4.4/hid-input-add-mapping-for-keyboard-brightness-up-dow.patch b/queue-4.4/hid-input-add-mapping-for-keyboard-brightness-up-dow.patch new file mode 100644 index 00000000000..35a9d0aa238 --- /dev/null +++ b/queue-4.4/hid-input-add-mapping-for-keyboard-brightness-up-dow.patch @@ -0,0 +1,34 @@ +From 018504cf2633def4349e3ffa664e0dda2d9777ed Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 18 Jan 2019 14:05:52 -0800 +Subject: HID: input: add mapping for keyboard Brightness Up/Down/Toggle keys + +[ Upstream commit 7975a1d6a7afeb3eb61c971a153d24dd8fa032f3 ] + +According to HUTRR73 usages 0x79, 0x7a and 0x7c from the consumer page +correspond to Brightness Up/Down/Toggle keys, so let's add the mappings. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 01b41ff430564..ee3c66c020438 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -783,6 +783,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + case 0x074: map_key_clear(KEY_BRIGHTNESS_MAX); break; + case 0x075: map_key_clear(KEY_BRIGHTNESS_AUTO); break; + ++ case 0x079: map_key_clear(KEY_KBDILLUMUP); break; ++ case 0x07a: map_key_clear(KEY_KBDILLUMDOWN); break; ++ case 0x07c: map_key_clear(KEY_KBDILLUMTOGGLE); break; ++ + case 0x082: map_key_clear(KEY_VIDEO_NEXT); break; + case 0x083: map_key_clear(KEY_LAST); break; + case 0x084: map_key_clear(KEY_ENTER); break; +-- +2.20.1 + diff --git a/queue-4.4/iio-adc-xilinx-fix-potential-use-after-free-on-remov.patch b/queue-4.4/iio-adc-xilinx-fix-potential-use-after-free-on-remov.patch new file mode 100644 index 00000000000..c76ab27f686 --- /dev/null +++ b/queue-4.4/iio-adc-xilinx-fix-potential-use-after-free-on-remov.patch @@ -0,0 +1,38 @@ +From ea1efc0e15d887fc1e2954a3ec9ae93c6292fe42 Mon Sep 17 00:00:00 2001 +From: Sven Van Asbroeck +Date: Sun, 10 Mar 2019 14:58:24 -0400 +Subject: iio: adc: xilinx: fix potential use-after-free on remove + +[ Upstream commit 62039b6aef63380ba7a37c113bbaeee8a55c5342 ] + +When cancel_delayed_work() returns, the delayed work may still +be running. This means that the core could potentially free +the private structure (struct xadc) while the delayed work +is still using it. This is a potential use-after-free. + +Fix by calling cancel_delayed_work_sync(), which waits for +any residual work to finish before returning. + +Signed-off-by: Sven Van Asbroeck +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/xilinx-xadc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c +index 475c5a74f2d1f..6398e86a272b8 100644 +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev) + } + free_irq(irq, indio_dev); + clk_disable_unprepare(xadc->clk); +- cancel_delayed_work(&xadc->zynq_unmask_work); ++ cancel_delayed_work_sync(&xadc->zynq_unmask_work); + kfree(xadc->data); + kfree(indio_dev->channels); + +-- +2.20.1 + diff --git a/queue-4.4/init-initialize-jump-labels-before-command-line-opti.patch b/queue-4.4/init-initialize-jump-labels-before-command-line-opti.patch new file mode 100644 index 00000000000..eeb831448e2 --- /dev/null +++ b/queue-4.4/init-initialize-jump-labels-before-command-line-opti.patch @@ -0,0 +1,79 @@ +From ac5d3cefba62b94e8d02640f85de9cf7b8a78732 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 18 Apr 2019 17:50:44 -0700 +Subject: init: initialize jump labels before command line option parsing + +[ Upstream commit 6041186a32585fc7a1d0f6cfe2f138b05fdc3c82 ] + +When a module option, or core kernel argument, toggles a static-key it +requires jump labels to be initialized early. While x86, PowerPC, and +ARM64 arrange for jump_label_init() to be called before parse_args(), +ARM does not. + + Kernel command line: rdinit=/sbin/init page_alloc.shuffle=1 panic=-1 console=ttyAMA0,115200 page_alloc.shuffle=1 + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 0 at ./include/linux/jump_label.h:303 + page_alloc_shuffle+0x12c/0x1ac + static_key_enable(): static key 'page_alloc_shuffle_key+0x0/0x4' used + before call to jump_label_init() + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted + 5.1.0-rc4-next-20190410-00003-g3367c36ce744 #1 + Hardware name: ARM Integrator/CP (Device Tree) + [] (unwind_backtrace) from [] (show_stack+0x10/0x18) + [] (show_stack) from [] (dump_stack+0x18/0x24) + [] (dump_stack) from [] (__warn+0xe0/0x108) + [] (__warn) from [] (warn_slowpath_fmt+0x44/0x6c) + [] (warn_slowpath_fmt) from [] + (page_alloc_shuffle+0x12c/0x1ac) + [] (page_alloc_shuffle) from [] (shuffle_store+0x28/0x48) + [] (shuffle_store) from [] (parse_args+0x1f4/0x350) + [] (parse_args) from [] (start_kernel+0x1c0/0x488) + +Move the fallback call to jump_label_init() to occur before +parse_args(). + +The redundant calls to jump_label_init() in other archs are left intact +in case they have static key toggling use cases that are even earlier +than option parsing. + +Link: http://lkml.kernel.org/r/155544804466.1032396.13418949511615676665.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Reported-by: Guenter Roeck +Reviewed-by: Kees Cook +Cc: Mathieu Desnoyers +Cc: Thomas Gleixner +Cc: Mike Rapoport +Cc: Russell King +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + init/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/init/main.c b/init/main.c +index 49926d95442f8..e88c8cdef6a7c 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -538,6 +538,8 @@ asmlinkage __visible void __init start_kernel(void) + page_alloc_init(); + + pr_notice("Kernel command line: %s\n", boot_command_line); ++ /* parameters may set static keys */ ++ jump_label_init(); + parse_early_param(); + after_dashes = parse_args("Booting kernel", + static_command_line, __start___param, +@@ -547,8 +549,6 @@ asmlinkage __visible void __init start_kernel(void) + parse_args("Setting init args", after_dashes, NULL, 0, -1, -1, + NULL, set_init_arg); + +- jump_label_init(); +- + /* + * These use large bootmem allocations and must precede + * kmem_cache_init() +-- +2.20.1 + diff --git a/queue-4.4/ipvs-do-not-schedule-icmp-errors-from-tunnels.patch b/queue-4.4/ipvs-do-not-schedule-icmp-errors-from-tunnels.patch new file mode 100644 index 00000000000..dd824463917 --- /dev/null +++ b/queue-4.4/ipvs-do-not-schedule-icmp-errors-from-tunnels.patch @@ -0,0 +1,38 @@ +From 1e2497404b2f5ce3876101ea6b51eb68f187b038 Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Sun, 31 Mar 2019 13:24:52 +0300 +Subject: ipvs: do not schedule icmp errors from tunnels + +[ Upstream commit 0261ea1bd1eb0da5c0792a9119b8655cf33c80a3 ] + +We can receive ICMP errors from client or from +tunneling real server. While the former can be +scheduled to real server, the latter should +not be scheduled, they are decapsulated only when +existing connection is found. + +Fixes: 6044eeffafbe ("ipvs: attempt to schedule icmp packets") +Signed-off-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index ac212542a2178..c4509a10ce52f 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1484,7 +1484,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related, + if (!cp) { + int v; + +- if (!sysctl_schedule_icmp(ipvs)) ++ if (ipip || !sysctl_schedule_icmp(ipvs)) + return NF_ACCEPT; + + if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph)) +-- +2.20.1 + diff --git a/queue-4.4/kvm-x86-avoid-misreporting-level-triggered-irqs-as-e.patch b/queue-4.4/kvm-x86-avoid-misreporting-level-triggered-irqs-as-e.patch new file mode 100644 index 00000000000..d388562403b --- /dev/null +++ b/queue-4.4/kvm-x86-avoid-misreporting-level-triggered-irqs-as-e.patch @@ -0,0 +1,51 @@ +From 5a98896a927ad23d3b1d473d45d0e2213f99d29f Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Wed, 27 Mar 2019 15:12:20 +0100 +Subject: KVM: x86: avoid misreporting level-triggered irqs as edge-triggered + in tracing + +[ Upstream commit 7a223e06b1a411cef6c4cd7a9b9a33c8d225b10e ] + +In __apic_accept_irq() interface trig_mode is int and actually on some code +paths it is set above u8: + +kvm_apic_set_irq() extracts it from 'struct kvm_lapic_irq' where trig_mode +is u16. This is done on purpose as e.g. kvm_set_msi_irq() sets it to +(1 << 15) & e->msi.data + +kvm_apic_local_deliver sets it to reg & (1 << 15). + +Fix the immediate issue by making 'tm' into u16. We may also want to adjust +__apic_accept_irq() interface and use proper sizes for vector, level, +trig_mode but this is not urgent. + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/trace.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h +index ab9ae67a80e44..0ec94c6b47576 100644 +--- a/arch/x86/kvm/trace.h ++++ b/arch/x86/kvm/trace.h +@@ -434,13 +434,13 @@ TRACE_EVENT(kvm_apic_ipi, + ); + + TRACE_EVENT(kvm_apic_accept_irq, +- TP_PROTO(__u32 apicid, __u16 dm, __u8 tm, __u8 vec), ++ TP_PROTO(__u32 apicid, __u16 dm, __u16 tm, __u8 vec), + TP_ARGS(apicid, dm, tm, vec), + + TP_STRUCT__entry( + __field( __u32, apicid ) + __field( __u16, dm ) +- __field( __u8, tm ) ++ __field( __u16, tm ) + __field( __u8, vec ) + ), + +-- +2.20.1 + diff --git a/queue-4.4/libnvdimm-btt-fix-a-kmemdup-failure-check.patch b/queue-4.4/libnvdimm-btt-fix-a-kmemdup-failure-check.patch new file mode 100644 index 00000000000..5bb9c84896c --- /dev/null +++ b/queue-4.4/libnvdimm-btt-fix-a-kmemdup-failure-check.patch @@ -0,0 +1,59 @@ +From abb771309636a0066ed49ae09875a1bc135d0f0d Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Mon, 25 Mar 2019 16:55:27 -0500 +Subject: libnvdimm/btt: Fix a kmemdup failure check + +[ Upstream commit 486fa92df4707b5df58d6508728bdb9321a59766 ] + +In case kmemdup fails, the fix releases resources and returns to +avoid the NULL pointer dereference. + +Signed-off-by: Aditya Pakki +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/btt_devs.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c +index cb477518dd0e4..4c129450495da 100644 +--- a/drivers/nvdimm/btt_devs.c ++++ b/drivers/nvdimm/btt_devs.c +@@ -170,14 +170,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region, + return NULL; + + nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL); +- if (nd_btt->id < 0) { +- kfree(nd_btt); +- return NULL; +- } ++ if (nd_btt->id < 0) ++ goto out_nd_btt; + + nd_btt->lbasize = lbasize; +- if (uuid) ++ if (uuid) { + uuid = kmemdup(uuid, 16, GFP_KERNEL); ++ if (!uuid) ++ goto out_put_id; ++ } + nd_btt->uuid = uuid; + dev = &nd_btt->dev; + dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id); +@@ -192,6 +193,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region, + return NULL; + } + return dev; ++ ++out_put_id: ++ ida_simple_remove(&nd_region->btt_ida, nd_btt->id); ++ ++out_nd_btt: ++ kfree(nd_btt); ++ return NULL; + } + + struct device *nd_btt_create(struct nd_region *nd_region) +-- +2.20.1 + diff --git a/queue-4.4/s390-3270-fix-lockdep-false-positive-on-view-lock.patch b/queue-4.4/s390-3270-fix-lockdep-false-positive-on-view-lock.patch new file mode 100644 index 00000000000..592f140d85e --- /dev/null +++ b/queue-4.4/s390-3270-fix-lockdep-false-positive-on-view-lock.patch @@ -0,0 +1,122 @@ +From 2a392999fe2881e305b2edbc53819fb48d07d6cd Mon Sep 17 00:00:00 2001 +From: Martin Schwidefsky +Date: Wed, 3 Apr 2019 09:13:34 +0200 +Subject: s390/3270: fix lockdep false positive on view->lock + +[ Upstream commit 5712f3301a12c0c3de9cc423484496b0464f2faf ] + +The spinlock in the raw3270_view structure is used by con3270, tty3270 +and fs3270 in different ways. For con3270 the lock can be acquired in +irq context, for tty3270 and fs3270 the highest context is bh. + +Lockdep sees the view->lock as a single class and if the 3270 driver +is used for the console the following message is generated: + +WARNING: inconsistent lock state +5.1.0-rc3-05157-g5c168033979d #12 Not tainted +-------------------------------- +inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. +swapper/0/1 [HC0[0]:SC1[1]:HE1:SE0] takes: +(____ptrval____) (&(&view->lock)->rlock){?.-.}, at: tty3270_update+0x7c/0x330 + +Introduce a lockdep subclass for the view lock to distinguish bh from +irq locks. + +Signed-off-by: Martin Schwidefsky + +Signed-off-by: Sasha Levin +--- + drivers/s390/char/con3270.c | 2 +- + drivers/s390/char/fs3270.c | 3 ++- + drivers/s390/char/raw3270.c | 3 ++- + drivers/s390/char/raw3270.h | 4 +++- + drivers/s390/char/tty3270.c | 3 ++- + 5 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c +index bae98521c808c..3e5a7912044fa 100644 +--- a/drivers/s390/char/con3270.c ++++ b/drivers/s390/char/con3270.c +@@ -627,7 +627,7 @@ con3270_init(void) + (void (*)(unsigned long)) con3270_read_tasklet, + (unsigned long) condev->read); + +- raw3270_add_view(&condev->view, &con3270_fn, 1); ++ raw3270_add_view(&condev->view, &con3270_fn, 1, RAW3270_VIEW_LOCK_IRQ); + + INIT_LIST_HEAD(&condev->freemem); + for (i = 0; i < CON3270_STRING_PAGES; i++) { +diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c +index 71e9747380149..f0c86bcbe3161 100644 +--- a/drivers/s390/char/fs3270.c ++++ b/drivers/s390/char/fs3270.c +@@ -463,7 +463,8 @@ fs3270_open(struct inode *inode, struct file *filp) + + init_waitqueue_head(&fp->wait); + fp->fs_pid = get_pid(task_pid(current)); +- rc = raw3270_add_view(&fp->view, &fs3270_fn, minor); ++ rc = raw3270_add_view(&fp->view, &fs3270_fn, minor, ++ RAW3270_VIEW_LOCK_BH); + if (rc) { + fs3270_free_view(&fp->view); + goto out; +diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c +index 220acb4cbee52..9c350e6d75bf7 100644 +--- a/drivers/s390/char/raw3270.c ++++ b/drivers/s390/char/raw3270.c +@@ -956,7 +956,7 @@ raw3270_deactivate_view(struct raw3270_view *view) + * Add view to device with minor "minor". + */ + int +-raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor) ++raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor, int subclass) + { + unsigned long flags; + struct raw3270 *rp; +@@ -978,6 +978,7 @@ raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor) + view->cols = rp->cols; + view->ascebc = rp->ascebc; + spin_lock_init(&view->lock); ++ lockdep_set_subclass(&view->lock, subclass); + list_add(&view->list, &rp->view_list); + rc = 0; + spin_unlock_irqrestore(get_ccwdev_lock(rp->cdev), flags); +diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h +index e1e41c2861fbb..5ae54317857a0 100644 +--- a/drivers/s390/char/raw3270.h ++++ b/drivers/s390/char/raw3270.h +@@ -155,6 +155,8 @@ struct raw3270_fn { + struct raw3270_view { + struct list_head list; + spinlock_t lock; ++#define RAW3270_VIEW_LOCK_IRQ 0 ++#define RAW3270_VIEW_LOCK_BH 1 + atomic_t ref_count; + struct raw3270 *dev; + struct raw3270_fn *fn; +@@ -163,7 +165,7 @@ struct raw3270_view { + unsigned char *ascebc; /* ascii -> ebcdic table */ + }; + +-int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int); ++int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int, int); + int raw3270_activate_view(struct raw3270_view *); + void raw3270_del_view(struct raw3270_view *); + void raw3270_deactivate_view(struct raw3270_view *); +diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c +index e96fc7fd94984..ab95d24b991b4 100644 +--- a/drivers/s390/char/tty3270.c ++++ b/drivers/s390/char/tty3270.c +@@ -937,7 +937,8 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty) + return PTR_ERR(tp); + + rc = raw3270_add_view(&tp->view, &tty3270_fn, +- tty->index + RAW3270_FIRSTMINOR); ++ tty->index + RAW3270_FIRSTMINOR, ++ RAW3270_VIEW_LOCK_BH); + if (rc) { + tty3270_free_view(tp); + return rc; +-- +2.20.1 + diff --git a/queue-4.4/s390-ctcm-fix-ctcm_new_device-error-return-code.patch b/queue-4.4/s390-ctcm-fix-ctcm_new_device-error-return-code.patch new file mode 100644 index 00000000000..1a6746a46c5 --- /dev/null +++ b/queue-4.4/s390-ctcm-fix-ctcm_new_device-error-return-code.patch @@ -0,0 +1,53 @@ +From 523e6b4118c1e4d3e13bc10db6d7007d28a1f637 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 17 Apr 2019 18:29:13 +0200 +Subject: s390: ctcm: fix ctcm_new_device error return code + +[ Upstream commit 27b141fc234a3670d21bd742c35d7205d03cbb3a ] + +clang points out that the return code from this function is +undefined for one of the error paths: + +../drivers/s390/net/ctcm_main.c:1595:7: warning: variable 'result' is used uninitialized whenever 'if' condition is true + [-Wsometimes-uninitialized] + if (priv->channel[direction] == NULL) { + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../drivers/s390/net/ctcm_main.c:1638:9: note: uninitialized use occurs here + return result; + ^~~~~~ +../drivers/s390/net/ctcm_main.c:1595:3: note: remove the 'if' if its condition is always false + if (priv->channel[direction] == NULL) { + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../drivers/s390/net/ctcm_main.c:1539:12: note: initialize the variable 'result' to silence this warning + int result; + ^ + +Make it return -ENODEV here, as in the related failure cases. +gcc has a known bug in underreporting some of these warnings +when it has already eliminated the assignment of the return code +based on some earlier optimization step. + +Reviewed-by: Nathan Chancellor +Signed-off-by: Arnd Bergmann +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/ctcm_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c +index 05c37d6d4afef..a31821d946775 100644 +--- a/drivers/s390/net/ctcm_main.c ++++ b/drivers/s390/net/ctcm_main.c +@@ -1595,6 +1595,7 @@ static int ctcm_new_device(struct ccwgroup_device *cgdev) + if (priv->channel[direction] == NULL) { + if (direction == CTCM_WRITE) + channel_free(priv->channel[CTCM_READ]); ++ result = -ENODEV; + goto out_dev; + } + priv->channel[direction]->netdev = dev; +-- +2.20.1 + diff --git a/queue-4.4/s390-dasd-fix-capacity-calculation-for-large-volumes.patch b/queue-4.4/s390-dasd-fix-capacity-calculation-for-large-volumes.patch new file mode 100644 index 00000000000..1e89aff12aa --- /dev/null +++ b/queue-4.4/s390-dasd-fix-capacity-calculation-for-large-volumes.patch @@ -0,0 +1,59 @@ +From 799b36a636a3ec83d77813786db5c48c445eb2ae Mon Sep 17 00:00:00 2001 +From: Peter Oberparleiter +Date: Fri, 22 Mar 2019 16:01:17 +0100 +Subject: s390/dasd: Fix capacity calculation for large volumes + +[ Upstream commit 2cc9637ce825f3a9f51f8f78af7474e9e85bfa5f ] + +The DASD driver incorrectly limits the maximum number of blocks of ECKD +DASD volumes to 32 bit numbers. Volumes with a capacity greater than +2^32-1 blocks are incorrectly recognized as smaller volumes. + +This results in the following volume capacity limits depending on the +formatted block size: + + BLKSIZE MAX_GB MAX_CYL + 512 2047 5843492 + 1024 4095 8676701 + 2048 8191 13634816 + 4096 16383 23860929 + +The same problem occurs when a volume with more than 17895697 cylinders +is accessed in raw-track-access mode. + +Fix this problem by adding an explicit type cast when calculating the +maximum number of blocks. + +Signed-off-by: Peter Oberparleiter +Reviewed-by: Stefan Haberland +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + drivers/s390/block/dasd_eckd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 80a43074c2f9a..c530610f61ac9 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -2066,14 +2066,14 @@ static int dasd_eckd_end_analysis(struct dasd_block *block) + blk_per_trk = recs_per_track(&private->rdc_data, 0, block->bp_block); + + raw: +- block->blocks = (private->real_cyl * ++ block->blocks = ((unsigned long) private->real_cyl * + private->rdc_data.trk_per_cyl * + blk_per_trk); + + dev_info(&device->cdev->dev, +- "DASD with %d KB/block, %d KB total size, %d KB/track, " ++ "DASD with %u KB/block, %lu KB total size, %u KB/track, " + "%s\n", (block->bp_block >> 10), +- ((private->real_cyl * ++ (((unsigned long) private->real_cyl * + private->rdc_data.trk_per_cyl * + blk_per_trk * (block->bp_block >> 9)) >> 1), + ((blk_per_trk * block->bp_block) >> 10), +-- +2.20.1 + diff --git a/queue-4.4/selftests-net-correct-the-return-value-for-run_netso.patch b/queue-4.4/selftests-net-correct-the-return-value-for-run_netso.patch new file mode 100644 index 00000000000..dd5a31cb631 --- /dev/null +++ b/queue-4.4/selftests-net-correct-the-return-value-for-run_netso.patch @@ -0,0 +1,44 @@ +From 76476ab077b638b2e4e8576522e431544de6fcb9 Mon Sep 17 00:00:00 2001 +From: Po-Hsu Lin +Date: Thu, 18 Apr 2019 19:57:25 +0800 +Subject: selftests/net: correct the return value for run_netsocktests + +[ Upstream commit 30c04d796b693e22405c38e9b78e9a364e4c77e6 ] + +The run_netsocktests will be marked as passed regardless the actual test +result from the ./socket: + + selftests: net: run_netsocktests + ======================================== + -------------------- + running socket test + -------------------- + [FAIL] + ok 1..6 selftests: net: run_netsocktests [PASS] + +This is because the test script itself has been successfully executed. +Fix this by exit 1 when the test failed. + +Signed-off-by: Po-Hsu Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/run_netsocktests | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests +index 16058bbea7a85..c195b44786627 100755 +--- a/tools/testing/selftests/net/run_netsocktests ++++ b/tools/testing/selftests/net/run_netsocktests +@@ -6,7 +6,7 @@ echo "--------------------" + ./socket + if [ $? -ne 0 ]; then + echo "[FAIL]" ++ exit 1 + else + echo "[PASS]" + fi +- +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 56765c9535e..0eedaf54665 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -159,3 +159,16 @@ timer-debug-change-proc-timer_stats-from-0644-to-0600.patch netfilter-compat-initialize-all-fields-in-xt_init.patch mm-vmstat-make-quiet_vmstat-lighter.patch platform-x86-sony-laptop-fix-unintentional-fall-through.patch +iio-adc-xilinx-fix-potential-use-after-free-on-remov.patch +hid-input-add-mapping-for-expose-overview-key.patch +hid-input-add-mapping-for-keyboard-brightness-up-dow.patch +libnvdimm-btt-fix-a-kmemdup-failure-check.patch +s390-dasd-fix-capacity-calculation-for-large-volumes.patch +s390-3270-fix-lockdep-false-positive-on-view-lock.patch +kvm-x86-avoid-misreporting-level-triggered-irqs-as-e.patch +tools-lib-traceevent-fix-missing-equality-check-for-.patch +init-initialize-jump-labels-before-command-line-opti.patch +ipvs-do-not-schedule-icmp-errors-from-tunnels.patch +s390-ctcm-fix-ctcm_new_device-error-return-code.patch +selftests-net-correct-the-return-value-for-run_netso.patch +gpu-ipu-v3-dp-fix-csc-handling.patch diff --git a/queue-4.4/tools-lib-traceevent-fix-missing-equality-check-for-.patch b/queue-4.4/tools-lib-traceevent-fix-missing-equality-check-for-.patch new file mode 100644 index 00000000000..bd7bc203697 --- /dev/null +++ b/queue-4.4/tools-lib-traceevent-fix-missing-equality-check-for-.patch @@ -0,0 +1,59 @@ +From b15db70111aa988e22a2e5d4f88210b1189d8a3a Mon Sep 17 00:00:00 2001 +From: Rikard Falkeborn +Date: Tue, 9 Apr 2019 11:15:29 +0200 +Subject: tools lib traceevent: Fix missing equality check for strcmp + +[ Upstream commit f32c2877bcb068a718bb70094cd59ccc29d4d082 ] + +There was a missing comparison with 0 when checking if type is "s64" or +"u64". Therefore, the body of the if-statement was entered if "type" was +"u64" or not "s64", which made the first strcmp() redundant since if +type is "u64", it's not "s64". + +If type is "s64", the body of the if-statement is not entered but since +the remainder of the function consists of if-statements which will not +be entered if type is "s64", we will just return "val", which is +correct, albeit at the cost of a few more calls to strcmp(), i.e., it +will behave just as if the if-statement was entered. + +If type is neither "s64" or "u64", the body of the if-statement will be +entered incorrectly and "val" returned. This means that any type that is +checked after "s64" and "u64" is handled the same way as "s64" and +"u64", i.e., the limiting of "val" to fit in for example "s8" is never +reached. + +This was introduced in the kernel tree when the sources were copied from +trace-cmd in commit f7d82350e597 ("tools/events: Add files to create +libtraceevent.a"), and in the trace-cmd repo in 1cdbae6035cei +("Implement typecasting in parser") when the function was introduced, +i.e., it has always behaved the wrong way. + +Detected by cppcheck. + +Signed-off-by: Rikard Falkeborn +Reviewed-by: Steven Rostedt (VMware) +Cc: Tzvetomir Stoyanov +Fixes: f7d82350e597 ("tools/events: Add files to create libtraceevent.a") +Link: http://lkml.kernel.org/r/20190409091529.2686-1-rikard.falkeborn@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/traceevent/event-parse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 743746a3c50d7..df3c73e9dea49 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -2201,7 +2201,7 @@ eval_type_str(unsigned long long val, const char *type, int pointer) + return val & 0xffffffff; + + if (strcmp(type, "u64") == 0 || +- strcmp(type, "s64")) ++ strcmp(type, "s64") == 0) + return val; + + if (strcmp(type, "s8") == 0) +-- +2.20.1 +