From: Greg Kroah-Hartman Date: Thu, 23 Jan 2020 11:34:13 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v5.4.15~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=54305c885bacd0223ed208566ae265a3822ba204;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch i2c-stm32f7-rework-slave_id-allocation.patch mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch powerpc-archrandom-fix-arch_get_random_seed_int.patch powerpc-pseries-enable-support-for-ibm-drc-info-property.patch sunrpc-fix-svcauth_gss_proxy_init.patch tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch tipc-update-mon-s-self-addr-when-node-addr-generated.patch xfs-sanity-check-flags-of-q_xquotarm-call.patch --- diff --git a/queue-4.19/i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch b/queue-4.19/i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch new file mode 100644 index 00000000000..7cda56cedc3 --- /dev/null +++ b/queue-4.19/i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch @@ -0,0 +1,36 @@ +From 7787657d7ee55a9ecf4aea4907b46b87a44eda67 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Tue, 12 Nov 2019 09:19:44 +0100 +Subject: i2c: i2c-stm32f7: fix 10-bits check in slave free id search loop + +From: Alain Volmat + +commit 7787657d7ee55a9ecf4aea4907b46b87a44eda67 upstream. + +Fix a typo in the free slave id search loop. Instead of I2C_CLIENT_PEC, +it should have been I2C_CLIENT_TEN. The slave id 1 can only handle 7-bit +addresses and thus is not eligible in case of 10-bit addresses. +As a matter of fact none of the slave id support I2C_CLIENT_PEC, overall +check is performed at the beginning of the stm32f7_i2c_reg_slave function. + +Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support") +Signed-off-by: Alain Volmat +Reviewed-by: Pierre-Yves MORDRET +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-stm32f7.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1253,7 +1253,7 @@ static int stm32f7_i2c_get_free_slave_id + * slave[1] supports 7-bit slave address only + */ + for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) { +- if (i == 1 && (slave->flags & I2C_CLIENT_PEC)) ++ if (i == 1 && (slave->flags & I2C_CLIENT_TEN)) + continue; + if (!i2c_dev->slave[i]) { + *id = i; diff --git a/queue-4.19/i2c-stm32f7-rework-slave_id-allocation.patch b/queue-4.19/i2c-stm32f7-rework-slave_id-allocation.patch new file mode 100644 index 00000000000..ed72a33f987 --- /dev/null +++ b/queue-4.19/i2c-stm32f7-rework-slave_id-allocation.patch @@ -0,0 +1,37 @@ +From 52d3be711e065a97a57c2f2ffba3098748855bd6 Mon Sep 17 00:00:00 2001 +From: Alain Volmat +Date: Tue, 15 Oct 2019 15:03:09 +0200 +Subject: i2c: stm32f7: rework slave_id allocation + +From: Alain Volmat + +commit 52d3be711e065a97a57c2f2ffba3098748855bd6 upstream. + +The IP can handle two slave addresses. One address can either be +7 bits or 10 bits while the other can only be 7 bits. +In order to ensure that a 10 bits address can always be allocated +(assuming there is only one 7 bits address already allocated), +pick up the 7-bits only address slot in priority when performing a 7-bits +address allocation. + +Fixes: 60d609f30de2 ("i2c: i2c-stm32f7: Add slave support") +Signed-off-by: Alain Volmat +Reviewed-by: Pierre-Yves MORDRET +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-stm32f7.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -1252,7 +1252,7 @@ static int stm32f7_i2c_get_free_slave_id + * slave[0] supports 7-bit and 10-bit slave address + * slave[1] supports 7-bit slave address only + */ +- for (i = 0; i < STM32F7_I2C_MAX_SLAVE; i++) { ++ for (i = STM32F7_I2C_MAX_SLAVE - 1; i >= 0; i--) { + if (i == 1 && (slave->flags & I2C_CLIENT_PEC)) + continue; + if (!i2c_dev->slave[i]) { diff --git a/queue-4.19/mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch b/queue-4.19/mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch new file mode 100644 index 00000000000..13160e46832 --- /dev/null +++ b/queue-4.19/mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch @@ -0,0 +1,71 @@ +From 3f31bc67e4dc6a555341dffefe328ddd58e8b431 Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Wed, 4 Sep 2019 08:56:25 +0300 +Subject: mfd: intel-lpss: Add default I2C device properties for Gemini Lake + +From: Jarkko Nikula + +commit 3f31bc67e4dc6a555341dffefe328ddd58e8b431 upstream. + +It turned out Intel Gemini Lake doesn't use the same I2C timing +parameters as Broxton. + +I got confirmation from the Windows team that Gemini Lake systems should +use updated timing parameters that differ from those used in Broxton +based systems. + +Fixes: f80e78aa11ad ("mfd: intel-lpss: Add Intel Gemini Lake PCI IDs") +Tested-by: Chris Chiu +Signed-off-by: Jarkko Nikula +Acked-by: Andy Shevchenko +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/intel-lpss-pci.c | 28 ++++++++++++++++++++-------- + 1 file changed, 20 insertions(+), 8 deletions(-) + +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -126,6 +126,18 @@ static const struct intel_lpss_platform_ + .properties = apl_i2c_properties, + }; + ++static struct property_entry glk_i2c_properties[] = { ++ PROPERTY_ENTRY_U32("i2c-sda-hold-time-ns", 313), ++ PROPERTY_ENTRY_U32("i2c-sda-falling-time-ns", 171), ++ PROPERTY_ENTRY_U32("i2c-scl-falling-time-ns", 290), ++ { }, ++}; ++ ++static const struct intel_lpss_platform_info glk_i2c_info = { ++ .clk_rate = 133000000, ++ .properties = glk_i2c_properties, ++}; ++ + static const struct intel_lpss_platform_info cnl_i2c_info = { + .clk_rate = 216000000, + .properties = spt_i2c_properties, +@@ -165,14 +177,14 @@ static const struct pci_device_id intel_ + { PCI_VDEVICE(INTEL, 0x1ac6), (kernel_ulong_t)&bxt_info }, + { PCI_VDEVICE(INTEL, 0x1aee), (kernel_ulong_t)&bxt_uart_info }, + /* GLK */ +- { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&bxt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&bxt_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31ac), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31ae), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31b0), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31b2), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31b4), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31b6), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31b8), (kernel_ulong_t)&glk_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x31ba), (kernel_ulong_t)&glk_i2c_info }, + { PCI_VDEVICE(INTEL, 0x31bc), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x31be), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0x31c0), (kernel_ulong_t)&bxt_uart_info }, diff --git a/queue-4.19/mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch b/queue-4.19/mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch new file mode 100644 index 00000000000..b0dffb92a84 --- /dev/null +++ b/queue-4.19/mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch @@ -0,0 +1,38 @@ +From 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Sat, 21 Sep 2019 10:44:01 +0200 +Subject: mt7601u: fix bbp version check in mt7601u_wait_bbp_ready + +From: Lorenzo Bianconi + +commit 15e14f76f85f4f0eab3b8146e1cd3c58ce272823 upstream. + +Fix bbp ready check in mt7601u_wait_bbp_ready. The issue is reported by +coverity with the following error: + +Logical vs. bitwise operator +The expression's value does not depend on the operands; inadvertent use +of the wrong operator is a likely logic error. + +Addresses-Coverity-ID: 1309441 ("Logical vs. bitwise operator") +Fixes: c869f77d6abb ("add mt7601u driver") +Acked-by: Jakub Kicinski +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mediatek/mt7601u/phy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mediatek/mt7601u/phy.c ++++ b/drivers/net/wireless/mediatek/mt7601u/phy.c +@@ -221,7 +221,7 @@ int mt7601u_wait_bbp_ready(struct mt7601 + + do { + val = mt7601u_bbp_rr(dev, MT_BBP_REG_VERSION); +- if (val && ~val) ++ if (val && val != 0xff) + break; + } while (--i); + diff --git a/queue-4.19/net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch b/queue-4.19/net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch new file mode 100644 index 00000000000..4ffb32c0e8f --- /dev/null +++ b/queue-4.19/net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch @@ -0,0 +1,51 @@ +From fea7fda7f50a6059220f83251e70709e45cc8040 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Thu, 3 Oct 2019 11:43:51 -0700 +Subject: net: phy: broadcom: Fix RGMII delays configuration for BCM54210E + +From: Florian Fainelli + +commit fea7fda7f50a6059220f83251e70709e45cc8040 upstream. + +Commit 0fc9ae107669 ("net: phy: broadcom: add support for +BCM54210E") added support for BCM54210E but also unconditionally cleared +the RXC to RXD skew and the TXD to TXC skew, thus only making +PHY_INTERFACE_MODE_RGMII a possible configuration. Use +bcm54xx_config_clock_delay() which correctly sets the registers +depending on the 4 possible PHY interface values that exist for RGMII. + +Fixes: 0fc9ae107669 ("net: phy: broadcom: add support for BCM54210E") +Reported-by: Manasa Mudireddy +Reported-by: Ray Jui +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/phy/broadcom.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -30,18 +30,13 @@ MODULE_DESCRIPTION("Broadcom PHY driver" + MODULE_AUTHOR("Maciej W. Rozycki"); + MODULE_LICENSE("GPL"); + ++static int bcm54xx_config_clock_delay(struct phy_device *phydev); ++ + static int bcm54210e_config_init(struct phy_device *phydev) + { + int val; + +- val = bcm54xx_auxctl_read(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC); +- val &= ~MII_BCM54XX_AUXCTL_SHDWSEL_MISC_RGMII_SKEW_EN; +- val |= MII_BCM54XX_AUXCTL_MISC_WREN; +- bcm54xx_auxctl_write(phydev, MII_BCM54XX_AUXCTL_SHDWSEL_MISC, val); +- +- val = bcm_phy_read_shadow(phydev, BCM54810_SHD_CLK_CTL); +- val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN; +- bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val); ++ bcm54xx_config_clock_delay(phydev); + + if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) { + val = phy_read(phydev, MII_CTRL1000); diff --git a/queue-4.19/powerpc-archrandom-fix-arch_get_random_seed_int.patch b/queue-4.19/powerpc-archrandom-fix-arch_get_random_seed_int.patch new file mode 100644 index 00000000000..1f190a81aee --- /dev/null +++ b/queue-4.19/powerpc-archrandom-fix-arch_get_random_seed_int.patch @@ -0,0 +1,43 @@ +From b6afd1234cf93aa0d71b4be4788c47534905f0be Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Wed, 4 Dec 2019 11:50:15 +0000 +Subject: powerpc/archrandom: fix arch_get_random_seed_int() + +From: Ard Biesheuvel + +commit b6afd1234cf93aa0d71b4be4788c47534905f0be upstream. + +Commit 01c9348c7620ec65 + + powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_* + +updated arch_get_random_[int|long]() to be NOPs, and moved the hardware +RNG backing to arch_get_random_seed_[int|long]() instead. However, it +failed to take into account that arch_get_random_int() was implemented +in terms of arch_get_random_long(), and so we ended up with a version +of the former that is essentially a NOP as well. + +Fix this by calling arch_get_random_seed_long() from +arch_get_random_seed_int() instead. + +Fixes: 01c9348c7620ec65 ("powerpc: Use hardware RNG for arch_get_random_seed_* not arch_get_random_*") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191204115015.18015-1-ardb@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/archrandom.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/include/asm/archrandom.h ++++ b/arch/powerpc/include/asm/archrandom.h +@@ -28,7 +28,7 @@ static inline int arch_get_random_seed_i + unsigned long val; + int rc; + +- rc = arch_get_random_long(&val); ++ rc = arch_get_random_seed_long(&val); + if (rc) + *v = val; + diff --git a/queue-4.19/powerpc-pseries-enable-support-for-ibm-drc-info-property.patch b/queue-4.19/powerpc-pseries-enable-support-for-ibm-drc-info-property.patch new file mode 100644 index 00000000000..79826c9634b --- /dev/null +++ b/queue-4.19/powerpc-pseries-enable-support-for-ibm-drc-info-property.patch @@ -0,0 +1,33 @@ +From 0a87ccd3699983645f54cafd2258514a716b20b8 Mon Sep 17 00:00:00 2001 +From: Tyrel Datwyler +Date: Sun, 10 Nov 2019 23:21:37 -0600 +Subject: powerpc/pseries: Enable support for ibm,drc-info property + +From: Tyrel Datwyler + +commit 0a87ccd3699983645f54cafd2258514a716b20b8 upstream. + +Advertise client support for the PAPR architected ibm,drc-info device +tree property during CAS handshake. + +Fixes: c7a3275e0f9e ("powerpc/pseries: Revert support for ibm,drc-info devtree property") +Signed-off-by: Tyrel Datwyler +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1573449697-5448-11-git-send-email-tyreld@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/prom_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -904,7 +904,7 @@ struct ibm_arch_vec __cacheline_aligned + .reserved2 = 0, + .reserved3 = 0, + .subprocessors = 1, +- .byte22 = OV5_FEAT(OV5_DRMEM_V2), ++ .byte22 = OV5_FEAT(OV5_DRMEM_V2) | OV5_FEAT(OV5_DRC_INFO), + .intarch = 0, + .mmu = 0, + .hash_ext = 0, diff --git a/queue-4.19/series b/queue-4.19/series index 5d26ca81deb..5dab6aa50c1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,12 @@ revert-efi-fix-debugobjects-warning-on-efi_rts_work.patch +xfs-sanity-check-flags-of-q_xquotarm-call.patch +i2c-stm32f7-rework-slave_id-allocation.patch +i2c-i2c-stm32f7-fix-10-bits-check-in-slave-free-id-search-loop.patch +mfd-intel-lpss-add-default-i2c-device-properties-for-gemini-lake.patch +sunrpc-fix-svcauth_gss_proxy_init.patch +powerpc-pseries-enable-support-for-ibm-drc-info-property.patch +powerpc-archrandom-fix-arch_get_random_seed_int.patch +tipc-update-mon-s-self-addr-when-node-addr-generated.patch +tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch +net-phy-broadcom-fix-rgmii-delays-configuration-for-bcm54210e.patch +mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch diff --git a/queue-4.19/sunrpc-fix-svcauth_gss_proxy_init.patch b/queue-4.19/sunrpc-fix-svcauth_gss_proxy_init.patch new file mode 100644 index 00000000000..4ea189cee1e --- /dev/null +++ b/queue-4.19/sunrpc-fix-svcauth_gss_proxy_init.patch @@ -0,0 +1,167 @@ +From 5866efa8cbfbadf3905072798e96652faf02dbe8 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 24 Oct 2019 09:34:16 -0400 +Subject: SUNRPC: Fix svcauth_gss_proxy_init() + +From: Chuck Lever + +commit 5866efa8cbfbadf3905072798e96652faf02dbe8 upstream. + +gss_read_proxy_verf() assumes things about the XDR buffer containing +the RPC Call that are not true for buffers generated by +svc_rdma_recv(). + +RDMA's buffers look more like what the upper layer generates for +sending: head is a kmalloc'd buffer; it does not point to a page +whose contents are contiguous with the first page in the buffers' +page array. The result is that ACCEPT_SEC_CONTEXT via RPC/RDMA has +stopped working on Linux NFS servers that use gssproxy. + +This does not affect clients that use only TCP to send their +ACCEPT_SEC_CONTEXT operation (that's all Linux clients). Other +clients, like Solaris NFS clients, send ACCEPT_SEC_CONTEXT on the +same transport as they send all other NFS operations. Such clients +can send ACCEPT_SEC_CONTEXT via RPC/RDMA. + +I thought I had found every direct reference in the server RPC code +to the rqstp->rq_pages field. + +Bug found at the 2019 Westford NFS bake-a-thon. + +Fixes: 3316f0631139 ("svcrdma: Persistently allocate and DMA- ... ") +Signed-off-by: Chuck Lever +Tested-by: Bill Baker +Reviewed-by: Simo Sorce +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/auth_gss/svcauth_gss.c | 84 ++++++++++++++++++++++++++++---------- + 1 file changed, 63 insertions(+), 21 deletions(-) + +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1054,24 +1054,32 @@ gss_read_verf(struct rpc_gss_wire_cred * + return 0; + } + +-/* Ok this is really heavily depending on a set of semantics in +- * how rqstp is set up by svc_recv and pages laid down by the +- * server when reading a request. We are basically guaranteed that +- * the token lays all down linearly across a set of pages, starting +- * at iov_base in rq_arg.head[0] which happens to be the first of a +- * set of pages stored in rq_pages[]. +- * rq_arg.head[0].iov_base will provide us the page_base to pass +- * to the upcall. +- */ +-static inline int +-gss_read_proxy_verf(struct svc_rqst *rqstp, +- struct rpc_gss_wire_cred *gc, __be32 *authp, +- struct xdr_netobj *in_handle, +- struct gssp_in_token *in_token) ++static void gss_free_in_token_pages(struct gssp_in_token *in_token) + { +- struct kvec *argv = &rqstp->rq_arg.head[0]; + u32 inlen; +- int res; ++ int i; ++ ++ i = 0; ++ inlen = in_token->page_len; ++ while (inlen) { ++ if (in_token->pages[i]) ++ put_page(in_token->pages[i]); ++ inlen -= inlen > PAGE_SIZE ? PAGE_SIZE : inlen; ++ } ++ ++ kfree(in_token->pages); ++ in_token->pages = NULL; ++} ++ ++static int gss_read_proxy_verf(struct svc_rqst *rqstp, ++ struct rpc_gss_wire_cred *gc, __be32 *authp, ++ struct xdr_netobj *in_handle, ++ struct gssp_in_token *in_token) ++{ ++ struct kvec *argv = &rqstp->rq_arg.head[0]; ++ unsigned int page_base, length; ++ int pages, i, res; ++ size_t inlen; + + res = gss_read_common_verf(gc, argv, authp, in_handle); + if (res) +@@ -1081,10 +1089,36 @@ gss_read_proxy_verf(struct svc_rqst *rqs + if (inlen > (argv->iov_len + rqstp->rq_arg.page_len)) + return SVC_DENIED; + +- in_token->pages = rqstp->rq_pages; +- in_token->page_base = (ulong)argv->iov_base & ~PAGE_MASK; ++ pages = DIV_ROUND_UP(inlen, PAGE_SIZE); ++ in_token->pages = kcalloc(pages, sizeof(struct page *), GFP_KERNEL); ++ if (!in_token->pages) ++ return SVC_DENIED; ++ in_token->page_base = 0; + in_token->page_len = inlen; ++ for (i = 0; i < pages; i++) { ++ in_token->pages[i] = alloc_page(GFP_KERNEL); ++ if (!in_token->pages[i]) { ++ gss_free_in_token_pages(in_token); ++ return SVC_DENIED; ++ } ++ } + ++ length = min_t(unsigned int, inlen, argv->iov_len); ++ memcpy(page_address(in_token->pages[0]), argv->iov_base, length); ++ inlen -= length; ++ ++ i = 1; ++ page_base = rqstp->rq_arg.page_base; ++ while (inlen) { ++ length = min_t(unsigned int, inlen, PAGE_SIZE); ++ memcpy(page_address(in_token->pages[i]), ++ page_address(rqstp->rq_arg.pages[i]) + page_base, ++ length); ++ ++ inlen -= length; ++ page_base = 0; ++ i++; ++ } + return 0; + } + +@@ -1259,8 +1293,11 @@ static int svcauth_gss_proxy_init(struct + break; + case GSS_S_COMPLETE: + status = gss_proxy_save_rsc(sn->rsc_cache, &ud, &handle); +- if (status) ++ if (status) { ++ pr_info("%s: gss_proxy_save_rsc failed (%d)\n", ++ __func__, status); + goto out; ++ } + cli_handle.data = (u8 *)&handle; + cli_handle.len = sizeof(handle); + break; +@@ -1271,15 +1308,20 @@ static int svcauth_gss_proxy_init(struct + + /* Got an answer to the upcall; use it: */ + if (gss_write_init_verf(sn->rsc_cache, rqstp, +- &cli_handle, &ud.major_status)) ++ &cli_handle, &ud.major_status)) { ++ pr_info("%s: gss_write_init_verf failed\n", __func__); + goto out; ++ } + if (gss_write_resv(resv, PAGE_SIZE, + &cli_handle, &ud.out_token, +- ud.major_status, ud.minor_status)) ++ ud.major_status, ud.minor_status)) { ++ pr_info("%s: gss_write_resv failed\n", __func__); + goto out; ++ } + + ret = SVC_COMPLETE; + out: ++ gss_free_in_token_pages(&ud.in_token); + gssp_free_upcall_data(&ud); + return ret; + } diff --git a/queue-4.19/tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch b/queue-4.19/tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch new file mode 100644 index 00000000000..2de60a7dbc6 --- /dev/null +++ b/queue-4.19/tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch @@ -0,0 +1,36 @@ +From 12db3c8083fcab4270866a88191933f2d9f24f89 Mon Sep 17 00:00:00 2001 +From: Tung Nguyen +Date: Thu, 28 Nov 2019 10:10:07 +0700 +Subject: tipc: fix wrong timeout input for tipc_wait_for_cond() + +From: Tung Nguyen + +commit 12db3c8083fcab4270866a88191933f2d9f24f89 upstream. + +In function __tipc_shutdown(), the timeout value passed to +tipc_wait_for_cond() is not jiffies. + +This commit fixes it by converting that value from milliseconds +to jiffies. + +Fixes: 365ad353c256 ("tipc: reduce risk of user starvation during link congestion") +Signed-off-by: Tung Nguyen +Acked-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/tipc/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -501,7 +501,7 @@ static void __tipc_shutdown(struct socke + struct sock *sk = sock->sk; + struct tipc_sock *tsk = tipc_sk(sk); + struct net *net = sock_net(sk); +- long timeout = CONN_TIMEOUT_DEFAULT; ++ long timeout = msecs_to_jiffies(CONN_TIMEOUT_DEFAULT); + u32 dnode = tsk_peer_node(tsk); + struct sk_buff *skb; + diff --git a/queue-4.19/tipc-update-mon-s-self-addr-when-node-addr-generated.patch b/queue-4.19/tipc-update-mon-s-self-addr-when-node-addr-generated.patch new file mode 100644 index 00000000000..6b266552119 --- /dev/null +++ b/queue-4.19/tipc-update-mon-s-self-addr-when-node-addr-generated.patch @@ -0,0 +1,83 @@ +From 46cb01eeeb86fca6afe24dda1167b0cb95424e29 Mon Sep 17 00:00:00 2001 +From: Hoang Le +Date: Tue, 12 Nov 2019 07:40:04 +0700 +Subject: tipc: update mon's self addr when node addr generated + +From: Hoang Le + +commit 46cb01eeeb86fca6afe24dda1167b0cb95424e29 upstream. + +In commit 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address +hash values"), the 32-bit node address only generated after one second +trial period expired. However the self's addr in struct tipc_monitor do +not update according to node address generated. This lead to it is +always zero as initial value. As result, sorting algorithm using this +value does not work as expected, neither neighbor monitoring framework. + +In this commit, we add a fix to update self's addr when 32-bit node +address generated. + +Fixes: 25b0b9c4e835 ("tipc: handle collisions of 32-bit node address hash values") +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/tipc/monitor.c | 15 +++++++++++++++ + net/tipc/monitor.h | 1 + + net/tipc/net.c | 2 ++ + 3 files changed, 18 insertions(+) + +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -665,6 +665,21 @@ void tipc_mon_delete(struct net *net, in + kfree(mon); + } + ++void tipc_mon_reinit_self(struct net *net) ++{ ++ struct tipc_monitor *mon; ++ int bearer_id; ++ ++ for (bearer_id = 0; bearer_id < MAX_BEARERS; bearer_id++) { ++ mon = tipc_monitor(net, bearer_id); ++ if (!mon) ++ continue; ++ write_lock_bh(&mon->lock); ++ mon->self->addr = tipc_own_addr(net); ++ write_unlock_bh(&mon->lock); ++ } ++} ++ + int tipc_nl_monitor_set_threshold(struct net *net, u32 cluster_size) + { + struct tipc_net *tn = tipc_net(net); +--- a/net/tipc/monitor.h ++++ b/net/tipc/monitor.h +@@ -77,6 +77,7 @@ int __tipc_nl_add_monitor(struct net *ne + u32 bearer_id); + int tipc_nl_add_monitor_peer(struct net *net, struct tipc_nl_msg *msg, + u32 bearer_id, u32 *prev_node); ++void tipc_mon_reinit_self(struct net *net); + + extern const int tipc_max_domain_size; + #endif +--- a/net/tipc/net.c ++++ b/net/tipc/net.c +@@ -42,6 +42,7 @@ + #include "node.h" + #include "bcast.h" + #include "netlink.h" ++#include "monitor.h" + + /* + * The TIPC locking policy is designed to ensure a very fine locking +@@ -136,6 +137,7 @@ static void tipc_net_finalize(struct net + tipc_set_node_addr(net, addr); + tipc_named_reinit(net); + tipc_sk_reinit(net); ++ tipc_mon_reinit_self(net); + tipc_nametbl_publish(net, TIPC_CFG_SRV, addr, addr, + TIPC_CLUSTER_SCOPE, 0, addr); + } diff --git a/queue-4.19/xfs-sanity-check-flags-of-q_xquotarm-call.patch b/queue-4.19/xfs-sanity-check-flags-of-q_xquotarm-call.patch new file mode 100644 index 00000000000..0dd51a59238 --- /dev/null +++ b/queue-4.19/xfs-sanity-check-flags-of-q_xquotarm-call.patch @@ -0,0 +1,36 @@ +From 3dd4d40b420846dd35869ccc8f8627feef2cff32 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 23 Oct 2019 17:00:45 -0700 +Subject: xfs: Sanity check flags of Q_XQUOTARM call + +From: Jan Kara + +commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream. + +Flags passed to Q_XQUOTARM were not sanity checked for invalid values. +Fix that. + +Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl") +Reported-by: Yang Xu +Signed-off-by: Jan Kara +Reviewed-by: Eric Sandeen +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_quotaops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/xfs/xfs_quotaops.c ++++ b/fs/xfs/xfs_quotaops.c +@@ -202,6 +202,9 @@ xfs_fs_rm_xquota( + if (XFS_IS_QUOTA_ON(mp)) + return -EINVAL; + ++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA)) ++ return -EINVAL; ++ + if (uflags & FS_USER_QUOTA) + flags |= XFS_DQ_USER; + if (uflags & FS_GROUP_QUOTA)