From: Sasha Levin Date: Sun, 10 Apr 2022 02:06:27 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.310~111 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5a4ff2979adf08fe5f4fbe343bb4536eef0d544f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/ath11k-fix-kernel-panic-during-unload-load-ath11k-mo.patch b/queue-5.10/ath11k-fix-kernel-panic-during-unload-load-ath11k-mo.patch new file mode 100644 index 00000000000..15dea4078d3 --- /dev/null +++ b/queue-5.10/ath11k-fix-kernel-panic-during-unload-load-ath11k-mo.patch @@ -0,0 +1,65 @@ +From fc8d49f4d327482a0e5540d7b053d41cacf3dcbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 14:49:33 +0530 +Subject: ath11k: fix kernel panic during unload/load ath11k modules + +From: Venkateswara Naralasetty + +[ Upstream commit 22b59cb965f79ee1accf83172441c9ca0ecb632a ] + +Call netif_napi_del() from ath11k_ahb_free_ext_irq() to fix +the following kernel panic when unload/load ath11k modules +for few iterations. + +[ 971.201365] Unable to handle kernel paging request at virtual address 6d97a208 +[ 971.204227] pgd = 594c2919 +[ 971.211478] [6d97a208] *pgd=00000000 +[ 971.214120] Internal error: Oops: 5 [#1] PREEMPT SMP ARM +[ 971.412024] CPU: 2 PID: 4435 Comm: insmod Not tainted 5.4.89 #0 +[ 971.434256] Hardware name: Generic DT based system +[ 971.440165] PC is at napi_by_id+0x10/0x40 +[ 971.445019] LR is at netif_napi_add+0x160/0x1dc + +[ 971.743127] (napi_by_id) from [<807d89a0>] (netif_napi_add+0x160/0x1dc) +[ 971.751295] (netif_napi_add) from [<7f1209ac>] (ath11k_ahb_config_irq+0xf8/0x414 [ath11k_ahb]) +[ 971.759164] (ath11k_ahb_config_irq [ath11k_ahb]) from [<7f12135c>] (ath11k_ahb_probe+0x40c/0x51c [ath11k_ahb]) +[ 971.768567] (ath11k_ahb_probe [ath11k_ahb]) from [<80666864>] (platform_drv_probe+0x48/0x94) +[ 971.779670] (platform_drv_probe) from [<80664718>] (really_probe+0x1c8/0x450) +[ 971.789389] (really_probe) from [<80664cc4>] (driver_probe_device+0x15c/0x1b8) +[ 971.797547] (driver_probe_device) from [<80664f60>] (device_driver_attach+0x44/0x60) +[ 971.805795] (device_driver_attach) from [<806650a0>] (__driver_attach+0x124/0x140) +[ 971.814822] (__driver_attach) from [<80662adc>] (bus_for_each_dev+0x58/0xa4) +[ 971.823328] (bus_for_each_dev) from [<80663a2c>] (bus_add_driver+0xf0/0x1e8) +[ 971.831662] (bus_add_driver) from [<806658a4>] (driver_register+0xa8/0xf0) +[ 971.839822] (driver_register) from [<8030269c>] (do_one_initcall+0x78/0x1ac) +[ 971.847638] (do_one_initcall) from [<80392524>] (do_init_module+0x54/0x200) +[ 971.855968] (do_init_module) from [<803945b0>] (load_module+0x1e30/0x1ffc) +[ 971.864126] (load_module) from [<803948b0>] (sys_init_module+0x134/0x17c) +[ 971.871852] (sys_init_module) from [<80301000>] (ret_fast_syscall+0x0/0x50) + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.6.0.1-00760-QCAHKSWPL_SILICONZ-1 + +Signed-off-by: Venkateswara Naralasetty +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1642583973-21599-1-git-send-email-quic_vnaralas@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ahb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index 9ff6e6853314..190bc5712e96 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -366,6 +366,8 @@ static void ath11k_ahb_free_ext_irq(struct ath11k_base *ab) + + for (j = 0; j < irq_grp->num_irq; j++) + free_irq(ab->irq_num[irq_grp->irqs[j]], irq_grp); ++ ++ netif_napi_del(&irq_grp->napi); + } + } + +-- +2.35.1 + diff --git a/queue-5.10/ath11k-mhi-use-mhi_sync_power_up.patch b/queue-5.10/ath11k-mhi-use-mhi_sync_power_up.patch new file mode 100644 index 00000000000..9b55e63b60c --- /dev/null +++ b/queue-5.10/ath11k-mhi-use-mhi_sync_power_up.patch @@ -0,0 +1,87 @@ +From b3cb98a7c0bbda608ff3c19ea04f656d3cd852d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 11:01:17 +0200 +Subject: ath11k: mhi: use mhi_sync_power_up() + +From: Kalle Valo + +[ Upstream commit 3df6d74aedfdca919cca475d15dfdbc8b05c9e5d ] + +If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The +reason for that was that we were using mhi_async_power_up() which does not +check any errors. But mhi_sync_power_up() on the other hand does check for +errors so let's use that to fix the crash. + +I was not able to find a reason why an async version was used. +ath11k_mhi_start() (which enables state ATH11K_MHI_POWER_ON) is called from +ath11k_hif_power_up(), which can sleep. So sync version should be safe to use +here. + +[ 145.569731] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI +[ 145.569789] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +[ 145.569843] CPU: 2 PID: 1628 Comm: rmmod Kdump: loaded Tainted: G W 5.16.0-wt-ath+ #567 +[ 145.569898] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0067.2021.0528.1339 05/28/2021 +[ 145.569956] RIP: 0010:ath11k_hal_srng_access_begin+0xb5/0x2b0 [ath11k] +[ 145.570028] Code: df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ec 01 00 00 48 8b ab a8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 <0f> b6 14 02 48 89 e8 83 e0 07 83 c0 03 45 85 ed 75 48 38 d0 7c 08 +[ 145.570089] RSP: 0018:ffffc900025d7ac0 EFLAGS: 00010246 +[ 145.570144] RAX: dffffc0000000000 RBX: ffff88814fca2dd8 RCX: 1ffffffff50cb455 +[ 145.570196] RDX: 0000000000000000 RSI: ffff88814fca2dd8 RDI: ffff88814fca2e80 +[ 145.570252] RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffffa8659497 +[ 145.570329] R10: fffffbfff50cb292 R11: 0000000000000001 R12: ffff88814fca0000 +[ 145.570410] R13: 0000000000000000 R14: ffff88814fca2798 R15: ffff88814fca2dd8 +[ 145.570465] FS: 00007fa399988540(0000) GS:ffff888233e00000(0000) knlGS:0000000000000000 +[ 145.570519] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 145.570571] CR2: 00007fa399b51421 CR3: 0000000137898002 CR4: 00000000003706e0 +[ 145.570623] Call Trace: +[ 145.570675] +[ 145.570727] ? ath11k_ce_tx_process_cb+0x34b/0x860 [ath11k] +[ 145.570797] ath11k_ce_tx_process_cb+0x356/0x860 [ath11k] +[ 145.570864] ? tasklet_init+0x150/0x150 +[ 145.570919] ? ath11k_ce_alloc_pipes+0x280/0x280 [ath11k] +[ 145.570986] ? tasklet_clear_sched+0x42/0xe0 +[ 145.571042] ? tasklet_kill+0xe9/0x1b0 +[ 145.571095] ? tasklet_clear_sched+0xe0/0xe0 +[ 145.571148] ? irq_has_action+0x120/0x120 +[ 145.571202] ath11k_ce_cleanup_pipes+0x45a/0x580 [ath11k] +[ 145.571270] ? ath11k_pci_stop+0x10e/0x170 [ath11k_pci] +[ 145.571345] ath11k_core_stop+0x8a/0xc0 [ath11k] +[ 145.571434] ath11k_core_deinit+0x9e/0x150 [ath11k] +[ 145.571499] ath11k_pci_remove+0xd2/0x260 [ath11k_pci] +[ 145.571553] pci_device_remove+0x9a/0x1c0 +[ 145.571605] __device_release_driver+0x332/0x660 +[ 145.571659] driver_detach+0x1e7/0x2c0 +[ 145.571712] bus_remove_driver+0xe2/0x2d0 +[ 145.571772] pci_unregister_driver+0x21/0x250 +[ 145.571826] __do_sys_delete_module+0x30a/0x4b0 +[ 145.571879] ? free_module+0xac0/0xac0 +[ 145.571933] ? lockdep_hardirqs_on_prepare.part.0+0x18c/0x370 +[ 145.571986] ? syscall_enter_from_user_mode+0x1d/0x50 +[ 145.572039] ? lockdep_hardirqs_on+0x79/0x100 +[ 145.572097] do_syscall_64+0x3b/0x90 +[ 145.572153] entry_SYSCALL_64_after_hwframe+0x44/0xae + +Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03003-QCAHSPSWPL_V1_V2_SILICONZ_LITE-2 + +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220127090117.2024-2-kvalo@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mhi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mhi.c b/drivers/net/wireless/ath/ath11k/mhi.c +index aded9a719d51..84db9e55c3e7 100644 +--- a/drivers/net/wireless/ath/ath11k/mhi.c ++++ b/drivers/net/wireless/ath/ath11k/mhi.c +@@ -402,7 +402,7 @@ static int ath11k_mhi_set_state(struct ath11k_pci *ab_pci, + ret = 0; + break; + case ATH11K_MHI_POWER_ON: +- ret = mhi_async_power_up(ab_pci->mhi_ctrl); ++ ret = mhi_sync_power_up(ab_pci->mhi_ctrl); + break; + case ATH11K_MHI_POWER_OFF: + mhi_power_down(ab_pci->mhi_ctrl, true); +-- +2.35.1 + diff --git a/queue-5.10/ath5k-fix-oob-in-ath5k_eeprom_read_pcal_info_5111.patch b/queue-5.10/ath5k-fix-oob-in-ath5k_eeprom_read_pcal_info_5111.patch new file mode 100644 index 00000000000..81a19fadcad --- /dev/null +++ b/queue-5.10/ath5k-fix-oob-in-ath5k_eeprom_read_pcal_info_5111.patch @@ -0,0 +1,87 @@ +From b7ad7d2b30a5ede3fafa45c9196592c193025d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Dec 2021 22:12:13 -0500 +Subject: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 + +From: Zekun Shen + +[ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ] + +The bug was found during fuzzing. Stacktrace locates it in +ath5k_eeprom_convert_pcal_info_5111. +When none of the curve is selected in the loop, idx can go +up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound. +pd = &chinfo[pier].pd_curves[idx]; + +There are many OOB writes using pd later in the code. So I +added a sanity check for idx. Checks for other loops involving +AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not +used outside the loops. + +The patch is NOT tested with real device. + +The following is the fuzzing report + +BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] +Write of size 1 at addr ffff8880174a4d60 by task modprobe/214 + +CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1 +Call Trace: + dump_stack+0x76/0xa0 + print_address_description.constprop.0+0x16/0x200 + ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] + ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] + __kasan_report.cold+0x37/0x7c + ? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] + kasan_report+0xe/0x20 + ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k] + ? apic_timer_interrupt+0xa/0x20 + ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] + ? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k] + ath5k_eeprom_init+0x2513/0x6290 [ath5k] + ? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k] + ? usleep_range+0xb8/0x100 + ? apic_timer_interrupt+0xa/0x20 + ? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k] + ath5k_hw_init+0xb60/0x1970 [ath5k] + ath5k_init_ah+0x6fe/0x2530 [ath5k] + ? kasprintf+0xa6/0xe0 + ? ath5k_stop+0x140/0x140 [ath5k] + ? _dev_notice+0xf6/0xf6 + ? apic_timer_interrupt+0xa/0x20 + ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k] + ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] + ? mutex_lock+0x89/0xd0 + ? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k] + local_pci_probe+0xd3/0x160 + pci_device_probe+0x23f/0x3e0 + ? pci_device_remove+0x280/0x280 + ? pci_device_remove+0x280/0x280 + really_probe+0x209/0x5d0 + +Reported-by: Brendan Dolan-Gavitt +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.edu +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 1fbc2c19848f..d444b3d70ba2 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, + } + } + ++ if (idx == AR5K_EEPROM_N_PD_CURVES) ++ goto err_out; ++ + ee->ee_pd_gains[mode] = 1; + + pd = &chinfo[pier].pd_curves[idx]; +-- +2.35.1 + diff --git a/queue-5.10/bluetooth-fix-not-checking-for-valid-hdev-on-bt_dev_.patch b/queue-5.10/bluetooth-fix-not-checking-for-valid-hdev-on-bt_dev_.patch new file mode 100644 index 00000000000..0d1b9951657 --- /dev/null +++ b/queue-5.10/bluetooth-fix-not-checking-for-valid-hdev-on-bt_dev_.patch @@ -0,0 +1,57 @@ +From 7c43dde8bc24f9336fb1929794393091e44a9971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 13:11:57 -0800 +Subject: Bluetooth: Fix not checking for valid hdev on + bt_dev_{info,warn,err,dbg} + +From: Luiz Augusto von Dentz + +[ Upstream commit 9b392e0e0b6d026da5a62bb79a08f32e27af858e ] + +This fixes attemting to print hdev->name directly which causes them to +print an error: + +kernel: read_version:367: (efault): sock 000000006a3008f2 + +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/bluetooth.h | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h +index 9125effbf448..3fecc4a411a1 100644 +--- a/include/net/bluetooth/bluetooth.h ++++ b/include/net/bluetooth/bluetooth.h +@@ -180,19 +180,21 @@ void bt_err_ratelimited(const char *fmt, ...); + #define BT_DBG(fmt, ...) pr_debug(fmt "\n", ##__VA_ARGS__) + #endif + ++#define bt_dev_name(hdev) ((hdev) ? (hdev)->name : "null") ++ + #define bt_dev_info(hdev, fmt, ...) \ +- BT_INFO("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_INFO("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_warn(hdev, fmt, ...) \ +- BT_WARN("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_WARN("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_err(hdev, fmt, ...) \ +- BT_ERR("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_ERR("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_dbg(hdev, fmt, ...) \ +- BT_DBG("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ BT_DBG("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + + #define bt_dev_warn_ratelimited(hdev, fmt, ...) \ +- bt_warn_ratelimited("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ bt_warn_ratelimited("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + #define bt_dev_err_ratelimited(hdev, fmt, ...) \ +- bt_err_ratelimited("%s: " fmt, (hdev)->name, ##__VA_ARGS__) ++ bt_err_ratelimited("%s: " fmt, bt_dev_name(hdev), ##__VA_ARGS__) + + /* Connection and socket states */ + enum { +-- +2.35.1 + diff --git a/queue-5.10/bluetooth-fix-use-after-free-in-hci_send_acl.patch b/queue-5.10/bluetooth-fix-use-after-free-in-hci_send_acl.patch new file mode 100644 index 00000000000..da2997d6c6e --- /dev/null +++ b/queue-5.10/bluetooth-fix-use-after-free-in-hci_send_acl.patch @@ -0,0 +1,134 @@ +From 2dc0adb126910d5dda4f878b09316e6fc4a3aa7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Mar 2022 13:19:33 -0800 +Subject: Bluetooth: Fix use after free in hci_send_acl +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luiz Augusto von Dentz + +[ Upstream commit f63d24baff787e13b723d86fe036f84bdbc35045 ] + +This fixes the following trace caused by receiving +HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without +first checking if conn->type is in fact AMP_LINK and in case it is +do properly cleanup upper layers with hci_disconn_cfm: + + ================================================================== + BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 + Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 + + CPU: 0 PID: 142 Comm: bluetoothd Not tainted + 5.17.0-rc5-00006-gda4022eeac1a #7 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS + rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + Call Trace: + + dump_stack_lvl+0x45/0x59 + print_address_description.constprop.0+0x1f/0x150 + kasan_report.cold+0x7f/0x11b + hci_send_acl+0xaba/0xc50 + l2cap_do_send+0x23f/0x3d0 + l2cap_chan_send+0xc06/0x2cc0 + l2cap_sock_sendmsg+0x201/0x2b0 + sock_sendmsg+0xdc/0x110 + sock_write_iter+0x20f/0x370 + do_iter_readv_writev+0x343/0x690 + do_iter_write+0x132/0x640 + vfs_writev+0x198/0x570 + do_writev+0x202/0x280 + do_syscall_64+0x38/0x90 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 + Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 + 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05 + <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 + RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015 + RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77 + R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580 + RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001 + + R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0 + + Allocated by task 45: + kasan_save_stack+0x1e/0x40 + __kasan_kmalloc+0x81/0xa0 + hci_chan_create+0x9a/0x2f0 + l2cap_conn_add.part.0+0x1a/0xdc0 + l2cap_connect_cfm+0x236/0x1000 + le_conn_complete_evt+0x15a7/0x1db0 + hci_le_conn_complete_evt+0x226/0x2c0 + hci_le_meta_evt+0x247/0x450 + hci_event_packet+0x61b/0xe90 + hci_rx_work+0x4d5/0xc50 + process_one_work+0x8fb/0x15a0 + worker_thread+0x576/0x1240 + kthread+0x29d/0x340 + ret_from_fork+0x1f/0x30 + + Freed by task 45: + kasan_save_stack+0x1e/0x40 + kasan_set_track+0x21/0x30 + kasan_set_free_info+0x20/0x30 + __kasan_slab_free+0xfb/0x130 + kfree+0xac/0x350 + hci_conn_cleanup+0x101/0x6a0 + hci_conn_del+0x27e/0x6c0 + hci_disconn_phylink_complete_evt+0xe0/0x120 + hci_event_packet+0x812/0xe90 + hci_rx_work+0x4d5/0xc50 + process_one_work+0x8fb/0x15a0 + worker_thread+0x576/0x1240 + kthread+0x29d/0x340 + ret_from_fork+0x1f/0x30 + + The buggy address belongs to the object at ffff88800c0f0500 + The buggy address is located 24 bytes inside of + which belongs to the cache kmalloc-128 of size 128 + The buggy address belongs to the page: + 128-byte region [ffff88800c0f0500, ffff88800c0f0580) + flags: 0x100000000000200(slab|node=0|zone=1) + page:00000000fe45cd86 refcount:1 mapcount:0 + mapping:0000000000000000 index:0x0 pfn:0xc0f0 + raw: 0000000000000000 0000000080100010 00000001ffffffff + 0000000000000000 + raw: 0100000000000200 ffffea00003a2c80 dead000000000004 + ffff8880078418c0 + page dumped because: kasan: bad access detected + ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc + Memory state around the buggy address: + >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ^ + ================================================================== + ffff88800c0f0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Reported-by: Sönke Huster +Tested-by: Sönke Huster +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 72b4127360c7..e926e80d9731 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5061,8 +5061,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon) { ++ if (hcon && hcon->type == AMP_LINK) { + hcon->state = BT_CLOSED; ++ hci_disconn_cfm(hcon, ev->reason); + hci_conn_del(hcon); + } + +-- +2.35.1 + diff --git a/queue-5.10/bluetooth-use-memset-avoid-memory-leaks.patch b/queue-5.10/bluetooth-use-memset-avoid-memory-leaks.patch new file mode 100644 index 00000000000..057b24af07a --- /dev/null +++ b/queue-5.10/bluetooth-use-memset-avoid-memory-leaks.patch @@ -0,0 +1,35 @@ +From 13f759265ba739dc571f4f8527168551181c2179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 07:41:52 +0000 +Subject: Bluetooth: use memset avoid memory leaks + +From: Minghao Chi (CGEL ZTE) + +[ Upstream commit d3715b2333e9a21692ba16ef8645eda584a9515d ] + +Use memset to initialize structs to prevent memory leaks +in l2cap_ecred_connect + +Reported-by: Zeal Robot +Signed-off-by: Minghao Chi (CGEL ZTE) +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index 0ddbc415ce15..012c1a0abda8 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -1438,6 +1438,7 @@ static void l2cap_ecred_connect(struct l2cap_chan *chan) + + l2cap_ecred_init(chan, 0); + ++ memset(&data, 0, sizeof(data)); + data.pdu.req.psm = chan->psm; + data.pdu.req.mtu = cpu_to_le16(chan->imtu); + data.pdu.req.mps = cpu_to_le16(chan->mps); +-- +2.35.1 + diff --git a/queue-5.10/bnxt_en-eliminate-unintended-link-toggle-during-fw-r.patch b/queue-5.10/bnxt_en-eliminate-unintended-link-toggle-during-fw-r.patch new file mode 100644 index 00000000000..ae767be0f1f --- /dev/null +++ b/queue-5.10/bnxt_en-eliminate-unintended-link-toggle-during-fw-r.patch @@ -0,0 +1,47 @@ +From 228027782aff084c9611c5e9d3f0951897005ad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 03:54:39 -0500 +Subject: bnxt_en: Eliminate unintended link toggle during FW reset + +From: Michael Chan + +[ Upstream commit 7c492a2530c1f05441da541307c2534230dfd59b ] + +If the flow control settings have been changed, a subsequent FW reset +may cause the ethernet link to toggle unnecessarily. This link toggle +will increase the down time by a few seconds. + +The problem is caused by bnxt_update_phy_setting() detecting a false +mismatch in the flow control settings between the stored software +settings and the current FW settings after the FW reset. This mismatch +is caused by the AUTONEG bit added to link_info->req_flow_ctrl in an +inconsistent way in bnxt_set_pauseparam() in autoneg mode. The AUTONEG +bit should not be added to link_info->req_flow_ctrl. + +Reviewed-by: Colin Winegarden +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 98087b278d1f..f8f775619520 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2041,9 +2041,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, + } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; +- if (bp->hwrm_spec_code >= 0x10201) +- link_info->req_flow_ctrl = +- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; ++ link_info->req_flow_ctrl = 0; + } else { + /* when transition from auto pause to force pause, + * force a link change +-- +2.35.1 + diff --git a/queue-5.10/bpf-make-dst_port-field-in-struct-bpf_sock-16-bit-wi.patch b/queue-5.10/bpf-make-dst_port-field-in-struct-bpf_sock-16-bit-wi.patch new file mode 100644 index 00000000000..838b20d1f8b --- /dev/null +++ b/queue-5.10/bpf-make-dst_port-field-in-struct-bpf_sock-16-bit-wi.patch @@ -0,0 +1,94 @@ +From 69e958d7a919f6f7666badfef8435af100a5b015 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jan 2022 12:55:17 +0100 +Subject: bpf: Make dst_port field in struct bpf_sock 16-bit wide + +From: Jakub Sitnicki + +[ Upstream commit 4421a582718ab81608d8486734c18083b822390d ] + +Menglong Dong reports that the documentation for the dst_port field in +struct bpf_sock is inaccurate and confusing. From the BPF program PoV, the +field is a zero-padded 16-bit integer in network byte order. The value +appears to the BPF user as if laid out in memory as so: + + offsetof(struct bpf_sock, dst_port) + 0 + + 8 + +16 0x00 + +24 0x00 + +32-, 16-, and 8-bit wide loads from the field are all allowed, but only if +the offset into the field is 0. + +32-bit wide loads from dst_port are especially confusing. The loaded value, +after converting to host byte order with bpf_ntohl(dst_port), contains the +port number in the upper 16-bits. + +Remove the confusion by splitting the field into two 16-bit fields. For +backward compatibility, allow 32-bit wide loads from offsetof(struct +bpf_sock, dst_port). + +While at it, allow loads 8-bit loads at offset [0] and [1] from dst_port. + +Reported-by: Menglong Dong +Signed-off-by: Jakub Sitnicki +Link: https://lore.kernel.org/r/20220130115518.213259-2-jakub@cloudflare.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/uapi/linux/bpf.h | 3 ++- + net/core/filter.c | 10 +++++++++- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index b43a86d05494..0f39fdcb2273 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -4180,7 +4180,8 @@ struct bpf_sock { + __u32 src_ip4; + __u32 src_ip6[4]; + __u32 src_port; /* host byte order */ +- __u32 dst_port; /* network byte order */ ++ __be16 dst_port; /* network byte order */ ++ __u16 :16; /* zero padding */ + __u32 dst_ip4; + __u32 dst_ip6[4]; + __u32 state; +diff --git a/net/core/filter.c b/net/core/filter.c +index 659a32802471..fe5e0ec5cd3e 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -7709,6 +7709,7 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + struct bpf_insn_access_aux *info) + { + const int size_default = sizeof(__u32); ++ int field_size; + + if (off < 0 || off >= sizeof(struct bpf_sock)) + return false; +@@ -7720,7 +7721,6 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case offsetof(struct bpf_sock, family): + case offsetof(struct bpf_sock, type): + case offsetof(struct bpf_sock, protocol): +- case offsetof(struct bpf_sock, dst_port): + case offsetof(struct bpf_sock, src_port): + case offsetof(struct bpf_sock, rx_queue_mapping): + case bpf_ctx_range(struct bpf_sock, src_ip4): +@@ -7729,6 +7729,14 @@ bool bpf_sock_is_valid_access(int off, int size, enum bpf_access_type type, + case bpf_ctx_range_till(struct bpf_sock, dst_ip6[0], dst_ip6[3]): + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); ++ case bpf_ctx_range(struct bpf_sock, dst_port): ++ field_size = size == size_default ? ++ size_default : sizeof_field(struct bpf_sock, dst_port); ++ bpf_ctx_record_field_size(info, field_size); ++ return bpf_ctx_narrow_access_ok(off, size, field_size); ++ case offsetofend(struct bpf_sock, dst_port) ... ++ offsetof(struct bpf_sock, dst_ip4) - 1: ++ return false; + } + + return size == size_default; +-- +2.35.1 + diff --git a/queue-5.10/can-isotp-set-default-value-for-n_as-to-50-micro-sec.patch b/queue-5.10/can-isotp-set-default-value-for-n_as-to-50-micro-sec.patch new file mode 100644 index 00000000000..2d80d1b0950 --- /dev/null +++ b/queue-5.10/can-isotp-set-default-value-for-n_as-to-50-micro-sec.patch @@ -0,0 +1,138 @@ +From 9774332e5925c347abd4307cfe2e43ed0c9847b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 13:04:13 +0100 +Subject: can: isotp: set default value for N_As to 50 micro seconds + +From: Oliver Hartkopp + +[ Upstream commit 530e0d46c61314c59ecfdb8d3bcb87edbc0f85d3 ] + +The N_As value describes the time a CAN frame needs on the wire when +transmitted by the CAN controller. Even very short CAN FD frames need +arround 100 usecs (bitrate 1Mbit/s, data bitrate 8Mbit/s). + +Having N_As to be zero (the former default) leads to 'no CAN frame +separation' when STmin is set to zero by the receiving node. This 'burst +mode' should not be enabled by default as it could potentially dump a high +number of CAN frames into the netdev queue from the soft hrtimer context. +This does not affect the system stability but is just not nice and +cooperative. + +With this N_As/frame_txtime value the 'burst mode' is disabled by default. + +As user space applications usually do not set the frame_txtime element +of struct can_isotp_options the new in-kernel default is very likely +overwritten with zero when the sockopt() CAN_ISOTP_OPTS is invoked. +To make sure that a N_As value of zero is only set intentional the +value '0' is now interpreted as 'do not change the current value'. +When a frame_txtime of zero is required for testing purposes this +CAN_ISOTP_FRAME_TXTIME_ZERO u32 value has to be set in frame_txtime. + +Link: https://lore.kernel.org/all/20220309120416.83514-2-socketcan@hartkopp.net +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/uapi/linux/can/isotp.h | 28 ++++++++++++++++++++++------ + net/can/isotp.c | 12 +++++++++++- + 2 files changed, 33 insertions(+), 7 deletions(-) + +diff --git a/include/uapi/linux/can/isotp.h b/include/uapi/linux/can/isotp.h +index c55935b64ccc..590f8aea2b6d 100644 +--- a/include/uapi/linux/can/isotp.h ++++ b/include/uapi/linux/can/isotp.h +@@ -137,20 +137,16 @@ struct can_isotp_ll_options { + #define CAN_ISOTP_WAIT_TX_DONE 0x400 /* wait for tx completion */ + #define CAN_ISOTP_SF_BROADCAST 0x800 /* 1-to-N functional addressing */ + +-/* default values */ ++/* protocol machine default values */ + + #define CAN_ISOTP_DEFAULT_FLAGS 0 + #define CAN_ISOTP_DEFAULT_EXT_ADDRESS 0x00 + #define CAN_ISOTP_DEFAULT_PAD_CONTENT 0xCC /* prevent bit-stuffing */ +-#define CAN_ISOTP_DEFAULT_FRAME_TXTIME 0 ++#define CAN_ISOTP_DEFAULT_FRAME_TXTIME 50000 /* 50 micro seconds */ + #define CAN_ISOTP_DEFAULT_RECV_BS 0 + #define CAN_ISOTP_DEFAULT_RECV_STMIN 0x00 + #define CAN_ISOTP_DEFAULT_RECV_WFTMAX 0 + +-#define CAN_ISOTP_DEFAULT_LL_MTU CAN_MTU +-#define CAN_ISOTP_DEFAULT_LL_TX_DL CAN_MAX_DLEN +-#define CAN_ISOTP_DEFAULT_LL_TX_FLAGS 0 +- + /* + * Remark on CAN_ISOTP_DEFAULT_RECV_* values: + * +@@ -162,4 +158,24 @@ struct can_isotp_ll_options { + * consistency and copied directly into the flow control (FC) frame. + */ + ++/* link layer default values => make use of Classical CAN frames */ ++ ++#define CAN_ISOTP_DEFAULT_LL_MTU CAN_MTU ++#define CAN_ISOTP_DEFAULT_LL_TX_DL CAN_MAX_DLEN ++#define CAN_ISOTP_DEFAULT_LL_TX_FLAGS 0 ++ ++/* ++ * The CAN_ISOTP_DEFAULT_FRAME_TXTIME has become a non-zero value as ++ * it only makes sense for isotp implementation tests to run without ++ * a N_As value. As user space applications usually do not set the ++ * frame_txtime element of struct can_isotp_options the new in-kernel ++ * default is very likely overwritten with zero when the sockopt() ++ * CAN_ISOTP_OPTS is invoked. ++ * To make sure that a N_As value of zero is only set intentional the ++ * value '0' is now interpreted as 'do not change the current value'. ++ * When a frame_txtime of zero is required for testing purposes this ++ * CAN_ISOTP_FRAME_TXTIME_ZERO u32 value has to be set in frame_txtime. ++ */ ++#define CAN_ISOTP_FRAME_TXTIME_ZERO 0xFFFFFFFF ++ + #endif /* !_UAPI_CAN_ISOTP_H */ +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 63e6e8923200..9a4a9c5a9f24 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -141,6 +141,7 @@ struct isotp_sock { + struct can_isotp_options opt; + struct can_isotp_fc_options rxfc, txfc; + struct can_isotp_ll_options ll; ++ u32 frame_txtime; + u32 force_tx_stmin; + u32 force_rx_stmin; + struct tpcon rx, tx; +@@ -360,7 +361,7 @@ static int isotp_rcv_fc(struct isotp_sock *so, struct canfd_frame *cf, int ae) + + so->tx_gap = ktime_set(0, 0); + /* add transmission time for CAN frame N_As */ +- so->tx_gap = ktime_add_ns(so->tx_gap, so->opt.frame_txtime); ++ so->tx_gap = ktime_add_ns(so->tx_gap, so->frame_txtime); + /* add waiting time for consecutive frames N_Cs */ + if (so->opt.flags & CAN_ISOTP_FORCE_TXSTMIN) + so->tx_gap = ktime_add_ns(so->tx_gap, +@@ -1245,6 +1246,14 @@ static int isotp_setsockopt_locked(struct socket *sock, int level, int optname, + /* no separate rx_ext_address is given => use ext_address */ + if (!(so->opt.flags & CAN_ISOTP_RX_EXT_ADDR)) + so->opt.rx_ext_address = so->opt.ext_address; ++ ++ /* check for frame_txtime changes (0 => no changes) */ ++ if (so->opt.frame_txtime) { ++ if (so->opt.frame_txtime == CAN_ISOTP_FRAME_TXTIME_ZERO) ++ so->frame_txtime = 0; ++ else ++ so->frame_txtime = so->opt.frame_txtime; ++ } + break; + + case CAN_ISOTP_RECV_FC: +@@ -1446,6 +1455,7 @@ static int isotp_init(struct sock *sk) + so->opt.rxpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; + so->opt.txpad_content = CAN_ISOTP_DEFAULT_PAD_CONTENT; + so->opt.frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; ++ so->frame_txtime = CAN_ISOTP_DEFAULT_FRAME_TXTIME; + so->rxfc.bs = CAN_ISOTP_DEFAULT_RECV_BS; + so->rxfc.stmin = CAN_ISOTP_DEFAULT_RECV_STMIN; + so->rxfc.wftmax = CAN_ISOTP_DEFAULT_RECV_WFTMAX; +-- +2.35.1 + diff --git a/queue-5.10/ceph-fix-memory-leak-in-ceph_readdir-when-note_last_.patch b/queue-5.10/ceph-fix-memory-leak-in-ceph_readdir-when-note_last_.patch new file mode 100644 index 00000000000..58d1e8e330a --- /dev/null +++ b/queue-5.10/ceph-fix-memory-leak-in-ceph_readdir-when-note_last_.patch @@ -0,0 +1,54 @@ +From daa96aeac0d3362ae81810d9fdbd7c256e7a162c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 19:52:59 +0800 +Subject: ceph: fix memory leak in ceph_readdir when note_last_dentry returns + error + +From: Xiubo Li + +[ Upstream commit f639d9867eea647005dc824e0e24f39ffc50d4e4 ] + +Reset the last_readdir at the same time, and add a comment explaining +why we don't free last_readdir when dir_emit returns false. + +Signed-off-by: Xiubo Li +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/dir.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c +index f63c1a090139..1fddb9cd3e88 100644 +--- a/fs/ceph/dir.c ++++ b/fs/ceph/dir.c +@@ -478,8 +478,11 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx) + 2 : (fpos_off(rde->offset) + 1); + err = note_last_dentry(dfi, rde->name, rde->name_len, + next_offset); +- if (err) ++ if (err) { ++ ceph_mdsc_put_request(dfi->last_readdir); ++ dfi->last_readdir = NULL; + return err; ++ } + } else if (req->r_reply_info.dir_end) { + dfi->next_offset = 2; + /* keep last name */ +@@ -520,6 +523,12 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx) + if (!dir_emit(ctx, rde->name, rde->name_len, + ceph_present_ino(inode->i_sb, le64_to_cpu(rde->inode.in->ino)), + le32_to_cpu(rde->inode.in->mode) >> 12)) { ++ /* ++ * NOTE: Here no need to put the 'dfi->last_readdir', ++ * because when dir_emit stops us it's most likely ++ * doesn't have enough memory, etc. So for next readdir ++ * it will continue. ++ */ + dout("filldir stopping us...\n"); + return 0; + } +-- +2.35.1 + diff --git a/queue-5.10/cfg80211-don-t-add-non-transmitted-bss-to-6ghz-scann.patch b/queue-5.10/cfg80211-don-t-add-non-transmitted-bss-to-6ghz-scann.patch new file mode 100644 index 00000000000..2748c805596 --- /dev/null +++ b/queue-5.10/cfg80211-don-t-add-non-transmitted-bss-to-6ghz-scann.patch @@ -0,0 +1,54 @@ +From ea652352fcf1b8dece40292e4a803141e418cdc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Feb 2022 10:49:37 +0200 +Subject: cfg80211: don't add non transmitted BSS to 6GHz scanned channels + +From: Avraham Stern + +[ Upstream commit 5666ee154f4696c011dfa8544aaf5591b6b87515 ] + +When adding 6GHz channels to scan request based on reported +co-located APs, don't add channels that have only APs with +"non-transmitted" BSSes if they only match the wildcard SSID since +they will be found by probing the "transmitted" BSS. + +Signed-off-by: Avraham Stern +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20220202104617.f6ddf099f934.I231e55885d3644f292d00dfe0f42653269f2559e@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/scan.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/scan.c b/net/wireless/scan.c +index fd614a5a00b4..c1b2655682a8 100644 +--- a/net/wireless/scan.c ++++ b/net/wireless/scan.c +@@ -702,8 +702,12 @@ static bool cfg80211_find_ssid_match(struct cfg80211_colocated_ap *ap, + + for (i = 0; i < request->n_ssids; i++) { + /* wildcard ssid in the scan request */ +- if (!request->ssids[i].ssid_len) ++ if (!request->ssids[i].ssid_len) { ++ if (ap->multi_bss && !ap->transmitted_bssid) ++ continue; ++ + return true; ++ } + + if (ap->ssid_len && + ap->ssid_len == request->ssids[i].ssid_len) { +@@ -830,6 +834,9 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev) + !cfg80211_find_ssid_match(ap, request)) + continue; + ++ if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid) ++ continue; ++ + cfg80211_scan_req_add_chan(request, chan, true); + memcpy(scan_6ghz_params->bssid, ap->bssid, ETH_ALEN); + scan_6ghz_params->short_ssid = ap->short_ssid; +-- +2.35.1 + diff --git a/queue-5.10/clk-enforce-that-disjoints-limits-are-invalid.patch b/queue-5.10/clk-enforce-that-disjoints-limits-are-invalid.patch new file mode 100644 index 00000000000..6b218361614 --- /dev/null +++ b/queue-5.10/clk-enforce-that-disjoints-limits-are-invalid.patch @@ -0,0 +1,103 @@ +From 02bcf65071fdb9452c49ad4b328cb000133cc9b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 15:35:25 +0100 +Subject: clk: Enforce that disjoints limits are invalid + +From: Maxime Ripard + +[ Upstream commit 10c46f2ea914202482d19cf80dcc9c321c9ff59b ] + +If we were to have two users of the same clock, doing something like: + +clk_set_rate_range(user1, 1000, 2000); +clk_set_rate_range(user2, 3000, 4000); + +The second call would fail with -EINVAL, preventing from getting in a +situation where we end up with impossible limits. + +However, this is never explicitly checked against and enforced, and +works by relying on an undocumented behaviour of clk_set_rate(). + +Indeed, on the first clk_set_rate_range will make sure the current clock +rate is within the new range, so it will be between 1000 and 2000Hz. On +the second clk_set_rate_range(), it will consider (rightfully), that our +current clock is outside of the 3000-4000Hz range, and will call +clk_core_set_rate_nolock() to set it to 3000Hz. + +clk_core_set_rate_nolock() will then call clk_calc_new_rates() that will +eventually check that our rate 3000Hz rate is outside the min 3000Hz max +2000Hz range, will bail out, the error will propagate and we'll +eventually return -EINVAL. + +This solely relies on the fact that clk_calc_new_rates(), and in +particular clk_core_determine_round_nolock(), won't modify the new rate +allowing the error to be reported. That assumption won't be true for all +drivers, and most importantly we'll break that assumption in a later +patch. + +It can also be argued that we shouldn't even reach the point where we're +calling clk_core_set_rate_nolock(). + +Let's make an explicit check for disjoints range before we're doing +anything. + +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220225143534.405820-4-maxime@cerno.tech +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 92fc084203b7..2e56cc0a3bce 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -631,6 +631,24 @@ static void clk_core_get_boundaries(struct clk_core *core, + *max_rate = min(*max_rate, clk_user->max_rate); + } + ++static bool clk_core_check_boundaries(struct clk_core *core, ++ unsigned long min_rate, ++ unsigned long max_rate) ++{ ++ struct clk *user; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ if (min_rate > core->max_rate || max_rate < core->min_rate) ++ return false; ++ ++ hlist_for_each_entry(user, &core->clks, clks_node) ++ if (min_rate > user->max_rate || max_rate < user->min_rate) ++ return false; ++ ++ return true; ++} ++ + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate) + { +@@ -2332,6 +2350,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + clk->min_rate = min; + clk->max_rate = max; + ++ if (!clk_core_check_boundaries(clk->core, min, max)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + rate = clk_core_get_rate_nolock(clk->core); + if (rate < min || rate > max) { + /* +@@ -2360,6 +2383,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + } + } + ++out: + if (clk->exclusive_count) + clk_core_rate_protect(clk->core); + +-- +2.35.1 + diff --git a/queue-5.10/clk-si5341-fix-reported-clk_rate-when-output-divider.patch b/queue-5.10/clk-si5341-fix-reported-clk_rate-when-output-divider.patch new file mode 100644 index 00000000000..710f630196a --- /dev/null +++ b/queue-5.10/clk-si5341-fix-reported-clk_rate-when-output-divider.patch @@ -0,0 +1,62 @@ +From 058e1624afad87c870985f9f4344661390e5a118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 14:12:07 +0000 +Subject: clk: si5341: fix reported clk_rate when output divider is 2 + +From: Adam Wujek + +[ Upstream commit 2a8b539433e111c4de364237627ef219d2f6350a ] + +SI5341_OUT_CFG_RDIV_FORCE2 shall be checked first to distinguish whether +a divider for a given output is set to 2 (SI5341_OUT_CFG_RDIV_FORCE2 +is set) or the output is disabled (SI5341_OUT_CFG_RDIV_FORCE2 not set, +SI5341_OUT_R_REG is set 0). +Before the change, divider set to 2 (SI5341_OUT_R_REG set to 0) was +interpreted as output is disabled. + +Signed-off-by: Adam Wujek +Link: https://lore.kernel.org/r/20211203141125.2447520-1-dev_public@wujek.eu +Reviewed-by: Robert Hancock +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index 772b48ad0cd7..382a0619a048 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -789,6 +789,15 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + u32 r_divider; + u8 r[3]; + ++ err = regmap_read(output->data->regmap, ++ SI5341_OUT_CONFIG(output), &val); ++ if (err < 0) ++ return err; ++ ++ /* If SI5341_OUT_CFG_RDIV_FORCE2 is set, r_divider is 2 */ ++ if (val & SI5341_OUT_CFG_RDIV_FORCE2) ++ return parent_rate / 2; ++ + err = regmap_bulk_read(output->data->regmap, + SI5341_OUT_R_REG(output), r, 3); + if (err < 0) +@@ -805,13 +814,6 @@ static unsigned long si5341_output_clk_recalc_rate(struct clk_hw *hw, + r_divider += 1; + r_divider <<= 1; + +- err = regmap_read(output->data->regmap, +- SI5341_OUT_CONFIG(output), &val); +- if (err < 0) +- return err; +- +- if (val & SI5341_OUT_CFG_RDIV_FORCE2) +- r_divider = 2; + + return parent_rate / r_divider; + } +-- +2.35.1 + diff --git a/queue-5.10/clk-ti-preserve-node-in-ti_dt_clocks_register.patch b/queue-5.10/clk-ti-preserve-node-in-ti_dt_clocks_register.patch new file mode 100644 index 00000000000..e71ac8468e5 --- /dev/null +++ b/queue-5.10/clk-ti-preserve-node-in-ti_dt_clocks_register.patch @@ -0,0 +1,56 @@ +From e5a410a6e270b8cfa56c433263cb8e711b6b3a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 09:14:43 +0200 +Subject: clk: ti: Preserve node in ti_dt_clocks_register() + +From: Tony Lindgren + +[ Upstream commit 80864594ff2ad002e2755daf97d46ff0c86faf1f ] + +In preparation for making use of the clock-output-names, we want to +keep node around in ti_dt_clocks_register(). + +This change should not needed as a fix currently. + +Signed-off-by: Tony Lindgren +Link: https://lore.kernel.org/r/20220204071449.16762-3-tony@atomide.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 3da33c786d77..29eafab4353e 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -131,7 +131,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops) + void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + { + struct ti_dt_clk *c; +- struct device_node *node, *parent; ++ struct device_node *node, *parent, *child; + struct clk *clk; + struct of_phandle_args clkspec; + char buf[64]; +@@ -171,10 +171,13 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + node = of_find_node_by_name(NULL, buf); + if (num_args && compat_mode) { + parent = node; +- node = of_get_child_by_name(parent, "clock"); +- if (!node) +- node = of_get_child_by_name(parent, "clk"); +- of_node_put(parent); ++ child = of_get_child_by_name(parent, "clock"); ++ if (!child) ++ child = of_get_child_by_name(parent, "clk"); ++ if (child) { ++ of_node_put(parent); ++ node = child; ++ } + } + + clkspec.np = node; +-- +2.35.1 + diff --git a/queue-5.10/dm-ioctl-prevent-potential-spectre-v1-gadget.patch b/queue-5.10/dm-ioctl-prevent-potential-spectre-v1-gadget.patch new file mode 100644 index 00000000000..915b5c71a91 --- /dev/null +++ b/queue-5.10/dm-ioctl-prevent-potential-spectre-v1-gadget.patch @@ -0,0 +1,44 @@ +From 292a9fdf7f6b0a146cee088c5a5ba22b90f2b015 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 15:58:39 +0100 +Subject: dm ioctl: prevent potential spectre v1 gadget + +From: Jordy Zomer + +[ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ] + +It appears like cmd could be a Spectre v1 gadget as it's supplied by a +user and used as an array index. Prevent the contents of kernel memory +from being leaked to userspace via speculative execution by using +array_index_nospec. + +Signed-off-by: Jordy Zomer +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-ioctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 1ca65b434f1f..b839705654d4 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) + if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) + return NULL; + ++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); + *ioctl_flags = _ioctls[cmd].flags; + return _ioctls[cmd].fn; + } +-- +2.35.1 + diff --git a/queue-5.10/dm-requeue-io-if-mapping-table-not-yet-available.patch b/queue-5.10/dm-requeue-io-if-mapping-table-not-yet-available.patch new file mode 100644 index 00000000000..c3e32d623a9 --- /dev/null +++ b/queue-5.10/dm-requeue-io-if-mapping-table-not-yet-available.patch @@ -0,0 +1,70 @@ +From 5efd007e276f4e082e903961ae3696e6c6267133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 13:28:12 -0500 +Subject: dm: requeue IO if mapping table not yet available + +From: Mike Snitzer + +[ Upstream commit fa247089de9936a46e290d4724cb5f0b845600f5 ] + +Update both bio-based and request-based DM to requeue IO if the +mapping table not available. + +This race of IO being submitted before the DM device ready is so +narrow, yet possible for initial table load given that the DM device's +request_queue is created prior, that it best to requeue IO to handle +this unlikely case. + +Reported-by: Zhang Yi +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 7 ++++++- + drivers/md/dm.c | 11 +++-------- + 2 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index b1e867feb4f6..4833f4b20b2c 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -492,8 +492,13 @@ static blk_status_t dm_mq_queue_rq(struct blk_mq_hw_ctx *hctx, + + if (unlikely(!ti)) { + int srcu_idx; +- struct dm_table *map = dm_get_live_table(md, &srcu_idx); ++ struct dm_table *map; + ++ map = dm_get_live_table(md, &srcu_idx); ++ if (unlikely(!map)) { ++ dm_put_live_table(md, srcu_idx); ++ return BLK_STS_RESOURCE; ++ } + ti = dm_table_find_target(map, 0); + dm_put_live_table(md, srcu_idx); + } +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 6030cba5b038..2836d44094ab 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1692,15 +1692,10 @@ static blk_qc_t dm_submit_bio(struct bio *bio) + struct dm_table *map; + + map = dm_get_live_table(md, &srcu_idx); +- if (unlikely(!map)) { +- DMERR_LIMIT("%s: mapping table unavailable, erroring io", +- dm_device_name(md)); +- bio_io_error(bio); +- goto out; +- } + +- /* If suspended, queue this IO for later */ +- if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) { ++ /* If suspended, or map not yet available, queue this IO for later */ ++ if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags)) || ++ unlikely(!map)) { + if (bio->bi_opf & REQ_NOWAIT) + bio_wouldblock_error(bio); + else if (bio->bi_opf & REQ_RAHEAD) +-- +2.35.1 + diff --git a/queue-5.10/drm-add-orientation-quirk-for-gpd-win-max.patch b/queue-5.10/drm-add-orientation-quirk-for-gpd-win-max.patch new file mode 100644 index 00000000000..c45220a3c89 --- /dev/null +++ b/queue-5.10/drm-add-orientation-quirk-for-gpd-win-max.patch @@ -0,0 +1,40 @@ +From 96e540a2646cff8c7faaa1683d8ef88794b35d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Dec 2021 23:22:00 +0100 +Subject: drm: Add orientation quirk for GPD Win Max + +From: Anisse Astier + +[ Upstream commit 0b464ca3e0dd3cec65f28bc6d396d82f19080f69 ] + +Panel is 800x1280, but mounted on a laptop form factor, sideways. + +Signed-off-by: Anisse Astier +Reviewed-by: Hans de Goede +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20211229222200.53128-3-anisse@astier.eu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 448c2f2d803a..f5ab891731d0 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -166,6 +166,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-amdgpu-amdgpu_cs-fix-refcount-leak-of-a-dma_.patch b/queue-5.10/drm-amd-amdgpu-amdgpu_cs-fix-refcount-leak-of-a-dma_.patch new file mode 100644 index 00000000000..71210c314ab --- /dev/null +++ b/queue-5.10/drm-amd-amdgpu-amdgpu_cs-fix-refcount-leak-of-a-dma_.patch @@ -0,0 +1,46 @@ +From 4e1cb3d512706095a035c228d96eb8c0fb5037c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 15:46:23 -0500 +Subject: drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xin Xiong + +[ Upstream commit dfced44f122c500004a48ecc8db516bb6a295a1b ] + +This issue takes place in an error path in +amdgpu_cs_fence_to_handle_ioctl(). When `info->in.what` falls into +default case, the function simply returns -EINVAL, forgetting to +decrement the reference count of a dma_fence obj, which is bumped +earlier by amdgpu_cs_get_fence(). This may result in reference count +leaks. + +Fix it by decreasing the refcount of specific object before returning +the error code. + +Reviewed-by: Christian König +Signed-off-by: Xin Xiong +Signed-off-by: Xin Tan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 12598a4b5c78..867fcee6b0d3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1484,6 +1484,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, + return 0; + + default: ++ dma_fence_put(fence); + return -EINVAL; + } + } +-- +2.35.1 + diff --git a/queue-5.10/drm-amd-display-add-signal-type-check-when-verify-st.patch b/queue-5.10/drm-amd-display-add-signal-type-check-when-verify-st.patch new file mode 100644 index 00000000000..de6f6c0c554 --- /dev/null +++ b/queue-5.10/drm-amd-display-add-signal-type-check-when-verify-st.patch @@ -0,0 +1,47 @@ +From d1a76e858ac70bf96ee1266ae28afaad906f2b84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 16:50:28 +0800 +Subject: drm/amd/display: Add signal type check when verify stream backends + same + +From: Dale Zhao + +[ Upstream commit 047db281c026de5971cedb5bb486aa29bd16a39d ] + +[Why] +For allow eDP hot-plug feature, the stream signal may change to VIRTUAL +when plug-out and back to eDP when plug-in. OS will still setPathMode +with same timing for each plugging, but eDP gets no stream update as we +don't check signal type changing back as keeping it VIRTUAL. It's also +unsafe for future cases that stream signal is switched with same timing. + +[How] +Check stream signal type change include previous HDMI signal case. + +Reviewed-by: Aric Cyr +Acked-by: Wayne Lin +Signed-off-by: Dale Zhao +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index 5f4cdb05c4db..5c5ccbad9658 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1674,6 +1674,9 @@ static bool are_stream_backends_same( + if (is_timing_changed(stream_a, stream_b)) + return false; + ++ if (stream_a->signal != stream_b->signal) ++ return false; ++ + if (stream_a->dpms_off != stream_b->dpms_off) + return false; + +-- +2.35.1 + diff --git a/queue-5.10/drm-amdgpu-fix-recursive-locking-warning.patch b/queue-5.10/drm-amdgpu-fix-recursive-locking-warning.patch new file mode 100644 index 00000000000..471d1a571ec --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-recursive-locking-warning.patch @@ -0,0 +1,141 @@ +From 645d1d9f67c796877d07b4d3874174554ec65d0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 21:18:21 -0500 +Subject: drm/amdgpu: Fix recursive locking warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rajneesh Bhardwaj + +[ Upstream commit 447c7997b62a5115ba4da846dcdee4fc12298a6a ] + +Noticed the below warning while running a pytorch workload on vega10 +GPUs. Change to trylock to avoid conflicts with already held reservation +locks. + +[ +0.000003] WARNING: possible recursive locking detected +[ +0.000003] 5.13.0-kfd-rajneesh #1030 Not tainted +[ +0.000004] -------------------------------------------- +[ +0.000002] python/4822 is trying to acquire lock: +[ +0.000004] ffff932cd9a259f8 (reservation_ww_class_mutex){+.+.}-{3:3}, +at: amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000203] + but task is already holding lock: +[ +0.000003] ffff932cbb7181f8 (reservation_ww_class_mutex){+.+.}-{3:3}, +at: ttm_eu_reserve_buffers+0x270/0x470 [ttm] +[ +0.000017] + other info that might help us debug this: +[ +0.000002] Possible unsafe locking scenario: + +[ +0.000003] CPU0 +[ +0.000002] ---- +[ +0.000002] lock(reservation_ww_class_mutex); +[ +0.000004] lock(reservation_ww_class_mutex); +[ +0.000003] + *** DEADLOCK *** + +[ +0.000002] May be due to missing lock nesting notation + +[ +0.000003] 7 locks held by python/4822: +[ +0.000003] #0: ffff932c4ac028d0 (&process->mutex){+.+.}-{3:3}, at: +kfd_ioctl_map_memory_to_gpu+0x10b/0x320 [amdgpu] +[ +0.000232] #1: ffff932c55e830a8 (&info->lock#2){+.+.}-{3:3}, at: +amdgpu_amdkfd_gpuvm_map_memory_to_gpu+0x64/0xf60 [amdgpu] +[ +0.000241] #2: ffff932cc45b5e68 (&(*mem)->lock){+.+.}-{3:3}, at: +amdgpu_amdkfd_gpuvm_map_memory_to_gpu+0xdf/0xf60 [amdgpu] +[ +0.000236] #3: ffffb2b35606fd28 +(reservation_ww_class_acquire){+.+.}-{0:0}, at: +amdgpu_amdkfd_gpuvm_map_memory_to_gpu+0x232/0xf60 [amdgpu] +[ +0.000235] #4: ffff932cbb7181f8 +(reservation_ww_class_mutex){+.+.}-{3:3}, at: +ttm_eu_reserve_buffers+0x270/0x470 [ttm] +[ +0.000015] #5: ffffffffc045f700 (*(sspp++)){....}-{0:0}, at: +drm_dev_enter+0x5/0xa0 [drm] +[ +0.000038] #6: ffff932c52da7078 (&vm->eviction_lock){+.+.}-{3:3}, +at: amdgpu_vm_bo_update_mapping+0xd5/0x4f0 [amdgpu] +[ +0.000195] + stack backtrace: +[ +0.000003] CPU: 11 PID: 4822 Comm: python Not tainted +5.13.0-kfd-rajneesh #1030 +[ +0.000005] Hardware name: GIGABYTE MZ01-CE0-00/MZ01-CE0-00, BIOS F02 +08/29/2018 +[ +0.000003] Call Trace: +[ +0.000003] dump_stack+0x6d/0x89 +[ +0.000010] __lock_acquire+0xb93/0x1a90 +[ +0.000009] lock_acquire+0x25d/0x2d0 +[ +0.000005] ? amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000184] ? lock_is_held_type+0xa2/0x110 +[ +0.000006] ? amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000184] __ww_mutex_lock.constprop.17+0xca/0x1060 +[ +0.000007] ? amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000183] ? lock_release+0x13f/0x270 +[ +0.000005] ? lock_is_held_type+0xa2/0x110 +[ +0.000006] ? amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000183] amdgpu_bo_release_notify+0xc4/0x160 [amdgpu] +[ +0.000185] ttm_bo_release+0x4c6/0x580 [ttm] +[ +0.000010] amdgpu_bo_unref+0x1a/0x30 [amdgpu] +[ +0.000183] amdgpu_vm_free_table+0x76/0xa0 [amdgpu] +[ +0.000189] amdgpu_vm_free_pts+0xb8/0xf0 [amdgpu] +[ +0.000189] amdgpu_vm_update_ptes+0x411/0x770 [amdgpu] +[ +0.000191] amdgpu_vm_bo_update_mapping+0x324/0x4f0 [amdgpu] +[ +0.000191] amdgpu_vm_bo_update+0x251/0x610 [amdgpu] +[ +0.000191] update_gpuvm_pte+0xcc/0x290 [amdgpu] +[ +0.000229] ? amdgpu_vm_bo_map+0xd7/0x130 [amdgpu] +[ +0.000190] amdgpu_amdkfd_gpuvm_map_memory_to_gpu+0x912/0xf60 +[amdgpu] +[ +0.000234] kfd_ioctl_map_memory_to_gpu+0x182/0x320 [amdgpu] +[ +0.000218] kfd_ioctl+0x2b9/0x600 [amdgpu] +[ +0.000216] ? kfd_ioctl_unmap_memory_from_gpu+0x270/0x270 [amdgpu] +[ +0.000216] ? lock_release+0x13f/0x270 +[ +0.000006] ? __fget_files+0x107/0x1e0 +[ +0.000007] __x64_sys_ioctl+0x8b/0xd0 +[ +0.000007] do_syscall_64+0x36/0x70 +[ +0.000004] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ +0.000007] RIP: 0033:0x7fbff90a7317 +[ +0.000004] Code: b3 66 90 48 8b 05 71 4b 2d 00 64 c7 00 26 00 00 00 +48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f +05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 41 4b 2d 00 f7 d8 64 89 01 48 +[ +0.000005] RSP: 002b:00007fbe301fe648 EFLAGS: 00000246 ORIG_RAX: +0000000000000010 +[ +0.000006] RAX: ffffffffffffffda RBX: 00007fbcc402d820 RCX: +00007fbff90a7317 +[ +0.000003] RDX: 00007fbe301fe690 RSI: 00000000c0184b18 RDI: +0000000000000004 +[ +0.000003] RBP: 00007fbe301fe690 R08: 0000000000000000 R09: +00007fbcc402d880 +[ +0.000003] R10: 0000000002001000 R11: 0000000000000246 R12: +00000000c0184b18 +[ +0.000003] R13: 0000000000000004 R14: 00007fbf689593a0 R15: +00007fbcc402d820 + +Cc: Christian König +Cc: Felix Kuehling +Cc: Alex Deucher + +Reviewed-by: Christian König +Reviewed-by: Felix Kuehling +Signed-off-by: Rajneesh Bhardwaj +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index ad9863b84f1f..f615ecc06a22 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -1338,7 +1338,8 @@ void amdgpu_bo_release_notify(struct ttm_buffer_object *bo) + !(abo->flags & AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE)) + return; + +- dma_resv_lock(bo->base.resv, NULL); ++ if (WARN_ON_ONCE(!dma_resv_trylock(bo->base.resv))) ++ return; + + r = amdgpu_fill_buffer(abo, AMDGPU_POISON, bo->base.resv, &fence); + if (!WARN_ON(r)) { +-- +2.35.1 + diff --git a/queue-5.10/drm-amdkfd-make-crat-table-missing-message-informati.patch b/queue-5.10/drm-amdkfd-make-crat-table-missing-message-informati.patch new file mode 100644 index 00000000000..8a701483c8c --- /dev/null +++ b/queue-5.10/drm-amdkfd-make-crat-table-missing-message-informati.patch @@ -0,0 +1,38 @@ +From 8827ae905707df538cddf4cfe1e088f16582112a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 15:40:12 -0500 +Subject: drm/amdkfd: make CRAT table missing message informational only + +From: Alex Deucher + +[ Upstream commit 9dff13f9edf755a15f6507874185a3290c1ae8bb ] + +The driver has a fallback so make the message informational +rather than a warning. The driver has a fallback if the +Component Resource Association Table (CRAT) is missing, so +make this informational now. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1906 +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index 31d793ee0836..86b4dadf772e 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -784,7 +784,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) + /* Fetch the CRAT table from ACPI */ + status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); + if (status == AE_NOT_FOUND) { +- pr_warn("CRAT table not found\n"); ++ pr_info("CRAT table not found\n"); + return -ENODATA; + } else if (ACPI_FAILURE(status)) { + const char *err = acpi_format_exception(status); +-- +2.35.1 + diff --git a/queue-5.10/gfs2-check-for-active-reservation-in-gfs2_release.patch b/queue-5.10/gfs2-check-for-active-reservation-in-gfs2_release.patch new file mode 100644 index 00000000000..cf8903c639d --- /dev/null +++ b/queue-5.10/gfs2-check-for-active-reservation-in-gfs2_release.patch @@ -0,0 +1,38 @@ +From 76f6a5f92d4fe06c12562a5c90bd7eb09b46aa57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 16:37:54 +0200 +Subject: gfs2: Check for active reservation in gfs2_release + +From: Andreas Gruenbacher + +[ Upstream commit 0ec9b9ea4f83303bfd8f052a3d8b2bd179b002e1 ] + +In gfs2_release, check if the inode has an active reservation to avoid +unnecessary lock taking. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index cfd9d03f604f..59318b1eaa60 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -716,10 +716,10 @@ static int gfs2_release(struct inode *inode, struct file *file) + kfree(file->private_data); + file->private_data = NULL; + +- if (file->f_mode & FMODE_WRITE) { ++ if (gfs2_rs_active(&ip->i_res)) + gfs2_rs_delete(ip, &inode->i_writecount); ++ if (file->f_mode & FMODE_WRITE) + gfs2_qa_put(ip); +- } + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.10/gfs2-fix-gfs2_release-for-non-writers-regression.patch b/queue-5.10/gfs2-fix-gfs2_release-for-non-writers-regression.patch new file mode 100644 index 00000000000..1b1f2799cdf --- /dev/null +++ b/queue-5.10/gfs2-fix-gfs2_release-for-non-writers-regression.patch @@ -0,0 +1,60 @@ +From ab6632a5759c42de6883f96537c0bc2b631b1307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 09:30:18 -0500 +Subject: gfs2: Fix gfs2_release for non-writers regression + +From: Bob Peterson + +[ Upstream commit d3add1a9519dcacd6e644ecac741c56cf18b67f5 ] + +When a file is opened for writing, the vfs code (do_dentry_open) +calls get_write_access for the inode, thus incrementing the inode's write +count. That writer normally then creates a multi-block reservation for +the inode (i_res) that can be re-used by other writers, which speeds up +writes for applications that stupidly loop on open/write/close. +When the writes are all done, the multi-block reservation should be +deleted when the file is closed by the last "writer." + +Commit 0ec9b9ea4f83 broke that concept when it moved the call to +gfs2_rs_delete before the check for FMODE_WRITE. Non-writers have no +business removing the multi-block reservations of writers. In fact, if +someone opens and closes the file for RO while a writer has a +multi-block reservation, the RO closer will delete the reservation +midway through the write, and this results in: + +kernel BUG at fs/gfs2/rgrp.c:677! (or thereabouts) which is: +BUG_ON(rs->rs_requested); from function gfs2_rs_deltree. + +This patch moves the check back inside the check for FMODE_WRITE. + +Fixes: 0ec9b9ea4f83 ("gfs2: Check for active reservation in gfs2_release") +Cc: stable@vger.kernel.org # v5.12+ +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/file.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 59318b1eaa60..7bd7581aa682 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -716,10 +716,11 @@ static int gfs2_release(struct inode *inode, struct file *file) + kfree(file->private_data); + file->private_data = NULL; + +- if (gfs2_rs_active(&ip->i_res)) +- gfs2_rs_delete(ip, &inode->i_writecount); +- if (file->f_mode & FMODE_WRITE) ++ if (file->f_mode & FMODE_WRITE) { ++ if (gfs2_rs_active(&ip->i_res)) ++ gfs2_rs_delete(ip, &inode->i_writecount); + gfs2_qa_put(ip); ++ } + return 0; + } + +-- +2.35.1 + diff --git a/queue-5.10/gfs2-gfs2_setattr_size-error-path-fix.patch b/queue-5.10/gfs2-gfs2_setattr_size-error-path-fix.patch new file mode 100644 index 00000000000..30a259b9801 --- /dev/null +++ b/queue-5.10/gfs2-gfs2_setattr_size-error-path-fix.patch @@ -0,0 +1,124 @@ +From e01ce9473b997a6f31ffb25e00cb79322fded244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 14:43:36 +0100 +Subject: gfs2: gfs2_setattr_size error path fix + +From: Andreas Gruenbacher + +[ Upstream commit 7336905a89f19173bf9301cd50a24421162f417c ] + +When gfs2_setattr_size() fails, it calls gfs2_rs_delete(ip, NULL) to get +rid of any reservations the inode may have. Instead, it should pass in +the inode's write count as the second parameter to allow +gfs2_rs_delete() to figure out if the inode has any writers left. + +In a next step, there are two instances of gfs2_rs_delete(ip, NULL) left +where we know that there can be no other users of the inode. Replace +those with gfs2_rs_deltree(&ip->i_res) to avoid the unnecessary write +count check. + +With that, gfs2_rs_delete() is only called with the inode's actual write +count, so get rid of the second parameter. + +Fixes: a097dc7e24cb ("GFS2: Make rgrp reservations part of the gfs2_inode structure") +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/bmap.c | 2 +- + fs/gfs2/file.c | 2 +- + fs/gfs2/inode.c | 2 +- + fs/gfs2/rgrp.c | 7 ++++--- + fs/gfs2/rgrp.h | 2 +- + fs/gfs2/super.c | 2 +- + 6 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index b34c02985d9d..6c047570d6a9 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -2200,7 +2200,7 @@ int gfs2_setattr_size(struct inode *inode, u64 newsize) + + ret = do_shrink(inode, newsize); + out: +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_delete(ip); + gfs2_qa_put(ip); + return ret; + } +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 7bd7581aa682..2e6f622ed428 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -718,7 +718,7 @@ static int gfs2_release(struct inode *inode, struct file *file) + + if (file->f_mode & FMODE_WRITE) { + if (gfs2_rs_active(&ip->i_res)) +- gfs2_rs_delete(ip, &inode->i_writecount); ++ gfs2_rs_delete(ip); + gfs2_qa_put(ip); + } + return 0; +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 65ae4fc28ede..74a6b0800e05 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -811,7 +811,7 @@ static int gfs2_create_inode(struct inode *dir, struct dentry *dentry, + if (free_vfs_inode) /* else evict will do the put for us */ + gfs2_glock_put(ip->i_gl); + } +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_deltree(&ip->i_res); + gfs2_qa_put(ip); + fail_free_acls: + posix_acl_release(default_acl); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index eb775e93de97..dc55b029afaa 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -664,13 +664,14 @@ void gfs2_rs_deltree(struct gfs2_blkreserv *rs) + /** + * gfs2_rs_delete - delete a multi-block reservation + * @ip: The inode for this reservation +- * @wcount: The inode's write count, or NULL + * + */ +-void gfs2_rs_delete(struct gfs2_inode *ip, atomic_t *wcount) ++void gfs2_rs_delete(struct gfs2_inode *ip) + { ++ struct inode *inode = &ip->i_inode; ++ + down_write(&ip->i_rw_mutex); +- if ((wcount == NULL) || (atomic_read(wcount) <= 1)) ++ if (atomic_read(&inode->i_writecount) <= 1) + gfs2_rs_deltree(&ip->i_res); + up_write(&ip->i_rw_mutex); + } +diff --git a/fs/gfs2/rgrp.h b/fs/gfs2/rgrp.h +index 9a587ada51ed..2d3c150c55bd 100644 +--- a/fs/gfs2/rgrp.h ++++ b/fs/gfs2/rgrp.h +@@ -45,7 +45,7 @@ extern int gfs2_alloc_blocks(struct gfs2_inode *ip, u64 *bn, unsigned int *n, + bool dinode, u64 *generation); + + extern void gfs2_rs_deltree(struct gfs2_blkreserv *rs); +-extern void gfs2_rs_delete(struct gfs2_inode *ip, atomic_t *wcount); ++extern void gfs2_rs_delete(struct gfs2_inode *ip); + extern void __gfs2_free_blocks(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, + u64 bstart, u32 blen, int meta); + extern void gfs2_free_meta(struct gfs2_inode *ip, struct gfs2_rgrpd *rgd, +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index d2b7ecbd1b15..d14b98aa1c3e 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -1434,7 +1434,7 @@ static void gfs2_evict_inode(struct inode *inode) + truncate_inode_pages_final(&inode->i_data); + if (ip->i_qadata) + gfs2_assert_warn(sdp, ip->i_qadata->qa_ref == 0); +- gfs2_rs_delete(ip, NULL); ++ gfs2_rs_deltree(&ip->i_res); + gfs2_ordered_del_inode(ip); + clear_inode(inode); + gfs2_dir_hash_inval(ip); +-- +2.35.1 + diff --git a/queue-5.10/init-main.c-return-1-from-handled-__setup-functions.patch b/queue-5.10/init-main.c-return-1-from-handled-__setup-functions.patch new file mode 100644 index 00000000000..91de162b4d7 --- /dev/null +++ b/queue-5.10/init-main.c-return-1-from-handled-__setup-functions.patch @@ -0,0 +1,57 @@ +From 8684073ff53265f6bca729dd0bb5dbbf0720ac6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 16:06:14 -0700 +Subject: init/main.c: return 1 from handled __setup() functions + +From: Randy Dunlap + +[ Upstream commit f9a40b0890658330c83c95511f9d6b396610defc ] + +initcall_blacklist() should return 1 to indicate that it handled its +cmdline arguments. + +set_debug_rodata() should return 1 to indicate that it handled its +cmdline arguments. Print a warning if the option string is invalid. + +This prevents these strings from being added to the 'init' program's +environment as they are not init arguments/parameters. + +Link: https://lkml.kernel.org/r/20220221050901.23985-1-rdunlap@infradead.org +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Cc: Ingo Molnar +Cc: Greg Kroah-Hartman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + init/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/init/main.c b/init/main.c +index 4fe58ed4aca7..3526eaec7508 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -1104,7 +1104,7 @@ static int __init initcall_blacklist(char *str) + } + } while (str_entry); + +- return 0; ++ return 1; + } + + static bool __init_or_module initcall_blacklisted(initcall_t fn) +@@ -1367,7 +1367,9 @@ static noinline void __init kernel_init_freeable(void); + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +- return strtobool(str, &rodata_enabled); ++ if (strtobool(str, &rodata_enabled)) ++ pr_warn("Invalid option string for rodata: '%s'\n", str); ++ return 1; + } + __setup("rodata=", set_debug_rodata); + #endif +-- +2.35.1 + diff --git a/queue-5.10/iommu-arm-smmu-v3-fix-event-handling-soft-lockup.patch b/queue-5.10/iommu-arm-smmu-v3-fix-event-handling-soft-lockup.patch new file mode 100644 index 00000000000..81ee7e3c514 --- /dev/null +++ b/queue-5.10/iommu-arm-smmu-v3-fix-event-handling-soft-lockup.patch @@ -0,0 +1,55 @@ +From fcde6f5a59b46742a549f3b1bcda490fef2d3bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 07:07:54 +0000 +Subject: iommu/arm-smmu-v3: fix event handling soft lockup + +From: Zhou Guanghui + +[ Upstream commit 30de2b541af98179780054836b48825fcfba4408 ] + +During event processing, events are read from the event queue one +by one until the queue is empty.If the master device continuously +requests address access at the same time and the SMMU generates +events, the cyclic processing of the event takes a long time and +softlockup warnings may be reported. + +arm-smmu-v3 arm-smmu-v3.34.auto: event 0x0a received: +arm-smmu-v3 arm-smmu-v3.34.auto: 0x00007f220000280a +arm-smmu-v3 arm-smmu-v3.34.auto: 0x000010000000007e +arm-smmu-v3 arm-smmu-v3.34.auto: 0x00000000034e8670 +watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [irq/268-arm-smm:247] +Call trace: + _dev_info+0x7c/0xa0 + arm_smmu_evtq_thread+0x1c0/0x230 + irq_thread_fn+0x30/0x80 + irq_thread+0x128/0x210 + kthread+0x134/0x138 + ret_from_fork+0x10/0x1c +Kernel panic - not syncing: softlockup: hung tasks + +Fix this by calling cond_resched() after the event information is +printed. + +Signed-off-by: Zhou Guanghui +Link: https://lore.kernel.org/r/20220119070754.26528-1-zhouguanghui1@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 7067b7c11626..483c1362cc4a 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -1368,6 +1368,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + dev_info(smmu->dev, "\t0x%016llx\n", + (unsigned long long)evt[i]); + ++ cond_resched(); + } + + /* +-- +2.35.1 + diff --git a/queue-5.10/ipv4-invalidate-neighbour-for-broadcast-address-upon.patch b/queue-5.10/ipv4-invalidate-neighbour-for-broadcast-address-upon.patch new file mode 100644 index 00000000000..6870936e154 --- /dev/null +++ b/queue-5.10/ipv4-invalidate-neighbour-for-broadcast-address-upon.patch @@ -0,0 +1,118 @@ +From 68ac52630d2d95b833adab0cef74b8d8384824a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Feb 2022 17:45:19 +0200 +Subject: ipv4: Invalidate neighbour for broadcast address upon address + addition + +From: Ido Schimmel + +[ Upstream commit 0c51e12e218f20b7d976158fdc18019627326f7a ] + +In case user space sends a packet destined to a broadcast address when a +matching broadcast route is not configured, the kernel will create a +unicast neighbour entry that will never be resolved [1]. + +When the broadcast route is configured, the unicast neighbour entry will +not be invalidated and continue to linger, resulting in packets being +dropped. + +Solve this by invalidating unresolved neighbour entries for broadcast +addresses after routes for these addresses are internally configured by +the kernel. This allows the kernel to create a broadcast neighbour entry +following the next route lookup. + +Another possible solution that is more generic but also more complex is +to have the ARP code register a listener to the FIB notification chain +and invalidate matching neighbour entries upon the addition of broadcast +routes. + +It is also possible to wave off the issue as a user space problem, but +it seems a bit excessive to expect user space to be that intimately +familiar with the inner workings of the FIB/neighbour kernel code. + +[1] https://lore.kernel.org/netdev/55a04a8f-56f3-f73c-2aea-2195923f09d1@huawei.com/ + +Reported-by: Wang Hai +Signed-off-by: Ido Schimmel +Tested-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/arp.h | 1 + + net/ipv4/arp.c | 9 +++++++-- + net/ipv4/fib_frontend.c | 5 ++++- + 3 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/include/net/arp.h b/include/net/arp.h +index 4950191f6b2b..4a23a97195f3 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, + const unsigned char *src_hw, const unsigned char *th); + int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); + void arp_ifdown(struct net_device *dev); ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force); + + struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, + struct net_device *dev, __be32 src_ip, +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index 922dd73e5740..83a47998c4b1 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1116,13 +1116,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) + return err; + } + +-static int arp_invalidate(struct net_device *dev, __be32 ip) ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force) + { + struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); + int err = -ENXIO; + struct neigh_table *tbl = &arp_tbl; + + if (neigh) { ++ if ((neigh->nud_state & NUD_VALID) && !force) { ++ neigh_release(neigh); ++ return 0; ++ } ++ + if (neigh->nud_state & ~NUD_NOARP) + err = neigh_update(neigh, NULL, NUD_FAILED, + NEIGH_UPDATE_F_OVERRIDE| +@@ -1169,7 +1174,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, + if (!dev) + return -EINVAL; + } +- return arp_invalidate(dev, ip); ++ return arp_invalidate(dev, ip, true); + } + + /* +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 917ea953dfad..0df4594b49c7 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1112,9 +1112,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + return; + + /* Add broadcast address, if it is explicitly assigned. */ +- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) ++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, + prim, 0); ++ arp_invalidate(dev, ifa->ifa_broadcast, false); ++ } + + if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && + (prefix != addr || ifa->ifa_prefixlen < 32)) { +@@ -1130,6 +1132,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + prim, 0); + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, + 32, prim, 0); ++ arp_invalidate(dev, prefix | ~mask, false); + } + } + } +-- +2.35.1 + diff --git a/queue-5.10/ipv6-make-mc_forwarding-atomic.patch b/queue-5.10/ipv6-make-mc_forwarding-atomic.patch new file mode 100644 index 00000000000..d3c5fa51a3b --- /dev/null +++ b/queue-5.10/ipv6-make-mc_forwarding-atomic.patch @@ -0,0 +1,127 @@ +From df4441711fbb881abeab6028b9e2817d798850c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 12:15:45 -0800 +Subject: ipv6: make mc_forwarding atomic + +From: Eric Dumazet + +[ Upstream commit 145c7a793838add5e004e7d49a67654dc7eba147 ] + +This fixes minor data-races in ip6_mc_input() and +batadv_mcast_mla_rtr_flags_softif_get_ipv6() + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/ipv6.h | 2 +- + net/batman-adv/multicast.c | 2 +- + net/ipv6/addrconf.c | 4 ++-- + net/ipv6/ip6_input.c | 2 +- + net/ipv6/ip6mr.c | 8 ++++---- + 5 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h +index f514a7dd8c9c..510f87656479 100644 +--- a/include/linux/ipv6.h ++++ b/include/linux/ipv6.h +@@ -50,7 +50,7 @@ struct ipv6_devconf { + __s32 use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- __s32 mc_forwarding; ++ atomic_t mc_forwarding; + #endif + __s32 disable_ipv6; + __s32 drop_unicast_in_l2_multicast; +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 139894ca788b..c8a341cd652c 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -136,7 +136,7 @@ static u8 batadv_mcast_mla_rtr_flags_softif_get_ipv6(struct net_device *dev) + { + struct inet6_dev *in6_dev = __in6_dev_get(dev); + +- if (in6_dev && in6_dev->cnf.mc_forwarding) ++ if (in6_dev && atomic_read(&in6_dev->cnf.mc_forwarding)) + return BATADV_NO_FLAGS; + else + return BATADV_MCAST_WANT_NO_RTR6; +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 7c5bf39dca5d..86bcb1825698 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -542,7 +542,7 @@ static int inet6_netconf_fill_devconf(struct sk_buff *skb, int ifindex, + #ifdef CONFIG_IPV6_MROUTE + if ((all || type == NETCONFA_MC_FORWARDING) && + nla_put_s32(skb, NETCONFA_MC_FORWARDING, +- devconf->mc_forwarding) < 0) ++ atomic_read(&devconf->mc_forwarding)) < 0) + goto nla_put_failure; + #endif + if ((all || type == NETCONFA_PROXY_NEIGH) && +@@ -5515,7 +5515,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf, + array[DEVCONF_USE_OPTIMISTIC] = cnf->use_optimistic; + #endif + #ifdef CONFIG_IPV6_MROUTE +- array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding; ++ array[DEVCONF_MC_FORWARDING] = atomic_read(&cnf->mc_forwarding); + #endif + array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6; + array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad; +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index 06d60662717d..15ea3d082534 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -509,7 +509,7 @@ int ip6_mc_input(struct sk_buff *skb) + /* + * IPv6 multicast router mode is now supported ;) + */ +- if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding && ++ if (atomic_read(&dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding) && + !(ipv6_addr_type(&hdr->daddr) & + (IPV6_ADDR_LOOPBACK|IPV6_ADDR_LINKLOCAL)) && + likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) { +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index 41cb348a7c3c..5f0ac47acc74 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -740,7 +740,7 @@ static int mif6_delete(struct mr_table *mrt, int vifi, int notify, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding--; ++ atomic_dec(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -908,7 +908,7 @@ static int mif6_add(struct net *net, struct mr_table *mrt, + + in6_dev = __in6_dev_get(dev); + if (in6_dev) { +- in6_dev->cnf.mc_forwarding++; ++ atomic_inc(&in6_dev->cnf.mc_forwarding); + inet6_netconf_notify_devconf(dev_net(dev), RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, + dev->ifindex, &in6_dev->cnf); +@@ -1558,7 +1558,7 @@ static int ip6mr_sk_init(struct mr_table *mrt, struct sock *sk) + } else { + rcu_assign_pointer(mrt->mroute_sk, sk); + sock_set_flag(sk, SOCK_RCU_FREE); +- net->ipv6.devconf_all->mc_forwarding++; ++ atomic_inc(&net->ipv6.devconf_all->mc_forwarding); + } + write_unlock_bh(&mrt_lock); + +@@ -1591,7 +1591,7 @@ int ip6mr_sk_done(struct sock *sk) + * so the RCU grace period before sk freeing + * is guaranteed by sk_destruct() + */ +- net->ipv6.devconf_all->mc_forwarding--; ++ atomic_dec(&net->ipv6.devconf_all->mc_forwarding); + write_unlock_bh(&mrt_lock); + inet6_netconf_notify_devconf(net, RTM_NEWNETCONF, + NETCONFA_MC_FORWARDING, +-- +2.35.1 + diff --git a/queue-5.10/iwlwifi-mvm-correctly-set-fragmented-ebs.patch b/queue-5.10/iwlwifi-mvm-correctly-set-fragmented-ebs.patch new file mode 100644 index 00000000000..cc9b2d00364 --- /dev/null +++ b/queue-5.10/iwlwifi-mvm-correctly-set-fragmented-ebs.patch @@ -0,0 +1,42 @@ +From ac3f175e82336cb6fdd1a5ef2f604ddb3ef8a1e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 12:25:00 +0200 +Subject: iwlwifi: mvm: Correctly set fragmented EBS + +From: Ilan Peer + +[ Upstream commit d8d4dd26b9e0469baf5017f0544d852fd4e3fb6d ] + +Currently, fragmented EBS was set for a channel only if the 'hb_type' +was set to fragmented or balanced scan. However, 'hb_type' is set only +in case of CDB, and thus fragmented EBS is never set for a channel for +non-CDB devices. Fix it. + +Signed-off-by: Ilan Peer +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20220204122220.a6165ac9b9d5.I654eafa62fd647030ae6d4f07f32c96c3171decb@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index 46255d2c555b..17b992526694 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -1706,7 +1706,10 @@ static u8 iwl_mvm_scan_umac_chan_flags_v2(struct iwl_mvm *mvm, + IWL_SCAN_CHANNEL_FLAG_CACHE_ADD; + + /* set fragmented ebs for fragmented scan on HB channels */ +- if (iwl_mvm_is_scan_fragmented(params->hb_type)) ++ if ((!iwl_mvm_is_cdb_supported(mvm) && ++ iwl_mvm_is_scan_fragmented(params->type)) || ++ (iwl_mvm_is_cdb_supported(mvm) && ++ iwl_mvm_is_scan_fragmented(params->hb_type))) + flags |= IWL_SCAN_CHANNEL_FLAG_EBS_FRAG; + + return flags; +-- +2.35.1 + diff --git a/queue-5.10/jfs-prevent-null-deref-in-difree.patch b/queue-5.10/jfs-prevent-null-deref-in-difree.patch new file mode 100644 index 00000000000..2d7ee5ab9b3 --- /dev/null +++ b/queue-5.10/jfs-prevent-null-deref-in-difree.patch @@ -0,0 +1,48 @@ +From 4c0cd5b1fda870d1b02b42365147d52b43135972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 21:59:17 +0800 +Subject: jfs: prevent NULL deref in diFree + +From: Haimin Zhang + +[ Upstream commit a53046291020ec41e09181396c1e829287b48d47 ] + +Add validation check for JFS_IP(ipimap)->i_imap to prevent a NULL deref +in diFree since diFree uses it without do any validations. +When function jfs_mount calls diMount to initialize fileset inode +allocation map, it can fail and JFS_IP(ipimap)->i_imap won't be +initialized. Then it calls diFreeSpecial to close fileset inode allocation +map inode and it will flow into jfs_evict_inode. Function jfs_evict_inode +just validates JFS_SBI(inode->i_sb)->ipimap, then calls diFree. diFree use +JFS_IP(ipimap)->i_imap directly, then it will cause a NULL deref. + +Reported-by: TCS Robot +Signed-off-by: Haimin Zhang +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index b0eb9c85eea0..980aa3300f10 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -146,12 +146,13 @@ void jfs_evict_inode(struct inode *inode) + dquot_initialize(inode); + + if (JFS_IP(inode)->fileset == FILESYSTEM_I) { ++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; + truncate_inode_pages_final(&inode->i_data); + + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- if (JFS_SBI(inode->i_sb)->ipimap) ++ if (ipimap && JFS_IP(ipimap)->i_imap) + diFree(inode); + + /* +-- +2.35.1 + diff --git a/queue-5.10/kvm-x86-emulator-emulate-rdpid-only-if-it-is-enabled.patch b/queue-5.10/kvm-x86-emulator-emulate-rdpid-only-if-it-is-enabled.patch new file mode 100644 index 00000000000..bfa10e005fc --- /dev/null +++ b/queue-5.10/kvm-x86-emulator-emulate-rdpid-only-if-it-is-enabled.patch @@ -0,0 +1,81 @@ +From 96c02e9d92534622430d3ea62dbe934260effb06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 21:15:14 +0800 +Subject: KVM: x86/emulator: Emulate RDPID only if it is enabled in guest + +From: Hou Wenlong + +[ Upstream commit a836839cbfe60dc434c5476a7429cf2bae36415d ] + +When RDTSCP is supported but RDPID is not supported in host, +RDPID emulation is available. However, __kvm_get_msr() would +only fail when RDTSCP/RDPID both are disabled in guest, so +the emulator wouldn't inject a #UD when RDPID is disabled but +RDTSCP is enabled in guest. + +Fixes: fb6d4d340e05 ("KVM: x86: emulate RDPID") +Signed-off-by: Hou Wenlong +Message-Id: <1dfd46ae5b76d3ed87bde3154d51c64ea64c99c1.1646226788.git.houwenlong.hwl@antgroup.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/emulate.c | 4 +++- + arch/x86/kvm/kvm_emulate.h | 1 + + arch/x86/kvm/x86.c | 6 ++++++ + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index a63df19ef4da..71e1a2d39f21 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -3611,8 +3611,10 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) + { + u64 tsc_aux = 0; + +- if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) ++ if (!ctxt->ops->guest_has_rdpid(ctxt)) + return emulate_ud(ctxt); ++ ++ ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux); + ctxt->dst.val = tsc_aux; + return X86EMUL_CONTINUE; + } +diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h +index 7d5be04dc661..aeed6da60e0c 100644 +--- a/arch/x86/kvm/kvm_emulate.h ++++ b/arch/x86/kvm/kvm_emulate.h +@@ -225,6 +225,7 @@ struct x86_emulate_ops { + bool (*guest_has_long_mode)(struct x86_emulate_ctxt *ctxt); + bool (*guest_has_movbe)(struct x86_emulate_ctxt *ctxt); + bool (*guest_has_fxsr)(struct x86_emulate_ctxt *ctxt); ++ bool (*guest_has_rdpid)(struct x86_emulate_ctxt *ctxt); + + void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); + +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index a5d6d79b023b..70d23bec09f5 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6875,6 +6875,11 @@ static bool emulator_guest_has_fxsr(struct x86_emulate_ctxt *ctxt) + return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_FXSR); + } + ++static bool emulator_guest_has_rdpid(struct x86_emulate_ctxt *ctxt) ++{ ++ return guest_cpuid_has(emul_to_vcpu(ctxt), X86_FEATURE_RDPID); ++} ++ + static ulong emulator_read_gpr(struct x86_emulate_ctxt *ctxt, unsigned reg) + { + return kvm_register_read(emul_to_vcpu(ctxt), reg); +@@ -6958,6 +6963,7 @@ static const struct x86_emulate_ops emulate_ops = { + .guest_has_long_mode = emulator_guest_has_long_mode, + .guest_has_movbe = emulator_guest_has_movbe, + .guest_has_fxsr = emulator_guest_has_fxsr, ++ .guest_has_rdpid = emulator_guest_has_rdpid, + .set_nmi_mask = emulator_set_nmi_mask, + .get_hflags = emulator_get_hflags, + .set_hflags = emulator_set_hflags, +-- +2.35.1 + diff --git a/queue-5.10/kvm-x86-svm-clear-reserved-bits-written-to-perfevtse.patch b/queue-5.10/kvm-x86-svm-clear-reserved-bits-written-to-perfevtse.patch new file mode 100644 index 00000000000..5a652bc84fd --- /dev/null +++ b/queue-5.10/kvm-x86-svm-clear-reserved-bits-written-to-perfevtse.patch @@ -0,0 +1,74 @@ +From 38937f00a7d6f660b9ff95875956a69ac0cd4ec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Feb 2022 15:41:31 -0800 +Subject: KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs + +From: Jim Mattson + +[ Upstream commit 9b026073db2f1ad0e4d8b61c83316c8497981037 ] + +AMD EPYC CPUs never raise a #GP for a WRMSR to a PerfEvtSeln MSR. Some +reserved bits are cleared, and some are not. Specifically, on +Zen3/Milan, bits 19 and 42 are not cleared. + +When emulating such a WRMSR, KVM should not synthesize a #GP, +regardless of which bits are set. However, undocumented bits should +not be passed through to the hardware MSR. So, rather than checking +for reserved bits and synthesizing a #GP, just clear the reserved +bits. + +This may seem pedantic, but since KVM currently does not support the +"Host/Guest Only" bits (41:40), it is necessary to clear these bits +rather than synthesizing #GP, because some popular guests (e.g Linux) +will set the "Host Only" bit even on CPUs that don't support +EFER.SVME, and they don't expect a #GP. + +For example, + +root@Ubuntu1804:~# perf stat -e r26 -a sleep 1 + + Performance counter stats for 'system wide': + + 0 r26 + + 1.001070977 seconds time elapsed + +Feb 23 03:59:58 Ubuntu1804 kernel: [ 405.379957] unchecked MSR access error: WRMSR to 0xc0010200 (tried to write 0x0000020000130026) at rIP: 0xffffffff9b276a28 (native_write_msr+0x8/0x30) +Feb 23 03:59:58 Ubuntu1804 kernel: [ 405.379958] Call Trace: +Feb 23 03:59:58 Ubuntu1804 kernel: [ 405.379963] amd_pmu_disable_event+0x27/0x90 + +Fixes: ca724305a2b0 ("KVM: x86/vPMU: Implement AMD vPMU code for KVM") +Reported-by: Lotus Fenn +Signed-off-by: Jim Mattson +Reviewed-by: Like Xu +Reviewed-by: David Dunn +Message-Id: <20220226234131.2167175-1-jmattson@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm/pmu.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kvm/svm/pmu.c b/arch/x86/kvm/svm/pmu.c +index 4e7093bcb64b..0e9c2322d398 100644 +--- a/arch/x86/kvm/svm/pmu.c ++++ b/arch/x86/kvm/svm/pmu.c +@@ -253,12 +253,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_EVNTSELn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); + if (pmc) { +- if (data == pmc->eventsel) +- return 0; +- if (!(data & pmu->reserved_bits)) { ++ data &= ~pmu->reserved_bits; ++ if (data != pmc->eventsel) + reprogram_gp_counter(pmc, data); +- return 0; +- } ++ return 0; + } + + return 1; +-- +2.35.1 + diff --git a/queue-5.10/libbpf-fix-build-issue-with-llvm-readelf.patch b/queue-5.10/libbpf-fix-build-issue-with-llvm-readelf.patch new file mode 100644 index 00000000000..b144e94c045 --- /dev/null +++ b/queue-5.10/libbpf-fix-build-issue-with-llvm-readelf.patch @@ -0,0 +1,97 @@ +From 60a02b5a7a45e33603c3c8c5350bf9f5b5698877 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 13:43:55 -0800 +Subject: libbpf: Fix build issue with llvm-readelf + +From: Yonghong Song + +[ Upstream commit 0908a66ad1124c1634c33847ac662106f7f2c198 ] + +There are cases where clang compiler is packaged in a way +readelf is a symbolic link to llvm-readelf. In such cases, +llvm-readelf will be used instead of default binutils readelf, +and the following error will appear during libbpf build: + + Warning: Num of global symbols in + /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/build/libbpf/sharedobjs/libbpf-in.o (367) + does NOT match with num of versioned symbols in + /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/build/libbpf/libbpf.so libbpf.map (383). + Please make sure all LIBBPF_API symbols are versioned in libbpf.map. + --- /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/build/libbpf/libbpf_global_syms.tmp ... + +++ /home/yhs/work/bpf-next/tools/testing/selftests/bpf/tools/build/libbpf/libbpf_versioned_syms.tmp ... + @@ -324,6 +324,22 @@ + btf__str_by_offset + btf__type_by_id + btf__type_cnt + +LIBBPF_0.0.1 + +LIBBPF_0.0.2 + +LIBBPF_0.0.3 + +LIBBPF_0.0.4 + +LIBBPF_0.0.5 + +LIBBPF_0.0.6 + +LIBBPF_0.0.7 + +LIBBPF_0.0.8 + +LIBBPF_0.0.9 + +LIBBPF_0.1.0 + +LIBBPF_0.2.0 + +LIBBPF_0.3.0 + +LIBBPF_0.4.0 + +LIBBPF_0.5.0 + +LIBBPF_0.6.0 + +LIBBPF_0.7.0 + libbpf_attach_type_by_name + libbpf_find_kernel_btf + libbpf_find_vmlinux_btf_id + make[2]: *** [Makefile:184: check_abi] Error 1 + make[1]: *** [Makefile:140: all] Error 2 + +The above failure is due to different printouts for some ABS +versioned symbols. For example, with the same libbpf.so, + $ /bin/readelf --dyn-syms --wide tools/lib/bpf/libbpf.so | grep "LIBBPF" | grep ABS + 134: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LIBBPF_0.5.0 + 202: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LIBBPF_0.6.0 + ... + $ /opt/llvm/bin/readelf --dyn-syms --wide tools/lib/bpf/libbpf.so | grep "LIBBPF" | grep ABS + 134: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LIBBPF_0.5.0@@LIBBPF_0.5.0 + 202: 0000000000000000 0 OBJECT GLOBAL DEFAULT ABS LIBBPF_0.6.0@@LIBBPF_0.6.0 + ... +The binutils readelf doesn't print out the symbol LIBBPF_* version and llvm-readelf does. +Such a difference caused libbpf build failure with llvm-readelf. + +The proposed fix filters out all ABS symbols as they are not part of the comparison. +This works for both binutils readelf and llvm-readelf. + +Reported-by: Delyan Kratunov +Signed-off-by: Yonghong Song +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20220204214355.502108-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 154b75fc1373..f2a353bba25f 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -147,7 +147,7 @@ GLOBAL_SYM_COUNT = $(shell readelf -s --wide $(BPF_IN_SHARED) | \ + sort -u | wc -l) + VERSIONED_SYM_COUNT = $(shell readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ + sed 's/\[.*\]//' | \ +- awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}' | \ ++ awk '/GLOBAL/ && /DEFAULT/ && !/UND|ABS/ {print $$NF}' | \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | sort -u | wc -l) + + CMD_TARGETS = $(LIB_TARGET) $(PC_FILE) +@@ -216,7 +216,7 @@ check_abi: $(OUTPUT)libbpf.so $(VERSION_SCRIPT) + sort -u > $(OUTPUT)libbpf_global_syms.tmp; \ + readelf --dyn-syms --wide $(OUTPUT)libbpf.so | \ + sed 's/\[.*\]//' | \ +- awk '/GLOBAL/ && /DEFAULT/ && !/UND/ {print $$NF}'| \ ++ awk '/GLOBAL/ && /DEFAULT/ && !/UND|ABS/ {print $$NF}'| \ + grep -Eo '[^ ]+@LIBBPF_' | cut -d@ -f1 | \ + sort -u > $(OUTPUT)libbpf_versioned_syms.tmp; \ + diff -u $(OUTPUT)libbpf_global_syms.tmp \ +-- +2.35.1 + diff --git a/queue-5.10/macvtap-advertise-link-netns-via-netlink.patch b/queue-5.10/macvtap-advertise-link-netns-via-netlink.patch new file mode 100644 index 00000000000..52a9af30661 --- /dev/null +++ b/queue-5.10/macvtap-advertise-link-netns-via-netlink.patch @@ -0,0 +1,68 @@ +From 26f9a344dca7a20f2601ba3a067c4356280156ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 01:32:40 +0100 +Subject: macvtap: advertise link netns via netlink +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sven Eckelmann + +[ Upstream commit a02192151b7dbf855084c38dca380d77c7658353 ] + +Assign rtnl_link_ops->get_link_net() callback so that IFLA_LINK_NETNSID is +added to rtnetlink messages. This fixes iproute2 which otherwise resolved +the link interface to an interface in the wrong namespace. + +Test commands: + + ip netns add nst + ip link add dummy0 type dummy + ip link add link macvtap0 link dummy0 type macvtap + ip link set macvtap0 netns nst + ip -netns nst link show macvtap0 + +Before: + + 10: macvtap0@gre0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 500 + link/ether 5e:8f:ae:1d:60:50 brd ff:ff:ff:ff:ff:ff + +After: + + 10: macvtap0@if2: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 500 + link/ether 5e:8f:ae:1d:60:50 brd ff:ff:ff:ff:ff:ff link-netnsid 0 + +Reported-by: Leonardo Mörlein +Signed-off-by: Sven Eckelmann +Link: https://lore.kernel.org/r/20220228003240.1337426-1-sven@narfation.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/macvtap.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 694e2f5dbbe5..39801c31e507 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -133,11 +133,17 @@ static void macvtap_setup(struct net_device *dev) + dev->tx_queue_len = TUN_READQ_SIZE; + } + ++static struct net *macvtap_link_net(const struct net_device *dev) ++{ ++ return dev_net(macvlan_dev_real_dev(dev)); ++} ++ + static struct rtnl_link_ops macvtap_link_ops __read_mostly = { + .kind = "macvtap", + .setup = macvtap_setup, + .newlink = macvtap_newlink, + .dellink = macvtap_dellink, ++ .get_link_net = macvtap_link_net, + .priv_size = sizeof(struct macvtap_dev), + }; + +-- +2.35.1 + diff --git a/queue-5.10/minix-fix-bug-when-opening-a-file-with-o_direct.patch b/queue-5.10/minix-fix-bug-when-opening-a-file-with-o_direct.patch new file mode 100644 index 00000000000..01e2c4b554b --- /dev/null +++ b/queue-5.10/minix-fix-bug-when-opening-a-file-with-o_direct.patch @@ -0,0 +1,48 @@ +From 968625c864f39125586286e889148d9aa724d00b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 16:06:23 -0700 +Subject: minix: fix bug when opening a file with O_DIRECT + +From: Qinghua Jin + +[ Upstream commit 9ce3c0d26c42d279b6c378a03cd6a61d828f19ca ] + +Testcase: +1. create a minix file system and mount it +2. open a file on the file system with O_RDWR|O_CREAT|O_TRUNC|O_DIRECT +3. open fails with -EINVAL but leaves an empty file behind. All other + open() failures don't leave the failed open files behind. + +It is hard to check the direct_IO op before creating the inode. Just as +ext4 and btrfs do, this patch will resolve the issue by allowing to +create the file with O_DIRECT but returning error when writing the file. + +Link: https://lkml.kernel.org/r/20220107133626.413379-1-qhjin.dev@gmail.com +Signed-off-by: Qinghua Jin +Reported-by: Colin Ian King +Reviewed-by: Jan Kara +Acked-by: Christian Brauner +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 34f546404aa1..e938f5b1e4b9 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -446,7 +446,8 @@ static const struct address_space_operations minix_aops = { + .writepage = minix_writepage, + .write_begin = minix_write_begin, + .write_end = generic_write_end, +- .bmap = minix_bmap ++ .bmap = minix_bmap, ++ .direct_IO = noop_direct_IO + }; + + static const struct inode_operations minix_symlink_inode_operations = { +-- +2.35.1 + diff --git a/queue-5.10/mips-fix-fortify-panic-when-copying-asm-exception-ha.patch b/queue-5.10/mips-fix-fortify-panic-when-copying-asm-exception-ha.patch new file mode 100644 index 00000000000..1e79c523aa0 --- /dev/null +++ b/queue-5.10/mips-fix-fortify-panic-when-copying-asm-exception-ha.patch @@ -0,0 +1,99 @@ +From c9b36b1c642f9236b3cecc8f9b683757bef4cd40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Feb 2022 01:30:23 +0000 +Subject: MIPS: fix fortify panic when copying asm exception handlers + +From: Alexander Lobakin + +[ Upstream commit d17b66417308996e7e64b270a3c7f3c1fbd4cfc8 ] + +With KCFLAGS="-O3", I was able to trigger a fortify-source +memcpy() overflow panic on set_vi_srs_handler(). +Although O3 level is not supported in the mainline, under some +conditions that may've happened with any optimization settings, +it's just a matter of inlining luck. The panic itself is correct, +more precisely, 50/50 false-positive and not at the same time. +From the one side, no real overflow happens. Exception handler +defined in asm just gets copied to some reserved places in the +memory. +But the reason behind is that C code refers to that exception +handler declares it as `char`, i.e. something of 1 byte length. +It's obvious that the asm function itself is way more than 1 byte, +so fortify logics thought we are going to past the symbol declared. +The standard way to refer to asm symbols from C code which is not +supposed to be called from C is to declare them as +`extern const u8[]`. This is fully correct from any point of view, +as any code itself is just a bunch of bytes (including 0 as it is +for syms like _stext/_etext/etc.), and the exact size is not known +at the moment of compilation. +Adjust the type of the except_vec_vi_*() and related variables. +Make set_handler() take `const` as a second argument to avoid +cast-away warnings and give a little more room for optimization. + +Signed-off-by: Alexander Lobakin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/setup.h | 2 +- + arch/mips/kernel/traps.c | 22 +++++++++++----------- + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h +index bb36a400203d..8c56b862fd9c 100644 +--- a/arch/mips/include/asm/setup.h ++++ b/arch/mips/include/asm/setup.h +@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, + unsigned int reg_shift, unsigned int timeout) {} + #endif + +-extern void set_handler(unsigned long offset, void *addr, unsigned long len); ++void set_handler(unsigned long offset, const void *addr, unsigned long len); + extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); + + typedef void (*vi_handler_t)(void); +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index e0352958e2f7..b1fe4518bd22 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2097,19 +2097,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) + * If no shadow set is selected then use the default handler + * that does normal register saving and standard interrupt exit + */ +- extern char except_vec_vi, except_vec_vi_lui; +- extern char except_vec_vi_ori, except_vec_vi_end; +- extern char rollback_except_vec_vi; +- char *vec_start = using_rollback_handler() ? +- &rollback_except_vec_vi : &except_vec_vi; ++ extern const u8 except_vec_vi[], except_vec_vi_lui[]; ++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; ++ extern const u8 rollback_except_vec_vi[]; ++ const u8 *vec_start = using_rollback_handler() ? ++ rollback_except_vec_vi : except_vec_vi; + #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) +- const int lui_offset = &except_vec_vi_lui - vec_start + 2; +- const int ori_offset = &except_vec_vi_ori - vec_start + 2; ++ const int lui_offset = except_vec_vi_lui - vec_start + 2; ++ const int ori_offset = except_vec_vi_ori - vec_start + 2; + #else +- const int lui_offset = &except_vec_vi_lui - vec_start; +- const int ori_offset = &except_vec_vi_ori - vec_start; ++ const int lui_offset = except_vec_vi_lui - vec_start; ++ const int ori_offset = except_vec_vi_ori - vec_start; + #endif +- const int handler_len = &except_vec_vi_end - vec_start; ++ const int handler_len = except_vec_vi_end - vec_start; + + if (handler_len > VECTORSPACING) { + /* +@@ -2317,7 +2317,7 @@ void per_cpu_trap_init(bool is_boot_cpu) + } + + /* Install CPU exception handler */ +-void set_handler(unsigned long offset, void *addr, unsigned long size) ++void set_handler(unsigned long offset, const void *addr, unsigned long size) + { + #ifdef CONFIG_CPU_MICROMIPS + memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); +-- +2.35.1 + diff --git a/queue-5.10/mips-ingenic-correct-unit-node-address.patch b/queue-5.10/mips-ingenic-correct-unit-node-address.patch new file mode 100644 index 00000000000..c789e2788cf --- /dev/null +++ b/queue-5.10/mips-ingenic-correct-unit-node-address.patch @@ -0,0 +1,37 @@ +From b0b613f8f5d5d861180b6dd987807d9ce31bb17f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 12:52:59 +0100 +Subject: MIPS: ingenic: correct unit node address + +From: Krzysztof Kozlowski + +[ Upstream commit 8931ddd8d6a55fcefb20f44a38ba42bb746f0b62 ] + +Unit node addresses should not have leading 0x: + + Warning (unit_address_format): /nemc@13410000/efuse@d0/eth-mac-addr@0x22: unit name should not have leading "0x" + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/jz4780.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/boot/dts/ingenic/jz4780.dtsi b/arch/mips/boot/dts/ingenic/jz4780.dtsi +index dfb5a7e1bb21..830e5dd3550e 100644 +--- a/arch/mips/boot/dts/ingenic/jz4780.dtsi ++++ b/arch/mips/boot/dts/ingenic/jz4780.dtsi +@@ -429,7 +429,7 @@ + #address-cells = <1>; + #size-cells = <1>; + +- eth0_addr: eth-mac-addr@0x22 { ++ eth0_addr: eth-mac-addr@22 { + reg = <0x22 0x6>; + }; + }; +-- +2.35.1 + diff --git a/queue-5.10/mips-ralink-fix-a-refcount-leak-in-ill_acc_of_setup.patch b/queue-5.10/mips-ralink-fix-a-refcount-leak-in-ill_acc_of_setup.patch new file mode 100644 index 00000000000..b1458152512 --- /dev/null +++ b/queue-5.10/mips-ralink-fix-a-refcount-leak-in-ill_acc_of_setup.patch @@ -0,0 +1,33 @@ +From b58639ed4030cb14ecc55e7e9be2756016c00efa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 15:35:37 +0800 +Subject: mips: ralink: fix a refcount leak in ill_acc_of_setup() + +From: Hangyu Hua + +[ Upstream commit 4a0a1436053b17e50b7c88858fb0824326641793 ] + +of_node_put(np) needs to be called when pdev == NULL. + +Signed-off-by: Hangyu Hua +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/ralink/ill_acc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/ralink/ill_acc.c b/arch/mips/ralink/ill_acc.c +index bdf53807d7c2..bea857c9da8b 100644 +--- a/arch/mips/ralink/ill_acc.c ++++ b/arch/mips/ralink/ill_acc.c +@@ -61,6 +61,7 @@ static int __init ill_acc_of_setup(void) + pdev = of_find_device_by_node(np); + if (!pdev) { + pr_err("%pOFn: failed to lookup pdev\n", np); ++ of_node_put(np); + return -EINVAL; + } + +-- +2.35.1 + diff --git a/queue-5.10/mm-fix-race-between-madv_free-reclaim-and-blkdev-dir.patch b/queue-5.10/mm-fix-race-between-madv_free-reclaim-and-blkdev-dir.patch new file mode 100644 index 00000000000..4a3a8be31c8 --- /dev/null +++ b/queue-5.10/mm-fix-race-between-madv_free-reclaim-and-blkdev-dir.patch @@ -0,0 +1,463 @@ +From 6c55ae1fd3f561f0ec303422736d8698c923abeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 16:14:28 -0300 +Subject: mm: fix race between MADV_FREE reclaim and blkdev direct IO read + +From: Mauricio Faria de Oliveira + +commit 6c8e2a256915a223f6289f651d6b926cd7135c9e upstream. + +Problem: +======= + +Userspace might read the zero-page instead of actual data from a direct IO +read on a block device if the buffers have been called madvise(MADV_FREE) +on earlier (this is discussed below) due to a race between page reclaim on +MADV_FREE and blkdev direct IO read. + +- Race condition: + ============== + +During page reclaim, the MADV_FREE page check in try_to_unmap_one() checks +if the page is not dirty, then discards its rmap PTE(s) (vs. remap back +if the page is dirty). + +However, after try_to_unmap_one() returns to shrink_page_list(), it might +keep the page _anyway_ if page_ref_freeze() fails (it expects exactly +_one_ page reference, from the isolation for page reclaim). + +Well, blkdev_direct_IO() gets references for all pages, and on READ +operations it only sets them dirty _later_. + +So, if MADV_FREE'd pages (i.e., not dirty) are used as buffers for direct +IO read from block devices, and page reclaim happens during +__blkdev_direct_IO[_simple]() exactly AFTER bio_iov_iter_get_pages() +returns, but BEFORE the pages are set dirty, the situation happens. + +The direct IO read eventually completes. Now, when userspace reads the +buffers, the PTE is no longer there and the page fault handler +do_anonymous_page() services that with the zero-page, NOT the data! + +A synthetic reproducer is provided. + +- Page faults: + =========== + +If page reclaim happens BEFORE bio_iov_iter_get_pages() the issue doesn't +happen, because that faults-in all pages as writeable, so +do_anonymous_page() sets up a new page/rmap/PTE, and that is used by +direct IO. The userspace reads don't fault as the PTE is there (thus +zero-page is not used/setup). + +But if page reclaim happens AFTER it / BEFORE setting pages dirty, the PTE +is no longer there; the subsequent page faults can't help: + +The data-read from the block device probably won't generate faults due to +DMA (no MMU) but even in the case it wouldn't use DMA, that happens on +different virtual addresses (not user-mapped addresses) because `struct +bio_vec` stores `struct page` to figure addresses out (which are different +from user-mapped addresses) for the read. + +Thus userspace reads (to user-mapped addresses) still fault, then +do_anonymous_page() gets another `struct page` that would address/ map to +other memory than the `struct page` used by `struct bio_vec` for the read. +(The original `struct page` is not available, since it wasn't freed, as +page_ref_freeze() failed due to more page refs. And even if it were +available, its data cannot be trusted anymore.) + +Solution: +======== + +One solution is to check for the expected page reference count in +try_to_unmap_one(). + +There should be one reference from the isolation (that is also checked in +shrink_page_list() with page_ref_freeze()) plus one or more references +from page mapping(s) (put in discard: label). Further references mean +that rmap/PTE cannot be unmapped/nuked. + +(Note: there might be more than one reference from mapping due to +fork()/clone() without CLONE_VM, which use the same `struct page` for +references, until the copy-on-write page gets copied.) + +So, additional page references (e.g., from direct IO read) now prevent the +rmap/PTE from being unmapped/dropped; similarly to the page is not freed +per shrink_page_list()/page_ref_freeze()). + +- Races and Barriers: + ================== + +The new check in try_to_unmap_one() should be safe in races with +bio_iov_iter_get_pages() in get_user_pages() fast and slow paths, as it's +done under the PTE lock. + +The fast path doesn't take the lock, but it checks if the PTE has changed +and if so, it drops the reference and leaves the page for the slow path +(which does take that lock). + +The fast path requires synchronization w/ full memory barrier: it writes +the page reference count first then it reads the PTE later, while +try_to_unmap() writes PTE first then it reads page refcount. + +And a second barrier is needed, as the page dirty flag should not be read +before the page reference count (as in __remove_mapping()). (This can be +a load memory barrier only; no writes are involved.) + +Call stack/comments: + +- try_to_unmap_one() + - page_vma_mapped_walk() + - map_pte() # see pte_offset_map_lock(): + pte_offset_map() + spin_lock() + + - ptep_get_and_clear() # write PTE + - smp_mb() # (new barrier) GUP fast path + - page_ref_count() # (new check) read refcount + + - page_vma_mapped_walk_done() # see pte_unmap_unlock(): + pte_unmap() + spin_unlock() + +- bio_iov_iter_get_pages() + - __bio_iov_iter_get_pages() + - iov_iter_get_pages() + - get_user_pages_fast() + - internal_get_user_pages_fast() + + # fast path + - lockless_pages_from_mm() + - gup_{pgd,p4d,pud,pmd,pte}_range() + ptep = pte_offset_map() # not _lock() + pte = ptep_get_lockless(ptep) + + page = pte_page(pte) + try_grab_compound_head(page) # inc refcount + # (RMW/barrier + # on success) + + if (pte_val(pte) != pte_val(*ptep)) # read PTE + put_compound_head(page) # dec refcount + # go slow path + + # slow path + - __gup_longterm_unlocked() + - get_user_pages_unlocked() + - __get_user_pages_locked() + - __get_user_pages() + - follow_{page,p4d,pud,pmd}_mask() + - follow_page_pte() + ptep = pte_offset_map_lock() + pte = *ptep + page = vm_normal_page(pte) + try_grab_page(page) # inc refcount + pte_unmap_unlock() + +- Huge Pages: + ========== + +Regarding transparent hugepages, that logic shouldn't change, as MADV_FREE +(aka lazyfree) pages are PageAnon() && !PageSwapBacked() +(madvise_free_pte_range() -> mark_page_lazyfree() -> lru_lazyfree_fn()) +thus should reach shrink_page_list() -> split_huge_page_to_list() before +try_to_unmap[_one](), so it deals with normal pages only. + +(And in case unlikely/TTU_SPLIT_HUGE_PMD/split_huge_pmd_address() happens, +which should not or be rare, the page refcount should be greater than +mapcount: the head page is referenced by tail pages. That also prevents +checking the head `page` then incorrectly call page_remove_rmap(subpage) +for a tail page, that isn't even in the shrink_page_list()'s page_list (an +effect of split huge pmd/pmvw), as it might happen today in this unlikely +scenario.) + +MADV_FREE'd buffers: +=================== + +So, back to the "if MADV_FREE pages are used as buffers" note. The case +is arguable, and subject to multiple interpretations. + +The madvise(2) manual page on the MADV_FREE advice value says: + +1) 'After a successful MADV_FREE ... data will be lost when + the kernel frees the pages.' +2) 'the free operation will be canceled if the caller writes + into the page' / 'subsequent writes ... will succeed and + then [the] kernel cannot free those dirtied pages' +3) 'If there is no subsequent write, the kernel can free the + pages at any time.' + +Thoughts, questions, considerations... respectively: + +1) Since the kernel didn't actually free the page (page_ref_freeze() + failed), should the data not have been lost? (on userspace read.) +2) Should writes performed by the direct IO read be able to cancel + the free operation? + - Should the direct IO read be considered as 'the caller' too, + as it's been requested by 'the caller'? + - Should the bio technique to dirty pages on return to userspace + (bio_check_pages_dirty() is called/used by __blkdev_direct_IO()) + be considered in another/special way here? +3) Should an upcoming write from a previously requested direct IO + read be considered as a subsequent write, so the kernel should + not free the pages? (as it's known at the time of page reclaim.) + +And lastly: + +Technically, the last point would seem a reasonable consideration and +balance, as the madvise(2) manual page apparently (and fairly) seem to +assume that 'writes' are memory access from the userspace process (not +explicitly considering writes from the kernel or its corner cases; again, +fairly).. plus the kernel fix implementation for the corner case of the +largely 'non-atomic write' encompassed by a direct IO read operation, is +relatively simple; and it helps. + +Reproducer: +========== + +@ test.c (simplified, but works) + + #define _GNU_SOURCE + #include + #include + #include + #include + + int main() { + int fd, i; + char *buf; + + fd = open(DEV, O_RDONLY | O_DIRECT); + + buf = mmap(NULL, BUF_SIZE, PROT_READ | PROT_WRITE, + MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + + for (i = 0; i < BUF_SIZE; i += PAGE_SIZE) + buf[i] = 1; // init to non-zero + + madvise(buf, BUF_SIZE, MADV_FREE); + + read(fd, buf, BUF_SIZE); + + for (i = 0; i < BUF_SIZE; i += PAGE_SIZE) + printf("%p: 0x%x\n", &buf[i], buf[i]); + + return 0; + } + +@ block/fops.c (formerly fs/block_dev.c) + + +#include + ... + ... __blkdev_direct_IO[_simple](...) + { + ... + + if (!strcmp(current->comm, "good")) + + shrink_all_memory(ULONG_MAX); + + + ret = bio_iov_iter_get_pages(...); + + + + if (!strcmp(current->comm, "bad")) + + shrink_all_memory(ULONG_MAX); + ... + } + +@ shell + + # NUM_PAGES=4 + # PAGE_SIZE=$(getconf PAGE_SIZE) + + # yes | dd of=test.img bs=${PAGE_SIZE} count=${NUM_PAGES} + # DEV=$(losetup -f --show test.img) + + # gcc -DDEV=\"$DEV\" \ + -DBUF_SIZE=$((PAGE_SIZE * NUM_PAGES)) \ + -DPAGE_SIZE=${PAGE_SIZE} \ + test.c -o test + + # od -tx1 $DEV + 0000000 79 0a 79 0a 79 0a 79 0a 79 0a 79 0a 79 0a 79 0a + * + 0040000 + + # mv test good + # ./good + 0x7f7c10418000: 0x79 + 0x7f7c10419000: 0x79 + 0x7f7c1041a000: 0x79 + 0x7f7c1041b000: 0x79 + + # mv good bad + # ./bad + 0x7fa1b8050000: 0x0 + 0x7fa1b8051000: 0x0 + 0x7fa1b8052000: 0x0 + 0x7fa1b8053000: 0x0 + +Note: the issue is consistent on v5.17-rc3, but it's intermittent with the +support of MADV_FREE on v4.5 (60%-70% error; needs swap). [wrap +do_direct_IO() in do_blockdev_direct_IO() @ fs/direct-io.c]. + +- v5.17-rc3: + + # for i in {1..1000}; do ./good; done \ + | cut -d: -f2 | sort | uniq -c + 4000 0x79 + + # mv good bad + # for i in {1..1000}; do ./bad; done \ + | cut -d: -f2 | sort | uniq -c + 4000 0x0 + + # free | grep Swap + Swap: 0 0 0 + +- v4.5: + + # for i in {1..1000}; do ./good; done \ + | cut -d: -f2 | sort | uniq -c + 4000 0x79 + + # mv good bad + # for i in {1..1000}; do ./bad; done \ + | cut -d: -f2 | sort | uniq -c + 2702 0x0 + 1298 0x79 + + # swapoff -av + swapoff /swap + + # for i in {1..1000}; do ./bad; done \ + | cut -d: -f2 | sort | uniq -c + 4000 0x79 + +Ceph/TCMalloc: +============= + +For documentation purposes, the use case driving the analysis/fix is Ceph +on Ubuntu 18.04, as the TCMalloc library there still uses MADV_FREE to +release unused memory to the system from the mmap'ed page heap (might be +committed back/used again; it's not munmap'ed.) - PageHeap::DecommitSpan() +-> TCMalloc_SystemRelease() -> madvise() - PageHeap::CommitSpan() -> +TCMalloc_SystemCommit() -> do nothing. + +Note: TCMalloc switched back to MADV_DONTNEED a few commits after the +release in Ubuntu 18.04 (google-perftools/gperftools 2.5), so the issue +just 'disappeared' on Ceph on later Ubuntu releases but is still present +in the kernel, and can be hit by other use cases. + +The observed issue seems to be the old Ceph bug #22464 [1], where checksum +mismatches are observed (and instrumentation with buffer dumps shows +zero-pages read from mmap'ed/MADV_FREE'd page ranges). + +The issue in Ceph was reasonably deemed a kernel bug (comment #50) and +mostly worked around with a retry mechanism, but other parts of Ceph could +still hit that (rocksdb). Anyway, it's less likely to be hit again as +TCMalloc switched out of MADV_FREE by default. + +(Some kernel versions/reports from the Ceph bug, and relation with +the MADV_FREE introduction/changes; TCMalloc versions not checked.) +- 4.4 good +- 4.5 (madv_free: introduction) +- 4.9 bad +- 4.10 good? maybe a swapless system +- 4.12 (madv_free: no longer free instantly on swapless systems) +- 4.13 bad + +[1] https://tracker.ceph.com/issues/22464 + +Thanks: +====== + +Several people contributed to analysis/discussions/tests/reproducers in +the first stages when drilling down on ceph/tcmalloc/linux kernel: + +- Dan Hill +- Dan Streetman +- Dongdong Tao +- Gavin Guo +- Gerald Yang +- Heitor Alves de Siqueira +- Ioanna Alifieraki +- Jay Vosburgh +- Matthew Ruffell +- Ponnuvel Palaniyappan + +Reviews, suggestions, corrections, comments: + +- Minchan Kim +- Yu Zhao +- Huang, Ying +- John Hubbard +- Christoph Hellwig + +[mfo@canonical.com: v4] + Link: https://lkml.kernel.org/r/20220209202659.183418-1-mfo@canonical.comLink: https://lkml.kernel.org/r/20220131230255.789059-1-mfo@canonical.com + +Fixes: 802a3a92ad7a ("mm: reclaim MADV_FREE pages") +Signed-off-by: Mauricio Faria de Oliveira +Reviewed-by: "Huang, Ying" +Cc: Minchan Kim +Cc: Yu Zhao +Cc: Yang Shi +Cc: Miaohe Lin +Cc: Dan Hill +Cc: Dan Streetman +Cc: Dongdong Tao +Cc: Gavin Guo +Cc: Gerald Yang +Cc: Heitor Alves de Siqueira +Cc: Ioanna Alifieraki +Cc: Jay Vosburgh +Cc: Matthew Ruffell +Cc: Ponnuvel Palaniyappan +Cc: +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +[mfo: backport: replace folio/test_flag with page/flag equivalents; + real Fixes: 854e9ed09ded ("mm: support madvise(MADV_FREE)") in v4.] +Signed-off-by: Mauricio Faria de Oliveira +Signed-off-by: Sasha Levin +--- + mm/rmap.c | 25 ++++++++++++++++++++++++- + 1 file changed, 24 insertions(+), 1 deletion(-) + +diff --git a/mm/rmap.c b/mm/rmap.c +index 14f84f70c557..44ad7bf2e563 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1640,7 +1640,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + + /* MADV_FREE page check */ + if (!PageSwapBacked(page)) { +- if (!PageDirty(page)) { ++ int ref_count, map_count; ++ ++ /* ++ * Synchronize with gup_pte_range(): ++ * - clear PTE; barrier; read refcount ++ * - inc refcount; barrier; read PTE ++ */ ++ smp_mb(); ++ ++ ref_count = page_ref_count(page); ++ map_count = page_mapcount(page); ++ ++ /* ++ * Order reads for page refcount and dirty flag ++ * (see comments in __remove_mapping()). ++ */ ++ smp_rmb(); ++ ++ /* ++ * The only page refs must be one from isolation ++ * plus the rmap(s) (dropped by discard:). ++ */ ++ if (ref_count == 1 + map_count && ++ !PageDirty(page)) { + /* Invalidate as we cleared the pte */ + mmu_notifier_invalidate_range(mm, + address, address + PAGE_SIZE); +-- +2.35.1 + diff --git a/queue-5.10/mt76-dma-initialize-skip_unmap-in-mt76_dma_rx_fill.patch b/queue-5.10/mt76-dma-initialize-skip_unmap-in-mt76_dma_rx_fill.patch new file mode 100644 index 00000000000..5fc5f0fb062 --- /dev/null +++ b/queue-5.10/mt76-dma-initialize-skip_unmap-in-mt76_dma_rx_fill.patch @@ -0,0 +1,89 @@ +From 6cb9fa76dca1ad7886d735e8e716bf30237c52ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 12:29:55 +0100 +Subject: mt76: dma: initialize skip_unmap in mt76_dma_rx_fill + +From: Lorenzo Bianconi + +[ Upstream commit 577298ec55dfc8b9aece54520f0258c3f93a6573 ] + +Even if it is only a false-positive since skip_buf0/skip_buf1 are only +used in mt76_dma_tx_cleanup_idx routine, initialize skip_unmap in +mt76_dma_rx_fill in order to fix the following UBSAN report: + +[ 13.924906] UBSAN: invalid-load in linux-5.15.0/drivers/net/wireless/mediatek/mt76/dma.c:162:13 +[ 13.924909] load of value 225 is not a valid value for type '_Bool' +[ 13.924912] CPU: 9 PID: 672 Comm: systemd-udevd Not tainted 5.15.0-18-generic #18-Ubuntu +[ 13.924914] Hardware name: LENOVO 21A0000CMX/21A0000CMX, BIOS R1MET43W (1.13 ) 11/05/2021 +[ 13.924915] Call Trace: +[ 13.924917] +[ 13.924920] show_stack+0x52/0x58 +[ 13.924925] dump_stack_lvl+0x4a/0x5f +[ 13.924931] dump_stack+0x10/0x12 +[ 13.924932] ubsan_epilogue+0x9/0x45 +[ 13.924934] __ubsan_handle_load_invalid_value.cold+0x44/0x49 +[ 13.924935] ? __iommu_dma_map+0x84/0xf0 +[ 13.924939] mt76_dma_add_buf.constprop.0.cold+0x23/0x85 [mt76] +[ 13.924949] mt76_dma_rx_fill.isra.0+0x102/0x1f0 [mt76] +[ 13.924954] mt76_dma_init+0xc9/0x150 [mt76] +[ 13.924959] ? mt7921_dma_enable+0x110/0x110 [mt7921e] +[ 13.924966] mt7921_dma_init+0x1e3/0x260 [mt7921e] +[ 13.924970] mt7921_register_device+0x29d/0x510 [mt7921e] +[ 13.924975] mt7921_pci_probe.part.0+0x17f/0x1b0 [mt7921e] +[ 13.924980] mt7921_pci_probe+0x43/0x60 [mt7921e] +[ 13.924984] local_pci_probe+0x4b/0x90 +[ 13.924987] pci_device_probe+0x115/0x1f0 +[ 13.924989] really_probe+0x21e/0x420 +[ 13.924992] __driver_probe_device+0x115/0x190 +[ 13.924994] driver_probe_device+0x23/0xc0 +[ 13.924996] __driver_attach+0xbd/0x1d0 +[ 13.924998] ? __device_attach_driver+0x110/0x110 +[ 13.924999] bus_for_each_dev+0x7e/0xc0 +[ 13.925001] driver_attach+0x1e/0x20 +[ 13.925003] bus_add_driver+0x135/0x200 +[ 13.925005] driver_register+0x95/0xf0 +[ 13.925008] ? 0xffffffffc0766000 +[ 13.925010] __pci_register_driver+0x68/0x70 +[ 13.925011] mt7921_pci_driver_init+0x23/0x1000 [mt7921e] +[ 13.925015] do_one_initcall+0x48/0x1d0 +[ 13.925019] ? kmem_cache_alloc_trace+0x19e/0x2e0 +[ 13.925022] do_init_module+0x62/0x280 +[ 13.925025] load_module+0xac9/0xbb0 +[ 13.925027] __do_sys_finit_module+0xbf/0x120 +[ 13.925029] __x64_sys_finit_module+0x18/0x20 +[ 13.925030] do_syscall_64+0x5c/0xc0 +[ 13.925033] ? do_syscall_64+0x69/0xc0 +[ 13.925034] ? sysvec_reschedule_ipi+0x78/0xe0 +[ 13.925036] ? asm_sysvec_reschedule_ipi+0xa/0x20 +[ 13.925039] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 13.925040] RIP: 0033:0x7fbf2b90f94d +[ 13.925045] RSP: 002b:00007ffe2ec7e5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 13.925047] RAX: ffffffffffffffda RBX: 000056106b0634e0 RCX: 00007fbf2b90f94d +[ 13.925048] RDX: 0000000000000000 RSI: 00007fbf2baa3441 RDI: 0000000000000013 +[ 13.925049] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000002 +[ 13.925050] R10: 0000000000000013 R11: 0000000000000246 R12: 00007fbf2baa3441 +[ 13.925051] R13: 000056106b062620 R14: 000056106b0610c0 R15: 000056106b0640d0 +[ 13.925053] + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/dma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 0fdfead45c77..f01b455783b2 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -455,6 +455,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q) + + qbuf.addr = addr + offset; + qbuf.len = len - offset; ++ qbuf.skip_unmap = false; + mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL); + frames++; + } +-- +2.35.1 + diff --git a/queue-5.10/mt76-mt7615-fix-assigning-negative-values-to-unsigne.patch b/queue-5.10/mt76-mt7615-fix-assigning-negative-values-to-unsigne.patch new file mode 100644 index 00000000000..7ed547c687d --- /dev/null +++ b/queue-5.10/mt76-mt7615-fix-assigning-negative-values-to-unsigne.patch @@ -0,0 +1,41 @@ +From 05e7aa7b64d5b3457d6ba17ed4324b0c3a1046dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 09:58:21 +0800 +Subject: mt76: mt7615: Fix assigning negative values to unsigned variable + +From: Yang Li + +[ Upstream commit 9273ffcc9a11942bd586bb42584337ef3962b692 ] + +Smatch reports the following: +drivers/net/wireless/mediatek/mt76/mt7615/mac.c:1865 +mt7615_mac_adjust_sensitivity() warn: assigning (-110) to unsigned +variable 'def_th' +drivers/net/wireless/mediatek/mt76/mt7615/mac.c:1865 +mt7615_mac_adjust_sensitivity() warn: assigning (-98) to unsigned +variable 'def_th' + +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 424be103093c..1465a92ea3fc 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -1626,7 +1626,7 @@ mt7615_mac_adjust_sensitivity(struct mt7615_phy *phy, + struct mt7615_dev *dev = phy->dev; + int false_cca = ofdm ? phy->false_cca_ofdm : phy->false_cca_cck; + bool ext_phy = phy != &dev->phy; +- u16 def_th = ofdm ? -98 : -110; ++ s16 def_th = ofdm ? -98 : -110; + bool update = false; + s8 *sensitivity; + int signal; +-- +2.35.1 + diff --git a/queue-5.10/net-account-alternate-interface-name-memory.patch b/queue-5.10/net-account-alternate-interface-name-memory.patch new file mode 100644 index 00000000000..adcd35af0b2 --- /dev/null +++ b/queue-5.10/net-account-alternate-interface-name-memory.patch @@ -0,0 +1,35 @@ +From aef840fd2eba8687371c394284cb4139e612361e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 10:29:13 -0800 +Subject: net: account alternate interface name memory + +From: Jakub Kicinski + +[ Upstream commit 5d26cff5bdbebdf98ba48217c078ff102536f134 ] + +George reports that altnames can eat up kernel memory. +We should charge that memory appropriately. + +Reported-by: George Shuklin +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 9ff6d4160dab..77b3d9cc08a1 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3632,7 +3632,7 @@ static int rtnl_alt_ifname(int cmd, struct net_device *dev, struct nlattr *attr, + if (err) + return err; + +- alt_ifname = nla_strdup(attr, GFP_KERNEL); ++ alt_ifname = nla_strdup(attr, GFP_KERNEL_ACCOUNT); + if (!alt_ifname) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-5.10/net-limit-altnames-to-64k-total.patch b/queue-5.10/net-limit-altnames-to-64k-total.patch new file mode 100644 index 00000000000..093a3e47c5f --- /dev/null +++ b/queue-5.10/net-limit-altnames-to-64k-total.patch @@ -0,0 +1,57 @@ +From 52c371d6ee7ac112d27a03e267a33b77de0ea85b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 10:29:14 -0800 +Subject: net: limit altnames to 64k total + +From: Jakub Kicinski + +[ Upstream commit 155fb43b70b5fce341347a77d1af2765d1e8fbb8 ] + +Property list (altname is a link "property") is wrapped +in a nlattr. nlattrs length is 16bit so practically +speaking the list of properties can't be longer than +that, otherwise user space would have to interpret +broken netlink messages. + +Prevent the problem from occurring by checking the length +of the property list before adding new entries. + +Reported-by: George Shuklin +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 77b3d9cc08a1..873081cda950 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -3626,12 +3626,23 @@ static int rtnl_alt_ifname(int cmd, struct net_device *dev, struct nlattr *attr, + bool *changed, struct netlink_ext_ack *extack) + { + char *alt_ifname; ++ size_t size; + int err; + + err = nla_validate(attr, attr->nla_len, IFLA_MAX, ifla_policy, extack); + if (err) + return err; + ++ if (cmd == RTM_NEWLINKPROP) { ++ size = rtnl_prop_list_size(dev); ++ size += nla_total_size(ALTIFNAMSIZ); ++ if (size >= U16_MAX) { ++ NL_SET_ERR_MSG(extack, ++ "effective property list too long"); ++ return -EINVAL; ++ } ++ } ++ + alt_ifname = nla_strdup(attr, GFP_KERNEL_ACCOUNT); + if (!alt_ifname) + return -ENOMEM; +-- +2.35.1 + diff --git a/queue-5.10/net-sfp-add-2500base-x-quirk-for-lantech-sfp-module.patch b/queue-5.10/net-sfp-add-2500base-x-quirk-for-lantech-sfp-module.patch new file mode 100644 index 00000000000..7127672407e --- /dev/null +++ b/queue-5.10/net-sfp-add-2500base-x-quirk-for-lantech-sfp-module.patch @@ -0,0 +1,53 @@ +From ef262c018b908ea48de3086b100d5ac4c1b45560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Mar 2022 21:50:14 +0100 +Subject: net: sfp: add 2500base-X quirk for Lantech SFP module + +From: Michael Walle + +[ Upstream commit 00eec9fe4f3b9588b4bfa8ef9dd0aae96407d5d7 ] + +The Lantech 8330-262D-E module is 2500base-X capable, but it reports the +nominal bitrate as 2500MBd instead of 3125MBd. Add a quirk for the +module. + +The following in an EEPROM dump of such a SFP with the serial number +redacted: + +00: 03 04 07 00 00 00 01 20 40 0c 05 01 19 00 00 00 ???...? @????... +10: 1e 0f 00 00 4c 61 6e 74 65 63 68 20 20 20 20 20 ??..Lantech +20: 20 20 20 20 00 00 00 00 38 33 33 30 2d 32 36 32 ....8330-262 +30: 44 2d 45 20 20 20 20 20 56 31 2e 30 03 52 00 cb D-E V1.0?R.? +40: 00 1a 00 00 46 43 XX XX XX XX XX XX XX XX XX XX .?..FCXXXXXXXXXX +50: 20 20 20 20 32 32 30 32 31 34 20 20 68 b0 01 98 220214 h??? +60: 45 58 54 52 45 4d 45 4c 59 20 43 4f 4d 50 41 54 EXTREMELY COMPAT +70: 49 42 4c 45 20 20 20 20 20 20 20 20 20 20 20 20 IBLE + +Signed-off-by: Michael Walle +Link: https://lore.kernel.org/r/20220312205014.4154907-1-michael@walle.cc +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp-bus.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c +index a05d8372669c..850915a37f4c 100644 +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -74,6 +74,12 @@ static const struct sfp_quirk sfp_quirks[] = { + .vendor = "HUAWEI", + .part = "MA5671A", + .modes = sfp_quirk_2500basex, ++ }, { ++ // Lantech 8330-262D-E can operate at 2500base-X, but ++ // incorrectly report 2500MBd NRZ in their EEPROM ++ .vendor = "Lantech", ++ .part = "8330-262D-E", ++ .modes = sfp_quirk_2500basex, + }, { + .vendor = "UBNT", + .part = "UF-INSTANT", +-- +2.35.1 + diff --git a/queue-5.10/net-smc-correct-settings-of-rmb-window-update-limit.patch b/queue-5.10/net-smc-correct-settings-of-rmb-window-update-limit.patch new file mode 100644 index 00000000000..89760fcbcf0 --- /dev/null +++ b/queue-5.10/net-smc-correct-settings-of-rmb-window-update-limit.patch @@ -0,0 +1,52 @@ +From 00e8feafc284637153cdd9c99ea014a52972b404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 17:44:00 +0800 +Subject: net/smc: correct settings of RMB window update limit + +From: Dust Li + +[ Upstream commit 6bf536eb5c8ca011d1ff57b5c5f7c57ceac06a37 ] + +rmbe_update_limit is used to limit announcing receive +window updating too frequently. RFC7609 request a minimal +increase in the window size of 10% of the receive buffer +space. But current implementation used: + + min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2) + +and SOCK_MIN_SNDBUF / 2 == 2304 Bytes, which is almost +always less then 10% of the receive buffer space. + +This causes the receiver always sending CDC message to +update its consumer cursor when it consumes more then 2K +of data. And as a result, we may encounter something like +"TCP silly window syndrome" when sending 2.5~8K message. + +This patch fixes this using max(rmbe_size / 10, SOCK_MIN_SNDBUF / 2). + +With this patch and SMC autocorking enabled, qperf 2K/4K/8K +tcp_bw test shows 45%/75%/40% increase in throughput respectively. + +Signed-off-by: Dust Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index d69aac6c1fce..ef2fd28999ba 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1426,7 +1426,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, + */ + static inline int smc_rmb_wnd_update_limit(int rmbe_size) + { +- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); ++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); + } + + /* map an rmb buf to a link */ +-- +2.35.1 + diff --git a/queue-5.10/netlabel-fix-out-of-bounds-memory-accesses.patch b/queue-5.10/netlabel-fix-out-of-bounds-memory-accesses.patch new file mode 100644 index 00000000000..f7ad0a017f2 --- /dev/null +++ b/queue-5.10/netlabel-fix-out-of-bounds-memory-accesses.patch @@ -0,0 +1,70 @@ +From 9181b1f55c0ce926daaebb09271a569c4db61b15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 14:35:08 +0800 +Subject: netlabel: fix out-of-bounds memory accesses + +From: Wang Yufen + +[ Upstream commit f22881de730ebd472e15bcc2c0d1d46e36a87b9c ] + +In calipso_map_cat_ntoh(), in the for loop, if the return value of +netlbl_bitmap_walk() is equal to (net_clen_bits - 1), when +netlbl_bitmap_walk() is called next time, out-of-bounds memory accesses +of bitmap[byte_offset] occurs. + +The bug was found during fuzzing. The following is the fuzzing report + BUG: KASAN: slab-out-of-bounds in netlbl_bitmap_walk+0x3c/0xd0 + Read of size 1 at addr ffffff8107bf6f70 by task err_OH/252 + + CPU: 7 PID: 252 Comm: err_OH Not tainted 5.17.0-rc7+ #17 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x21c/0x230 + show_stack+0x1c/0x60 + dump_stack_lvl+0x64/0x7c + print_address_description.constprop.0+0x70/0x2d0 + __kasan_report+0x158/0x16c + kasan_report+0x74/0x120 + __asan_load1+0x80/0xa0 + netlbl_bitmap_walk+0x3c/0xd0 + calipso_opt_getattr+0x1a8/0x230 + calipso_sock_getattr+0x218/0x340 + calipso_sock_getattr+0x44/0x60 + netlbl_sock_getattr+0x44/0x80 + selinux_netlbl_socket_setsockopt+0x138/0x170 + selinux_socket_setsockopt+0x4c/0x60 + security_socket_setsockopt+0x4c/0x90 + __sys_setsockopt+0xbc/0x2b0 + __arm64_sys_setsockopt+0x6c/0x84 + invoke_syscall+0x64/0x190 + el0_svc_common.constprop.0+0x88/0x200 + do_el0_svc+0x88/0xa0 + el0_svc+0x128/0x1b0 + el0t_64_sync_handler+0x9c/0x120 + el0t_64_sync+0x16c/0x170 + +Reported-by: Hulk Robot +Signed-off-by: Wang Yufen +Acked-by: Paul Moore +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlabel/netlabel_kapi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c +index 5e1239cef000..91b35b7c80d8 100644 +--- a/net/netlabel/netlabel_kapi.c ++++ b/net/netlabel/netlabel_kapi.c +@@ -885,6 +885,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, + unsigned char bitmask; + unsigned char byte; + ++ if (offset >= bitmap_len) ++ return -1; + byte_offset = offset / 8; + byte = bitmap[byte_offset]; + bit_spot = offset; +-- +2.35.1 + diff --git a/queue-5.10/nfs-avoid-writeback-threads-getting-stuck-in-mempool.patch b/queue-5.10/nfs-avoid-writeback-threads-getting-stuck-in-mempool.patch new file mode 100644 index 00000000000..cee170fa061 --- /dev/null +++ b/queue-5.10/nfs-avoid-writeback-threads-getting-stuck-in-mempool.patch @@ -0,0 +1,80 @@ +From 86efb59e5dd8d1d4111a946b5f73d9cf129aadfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 13:48:36 -0400 +Subject: NFS: Avoid writeback threads getting stuck in mempool_alloc() + +From: Trond Myklebust + +[ Upstream commit 0bae835b63c53f86cdc524f5962e39409585b22c ] + +In a low memory situation, allow the NFS writeback code to fail without +getting stuck in infinite loops in mempool_alloc(). + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pagelist.c | 10 +++++----- + fs/nfs/write.c | 10 ++++++++-- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 98b9c1ed366e..17fef6eb490c 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -90,10 +90,10 @@ void nfs_set_pgio_error(struct nfs_pgio_header *hdr, int error, loff_t pos) + } + } + +-static inline struct nfs_page * +-nfs_page_alloc(void) ++static inline struct nfs_page *nfs_page_alloc(void) + { +- struct nfs_page *p = kmem_cache_zalloc(nfs_page_cachep, GFP_KERNEL); ++ struct nfs_page *p = ++ kmem_cache_zalloc(nfs_page_cachep, nfs_io_gfp_mask()); + if (p) + INIT_LIST_HEAD(&p->wb_list); + return p; +@@ -901,7 +901,7 @@ int nfs_generic_pgio(struct nfs_pageio_descriptor *desc, + struct nfs_commit_info cinfo; + struct nfs_page_array *pg_array = &hdr->page_array; + unsigned int pagecount, pageused; +- gfp_t gfp_flags = GFP_KERNEL; ++ gfp_t gfp_flags = nfs_io_gfp_mask(); + + pagecount = nfs_page_array_len(mirror->pg_base, mirror->pg_count); + pg_array->npages = pagecount; +@@ -984,7 +984,7 @@ nfs_pageio_alloc_mirrors(struct nfs_pageio_descriptor *desc, + desc->pg_mirrors_dynamic = NULL; + if (mirror_count == 1) + return desc->pg_mirrors_static; +- ret = kmalloc_array(mirror_count, sizeof(*ret), GFP_KERNEL); ++ ret = kmalloc_array(mirror_count, sizeof(*ret), nfs_io_gfp_mask()); + if (ret != NULL) { + for (i = 0; i < mirror_count; i++) + nfs_pageio_mirror_init(&ret[i], desc->pg_bsize); +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index a97eaf4e813c..5d07799513a6 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -94,9 +94,15 @@ EXPORT_SYMBOL_GPL(nfs_commit_free); + + static struct nfs_pgio_header *nfs_writehdr_alloc(void) + { +- struct nfs_pgio_header *p = mempool_alloc(nfs_wdata_mempool, GFP_KERNEL); ++ struct nfs_pgio_header *p; + +- memset(p, 0, sizeof(*p)); ++ p = kmem_cache_zalloc(nfs_wdata_cachep, nfs_io_gfp_mask()); ++ if (!p) { ++ p = mempool_alloc(nfs_wdata_mempool, GFP_NOWAIT); ++ if (!p) ++ return NULL; ++ memset(p, 0, sizeof(*p)); ++ } + p->rw_mode = FMODE_WRITE; + return p; + } +-- +2.35.1 + diff --git a/queue-5.10/nfs-nfsiod-should-not-block-forever-in-mempool_alloc.patch b/queue-5.10/nfs-nfsiod-should-not-block-forever-in-mempool_alloc.patch new file mode 100644 index 00000000000..fdb4cf699f1 --- /dev/null +++ b/queue-5.10/nfs-nfsiod-should-not-block-forever-in-mempool_alloc.patch @@ -0,0 +1,135 @@ +From d57ae29f4359169b5a65390ddab15f38760e9e88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 12:34:19 -0400 +Subject: NFS: nfsiod should not block forever in mempool_alloc() + +From: Trond Myklebust + +[ Upstream commit 515dcdcd48736576c6f5c197814da6f81c60a21e ] + +The concern is that since nfsiod is sometimes required to kick off a +commit, it can get locked up waiting forever in mempool_alloc() instead +of failing gracefully and leaving the commit until later. + +Try to allocate from the slab first, with GFP_KERNEL | __GFP_NORETRY, +then fall back to a non-blocking attempt to allocate from the memory +pool. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/internal.h | 7 +++++++ + fs/nfs/pnfs_nfs.c | 8 ++++++-- + fs/nfs/write.c | 24 +++++++++--------------- + include/linux/nfs_fs.h | 2 +- + 4 files changed, 23 insertions(+), 18 deletions(-) + +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index 98554dd18a71..7de38abb6566 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -578,6 +578,13 @@ nfs_write_match_verf(const struct nfs_writeverf *verf, + !nfs_write_verifier_cmp(&req->wb_verf, &verf->verifier); + } + ++static inline gfp_t nfs_io_gfp_mask(void) ++{ ++ if (current->flags & PF_WQ_WORKER) ++ return GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN; ++ return GFP_KERNEL; ++} ++ + /* unlink.c */ + extern struct rpc_task * + nfs_async_rename(struct inode *old_dir, struct inode *new_dir, +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 7b9d701bef01..a2ad8bb87e2d 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -419,7 +419,7 @@ static struct nfs_commit_data * + pnfs_bucket_fetch_commitdata(struct pnfs_commit_bucket *bucket, + struct nfs_commit_info *cinfo) + { +- struct nfs_commit_data *data = nfs_commitdata_alloc(false); ++ struct nfs_commit_data *data = nfs_commitdata_alloc(); + + if (!data) + return NULL; +@@ -515,7 +515,11 @@ pnfs_generic_commit_pagelist(struct inode *inode, struct list_head *mds_pages, + unsigned int nreq = 0; + + if (!list_empty(mds_pages)) { +- data = nfs_commitdata_alloc(true); ++ data = nfs_commitdata_alloc(); ++ if (!data) { ++ nfs_retry_commit(mds_pages, NULL, cinfo, -1); ++ return -ENOMEM; ++ } + data->ds_commit_index = -1; + list_splice_init(mds_pages, &data->pages); + list_add_tail(&data->list, &list); +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index cc926e69ee9b..a97eaf4e813c 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -70,27 +70,17 @@ static mempool_t *nfs_wdata_mempool; + static struct kmem_cache *nfs_cdata_cachep; + static mempool_t *nfs_commit_mempool; + +-struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail) ++struct nfs_commit_data *nfs_commitdata_alloc(void) + { + struct nfs_commit_data *p; + +- if (never_fail) +- p = mempool_alloc(nfs_commit_mempool, GFP_NOIO); +- else { +- /* It is OK to do some reclaim, not no safe to wait +- * for anything to be returned to the pool. +- * mempool_alloc() cannot handle that particular combination, +- * so we need two separate attempts. +- */ ++ p = kmem_cache_zalloc(nfs_cdata_cachep, nfs_io_gfp_mask()); ++ if (!p) { + p = mempool_alloc(nfs_commit_mempool, GFP_NOWAIT); +- if (!p) +- p = kmem_cache_alloc(nfs_cdata_cachep, GFP_NOIO | +- __GFP_NOWARN | __GFP_NORETRY); + if (!p) + return NULL; ++ memset(p, 0, sizeof(*p)); + } +- +- memset(p, 0, sizeof(*p)); + INIT_LIST_HEAD(&p->pages); + return p; + } +@@ -1800,7 +1790,11 @@ nfs_commit_list(struct inode *inode, struct list_head *head, int how, + if (list_empty(head)) + return 0; + +- data = nfs_commitdata_alloc(true); ++ data = nfs_commitdata_alloc(); ++ if (!data) { ++ nfs_retry_commit(head, NULL, cinfo, -1); ++ return -ENOMEM; ++ } + + /* Set up the argument struct */ + nfs_init_commit(data, head, NULL, cinfo); +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 2a17e0dfd431..e39342945a80 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -551,7 +551,7 @@ extern int nfs_wb_all(struct inode *inode); + extern int nfs_wb_page(struct inode *inode, struct page *page); + extern int nfs_wb_page_cancel(struct inode *inode, struct page* page); + extern int nfs_commit_inode(struct inode *, int); +-extern struct nfs_commit_data *nfs_commitdata_alloc(bool never_fail); ++extern struct nfs_commit_data *nfs_commitdata_alloc(void); + extern void nfs_commit_free(struct nfs_commit_data *data); + bool nfs_commit_end(struct nfs_mds_commit_info *cinfo); + +-- +2.35.1 + diff --git a/queue-5.10/nfs-swap-io-handling-is-slightly-different-for-o_dir.patch b/queue-5.10/nfs-swap-io-handling-is-slightly-different-for-o_dir.patch new file mode 100644 index 00000000000..50d40433368 --- /dev/null +++ b/queue-5.10/nfs-swap-io-handling-is-slightly-different-for-o_dir.patch @@ -0,0 +1,183 @@ +From 94a0d2de889a2b50f02162346ecd71722c174570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: NFS: swap IO handling is slightly different for O_DIRECT IO + +From: NeilBrown + +[ Upstream commit 64158668ac8b31626a8ce48db4cad08496eb8340 ] + +1/ Taking the i_rwsem for swap IO triggers lockdep warnings regarding + possible deadlocks with "fs_reclaim". These deadlocks could, I believe, + eventuate if a buffered read on the swapfile was attempted. + + We don't need coherence with the page cache for a swap file, and + buffered writes are forbidden anyway. There is no other need for + i_rwsem during direct IO. So never take it for swap_rw() + +2/ generic_write_checks() explicitly forbids writes to swap, and + performs checks that are not needed for swap. So bypass it + for swap_rw(). + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 42 ++++++++++++++++++++++++++++-------------- + fs/nfs/file.c | 4 ++-- + include/linux/nfs_fs.h | 8 ++++---- + 3 files changed, 34 insertions(+), 20 deletions(-) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 3c0335c15a73..28afc315ec0c 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -172,8 +172,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); + + if (iov_iter_rw(iter) == READ) +- return nfs_file_direct_read(iocb, iter); +- return nfs_file_direct_write(iocb, iter); ++ return nfs_file_direct_read(iocb, iter, true); ++ return nfs_file_direct_write(iocb, iter, true); + } + + static void nfs_direct_release_pages(struct page **pages, unsigned int npages) +@@ -424,6 +424,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_read - file direct read operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers into which to read data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct reads instead of calling + * generic_file_aio_read() in order to avoid gfar's check to see if +@@ -439,7 +440,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * client must read the updated atime from the server back into its + * cache. + */ +-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + struct file *file = iocb->ki_filp; + struct address_space *mapping = file->f_mapping; +@@ -481,12 +483,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (iter_is_iovec(iter)) + dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; + +- nfs_start_io_direct(inode); ++ if (!swap) ++ nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; + requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); + +- nfs_end_io_direct(inode); ++ if (!swap) ++ nfs_end_io_direct(inode); + + if (requested > 0) { + result = nfs_direct_wait(dreq); +@@ -875,6 +879,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_write - file direct write operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers from which to write data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct writes instead of calling + * generic_file_aio_write() in order to avoid taking the inode +@@ -891,7 +896,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * Note that O_APPEND is not supported for NFS direct writes, as there + * is no atomic O_APPEND write facility in the NFS protocol. + */ +-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + ssize_t result, requested; + size_t count; +@@ -905,7 +911,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", + file, iov_iter_count(iter), (long long) iocb->ki_pos); + +- result = generic_write_checks(iocb, iter); ++ if (swap) ++ /* bypass generic checks */ ++ result = iov_iter_count(iter); ++ else ++ result = generic_write_checks(iocb, iter); + if (result <= 0) + return result; + count = result; +@@ -936,16 +946,20 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dreq->iocb = iocb; + pnfs_init_ds_commit_info_ops(&dreq->ds_cinfo, inode); + +- nfs_start_io_direct(inode); ++ if (swap) { ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ } else { ++ nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); + +- if (mapping->nrpages) { +- invalidate_inode_pages2_range(mapping, +- pos >> PAGE_SHIFT, end); +- } ++ if (mapping->nrpages) { ++ invalidate_inode_pages2_range(mapping, ++ pos >> PAGE_SHIFT, end); ++ } + +- nfs_end_io_direct(inode); ++ nfs_end_io_direct(inode); ++ } + + if (requested > 0) { + result = nfs_direct_wait(dreq); +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 63940a7a70be..7b47f9b063f1 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -161,7 +161,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) + ssize_t result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_read(iocb, to); ++ return nfs_file_direct_read(iocb, to, false); + + dprintk("NFS: read(%pD2, %zu@%lu)\n", + iocb->ki_filp, +@@ -616,7 +616,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + return result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_write(iocb, from); ++ return nfs_file_direct_write(iocb, from, false); + + dprintk("NFS: write(%pD2, %zu@%Ld)\n", + file, iov_iter_count(from), (long long) iocb->ki_pos); +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 1e0a3497bdb4..2a17e0dfd431 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -478,10 +478,10 @@ static inline const struct cred *nfs_file_cred(struct file *file) + * linux/fs/nfs/direct.c + */ + extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); +-extern ssize_t nfs_file_direct_read(struct kiocb *iocb, +- struct iov_iter *iter); +-extern ssize_t nfs_file_direct_write(struct kiocb *iocb, +- struct iov_iter *iter); ++ssize_t nfs_file_direct_read(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); ++ssize_t nfs_file_direct_write(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); + + /* + * linux/fs/nfs/dir.c +-- +2.35.1 + diff --git a/queue-5.10/nfs-swap-out-must-always-use-stable-writes.patch b/queue-5.10/nfs-swap-out-must-always-use-stable-writes.patch new file mode 100644 index 00000000000..cba31094202 --- /dev/null +++ b/queue-5.10/nfs-swap-out-must-always-use-stable-writes.patch @@ -0,0 +1,71 @@ +From d316d20ecf0a967ae456079678d23b3a8404385c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: NFS: swap-out must always use STABLE writes. + +From: NeilBrown + +[ Upstream commit c265de257f558a05c1859ee9e3fed04883b9ec0e ] + +The commit handling code is not safe against memory-pressure deadlocks +when writing to swap. In particular, nfs_commitdata_alloc() blocks +indefinitely waiting for memory, and this can consume all available +workqueue threads. + +swap-out most likely uses STABLE writes anyway as COND_STABLE indicates +that a stable write should be used if the write fits in a single +request, and it normally does. However if we ever swap with a small +wsize, or gather unusually large numbers of pages for a single write, +this might change. + +For safety, make it explicit in the code that direct writes used for swap +must always use FLUSH_STABLE. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 28afc315ec0c..c220810c61d1 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -793,7 +793,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { + */ + static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + struct iov_iter *iter, +- loff_t pos) ++ loff_t pos, int ioflags) + { + struct nfs_pageio_descriptor desc; + struct inode *inode = dreq->inode; +@@ -801,7 +801,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + size_t requested_bytes = 0; + size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); + +- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, ++ nfs_pageio_init_write(&desc, inode, ioflags, false, + &nfs_direct_write_completion_ops); + desc.pg_dreq = dreq; + get_dreq(dreq); +@@ -947,11 +947,13 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, + pnfs_init_ds_commit_info_ops(&dreq->ds_cinfo, inode); + + if (swap) { +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_STABLE); + } else { + nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_COND_STABLE); + + if (mapping->nrpages) { + invalidate_inode_pages2_range(mapping, +-- +2.35.1 + diff --git a/queue-5.10/nfsv4-protect-the-state-recovery-thread-against-dire.patch b/queue-5.10/nfsv4-protect-the-state-recovery-thread-against-dire.patch new file mode 100644 index 00000000000..d248e782856 --- /dev/null +++ b/queue-5.10/nfsv4-protect-the-state-recovery-thread-against-dire.patch @@ -0,0 +1,76 @@ +From 87518a18a29666821f9effd345840e19ca82438c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 13:32:45 -0500 +Subject: NFSv4: Protect the state recovery thread against direct reclaim + +From: Trond Myklebust + +[ Upstream commit 3e17898aca293a24dae757a440a50aa63ca29671 ] + +If memory allocation triggers a direct reclaim from the state recovery +thread, then we can deadlock. Use memalloc_nofs_save/restore to ensure +that doesn't happen. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index cbeec29e9f21..a8fe8f84c5ae 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2557,9 +2558,17 @@ static void nfs4_layoutreturn_any_run(struct nfs_client *clp) + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + trace_nfs4_state_mgr(clp); +@@ -2654,6 +2663,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2671,6 +2681,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2683,6 +2694,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +-- +2.35.1 + diff --git a/queue-5.10/nfsv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch b/queue-5.10/nfsv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch new file mode 100644 index 00000000000..f6268a885ee --- /dev/null +++ b/queue-5.10/nfsv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch @@ -0,0 +1,66 @@ +From 5b75e98d926e6fd552ac6375545e6617d13cdfa3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 21:10:45 +0800 +Subject: NFSv4.2: fix reference count leaks in _nfs42_proc_copy_notify() + +From: Xin Xiong + +[ Upstream commit b7f114edd54326f730a754547e7cfb197b5bc132 ] + +[You don't often get email from xiongx18@fudan.edu.cn. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] + +The reference counting issue happens in two error paths in the +function _nfs42_proc_copy_notify(). In both error paths, the function +simply returns the error code and forgets to balance the refcount of +object `ctx`, bumped by get_nfs_open_context() earlier, which may +cause refcount leaks. + +Fix it by balancing refcount of the `ctx` object before the function +returns in both error paths. + +Signed-off-by: Xin Xiong +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42proc.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c +index 2587b1b8e2ef..dad32b171e67 100644 +--- a/fs/nfs/nfs42proc.c ++++ b/fs/nfs/nfs42proc.c +@@ -567,8 +567,10 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + + ctx = get_nfs_open_context(nfs_file_open_context(src)); + l_ctx = nfs_get_lock_context(ctx); +- if (IS_ERR(l_ctx)) +- return PTR_ERR(l_ctx); ++ if (IS_ERR(l_ctx)) { ++ status = PTR_ERR(l_ctx); ++ goto out; ++ } + + status = nfs4_set_rw_stateid(&args->cna_src_stateid, ctx, l_ctx, + FMODE_READ); +@@ -576,7 +578,7 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + if (status) { + if (status == -EAGAIN) + status = -NFS4ERR_BAD_STATEID; +- return status; ++ goto out; + } + + status = nfs4_call_sync(src_server->client, src_server, &msg, +@@ -584,6 +586,7 @@ static int _nfs42_proc_copy_notify(struct file *src, struct file *dst, + if (status == -ENOTSUPP) + src_server->caps &= ~NFS_CAP_COPY_NOTIFY; + ++out: + put_nfs_open_context(nfs_file_open_context(src)); + return status; + } +-- +2.35.1 + diff --git a/queue-5.10/parisc-fix-cpu-affinity-for-lasi-wax-and-dino-chips.patch b/queue-5.10/parisc-fix-cpu-affinity-for-lasi-wax-and-dino-chips.patch new file mode 100644 index 00000000000..63e6f69b6ef --- /dev/null +++ b/queue-5.10/parisc-fix-cpu-affinity-for-lasi-wax-and-dino-chips.patch @@ -0,0 +1,232 @@ +From 65664b1c0304f6b273c298507c4b86faa9a03567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Mar 2022 15:46:26 +0200 +Subject: parisc: Fix CPU affinity for Lasi, WAX and Dino chips + +From: Helge Deller + +[ Upstream commit 939fc856676c266c3bc347c1c1661872a3725c0f ] + +Add the missing logic to allow Lasi, WAX and Dino to set the +CPU affinity. This fixes IRQ migration to other CPUs when a +CPU is shutdown which currently holds the IRQs for one of those +chips. + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/parisc/dino.c | 41 +++++++++++++++++++++++++++++++++-------- + drivers/parisc/gsc.c | 31 +++++++++++++++++++++++++++++++ + drivers/parisc/gsc.h | 1 + + drivers/parisc/lasi.c | 7 +++---- + drivers/parisc/wax.c | 7 +++---- + 5 files changed, 71 insertions(+), 16 deletions(-) + +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index 952a92504df6..e33036281327 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -142,9 +142,8 @@ struct dino_device + { + struct pci_hba_data hba; /* 'C' inheritance - must be first */ + spinlock_t dinosaur_pen; +- unsigned long txn_addr; /* EIR addr to generate interrupt */ +- u32 txn_data; /* EIR data assign to each dino */ + u32 imr; /* IRQ's which are enabled */ ++ struct gsc_irq gsc_irq; + int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ + #ifdef DINO_DEBUG + unsigned int dino_irr0; /* save most recent IRQ line stat */ +@@ -339,14 +338,43 @@ static void dino_unmask_irq(struct irq_data *d) + if (tmp & DINO_MASK_IRQ(local_irq)) { + DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", + __func__, tmp); +- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); ++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); + } + } + ++#ifdef CONFIG_SMP ++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ u32 eim; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; ++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ + static struct irq_chip dino_interrupt_type = { + .name = "GSC-PCI", + .irq_unmask = dino_unmask_irq, + .irq_mask = dino_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = dino_set_affinity_irq, ++#endif + }; + + +@@ -806,7 +834,6 @@ static int __init dino_common_init(struct parisc_device *dev, + { + int status; + u32 eim; +- struct gsc_irq gsc_irq; + struct resource *res; + + pcibios_register_hba(&dino_dev->hba); +@@ -821,10 +848,8 @@ static int __init dino_common_init(struct parisc_device *dev, + ** still only has 11 IRQ input lines - just map some of them + ** to a different processor. + */ +- dev->irq = gsc_alloc_irq(&gsc_irq); +- dino_dev->txn_addr = gsc_irq.txn_addr; +- dino_dev->txn_data = gsc_irq.txn_data; +- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; + + /* + ** Dino needs a PA "IRQ" to get a processor's attention. +diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c +index ed9371acf37e..ec175ae99873 100644 +--- a/drivers/parisc/gsc.c ++++ b/drivers/parisc/gsc.c +@@ -135,10 +135,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) + */ + } + ++#ifdef CONFIG_SMP ++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; ++ ++ /* switch IRQ's for devices below LASI/WAX to other CPU */ ++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ ++ + static struct irq_chip gsc_asic_interrupt_type = { + .name = "GSC-ASIC", + .irq_unmask = gsc_asic_unmask_irq, + .irq_mask = gsc_asic_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = gsc_set_affinity_irq, ++#endif + }; + + int gsc_assign_irq(struct irq_chip *type, void *data) +diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h +index 86abad3fa215..73cbd0bb1975 100644 +--- a/drivers/parisc/gsc.h ++++ b/drivers/parisc/gsc.h +@@ -31,6 +31,7 @@ struct gsc_asic { + int version; + int type; + int eim; ++ struct gsc_irq gsc_irq; + int global_irq[32]; + }; + +diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c +index 4e4fd12c2112..6ef621adb63a 100644 +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -163,7 +163,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) + { + extern void (*chassis_power_off)(void); + struct gsc_asic *lasi; +- struct gsc_irq gsc_irq; + int ret; + + lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); +@@ -185,7 +184,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) + lasi_init_irq(lasi); + + /* the IRQ lasi should use */ +- dev->irq = gsc_alloc_irq(&gsc_irq); ++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -193,9 +192,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); ++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { + kfree(lasi); + return ret; +diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c +index 5b6df1516235..73a2b01f8d9c 100644 +--- a/drivers/parisc/wax.c ++++ b/drivers/parisc/wax.c +@@ -68,7 +68,6 @@ static int __init wax_init_chip(struct parisc_device *dev) + { + struct gsc_asic *wax; + struct parisc_device *parent; +- struct gsc_irq gsc_irq; + int ret; + + wax = kzalloc(sizeof(*wax), GFP_KERNEL); +@@ -85,7 +84,7 @@ static int __init wax_init_chip(struct parisc_device *dev) + wax_init_irq(wax); + + /* the IRQ wax should use */ +- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); ++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -93,9 +92,9 @@ static int __init wax_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); ++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); + if (ret < 0) { + kfree(wax); + return ret; +-- +2.35.1 + diff --git a/queue-5.10/parisc-fix-patch-code-locking-and-flushing.patch b/queue-5.10/parisc-fix-patch-code-locking-and-flushing.patch new file mode 100644 index 00000000000..200a20e3657 --- /dev/null +++ b/queue-5.10/parisc-fix-patch-code-locking-and-flushing.patch @@ -0,0 +1,97 @@ +From 6687540302a43b6e3f2381025f533e7d7924daf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 18:54:36 +0000 +Subject: parisc: Fix patch code locking and flushing + +From: John David Anglin + +[ Upstream commit a9fe7fa7d874a536e0540469f314772c054a0323 ] + +This change fixes the following: + +1) The flags variable is not initialized. Always use raw_spin_lock_irqsave +and raw_spin_unlock_irqrestore to serialize patching. + +2) flush_kernel_vmap_range is primarily intended for DMA flushes. Since +__patch_text_multiple is often called with interrupts disabled, it is +better to directly call flush_kernel_dcache_range_asm and +flush_kernel_icache_range_asm. This avoids an extra call. + +3) The final call to flush_icache_range is unnecessary. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/patch.c | 25 +++++++++++-------------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/arch/parisc/kernel/patch.c b/arch/parisc/kernel/patch.c +index 80a0ab372802..e59574f65e64 100644 +--- a/arch/parisc/kernel/patch.c ++++ b/arch/parisc/kernel/patch.c +@@ -40,10 +40,7 @@ static void __kprobes *patch_map(void *addr, int fixmap, unsigned long *flags, + + *need_unmap = 1; + set_fixmap(fixmap, page_to_phys(page)); +- if (flags) +- raw_spin_lock_irqsave(&patch_lock, *flags); +- else +- __acquire(&patch_lock); ++ raw_spin_lock_irqsave(&patch_lock, *flags); + + return (void *) (__fix_to_virt(fixmap) + (uintaddr & ~PAGE_MASK)); + } +@@ -52,10 +49,7 @@ static void __kprobes patch_unmap(int fixmap, unsigned long *flags) + { + clear_fixmap(fixmap); + +- if (flags) +- raw_spin_unlock_irqrestore(&patch_lock, *flags); +- else +- __release(&patch_lock); ++ raw_spin_unlock_irqrestore(&patch_lock, *flags); + } + + void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) +@@ -67,8 +61,9 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + int mapped; + + /* Make sure we don't have any aliases in cache */ +- flush_kernel_vmap_range(addr, len); +- flush_icache_range(start, end); ++ flush_kernel_dcache_range_asm(start, end); ++ flush_kernel_icache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, &mapped); + +@@ -81,8 +76,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + * We're crossing a page boundary, so + * need to remap + */ +- flush_kernel_vmap_range((void *)fixmap, +- (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, ++ (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, ++ (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); + p = fixmap = patch_map(addr, FIX_TEXT_POKE0, &flags, +@@ -90,10 +87,10 @@ void __kprobes __patch_text_multiple(void *addr, u32 *insn, unsigned int len) + } + } + +- flush_kernel_vmap_range((void *)fixmap, (p-fixmap) * sizeof(*p)); ++ flush_kernel_dcache_range_asm((unsigned long)fixmap, (unsigned long)p); ++ flush_tlb_kernel_range((unsigned long)fixmap, (unsigned long)p); + if (mapped) + patch_unmap(FIX_TEXT_POKE0, &flags); +- flush_icache_range(start, end); + } + + void __kprobes __patch_text(void *addr, u32 insn) +-- +2.35.1 + diff --git a/queue-5.10/pci-aardvark-fix-support-for-msi-interrupts.patch b/queue-5.10/pci-aardvark-fix-support-for-msi-interrupts.patch new file mode 100644 index 00000000000..76216dd8d17 --- /dev/null +++ b/queue-5.10/pci-aardvark-fix-support-for-msi-interrupts.patch @@ -0,0 +1,84 @@ +From b3743b4da457d730000c42f6f3fafd11c9e81cb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 02:49:58 +0100 +Subject: PCI: aardvark: Fix support for MSI interrupts +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b0b0b8b897f8e12b2368e868bd7cdc5742d5c5a9 ] + +Aardvark hardware supports Multi-MSI and MSI_FLAG_MULTI_PCI_MSI is already +set for the MSI chip. But when allocating MSI interrupt numbers for +Multi-MSI, the numbers need to be properly aligned, otherwise endpoint +devices send MSI interrupt with incorrect numbers. + +Fix this issue by using function bitmap_find_free_region() instead of +bitmap_find_next_zero_area(). + +To ensure that aligned MSI interrupt numbers are used by endpoint devices, +we cannot use Linux virtual irq numbers (as they are random and not +properly aligned). Instead we need to use the aligned hwirq numbers. + +This change fixes receiving MSI interrupts on Armada 3720 boards and +allows using NVMe disks which use Multi-MSI feature with 3 interrupts. + +Without this NVMe disks freeze booting as linux nvme-core.c is waiting +60s for an interrupt. + +Link: https://lore.kernel.org/r/20220110015018.26359-4-kabel@kernel.org +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 49ff8bf10c74..af051fb88699 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -1186,7 +1186,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, + + msg->address_lo = lower_32_bits(msi_msg); + msg->address_hi = upper_32_bits(msi_msg); +- msg->data = data->irq; ++ msg->data = data->hwirq; + } + + static int advk_msi_set_affinity(struct irq_data *irq_data, +@@ -1203,15 +1203,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + int hwirq, i; + + mutex_lock(&pcie->msi_used_lock); +- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, +- 0, nr_irqs, 0); +- if (hwirq >= MSI_IRQ_NUM) { +- mutex_unlock(&pcie->msi_used_lock); +- return -ENOSPC; +- } +- +- bitmap_set(pcie->msi_used, hwirq, nr_irqs); ++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, ++ order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); ++ if (hwirq < 0) ++ return -ENOSPC; + + for (i = 0; i < nr_irqs; i++) + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -1229,7 +1225,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, + struct advk_pcie *pcie = domain->host_data; + + mutex_lock(&pcie->msi_used_lock); +- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); + } + +-- +2.35.1 + diff --git a/queue-5.10/pci-endpoint-fix-alignment-fault-error-in-copy-tests.patch b/queue-5.10/pci-endpoint-fix-alignment-fault-error-in-copy-tests.patch new file mode 100644 index 00000000000..346c28a7f03 --- /dev/null +++ b/queue-5.10/pci-endpoint-fix-alignment-fault-error-in-copy-tests.patch @@ -0,0 +1,92 @@ +From 8a957686e8d22f86d569be27e5e37b9a9a3333da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 17:47:08 +0800 +Subject: PCI: endpoint: Fix alignment fault error in copy tests + +From: Hou Zhiqiang + +[ Upstream commit 829cc0e2ea2d61fb6c54bc3f8a17f86c56e11864 ] + +The copy test uses the memcpy() to copy data between IO memory spaces. +This can trigger an alignment fault error (pasted the error logs below) +because memcpy() may use unaligned accesses on a mapped memory that is +just IO, which does not support unaligned memory accesses. + +Fix it by using the correct memcpy API to copy from/to IO memory. + +Alignment fault error logs: + Unable to handle kernel paging request at virtual address ffff8000101cd3c1 + Mem abort info: + ESR = 0x96000021 + EC = 0x25: DABT (current EL), IL = 32 bits + SET = 0, FnV = 0 + EA = 0, S1PTW = 0 + FSC = 0x21: alignment fault + Data abort info: + ISV = 0, ISS = 0x00000021 + CM = 0, WnR = 0 + swapper pgtable: 4k pages, 48-bit VAs, pgdp=0000000081773000 + [ffff8000101cd3c1] pgd=1000000082410003, p4d=1000000082410003, pud=1000000082411003, pmd=1000000082412003, pte=0068004000001f13 + Internal error: Oops: 96000021 [#1] PREEMPT SMP + Modules linked in: + CPU: 0 PID: 6 Comm: kworker/0:0H Not tainted 5.15.0-rc1-next-20210914-dirty #2 + Hardware name: LS1012A RDB Board (DT) + Workqueue: kpcitest pci_epf_test_cmd_handler + pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __memcpy+0x168/0x230 + lr : pci_epf_test_cmd_handler+0x6f0/0xa68 + sp : ffff80001003bce0 + x29: ffff80001003bce0 x28: ffff800010135000 x27: ffff8000101e5000 + x26: ffff8000101cd000 x25: ffff6cda941cf6c8 x24: 0000000000000000 + x23: ffff6cda863f2000 x22: ffff6cda9096c800 x21: ffff800010135000 + x20: ffff6cda941cf680 x19: ffffaf39fd999000 x18: 0000000000000000 + x17: 0000000000000000 x16: 0000000000000000 x15: ffffaf39fd2b6000 + x14: 0000000000000000 x13: 15f5c8fa2f984d57 x12: 604d132b60275454 + x11: 065cee5e5fb428b6 x10: aae662eb17d0cf3e x9 : 1d97c9a1b4ddef37 + x8 : 7541b65edebf928c x7 : e71937c4fc595de0 x6 : b8a0e09562430d1c + x5 : ffff8000101e5401 x4 : ffff8000101cd401 x3 : ffff8000101e5380 + x2 : fffffffffffffff1 x1 : ffff8000101cd3c0 x0 : ffff8000101e5000 + Call trace: + __memcpy+0x168/0x230 + process_one_work+0x1ec/0x370 + worker_thread+0x44/0x478 + kthread+0x154/0x160 + ret_from_fork+0x10/0x20 + Code: a984346c a9c4342c f1010042 54fffee8 (a97c3c8e) + ---[ end trace 568c28c7b6336335 ]--- + +Link: https://lore.kernel.org/r/20211217094708.28678-1-Zhiqiang.Hou@nxp.com +Signed-off-by: Hou Zhiqiang +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index d41570715dc7..b861840e867c 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -285,7 +285,17 @@ static int pci_epf_test_copy(struct pci_epf_test *epf_test) + if (ret) + dev_err(dev, "Data transfer failed\n"); + } else { +- memcpy(dst_addr, src_addr, reg->size); ++ void *buf; ++ ++ buf = kzalloc(reg->size, GFP_KERNEL); ++ if (!buf) { ++ ret = -ENOMEM; ++ goto err_map_addr; ++ } ++ ++ memcpy_fromio(buf, src_addr, reg->size); ++ memcpy_toio(dst_addr, buf, reg->size); ++ kfree(buf); + } + ktime_get_ts64(&end); + pci_epf_test_print_rate("COPY", reg->size, &start, &end, use_dma); +-- +2.35.1 + diff --git a/queue-5.10/pci-endpoint-fix-misused-goto-label.patch b/queue-5.10/pci-endpoint-fix-misused-goto-label.patch new file mode 100644 index 00000000000..6d345cb54c6 --- /dev/null +++ b/queue-5.10/pci-endpoint-fix-misused-goto-label.patch @@ -0,0 +1,36 @@ +From 89fe4e393d1d64fcc2e7cbacaf5cbc16ff07da69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jan 2022 15:48:23 +0800 +Subject: PCI: endpoint: Fix misused goto label + +From: Li Chen + +[ Upstream commit bf8d87c076f55b8b4dfdb6bc6c6b6dc0c2ccb487 ] + +Fix a misused goto label jump since that can result in a memory leak. + +Link: https://lore.kernel.org/r/17e7b9b9ee6.c6d9c6a02564.4545388417402742326@zohomail.com +Signed-off-by: Li Chen +Signed-off-by: Lorenzo Pieralisi +Acked-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index b861840e867c..262b2c4c70c9 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -451,7 +451,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test) + if (!epf_test->dma_supported) { + dev_err(dev, "Cannot transfer data using DMA\n"); + ret = -EINVAL; +- goto err_map_addr; ++ goto err_dma_map; + } + + src_phys_addr = dma_map_single(dma_dev, buf, reg->size, +-- +2.35.1 + diff --git a/queue-5.10/pci-pciehp-add-qualcomm-quirk-for-command-completed-.patch b/queue-5.10/pci-pciehp-add-qualcomm-quirk-for-command-completed-.patch new file mode 100644 index 00000000000..948443e2fec --- /dev/null +++ b/queue-5.10/pci-pciehp-add-qualcomm-quirk-for-command-completed-.patch @@ -0,0 +1,44 @@ +From 8ca0040c4b92a928d0b78a2b6c6a4bfedb9e26e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 20:20:03 +0530 +Subject: PCI: pciehp: Add Qualcomm quirk for Command Completed erratum + +From: Manivannan Sadhasivam + +[ Upstream commit 9f72d4757cbe4d1ed669192f6d23817c9e437c4b ] + +The Qualcomm PCI bridge device (Device ID 0x0110) found in chipsets such as +SM8450 does not set the Command Completed bit unless writes to the Slot +Command register change "Control" bits. + +This results in timeouts like below: + + pcieport 0001:00:00.0: pciehp: Timeout on hotplug command 0x03c0 (issued 2020 msec ago) + +Add the device to the Command Completed quirk to mark commands "completed" +immediately unless they change the "Control" bits. + +Link: https://lore.kernel.org/r/20220210145003.135907-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/hotplug/pciehp_hpc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index af4c4cc837fc..dda952357747 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -1060,6 +1060,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, ++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, +-- +2.35.1 + diff --git a/queue-5.10/phy-amlogic-meson8b-usb2-use-dev_err_probe.patch b/queue-5.10/phy-amlogic-meson8b-usb2-use-dev_err_probe.patch new file mode 100644 index 00000000000..22d809e56b1 --- /dev/null +++ b/queue-5.10/phy-amlogic-meson8b-usb2-use-dev_err_probe.patch @@ -0,0 +1,42 @@ +From 4abb6f2f0175053e4947e922781a0a3b3573f674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jan 2022 10:52:54 +0100 +Subject: phy: amlogic: meson8b-usb2: Use dev_err_probe() + +From: Amjad Ouled-Ameur + +[ Upstream commit 6466ba1898d415b527e1013bd8551a6fdfece94c ] + +Use the existing dev_err_probe() helper instead of open-coding the same +operation. + +Signed-off-by: Amjad Ouled-Ameur +Reported-by: Martin Blumenstingl +Reviewed-by: Martin Blumenstingl +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20220111095255.176141-3-aouledameur@baylibre.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/amlogic/phy-meson8b-usb2.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/amlogic/phy-meson8b-usb2.c b/drivers/phy/amlogic/phy-meson8b-usb2.c +index 03c061dd5f0d..8f40b9342a97 100644 +--- a/drivers/phy/amlogic/phy-meson8b-usb2.c ++++ b/drivers/phy/amlogic/phy-meson8b-usb2.c +@@ -261,8 +261,9 @@ static int phy_meson8b_usb2_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk_usb); + + priv->reset = devm_reset_control_get_optional_shared(&pdev->dev, NULL); +- if (PTR_ERR(priv->reset) == -EPROBE_DEFER) +- return PTR_ERR(priv->reset); ++ if (IS_ERR(priv->reset)) ++ return dev_err_probe(&pdev->dev, PTR_ERR(priv->reset), ++ "Failed to get the reset line"); + + priv->dr_mode = of_usb_get_dr_mode_by_phy(pdev->dev.of_node, -1); + if (priv->dr_mode == USB_DR_MODE_UNKNOWN) { +-- +2.35.1 + diff --git a/queue-5.10/power-supply-axp20x_battery-properly-report-current-.patch b/queue-5.10/power-supply-axp20x_battery-properly-report-current-.patch new file mode 100644 index 00000000000..8baaa857aae --- /dev/null +++ b/queue-5.10/power-supply-axp20x_battery-properly-report-current-.patch @@ -0,0 +1,63 @@ +From 3f2789a4f0d5edfebdc905772d09d06c19f33e46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 11:47:27 +0300 +Subject: power: supply: axp20x_battery: properly report current when + discharging + +From: Evgeny Boger + +[ Upstream commit d4f408cdcd26921c1268cb8dcbe8ffb6faf837f3 ] + +As stated in [1], negative current values are used for discharging +batteries. + +AXP PMICs internally have two different ADC channels for shunt current +measurement: one used during charging and one during discharging. +The values reported by these ADCs are unsigned. +While the driver properly selects ADC channel to get the data from, +it doesn't apply negative sign when reporting discharging current. + +[1] Documentation/ABI/testing/sysfs-class-power + +Signed-off-by: Evgeny Boger +Acked-by: Chen-Yu Tsai +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp20x_battery.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index e84b6e4da14a..9fda98b950ba 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + union power_supply_propval *val) + { + struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); +- struct iio_channel *chan; + int ret = 0, reg, val1; + + switch (psp) { +@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + if (ret) + return ret; + +- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) +- chan = axp20x_batt->batt_chrg_i; +- else +- chan = axp20x_batt->batt_dischrg_i; +- +- ret = iio_read_channel_processed(chan, &val->intval); ++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { ++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); ++ } else { ++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); ++ val->intval = -val1; ++ } + if (ret) + return ret; + +-- +2.35.1 + diff --git a/queue-5.10/power-supply-axp288-charger-set-vhold-to-4.4v.patch b/queue-5.10/power-supply-axp288-charger-set-vhold-to-4.4v.patch new file mode 100644 index 00000000000..22f5f0042a0 --- /dev/null +++ b/queue-5.10/power-supply-axp288-charger-set-vhold-to-4.4v.patch @@ -0,0 +1,85 @@ +From 089a4030aed7b6363674016d72e35add8f5e8285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 13:51:47 +0100 +Subject: power: supply: axp288-charger: Set Vhold to 4.4V + +From: Hans de Goede + +[ Upstream commit 5ac121b81b4051e7fc83d5b3456a5e499d5bd147 ] + +The AXP288's recommended and factory default Vhold value (minimum +input voltage below which the input current draw will be reduced) +is 4.4V. This lines up with other charger IC's such as the TI +bq2419x/bq2429x series which use 4.36V or 4.44V. + +For some reason some BIOS-es initialize Vhold to 4.6V or even 4.7V +which combined with the typical voltage drop over typically low +wire gauge micro-USB cables leads to the input-current getting +capped below 1A (with a 2A capable dedicated charger) based on Vhold. + +This leads to slow charging, or even to the device slowly discharging +if the device is in heavy use. + +As the Linux AXP288 drivers use the builtin BC1.2 charger detection +and send the input-current-limit according to the detected charger +there really is no reason not to use the recommended 4.4V Vhold. + +Set Vhold to 4.4V to fix the slow charging issue on various devices. + +There is one exception, the special-case of the HP X2 2-in-1s which +combine this BC1.2 capable PMIC with a Type-C port and a 5V/3A factory +provided charger with a Type-C plug which does not do BC1.2. These +have their input-current-limit hardcoded to 3A (like under Windows) +and use a higher Vhold on purpose to limit the current when used +with other chargers. To avoid touching Vhold on these HP X2 laptops +the code setting Vhold is added to an else branch of the if checking +for these models. + +Note this also fixes the sofar unused VBUS_ISPOUT_VHOLD_SET_MASK +define, which was wrong. + +Signed-off-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp288_charger.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index a4df1ea92386..f65bf7b295c5 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -41,11 +41,11 @@ + #define VBUS_ISPOUT_CUR_LIM_1500MA 0x1 /* 1500mA */ + #define VBUS_ISPOUT_CUR_LIM_2000MA 0x2 /* 2000mA */ + #define VBUS_ISPOUT_CUR_NO_LIM 0x3 /* 2500mA */ +-#define VBUS_ISPOUT_VHOLD_SET_MASK 0x31 ++#define VBUS_ISPOUT_VHOLD_SET_MASK 0x38 + #define VBUS_ISPOUT_VHOLD_SET_BIT_POS 0x3 + #define VBUS_ISPOUT_VHOLD_SET_OFFSET 4000 /* 4000mV */ + #define VBUS_ISPOUT_VHOLD_SET_LSB_RES 100 /* 100mV */ +-#define VBUS_ISPOUT_VHOLD_SET_4300MV 0x3 /* 4300mV */ ++#define VBUS_ISPOUT_VHOLD_SET_4400MV 0x4 /* 4400mV */ + #define VBUS_ISPOUT_VBUS_PATH_DIS BIT(7) + + #define CHRG_CCCV_CC_MASK 0xf /* 4 bits */ +@@ -744,6 +744,16 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + ret = axp288_charger_vbus_path_select(info, true); + if (ret < 0) + return ret; ++ } else { ++ /* Set Vhold to the factory default / recommended 4.4V */ ++ val = VBUS_ISPOUT_VHOLD_SET_4400MV << VBUS_ISPOUT_VHOLD_SET_BIT_POS; ++ ret = regmap_update_bits(info->regmap, AXP20X_VBUS_IPSOUT_MGMT, ++ VBUS_ISPOUT_VHOLD_SET_MASK, val); ++ if (ret < 0) { ++ dev_err(&info->pdev->dev, "register(%x) write error(%d)\n", ++ AXP20X_VBUS_IPSOUT_MGMT, ret); ++ return ret; ++ } + } + + /* Read current charge voltage and current limit */ +-- +2.35.1 + diff --git a/queue-5.10/powerpc-code-patching-pre-map-patch-area.patch b/queue-5.10/powerpc-code-patching-pre-map-patch-area.patch new file mode 100644 index 00000000000..8ebc22352c7 --- /dev/null +++ b/queue-5.10/powerpc-code-patching-pre-map-patch-area.patch @@ -0,0 +1,99 @@ +From 5d11ea532ca7b6c6dd692badd674aa22a879ce9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Feb 2022 12:58:21 +1100 +Subject: powerpc/code-patching: Pre-map patch area + +From: Michael Ellerman + +[ Upstream commit 591b4b268435f00d2f0b81f786c2c7bd5ef66416 ] + +Paul reported a warning with DEBUG_ATOMIC_SLEEP=y: + + BUG: sleeping function called from invalid context at include/linux/sched/mm.h:256 + in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0 + preempt_count: 0, expected: 0 + ... + Call Trace: + dump_stack_lvl+0xa0/0xec (unreliable) + __might_resched+0x2f4/0x310 + kmem_cache_alloc+0x220/0x4b0 + __pud_alloc+0x74/0x1d0 + hash__map_kernel_page+0x2cc/0x390 + do_patch_instruction+0x134/0x4a0 + arch_jump_label_transform+0x64/0x78 + __jump_label_update+0x148/0x180 + static_key_enable_cpuslocked+0xd0/0x120 + static_key_enable+0x30/0x50 + check_kvm_guest+0x60/0x88 + pSeries_smp_probe+0x54/0xb0 + smp_prepare_cpus+0x3e0/0x430 + kernel_init_freeable+0x20c/0x43c + kernel_init+0x30/0x1a0 + ret_from_kernel_thread+0x5c/0x64 + +Peter pointed out that this is because do_patch_instruction() has +disabled interrupts, but then map_patch_area() calls map_kernel_page() +then hash__map_kernel_page() which does a sleeping memory allocation. + +We only see the warning in KVM guests with SMT enabled, which is not +particularly common, or on other platforms if CONFIG_KPROBES is +disabled, also not common. The reason we don't see it in most +configurations is that another path that happens to have interrupts +enabled has allocated the required page tables for us, eg. there's a +path in kprobes init that does that. That's just pure luck though. + +As Christophe suggested, the simplest solution is to do a dummy +map/unmap when we initialise the patching, so that any required page +table levels are pre-allocated before the first call to +do_patch_instruction(). This works because the unmap doesn't free any +page tables that were allocated by the map, it just clears the PTE, +leaving the page table levels there for the next map. + +Reported-by: Paul Menzel +Debugged-by: Peter Zijlstra +Suggested-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220223015821.473097-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/lib/code-patching.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c +index a2e4f864b63d..4318aee65a39 100644 +--- a/arch/powerpc/lib/code-patching.c ++++ b/arch/powerpc/lib/code-patching.c +@@ -43,9 +43,14 @@ int raw_patch_instruction(struct ppc_inst *addr, struct ppc_inst instr) + #ifdef CONFIG_STRICT_KERNEL_RWX + static DEFINE_PER_CPU(struct vm_struct *, text_poke_area); + ++static int map_patch_area(void *addr, unsigned long text_poke_addr); ++static void unmap_patch_area(unsigned long addr); ++ + static int text_area_cpu_up(unsigned int cpu) + { + struct vm_struct *area; ++ unsigned long addr; ++ int err; + + area = get_vm_area(PAGE_SIZE, VM_ALLOC); + if (!area) { +@@ -53,6 +58,15 @@ static int text_area_cpu_up(unsigned int cpu) + cpu); + return -1; + } ++ ++ // Map/unmap the area to ensure all page tables are pre-allocated ++ addr = (unsigned long)area->addr; ++ err = map_patch_area(empty_zero_page, addr); ++ if (err) ++ return err; ++ ++ unmap_patch_area(addr); ++ + this_cpu_write(text_poke_area, area); + + return 0; +-- +2.35.1 + diff --git a/queue-5.10/powerpc-dts-t104xrdb-fix-phy-type-for-fman-4-5.patch b/queue-5.10/powerpc-dts-t104xrdb-fix-phy-type-for-fman-4-5.patch new file mode 100644 index 00000000000..c7583a12c18 --- /dev/null +++ b/queue-5.10/powerpc-dts-t104xrdb-fix-phy-type-for-fman-4-5.patch @@ -0,0 +1,47 @@ +From d1e609947d82eb55e6da16bd9c2f9fd5a726bbce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 18:11:21 +0300 +Subject: powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 + +From: Maxim Kiselev + +[ Upstream commit 17846485dff91acce1ad47b508b633dffc32e838 ] + +T1040RDB has two RTL8211E-VB phys which requires setting +of internal delays for correct work. + +Changing the phy-connection-type property to `rgmii-id` +will fix this issue. + +Signed-off-by: Maxim Kiselev +Reviewed-by: Maxim Kochetkov +Reviewed-by: Vladimir Oltean +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211230151123.1258321-1-bigunclemax@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/t104xrdb.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +index 099a598c74c0..bfe1ed5be337 100644 +--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +@@ -139,12 +139,12 @@ + fman@400000 { + ethernet@e6000 { + phy-handle = <&phy_rgmii_0>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + ethernet@e8000 { + phy-handle = <&phy_rgmii_1>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + mdio0: mdio@fc000 { +-- +2.35.1 + diff --git a/queue-5.10/powerpc-secvar-fix-refcount-leak-in-format_show.patch b/queue-5.10/powerpc-secvar-fix-refcount-leak-in-format_show.patch new file mode 100644 index 00000000000..5c4c4d872f7 --- /dev/null +++ b/queue-5.10/powerpc-secvar-fix-refcount-leak-in-format_show.patch @@ -0,0 +1,49 @@ +From aa6470d26d82bf8828453c12614a824ddae72d38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 10:19:59 +0800 +Subject: powerpc/secvar: fix refcount leak in format_show() + +From: Hangyu Hua + +[ Upstream commit d601fd24e6964967f115f036a840f4f28488f63f ] + +Refcount leak will happen when format_show returns failure in multiple +cases. Unified management of of_node_put can fix this problem. + +Signed-off-by: Hangyu Hua +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220302021959.10959-1-hbh25y@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/secvar-sysfs.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/kernel/secvar-sysfs.c b/arch/powerpc/kernel/secvar-sysfs.c +index a0a78aba2083..1ee4640a2641 100644 +--- a/arch/powerpc/kernel/secvar-sysfs.c ++++ b/arch/powerpc/kernel/secvar-sysfs.c +@@ -26,15 +26,18 @@ static ssize_t format_show(struct kobject *kobj, struct kobj_attribute *attr, + const char *format; + + node = of_find_compatible_node(NULL, NULL, "ibm,secvar-backend"); +- if (!of_device_is_available(node)) +- return -ENODEV; ++ if (!of_device_is_available(node)) { ++ rc = -ENODEV; ++ goto out; ++ } + + rc = of_property_read_string(node, "format", &format); + if (rc) +- return rc; ++ goto out; + + rc = sprintf(buf, "%s\n", format); + ++out: + of_node_put(node); + + return rc; +-- +2.35.1 + diff --git a/queue-5.10/powerpc-set-crashkernel-offset-to-mid-of-rma-region.patch b/queue-5.10/powerpc-set-crashkernel-offset-to-mid-of-rma-region.patch new file mode 100644 index 00000000000..17b985a22ba --- /dev/null +++ b/queue-5.10/powerpc-set-crashkernel-offset-to-mid-of-rma-region.patch @@ -0,0 +1,90 @@ +From 3a3f73f3e4879b64ba6940aafcc2df65abe3ce5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 14:26:01 +0530 +Subject: powerpc: Set crashkernel offset to mid of RMA region + +From: Sourabh Jain + +[ Upstream commit 7c5ed82b800d8615cdda00729e7b62e5899f0b13 ] + +On large config LPARs (having 192 and more cores), Linux fails to boot +due to insufficient memory in the first memblock. It is due to the +memory reservation for the crash kernel which starts at 128MB offset of +the first memblock. This memory reservation for the crash kernel doesn't +leave enough space in the first memblock to accommodate other essential +system resources. + +The crash kernel start address was set to 128MB offset by default to +ensure that the crash kernel get some memory below the RMA region which +is used to be of size 256MB. But given that the RMA region size can be +512MB or more, setting the crash kernel offset to mid of RMA size will +leave enough space for the kernel to allocate memory for other system +resources. + +Since the above crash kernel offset change is only applicable to the LPAR +platform, the LPAR feature detection is pushed before the crash kernel +reservation. The rest of LPAR specific initialization will still +be done during pseries_probe_fw_features as usual. + +This patch is dependent on changes to paca allocation for boot CPU. It +expect boot CPU to discover 1T segment support which is introduced by +the patch posted here: +https://lists.ozlabs.org/pipermail/linuxppc-dev/2022-January/239175.html + +Reported-by: Abdul haleem +Signed-off-by: Sourabh Jain +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220204085601.107257-1-sourabhjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/rtas.c | 6 ++++++ + arch/powerpc/kexec/core.c | 15 +++++++++++---- + 2 files changed, 17 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index cccb32cf0e08..cf421eb7f90d 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -1296,6 +1296,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, + entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); + sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); + ++#ifdef CONFIG_PPC64 ++ /* need this feature to decide the crashkernel offset */ ++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) ++ powerpc_firmware_features |= FW_FEATURE_LPAR; ++#endif ++ + if (basep && entryp && sizep) { + rtas.base = *basep; + rtas.entry = *entryp; +diff --git a/arch/powerpc/kexec/core.c b/arch/powerpc/kexec/core.c +index 56da5eb2b923..80c79cb5010c 100644 +--- a/arch/powerpc/kexec/core.c ++++ b/arch/powerpc/kexec/core.c +@@ -147,11 +147,18 @@ void __init reserve_crashkernel(void) + if (!crashk_res.start) { + #ifdef CONFIG_PPC64 + /* +- * On 64bit we split the RMO in half but cap it at half of +- * a small SLB (128MB) since the crash kernel needs to place +- * itself and some stacks to be in the first segment. ++ * On the LPAR platform place the crash kernel to mid of ++ * RMA size (512MB or more) to ensure the crash kernel ++ * gets enough space to place itself and some stack to be ++ * in the first segment. At the same time normal kernel ++ * also get enough space to allocate memory for essential ++ * system resource in the first segment. Keep the crash ++ * kernel starts at 128MB offset on other platforms. + */ +- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); ++ if (firmware_has_feature(FW_FEATURE_LPAR)) ++ crashk_res.start = ppc64_rma_size / 2; ++ else ++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); + #else + crashk_res.start = KDUMP_KERNELBASE; + #endif +-- +2.35.1 + diff --git a/queue-5.10/ptp-replace-snprintf-with-sysfs_emit.patch b/queue-5.10/ptp-replace-snprintf-with-sysfs_emit.patch new file mode 100644 index 00000000000..9c83fc69b21 --- /dev/null +++ b/queue-5.10/ptp-replace-snprintf-with-sysfs_emit.patch @@ -0,0 +1,52 @@ +From 16e3807093cdfe84710d4d8ddf8e8e37054959b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 08:02:36 +0800 +Subject: ptp: replace snprintf with sysfs_emit + +From: Yang Guang + +[ Upstream commit e2cf07654efb0fd7bbcb475c6f74be7b5755a8fd ] + +coccinelle report: +./drivers/ptp/ptp_sysfs.c:17:8-16: +WARNING: use scnprintf or sprintf +./drivers/ptp/ptp_sysfs.c:390:8-16: +WARNING: use scnprintf or sprintf + +Use sysfs_emit instead of scnprintf or sprintf makes more sense. + +Reported-by: Zeal Robot +Signed-off-by: Yang Guang +Signed-off-by: David Yang +Acked-by: Richard Cochran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_sysfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index be076a91e20e..8cd59e848163 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -13,7 +13,7 @@ static ssize_t clock_name_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); ++ return sysfs_emit(page, "%s\n", ptp->info->name); + } + static DEVICE_ATTR_RO(clock_name); + +@@ -227,7 +227,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, + + mutex_unlock(&ptp->pincfg_mux); + +- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); ++ return sysfs_emit(page, "%u %u\n", func, chan); + } + + static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, +-- +2.35.1 + diff --git a/queue-5.10/revert-hv-utils-add-ptp_1588_clock-to-kconfig-to-fix.patch b/queue-5.10/revert-hv-utils-add-ptp_1588_clock-to-kconfig-to-fix.patch new file mode 100644 index 00000000000..a41840e754e --- /dev/null +++ b/queue-5.10/revert-hv-utils-add-ptp_1588_clock-to-kconfig-to-fix.patch @@ -0,0 +1,33 @@ +From c82c70d7fb8470c76246f54e1e4452215bae70bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Apr 2022 12:16:15 -0400 +Subject: Revert "hv: utils: add PTP_1588_CLOCK to Kconfig to fix build" + +This reverts commit c4dc584a2d4c8d74b054f09d67e0a076767bdee5. + +On Sat, Apr 09, 2022 at 09:07:51AM -0700, Randy Dunlap wrote: +>According to https://bugzilla.kernel.org/show_bug.cgi?id=215823, +>c4dc584a2d4c8d74b054f09d67e0a076767bdee5 ("hv: utils: add PTP_1588_CLOCK to Kconfig to fix build") +>is a problem for 5.10 since CONFIG_PTP_1588_CLOCK_OPTIONAL does not exist in 5.10. +>This prevents the hyper-V NIC timestamping from working, so please revert that commit. + +Signed-off-by: Sasha Levin +--- + drivers/hv/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig +index 210e532ac277..79e5356a737a 100644 +--- a/drivers/hv/Kconfig ++++ b/drivers/hv/Kconfig +@@ -17,7 +17,6 @@ config HYPERV_TIMER + config HYPERV_UTILS + tristate "Microsoft Hyper-V Utilities driver" + depends on HYPERV && CONNECTOR && NLS +- depends on PTP_1588_CLOCK_OPTIONAL + help + Select this option to enable the Hyper-V Utilities. + +-- +2.35.1 + diff --git a/queue-5.10/rtc-wm8350-handle-error-for-wm8350_register_irq.patch b/queue-5.10/rtc-wm8350-handle-error-for-wm8350_register_irq.patch new file mode 100644 index 00000000000..ebec0257e4c --- /dev/null +++ b/queue-5.10/rtc-wm8350-handle-error-for-wm8350_register_irq.patch @@ -0,0 +1,55 @@ +From 9101ea4d802f045bc499994d325f7eb9c7dc2a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 16:50:30 +0800 +Subject: rtc: wm8350: Handle error for wm8350_register_irq + +From: Jiasheng Jiang + +[ Upstream commit 43f0269b6b89c1eec4ef83c48035608f4dcdd886 ] + +As the potential failure of the wm8350_register_irq(), +it should be better to check it and return error if fails. +Also, it need not free 'wm_rtc->rtc' since it will be freed +automatically. + +Fixes: 077eaf5b40ec ("rtc: rtc-wm8350: add support for WM8350 RTC") +Signed-off-by: Jiasheng Jiang +Acked-by: Charles Keepax +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20220303085030.291793-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-wm8350.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c +index 2018614f258f..6eaa9321c074 100644 +--- a/drivers/rtc/rtc-wm8350.c ++++ b/drivers/rtc/rtc-wm8350.c +@@ -432,14 +432,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) + return ret; + } + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, + wm8350_rtc_update_handler, 0, + "RTC Seconds", wm8350); ++ if (ret) ++ return ret; ++ + wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, + wm8350_rtc_alarm_handler, 0, + "RTC Alarm", wm8350); ++ if (ret) { ++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); ++ return ret; ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.10/scsi-aha152x-fix-aha152x_setup-__setup-handler-retur.patch b/queue-5.10/scsi-aha152x-fix-aha152x_setup-__setup-handler-retur.patch new file mode 100644 index 00000000000..1acbfd950c2 --- /dev/null +++ b/queue-5.10/scsi-aha152x-fix-aha152x_setup-__setup-handler-retur.patch @@ -0,0 +1,52 @@ +From 528ab0ec981b9c734ec7cf982f005f3b04498db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 16:06:23 -0800 +Subject: scsi: aha152x: Fix aha152x_setup() __setup handler return value + +From: Randy Dunlap + +[ Upstream commit cc8294ec4738d25e2bb2d71f7d82a9bf7f4a157b ] + +__setup() handlers should return 1 if the command line option is handled +and 0 if not (or maybe never return 0; doing so just pollutes init's +environment with strings that are not init arguments/parameters). + +Return 1 from aha152x_setup() to indicate that the boot option has been +handled. + +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Link: https://lore.kernel.org/r/20220223000623.5920-1-rdunlap@infradead.org +Cc: "Juergen E. Fischer" +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Reported-by: Igor Zhbanov +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/aha152x.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c +index d8e19afa7a14..c6607c4686bb 100644 +--- a/drivers/scsi/aha152x.c ++++ b/drivers/scsi/aha152x.c +@@ -3367,13 +3367,11 @@ static int __init aha152x_setup(char *str) + setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; + setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; + setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; +- if (ints[0] > 8) { /*}*/ ++ if (ints[0] > 8) + printk(KERN_NOTICE "aha152x: usage: aha152x=[,[," + "[,[,[,[,[,]]]]]]]\n"); +- } else { ++ else + setup_count++; +- return 0; +- } + + return 1; + } +-- +2.35.1 + diff --git a/queue-5.10/scsi-bfa-replace-snprintf-with-sysfs_emit.patch b/queue-5.10/scsi-bfa-replace-snprintf-with-sysfs_emit.patch new file mode 100644 index 00000000000..b39a12da059 --- /dev/null +++ b/queue-5.10/scsi-bfa-replace-snprintf-with-sysfs_emit.patch @@ -0,0 +1,169 @@ +From 854c286f032b1e74d6740a5fc8ca6829af41c682 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 08:03:46 +0800 +Subject: scsi: bfa: Replace snprintf() with sysfs_emit() + +From: Yang Guang + +[ Upstream commit 2245ea91fd3a04cafbe2f54911432a8657528c3b ] + +coccinelle report: +./drivers/scsi/bfa/bfad_attr.c:908:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:860:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:888:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:853:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:808:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:728:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:822:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:927:9-17: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:900:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:874:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:714:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/bfa/bfad_attr.c:839:8-16: +WARNING: use scnprintf or sprintf + +Use sysfs_emit() instead of scnprintf() or sprintf(). + +Link: https://lore.kernel.org/r/def83ff75faec64ba592b867a8499b1367bae303.1643181468.git.yang.guang5@zte.com.cn +Reported-by: Zeal Robot +Signed-off-by: Yang Guang +Signed-off-by: David Yang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bfa/bfad_attr.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 5ae1e3f78910..e049cdb3c286 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -711,7 +711,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, + char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; + + bfa_get_adapter_serial_num(&bfad->bfa, serial_num); +- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); ++ return sysfs_emit(buf, "%s\n", serial_num); + } + + static ssize_t +@@ -725,7 +725,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, + char model[BFA_ADAPTER_MODEL_NAME_LEN]; + + bfa_get_adapter_model(&bfad->bfa, model); +- return snprintf(buf, PAGE_SIZE, "%s\n", model); ++ return sysfs_emit(buf, "%s\n", model); + } + + static ssize_t +@@ -805,7 +805,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, + snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, + "Invalid Model"); + +- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); ++ return sysfs_emit(buf, "%s\n", model_descr); + } + + static ssize_t +@@ -819,7 +819,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, + u64 nwwn; + + nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); +- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); ++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); + } + + static ssize_t +@@ -836,7 +836,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); + strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); +- return snprintf(buf, PAGE_SIZE, "%s\n", symname); ++ return sysfs_emit(buf, "%s\n", symname); + } + + static ssize_t +@@ -850,14 +850,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, + char hw_ver[BFA_VERSION_LEN]; + + bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); ++ return sysfs_emit(buf, "%s\n", hw_ver); + } + + static ssize_t + bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); + } + + static ssize_t +@@ -871,7 +871,7 @@ bfad_im_optionrom_version_show(struct device *dev, + char optrom_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); ++ return sysfs_emit(buf, "%s\n", optrom_ver); + } + + static ssize_t +@@ -885,7 +885,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, + char fw_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); ++ return sysfs_emit(buf, "%s\n", fw_ver); + } + + static ssize_t +@@ -897,7 +897,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, + (struct bfad_im_port_s *) shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + +- return snprintf(buf, PAGE_SIZE, "%d\n", ++ return sysfs_emit(buf, "%d\n", + bfa_get_nports(&bfad->bfa)); + } + +@@ -905,7 +905,7 @@ static ssize_t + bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); + } + + static ssize_t +@@ -924,14 +924,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, + rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), + GFP_ATOMIC); + if (rports == NULL) +- return snprintf(buf, PAGE_SIZE, "Failed\n"); ++ return sysfs_emit(buf, "Failed\n"); + + spin_lock_irqsave(&bfad->bfad_lock, flags); + bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); + kfree(rports); + +- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); ++ return sysfs_emit(buf, "%d\n", nrports); + } + + static DEVICE_ATTR(serial_number, S_IRUGO, +-- +2.35.1 + diff --git a/queue-5.10/scsi-hisi_sas-free-irq-vectors-in-order-for-v3-hw.patch b/queue-5.10/scsi-hisi_sas-free-irq-vectors-in-order-for-v3-hw.patch new file mode 100644 index 00000000000..6647125568a --- /dev/null +++ b/queue-5.10/scsi-hisi_sas-free-irq-vectors-in-order-for-v3-hw.patch @@ -0,0 +1,109 @@ +From 02a1c91b58e77c6e5017179abb8ad56bfe322a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 19:51:26 +0800 +Subject: scsi: hisi_sas: Free irq vectors in order for v3 HW + +From: Qi Liu + +[ Upstream commit 554fb72ee34f4732c7f694f56c3c6e67790352a0 ] + +If the driver probe fails to request the channel IRQ or fatal IRQ, the +driver will free the IRQ vectors before freeing the IRQs in free_irq(), +and this will cause a kernel BUG like this: + +------------[ cut here ]------------ +kernel BUG at drivers/pci/msi.c:369! +Internal error: Oops - BUG: 0 [#1] PREEMPT SMP +Call trace: + free_msi_irqs+0x118/0x13c + pci_disable_msi+0xfc/0x120 + pci_free_irq_vectors+0x24/0x3c + hisi_sas_v3_probe+0x360/0x9d0 [hisi_sas_v3_hw] + local_pci_probe+0x44/0xb0 + work_for_cpu_fn+0x20/0x34 + process_one_work+0x1d0/0x340 + worker_thread+0x2e0/0x460 + kthread+0x180/0x190 + ret_from_fork+0x10/0x20 +---[ end trace b88990335b610c11 ]--- + +So we use devm_add_action() to control the order in which we free the +vectors. + +Link: https://lore.kernel.org/r/1645703489-87194-4-git-send-email-john.garry@huawei.com +Signed-off-by: Qi Liu +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index a8998b016b86..cd41dc061d87 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -2372,17 +2372,25 @@ static irqreturn_t cq_interrupt_v3_hw(int irq_no, void *p) + return IRQ_WAKE_THREAD; + } + ++static void hisi_sas_v3_free_vectors(void *data) ++{ ++ struct pci_dev *pdev = data; ++ ++ pci_free_irq_vectors(pdev); ++} ++ + static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + { + int vectors; + int max_msi = HISI_SAS_MSI_COUNT_V3_HW, min_msi; + struct Scsi_Host *shost = hisi_hba->shost; ++ struct pci_dev *pdev = hisi_hba->pci_dev; + struct irq_affinity desc = { + .pre_vectors = BASE_VECTORS_V3_HW, + }; + + min_msi = MIN_AFFINE_VECTORS_V3_HW; +- vectors = pci_alloc_irq_vectors_affinity(hisi_hba->pci_dev, ++ vectors = pci_alloc_irq_vectors_affinity(pdev, + min_msi, max_msi, + PCI_IRQ_MSI | + PCI_IRQ_AFFINITY, +@@ -2394,6 +2402,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) + hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW; + shost->nr_hw_queues = hisi_hba->cq_nvecs; + ++ devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev); + return 0; + } + +@@ -3313,7 +3322,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + dev_err(dev, "%d hw queues\n", shost->nr_hw_queues); + rc = scsi_add_host(shost, dev); + if (rc) +- goto err_out_free_irq_vectors; ++ goto err_out_debugfs; + + rc = sas_register_ha(sha); + if (rc) +@@ -3340,8 +3349,6 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + err_out_register_ha: + scsi_remove_host(shost); +-err_out_free_irq_vectors: +- pci_free_irq_vectors(pdev); + err_out_debugfs: + hisi_sas_debugfs_exit(hisi_hba); + err_out_ha: +@@ -3369,7 +3376,6 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba) + + devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq); + } +- pci_free_irq_vectors(pdev); + } + + static void hisi_sas_v3_remove(struct pci_dev *pdev) +-- +2.35.1 + diff --git a/queue-5.10/scsi-libfc-fix-use-after-free-in-fc_exch_abts_resp.patch b/queue-5.10/scsi-libfc-fix-use-after-free-in-fc_exch_abts_resp.patch new file mode 100644 index 00000000000..b478340bfd2 --- /dev/null +++ b/queue-5.10/scsi-libfc-fix-use-after-free-in-fc_exch_abts_resp.patch @@ -0,0 +1,39 @@ +From be2de9215e0c7709b0697f9d03db3ce311e33028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 09:51:15 +0800 +Subject: scsi: libfc: Fix use after free in fc_exch_abts_resp() + +From: Jianglei Nie + +[ Upstream commit 271add11994ba1a334859069367e04d2be2ebdd4 ] + +fc_exch_release(ep) will decrease the ep's reference count. When the +reference count reaches zero, it is freed. But ep is still used in the +following code, which will lead to a use after free. + +Return after the fc_exch_release() call to avoid use after free. + +Link: https://lore.kernel.org/r/20220303015115.459778-1-niejianglei2021@163.com +Reviewed-by: Hannes Reinecke +Signed-off-by: Jianglei Nie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libfc/fc_exch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index a50f1eef0e0c..4261380af97b 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1702,6 +1702,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) + if (cancel_delayed_work_sync(&ep->timeout_work)) { + FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); + fc_exch_release(ep); /* release from pending timer hold */ ++ return; + } + + spin_lock_bh(&ep->ex_lock); +-- +2.35.1 + diff --git a/queue-5.10/scsi-mvsas-replace-snprintf-with-sysfs_emit.patch b/queue-5.10/scsi-mvsas-replace-snprintf-with-sysfs_emit.patch new file mode 100644 index 00000000000..fb35c02d2a4 --- /dev/null +++ b/queue-5.10/scsi-mvsas-replace-snprintf-with-sysfs_emit.patch @@ -0,0 +1,52 @@ +From cb7b9cb5d858ae165a25b7cc0b7e7841a4441d46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 08:00:59 +0800 +Subject: scsi: mvsas: Replace snprintf() with sysfs_emit() + +From: Yang Guang + +[ Upstream commit 0ad3867b0f13e45cfee5a1298bfd40eef096116c ] + +coccinelle report: +./drivers/scsi/mvsas/mv_init.c:699:8-16: +WARNING: use scnprintf or sprintf +./drivers/scsi/mvsas/mv_init.c:747:8-16: +WARNING: use scnprintf or sprintf + +Use sysfs_emit() instead of scnprintf() or sprintf(). + +Link: https://lore.kernel.org/r/c1711f7cf251730a8ceb5bdfc313bf85662b3395.1643182948.git.yang.guang5@zte.com.cn +Reported-by: Zeal Robot +Signed-off-by: Yang Guang +Signed-off-by: David Yang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvsas/mv_init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index b03c0f35d7b0..0cfea7b2ab13 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -697,7 +697,7 @@ static ssize_t + mvs_show_driver_version(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); ++ return sysfs_emit(buffer, "%s\n", DRV_VERSION); + } + + static DEVICE_ATTR(driver_version, +@@ -749,7 +749,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, + static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); ++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); + } + + static DEVICE_ATTR(interrupt_coalescing, +-- +2.35.1 + diff --git a/queue-5.10/scsi-pm8001-fix-memory-leak-in-pm8001_chip_fw_flash_.patch b/queue-5.10/scsi-pm8001-fix-memory-leak-in-pm8001_chip_fw_flash_.patch new file mode 100644 index 00000000000..ebfba405525 --- /dev/null +++ b/queue-5.10/scsi-pm8001-fix-memory-leak-in-pm8001_chip_fw_flash_.patch @@ -0,0 +1,41 @@ +From a34d03948427772db67e18007638ebdda814517d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 12:18:01 +0900 +Subject: scsi: pm8001: Fix memory leak in pm8001_chip_fw_flash_update_req() + +From: Damien Le Moal + +[ Upstream commit f792a3629f4c4aa4c3703d66b43ce1edcc3ec09a ] + +In pm8001_chip_fw_flash_update_build(), if +pm8001_chip_fw_flash_update_build() fails, the struct fw_control_ex +allocated must be freed. + +Link: https://lore.kernel.org/r/20220220031810.738362-23-damien.lemoal@opensource.wdc.com +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 397fce8de46c..da9fbe62a34d 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4845,8 +4845,10 @@ pm8001_chip_fw_flash_update_req(struct pm8001_hba_info *pm8001_ha, + ccb->ccb_tag = tag; + rc = pm8001_chip_fw_flash_update_build(pm8001_ha, &flash_update_info, + tag); +- if (rc) ++ if (rc) { ++ kfree(fw_control_context); + pm8001_tag_free(pm8001_ha, tag); ++ } + + return rc; + } +-- +2.35.1 + diff --git a/queue-5.10/scsi-pm8001-fix-pm8001_mpi_task_abort_resp.patch b/queue-5.10/scsi-pm8001-fix-pm8001_mpi_task_abort_resp.patch new file mode 100644 index 00000000000..4d5e97997ff --- /dev/null +++ b/queue-5.10/scsi-pm8001-fix-pm8001_mpi_task_abort_resp.patch @@ -0,0 +1,46 @@ +From 3520cda8ced63c781722fbc864fd08854f0af82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 12:17:57 +0900 +Subject: scsi: pm8001: Fix pm8001_mpi_task_abort_resp() + +From: Damien Le Moal + +[ Upstream commit 7e6b7e740addcea450041b5be8e42f0a4ceece0f ] + +The call to pm8001_ccb_task_free() at the end of +pm8001_mpi_task_abort_resp() already frees the ccb tag. So when the device +NCQ_ABORT_ALL_FLAG is set, the tag should not be freed again. Also change +the hardcoded 0xBFFFFFFF value to ~NCQ_ABORT_ALL_FLAG as it ought to be. + +Link: https://lore.kernel.org/r/20220220031810.738362-19-damien.lemoal@opensource.wdc.com +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index cd0e1d31db70..e0803ce2957b 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -3669,12 +3669,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + mb(); + + if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { +- pm8001_tag_free(pm8001_ha, tag); + sas_free_task(t); +- /* clear the flag */ +- pm8001_dev->id &= 0xBFFFFFFF; +- } else ++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; ++ } else { + t->task_done(t); ++ } + + return 0; + } +-- +2.35.1 + diff --git a/queue-5.10/scsi-pm8001-fix-pm80xx_pci_mem_copy-interface.patch b/queue-5.10/scsi-pm8001-fix-pm80xx_pci_mem_copy-interface.patch new file mode 100644 index 00000000000..3a3d29d3bb1 --- /dev/null +++ b/queue-5.10/scsi-pm8001-fix-pm80xx_pci_mem_copy-interface.patch @@ -0,0 +1,61 @@ +From 87de112c24db2bb3b5ff4950c08cda0b1aed2da4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 12:17:44 +0900 +Subject: scsi: pm8001: Fix pm80xx_pci_mem_copy() interface + +From: Damien Le Moal + +[ Upstream commit 3762d8f6edcdb03994c919f9487fd6d336c06561 ] + +The declaration of the local variable destination1 in pm80xx_pci_mem_copy() +as a pointer to a u32 results in the sparse warning: + +warning: incorrect type in assignment (different base types) + expected unsigned int [usertype] + got restricted __le32 [usertype] + +Furthermore, the destination" argument of pm80xx_pci_mem_copy() is wrongly +declared with the const attribute. + +Fix both problems by changing the type of the "destination" argument to +"__le32 *" and use this argument directly inside the pm80xx_pci_mem_copy() +function, thus removing the need for the destination1 local variable. + +Link: https://lore.kernel.org/r/20220220031810.738362-6-damien.lemoal@opensource.wdc.com +Reviewed-by: Jack Wang +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm80xx_hwi.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index b5e60553acdc..a10c6f6b6f25 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -66,18 +66,16 @@ int pm80xx_bar4_shift(struct pm8001_hba_info *pm8001_ha, u32 shift_value) + } + + static void pm80xx_pci_mem_copy(struct pm8001_hba_info *pm8001_ha, u32 soffset, +- const void *destination, ++ __le32 *destination, + u32 dw_count, u32 bus_base_number) + { + u32 index, value, offset; +- u32 *destination1; +- destination1 = (u32 *)destination; + +- for (index = 0; index < dw_count; index += 4, destination1++) { ++ for (index = 0; index < dw_count; index += 4, destination++) { + offset = (soffset + index); + if (offset < (64 * 1024)) { + value = pm8001_cr32(pm8001_ha, bus_base_number, offset); +- *destination1 = cpu_to_le32(value); ++ *destination = cpu_to_le32(value); + } + } + return; +-- +2.35.1 + diff --git a/queue-5.10/scsi-pm8001-fix-tag-leaks-on-error.patch b/queue-5.10/scsi-pm8001-fix-tag-leaks-on-error.patch new file mode 100644 index 00000000000..4f49922dec7 --- /dev/null +++ b/queue-5.10/scsi-pm8001-fix-tag-leaks-on-error.patch @@ -0,0 +1,102 @@ +From 5166c7c39907aab78f660926f637190170303e5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 12:18:00 +0900 +Subject: scsi: pm8001: Fix tag leaks on error + +From: Damien Le Moal + +[ Upstream commit 4c8f04b1905cd4b776d0b720463c091545478ef7 ] + +In pm8001_chip_set_dev_state_req(), pm8001_chip_fw_flash_update_req(), +pm80xx_chip_phy_ctl_req() and pm8001_chip_reg_dev_req() add missing calls +to pm8001_tag_free() to free the allocated tag when pm8001_mpi_build_cmd() +fails. + +Similarly, in pm8001_exec_internal_task_abort(), if the chip ->task_abort +method fails, the tag allocated for the abort request task must be +freed. Add the missing call to pm8001_tag_free(). + +Link: https://lore.kernel.org/r/20220220031810.738362-22-damien.lemoal@opensource.wdc.com +Reviewed-by: John Garry +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 9 +++++++++ + drivers/scsi/pm8001/pm8001_sas.c | 2 +- + drivers/scsi/pm8001/pm80xx_hwi.c | 9 +++++++-- + 3 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 616e52be817d..397fce8de46c 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -4430,6 +4430,9 @@ static int pm8001_chip_reg_dev_req(struct pm8001_hba_info *pm8001_ha, + SAS_ADDR_SIZE); + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, + sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ + return rc; + } + +@@ -4842,6 +4845,9 @@ pm8001_chip_fw_flash_update_req(struct pm8001_hba_info *pm8001_ha, + ccb->ccb_tag = tag; + rc = pm8001_chip_fw_flash_update_build(pm8001_ha, &flash_update_info, + tag); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ + return rc; + } + +@@ -4946,6 +4952,9 @@ pm8001_chip_set_dev_state_req(struct pm8001_hba_info *pm8001_ha, + payload.nds = cpu_to_le32(state); + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, + sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ + return rc; + + } +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 75ac4d86d9c4..ba5852548bee 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -831,10 +831,10 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, + + res = PM8001_CHIP_DISP->task_abort(pm8001_ha, + pm8001_dev, flag, task_tag, ccb_tag); +- + if (res) { + del_timer(&task->slow_task->timer); + pm8001_dbg(pm8001_ha, FAIL, "Executing internal task failed\n"); ++ pm8001_tag_free(pm8001_ha, ccb_tag); + goto ex_err; + } + wait_for_completion(&task->slow_task->completion); +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index a10c6f6b6f25..4c03bf08b543 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -4847,8 +4847,13 @@ static int pm80xx_chip_phy_ctl_req(struct pm8001_hba_info *pm8001_ha, + payload.tag = cpu_to_le32(tag); + payload.phyop_phyid = + cpu_to_le32(((phy_op & 0xFF) << 8) | (phyId & 0xFF)); +- return pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, +- sizeof(payload), 0); ++ ++ rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, ++ sizeof(payload), 0); ++ if (rc) ++ pm8001_tag_free(pm8001_ha, tag); ++ ++ return rc; + } + + static u32 pm80xx_chip_is_our_interrupt(struct pm8001_hba_info *pm8001_ha) +-- +2.35.1 + diff --git a/queue-5.10/scsi-pm8001-fix-task-leak-in-pm8001_send_abort_all.patch b/queue-5.10/scsi-pm8001-fix-task-leak-in-pm8001_send_abort_all.patch new file mode 100644 index 00000000000..d06732c2203 --- /dev/null +++ b/queue-5.10/scsi-pm8001-fix-task-leak-in-pm8001_send_abort_all.patch @@ -0,0 +1,60 @@ +From 2e484a076f2db66f1bec7172cbd3b108efd5a5e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 12:17:59 +0900 +Subject: scsi: pm8001: Fix task leak in pm8001_send_abort_all() + +From: Damien Le Moal + +[ Upstream commit f90a74892f3acf0cdec5844e90fc8686ca13e7d7 ] + +In pm8001_send_abort_all(), make sure to free the allocated sas task +if pm8001_tag_alloc() or pm8001_mpi_build_cmd() fail. + +Link: https://lore.kernel.org/r/20220220031810.738362-21-damien.lemoal@opensource.wdc.com +Reviewed-by: John Garry +Signed-off-by: Damien Le Moal +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_hwi.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index e0803ce2957b..616e52be817d 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1711,7 +1711,6 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + } + + task = sas_alloc_slow_task(GFP_ATOMIC); +- + if (!task) { + pm8001_dbg(pm8001_ha, FAIL, "cannot allocate task\n"); + return; +@@ -1720,8 +1719,10 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + task->task_done = pm8001_task_done; + + res = pm8001_tag_alloc(pm8001_ha, &ccb_tag); +- if (res) ++ if (res) { ++ sas_free_task(task); + return; ++ } + + ccb = &pm8001_ha->ccb_info[ccb_tag]; + ccb->device = pm8001_ha_dev; +@@ -1738,8 +1739,10 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &task_abort, + sizeof(task_abort), 0); +- if (ret) ++ if (ret) { ++ sas_free_task(task); + pm8001_tag_free(pm8001_ha, ccb_tag); ++ } + + } + +-- +2.35.1 + diff --git a/queue-5.10/serial-samsung_tty-do-not-unlock-port-lock-for-uart_.patch b/queue-5.10/serial-samsung_tty-do-not-unlock-port-lock-for-uart_.patch new file mode 100644 index 00000000000..b12b1d22720 --- /dev/null +++ b/queue-5.10/serial-samsung_tty-do-not-unlock-port-lock-for-uart_.patch @@ -0,0 +1,53 @@ +From 6444707db7b6eaa5c305cf7c7c11cb6850b28d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 12:51:53 +0100 +Subject: serial: samsung_tty: do not unlock port->lock for uart_write_wakeup() + +From: Jiri Slaby + +[ Upstream commit 988c7c00691008ea1daaa1235680a0da49dab4e8 ] + +The commit c15c3747ee32 (serial: samsung: fix potential soft lockup +during uart write) added an unlock of port->lock before +uart_write_wakeup() and a lock after it. It was always problematic to +write data from tty_ldisc_ops::write_wakeup and it was even documented +that way. We fixed the line disciplines to conform to this recently. +So if there is still a missed one, we should fix them instead of this +workaround. + +On the top of that, s3c24xx_serial_tx_dma_complete() in this driver +still holds the port->lock while calling uart_write_wakeup(). + +So revert the wrap added by the commit above. + +Cc: Thomas Abraham +Cc: Kyungmin Park +Cc: Hyeonkook Kim +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20220308115153.4225-1-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/samsung_tty.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/tty/serial/samsung_tty.c b/drivers/tty/serial/samsung_tty.c +index 8ae3e03fbd8c..81faead3c4f8 100644 +--- a/drivers/tty/serial/samsung_tty.c ++++ b/drivers/tty/serial/samsung_tty.c +@@ -883,11 +883,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) + goto out; + } + +- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { +- spin_unlock(&port->lock); ++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- spin_lock(&port->lock); +- } + + if (uart_circ_empty(xmit)) + s3c24xx_serial_stop_tx(port); +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..c543c597276 --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,97 @@ +ubifs-rectify-space-amount-budget-for-mkdir-tmpfile-.patch +gfs2-check-for-active-reservation-in-gfs2_release.patch +gfs2-fix-gfs2_release-for-non-writers-regression.patch +gfs2-gfs2_setattr_size-error-path-fix.patch +rtc-wm8350-handle-error-for-wm8350_register_irq.patch +kvm-x86-svm-clear-reserved-bits-written-to-perfevtse.patch +kvm-x86-emulator-emulate-rdpid-only-if-it-is-enabled.patch +drm-add-orientation-quirk-for-gpd-win-max.patch +ath5k-fix-oob-in-ath5k_eeprom_read_pcal_info_5111.patch +drm-amd-display-add-signal-type-check-when-verify-st.patch +drm-amd-amdgpu-amdgpu_cs-fix-refcount-leak-of-a-dma_.patch +usb-gadget-tegra-xudc-do-not-program-sparam.patch +usb-gadget-tegra-xudc-fix-control-endpoint-s-definit.patch +ptp-replace-snprintf-with-sysfs_emit.patch +powerpc-dts-t104xrdb-fix-phy-type-for-fman-4-5.patch +ath11k-fix-kernel-panic-during-unload-load-ath11k-mo.patch +ath11k-mhi-use-mhi_sync_power_up.patch +bpf-make-dst_port-field-in-struct-bpf_sock-16-bit-wi.patch +scsi-mvsas-replace-snprintf-with-sysfs_emit.patch +scsi-bfa-replace-snprintf-with-sysfs_emit.patch +power-supply-axp20x_battery-properly-report-current-.patch +mt76-dma-initialize-skip_unmap-in-mt76_dma_rx_fill.patch +cfg80211-don-t-add-non-transmitted-bss-to-6ghz-scann.patch +libbpf-fix-build-issue-with-llvm-readelf.patch +ipv6-make-mc_forwarding-atomic.patch +powerpc-set-crashkernel-offset-to-mid-of-rma-region.patch +drm-amdgpu-fix-recursive-locking-warning.patch +pci-aardvark-fix-support-for-msi-interrupts.patch +iommu-arm-smmu-v3-fix-event-handling-soft-lockup.patch +usb-ehci-add-pci-device-support-for-aspeed-platforms.patch +pci-endpoint-fix-alignment-fault-error-in-copy-tests.patch +tcp-don-t-acquire-inet_listen_hashbucket-lock-with-d.patch +pci-pciehp-add-qualcomm-quirk-for-command-completed-.patch +power-supply-axp288-charger-set-vhold-to-4.4v.patch +iwlwifi-mvm-correctly-set-fragmented-ebs.patch +ipv4-invalidate-neighbour-for-broadcast-address-upon.patch +dm-ioctl-prevent-potential-spectre-v1-gadget.patch +dm-requeue-io-if-mapping-table-not-yet-available.patch +drm-amdkfd-make-crat-table-missing-message-informati.patch +scsi-pm8001-fix-pm80xx_pci_mem_copy-interface.patch +scsi-pm8001-fix-pm8001_mpi_task_abort_resp.patch +scsi-pm8001-fix-task-leak-in-pm8001_send_abort_all.patch +scsi-pm8001-fix-tag-leaks-on-error.patch +scsi-pm8001-fix-memory-leak-in-pm8001_chip_fw_flash_.patch +mt76-mt7615-fix-assigning-negative-values-to-unsigne.patch +scsi-aha152x-fix-aha152x_setup-__setup-handler-retur.patch +scsi-hisi_sas-free-irq-vectors-in-order-for-v3-hw.patch +net-smc-correct-settings-of-rmb-window-update-limit.patch +mips-ralink-fix-a-refcount-leak-in-ill_acc_of_setup.patch +macvtap-advertise-link-netns-via-netlink.patch +tuntap-add-sanity-checks-about-msg_controllen-in-sen.patch +bluetooth-fix-not-checking-for-valid-hdev-on-bt_dev_.patch +bluetooth-use-memset-avoid-memory-leaks.patch +bnxt_en-eliminate-unintended-link-toggle-during-fw-r.patch +pci-endpoint-fix-misused-goto-label.patch +mips-fix-fortify-panic-when-copying-asm-exception-ha.patch +powerpc-code-patching-pre-map-patch-area.patch +powerpc-secvar-fix-refcount-leak-in-format_show.patch +scsi-libfc-fix-use-after-free-in-fc_exch_abts_resp.patch +can-isotp-set-default-value-for-n_as-to-50-micro-sec.patch +net-account-alternate-interface-name-memory.patch +net-limit-altnames-to-64k-total.patch +net-sfp-add-2500base-x-quirk-for-lantech-sfp-module.patch +usb-dwc3-omap-fix-unbalanced-disables-for-smps10_out.patch +xtensa-fix-dtc-warning-unit_address_format.patch +mips-ingenic-correct-unit-node-address.patch +bluetooth-fix-use-after-free-in-hci_send_acl.patch +netlabel-fix-out-of-bounds-memory-accesses.patch +ceph-fix-memory-leak-in-ceph_readdir-when-note_last_.patch +init-main.c-return-1-from-handled-__setup-functions.patch +minix-fix-bug-when-opening-a-file-with-o_direct.patch +clk-si5341-fix-reported-clk_rate-when-output-divider.patch +staging-vchiq_core-handle-null-result-of-find_servic.patch +phy-amlogic-meson8b-usb2-use-dev_err_probe.patch +staging-wfx-fix-an-error-handling-in-wfx_init_common.patch +w1-w1_therm-fixes-w1_seq-for-ds28ea00-sensors.patch +nfsv4.2-fix-reference-count-leaks-in-_nfs42_proc_cop.patch +nfsv4-protect-the-state-recovery-thread-against-dire.patch +xen-delay-xen_hvm_init_time_ops-if-kdump-is-boot-on-.patch +clk-ti-preserve-node-in-ti_dt_clocks_register.patch +clk-enforce-that-disjoints-limits-are-invalid.patch +sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch +sunrpc-xprt-async-tasks-mustn-t-block-waiting-for-me.patch +sunrpc-remove-scheduling-boost-for-swapper-tasks.patch +nfs-swap-io-handling-is-slightly-different-for-o_dir.patch +nfs-swap-out-must-always-use-stable-writes.patch +x86-kconfig-do-not-allow-config_x86_x32_abi-y-with-l.patch +serial-samsung_tty-do-not-unlock-port-lock-for-uart_.patch +virtio_console-eliminate-anonymous-module_init-modul.patch +jfs-prevent-null-deref-in-difree.patch +sunrpc-fix-socket-waits-for-write-buffer-space.patch +nfs-nfsiod-should-not-block-forever-in-mempool_alloc.patch +nfs-avoid-writeback-threads-getting-stuck-in-mempool.patch +parisc-fix-cpu-affinity-for-lasi-wax-and-dino-chips.patch +parisc-fix-patch-code-locking-and-flushing.patch +mm-fix-race-between-madv_free-reclaim-and-blkdev-dir.patch +revert-hv-utils-add-ptp_1588_clock-to-kconfig-to-fix.patch diff --git a/queue-5.10/staging-vchiq_core-handle-null-result-of-find_servic.patch b/queue-5.10/staging-vchiq_core-handle-null-result-of-find_servic.patch new file mode 100644 index 00000000000..a6df0863d4c --- /dev/null +++ b/queue-5.10/staging-vchiq_core-handle-null-result-of-find_servic.patch @@ -0,0 +1,48 @@ +From 9c206d68cc996fe30ce1c87bae65c2569ebed5ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 21:02:22 +0100 +Subject: staging: vchiq_core: handle NULL result of find_service_by_handle + +From: Stefan Wahren + +[ Upstream commit ca225857faf237234d2fffe5d1919467dfadd822 ] + +In case of an invalid handle the function find_servive_by_handle +returns NULL. So take care of this and avoid a NULL pointer dereference. + +Reviewed-by: Nicolas Saenz Julienne +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/1642968143-19281-18-git-send-email-stefan.wahren@i2se.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +index 38b10fd5d992..95b91fe45cb3 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -2280,6 +2280,9 @@ void vchiq_msg_queue_push(unsigned int handle, struct vchiq_header *header) + struct vchiq_service *service = find_service_by_handle(handle); + int pos; + ++ if (!service) ++ return; ++ + while (service->msg_queue_write == service->msg_queue_read + + VCHIQ_MAX_SLOTS) { + if (wait_for_completion_interruptible(&service->msg_queue_pop)) +@@ -2299,6 +2302,9 @@ struct vchiq_header *vchiq_msg_hold(unsigned int handle) + struct vchiq_header *header; + int pos; + ++ if (!service) ++ return NULL; ++ + if (service->msg_queue_write == service->msg_queue_read) + return NULL; + +-- +2.35.1 + diff --git a/queue-5.10/staging-wfx-fix-an-error-handling-in-wfx_init_common.patch b/queue-5.10/staging-wfx-fix-an-error-handling-in-wfx_init_common.patch new file mode 100644 index 00000000000..6199ee35e64 --- /dev/null +++ b/queue-5.10/staging-wfx-fix-an-error-handling-in-wfx_init_common.patch @@ -0,0 +1,56 @@ +From 7826ebbcb75f84e33c9de2023d9d36fd6f5ccd29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 21:59:45 +0800 +Subject: staging: wfx: fix an error handling in wfx_init_common() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiaoke Wang + +[ Upstream commit 60f1d3c92dc1ef1026e5b917a329a7fa947da036 ] + +One error handler of wfx_init_common() return without calling +ieee80211_free_hw(hw), which may result in memory leak. And I add +one err label to unify the error handler, which is useful for the +subsequent changes. + +Suggested-by: Jérôme Pouiller +Reviewed-by: Dan Carpenter +Reviewed-by: Jérôme Pouiller +Signed-off-by: Xiaoke Wang +Link: https://lore.kernel.org/r/tencent_24A24A3EFF61206ECCC4B94B1C5C1454E108@qq.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/wfx/main.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/wfx/main.c b/drivers/staging/wfx/main.c +index e7bc1988124a..d5dacd5583c6 100644 +--- a/drivers/staging/wfx/main.c ++++ b/drivers/staging/wfx/main.c +@@ -309,7 +309,8 @@ struct wfx_dev *wfx_init_common(struct device *dev, + wdev->pdata.gpio_wakeup = devm_gpiod_get_optional(dev, "wakeup", + GPIOD_OUT_LOW); + if (IS_ERR(wdev->pdata.gpio_wakeup)) +- return NULL; ++ goto err; ++ + if (wdev->pdata.gpio_wakeup) + gpiod_set_consumer_name(wdev->pdata.gpio_wakeup, "wfx wakeup"); + +@@ -328,6 +329,10 @@ struct wfx_dev *wfx_init_common(struct device *dev, + return NULL; + + return wdev; ++ ++err: ++ ieee80211_free_hw(hw); ++ return NULL; + } + + int wfx_probe(struct wfx_dev *wdev) +-- +2.35.1 + diff --git a/queue-5.10/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch b/queue-5.10/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch new file mode 100644 index 00000000000..0df78a13038 --- /dev/null +++ b/queue-5.10/sunrpc-call_alloc-async-tasks-mustn-t-block-waiting-.patch @@ -0,0 +1,65 @@ +From 0ca3e4eacda0a38fe81d3fb1bef7ccb2e49a1ddc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: SUNRPC/call_alloc: async tasks mustn't block waiting for memory + +From: NeilBrown + +[ Upstream commit c487216bec83b0c5a8803e5c61433d33ad7b104d ] + +When memory is short, new worker threads cannot be created and we depend +on the minimum one rpciod thread to be able to handle everything. +So it must not block waiting for memory. + +mempools are particularly a problem as memory can only be released back +to the mempool by an async rpc task running. If all available +workqueue threads are waiting on the mempool, no thread is available to +return anything. + +rpc_malloc() can block, and this might cause deadlocks. +So check RPC_IS_ASYNC(), rather than RPC_IS_SWAPPER() to determine if +blocking is acceptable. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/sched.c | 4 +++- + net/sunrpc/xprtrdma/transport.c | 4 +++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index c045f63d11fa..6e4d476c6324 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -1012,8 +1012,10 @@ int rpc_malloc(struct rpc_task *task) + struct rpc_buffer *buf; + gfp_t gfp = GFP_NOFS; + ++ if (RPC_IS_ASYNC(task)) ++ gfp = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ gfp |= __GFP_MEMALLOC; + + size += sizeof(struct rpc_buffer); + if (size <= RPC_BUFFER_MAXSIZE) +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index 8e2368a0c2a2..fb7a0ab27899 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -572,8 +572,10 @@ xprt_rdma_allocate(struct rpc_task *task) + gfp_t flags; + + flags = RPCRDMA_DEF_GFP; ++ if (RPC_IS_ASYNC(task)) ++ flags = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ flags |= __GFP_MEMALLOC; + + if (!rpcrdma_check_regbuf(r_xprt, req->rl_sendbuf, rqst->rq_callsize, + flags)) +-- +2.35.1 + diff --git a/queue-5.10/sunrpc-fix-socket-waits-for-write-buffer-space.patch b/queue-5.10/sunrpc-fix-socket-waits-for-write-buffer-space.patch new file mode 100644 index 00000000000..52861f2461e --- /dev/null +++ b/queue-5.10/sunrpc-fix-socket-waits-for-write-buffer-space.patch @@ -0,0 +1,128 @@ +From d24b1613980f8af1a4643de5ac7858a623ecbd23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 21:02:10 -0400 +Subject: SUNRPC: Fix socket waits for write buffer space + +From: Trond Myklebust + +[ Upstream commit 7496b59f588dd52886fdbac7633608097543a0a5 ] + +The socket layer requires that we use the socket lock to protect changes +to the sock->sk_write_pending field and others. + +Reported-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 54 +++++++++++++++++++++++++++++++------------ + 1 file changed, 39 insertions(+), 15 deletions(-) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 16c7758e7bf3..bd123f1d0923 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -754,12 +754,12 @@ xs_stream_start_connect(struct sock_xprt *transport) + /** + * xs_nospace - handle transmit was incomplete + * @req: pointer to RPC request ++ * @transport: pointer to struct sock_xprt + * + */ +-static int xs_nospace(struct rpc_rqst *req) ++static int xs_nospace(struct rpc_rqst *req, struct sock_xprt *transport) + { +- struct rpc_xprt *xprt = req->rq_xprt; +- struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); ++ struct rpc_xprt *xprt = &transport->xprt; + struct sock *sk = transport->inet; + int ret = -EAGAIN; + +@@ -770,25 +770,49 @@ static int xs_nospace(struct rpc_rqst *req) + + /* Don't race with disconnect */ + if (xprt_connected(xprt)) { ++ struct socket_wq *wq; ++ ++ rcu_read_lock(); ++ wq = rcu_dereference(sk->sk_wq); ++ set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); ++ rcu_read_unlock(); ++ + /* wait for more buffer space */ ++ set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); + sk->sk_write_pending++; + xprt_wait_for_buffer_space(xprt); + } else + ret = -ENOTCONN; + + spin_unlock(&xprt->transport_lock); ++ return ret; ++} + +- /* Race breaker in case memory is freed before above code is called */ +- if (ret == -EAGAIN) { +- struct socket_wq *wq; ++static int xs_sock_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; + +- rcu_read_lock(); +- wq = rcu_dereference(sk->sk_wq); +- set_bit(SOCKWQ_ASYNC_NOSPACE, &wq->flags); +- rcu_read_unlock(); ++ lock_sock(sk); ++ if (!sock_writeable(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); ++ return ret; ++} + +- sk->sk_write_space(sk); +- } ++static int xs_stream_nospace(struct rpc_rqst *req) ++{ ++ struct sock_xprt *transport = ++ container_of(req->rq_xprt, struct sock_xprt, xprt); ++ struct sock *sk = transport->inet; ++ int ret = -EAGAIN; ++ ++ lock_sock(sk); ++ if (!sk_stream_memory_free(sk)) ++ ret = xs_nospace(req, transport); ++ release_sock(sk); + return ret; + } + +@@ -878,7 +902,7 @@ static int xs_local_send_request(struct rpc_rqst *req) + case -ENOBUFS: + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + default: + dprintk("RPC: sendmsg returned unrecognized error %d\n", +@@ -954,7 +978,7 @@ static int xs_udp_send_request(struct rpc_rqst *req) + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_sock_nospace(req); + break; + case -ENETUNREACH: + case -ENOBUFS: +@@ -1069,7 +1093,7 @@ static int xs_tcp_send_request(struct rpc_rqst *req) + /* Should we call xs_close() here? */ + break; + case -EAGAIN: +- status = xs_nospace(req); ++ status = xs_stream_nospace(req); + break; + case -ECONNRESET: + case -ECONNREFUSED: +-- +2.35.1 + diff --git a/queue-5.10/sunrpc-remove-scheduling-boost-for-swapper-tasks.patch b/queue-5.10/sunrpc-remove-scheduling-boost-for-swapper-tasks.patch new file mode 100644 index 00000000000..0ed770dd6fd --- /dev/null +++ b/queue-5.10/sunrpc-remove-scheduling-boost-for-swapper-tasks.patch @@ -0,0 +1,79 @@ +From 578e3267e4c9282d94ccf47856ebb728ebf3e781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: SUNRPC: remove scheduling boost for "SWAPPER" tasks. + +From: NeilBrown + +[ Upstream commit a80a8461868905823609be97f91776a26befe839 ] + +Currently, tasks marked as "swapper" tasks get put to the front of +non-priority rpc_queues, and are sorted earlier than non-swapper tasks on +the transport's ->xmit_queue. + +This is pointless as currently *all* tasks for a mount that has swap +enabled on *any* file are marked as "swapper" tasks. So the net result +is that the non-priority rpc_queues are reverse-ordered (LIFO). + +This scheduling boost is not necessary to avoid deadlocks, and hurts +fairness, so remove it. If there were a need to expedite some requests, +the tk_priority mechanism is a more appropriate tool. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/sched.c | 7 ------- + net/sunrpc/xprt.c | 11 ----------- + 2 files changed, 18 deletions(-) + +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 6e4d476c6324..f0f55fbd1375 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -186,11 +186,6 @@ static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue, + + /* + * Add new request to wait queue. +- * +- * Swapper tasks always get inserted at the head of the queue. +- * This should avoid many nasty memory deadlocks and hopefully +- * improve overall performance. +- * Everyone else gets appended to the queue to ensure proper FIFO behavior. + */ + static void __rpc_add_wait_queue(struct rpc_wait_queue *queue, + struct rpc_task *task, +@@ -199,8 +194,6 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue, + INIT_LIST_HEAD(&task->u.tk_wait.timer_list); + if (RPC_IS_PRIORITY(queue)) + __rpc_add_wait_queue_priority(queue, task, queue_priority); +- else if (RPC_IS_SWAPPER(task)) +- list_add(&task->u.tk_wait.list, &queue->tasks[0]); + else + list_add_tail(&task->u.tk_wait.list, &queue->tasks[0]); + task->tk_waitqueue = queue; +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 441a8604c060..6bc225d64d23 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1306,17 +1306,6 @@ xprt_request_enqueue_transmit(struct rpc_task *task) + INIT_LIST_HEAD(&req->rq_xmit2); + goto out; + } +- } else if (RPC_IS_SWAPPER(task)) { +- list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) { +- if (pos->rq_cong || pos->rq_bytes_sent) +- continue; +- if (RPC_IS_SWAPPER(pos->rq_task)) +- continue; +- /* Note: req is added _before_ pos */ +- list_add_tail(&req->rq_xmit, &pos->rq_xmit); +- INIT_LIST_HEAD(&req->rq_xmit2); +- goto out; +- } + } else if (!req->rq_seqno) { + list_for_each_entry(pos, &xprt->xmit_queue, rq_xmit) { + if (pos->rq_task->tk_owner != task->tk_owner) +-- +2.35.1 + diff --git a/queue-5.10/sunrpc-xprt-async-tasks-mustn-t-block-waiting-for-me.patch b/queue-5.10/sunrpc-xprt-async-tasks-mustn-t-block-waiting-for-me.patch new file mode 100644 index 00000000000..e6b36c29ab5 --- /dev/null +++ b/queue-5.10/sunrpc-xprt-async-tasks-mustn-t-block-waiting-for-me.patch @@ -0,0 +1,67 @@ +From c2c4a00a735bf40a560485f74b44af10c59ddb97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 10:41:44 +1100 +Subject: SUNRPC/xprt: async tasks mustn't block waiting for memory + +From: NeilBrown + +[ Upstream commit a721035477fb5fb8abc738fbe410b07c12af3dc5 ] + +When memory is short, new worker threads cannot be created and we depend +on the minimum one rpciod thread to be able to handle everything. So it +must not block waiting for memory. + +xprt_dynamic_alloc_slot can block indefinitely. This can tie up all +workqueue threads and NFS can deadlock. So when called from a +workqueue, set __GFP_NORETRY. + +The rdma alloc_slot already does not block. However it sets the error +to -EAGAIN suggesting this will trigger a sleep. It does not. As we +can see in call_reserveresult(), only -ENOMEM causes a sleep. -EAGAIN +causes immediate retry. + +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprt.c | 5 ++++- + net/sunrpc/xprtrdma/transport.c | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 46304e647c49..441a8604c060 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1635,12 +1635,15 @@ static bool xprt_throttle_congested(struct rpc_xprt *xprt, struct rpc_task *task + static struct rpc_rqst *xprt_dynamic_alloc_slot(struct rpc_xprt *xprt) + { + struct rpc_rqst *req = ERR_PTR(-EAGAIN); ++ gfp_t gfp_mask = GFP_KERNEL; + + if (xprt->num_reqs >= xprt->max_reqs) + goto out; + ++xprt->num_reqs; + spin_unlock(&xprt->reserve_lock); +- req = kzalloc(sizeof(struct rpc_rqst), GFP_NOFS); ++ if (current->flags & PF_WQ_WORKER) ++ gfp_mask |= __GFP_NORETRY | __GFP_NOWARN; ++ req = kzalloc(sizeof(*req), gfp_mask); + spin_lock(&xprt->reserve_lock); + if (req != NULL) + goto out; +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index fb7a0ab27899..9cf10cfb85c6 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -519,7 +519,7 @@ xprt_rdma_alloc_slot(struct rpc_xprt *xprt, struct rpc_task *task) + return; + + out_sleep: +- task->tk_status = -EAGAIN; ++ task->tk_status = -ENOMEM; + xprt_add_backlog(xprt, task); + } + +-- +2.35.1 + diff --git a/queue-5.10/tcp-don-t-acquire-inet_listen_hashbucket-lock-with-d.patch b/queue-5.10/tcp-don-t-acquire-inet_listen_hashbucket-lock-with-d.patch new file mode 100644 index 00000000000..9fadfc50d6a --- /dev/null +++ b/queue-5.10/tcp-don-t-acquire-inet_listen_hashbucket-lock-with-d.patch @@ -0,0 +1,173 @@ +From 92e3c756e84096e6011e041c0acbe63e1dd3ef06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 19:56:57 +0100 +Subject: tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH. + +From: Sebastian Andrzej Siewior + +[ Upstream commit 4f9bf2a2f5aacf988e6d5e56b961ba45c5a25248 ] + +Commit + 9652dc2eb9e40 ("tcp: relax listening_hash operations") + +removed the need to disable bottom half while acquiring +listening_hash.lock. There are still two callers left which disable +bottom half before the lock is acquired. + +On PREEMPT_RT the softirqs are preemptible and local_bh_disable() acts +as a lock to ensure that resources, that are protected by disabling +bottom halves, remain protected. +This leads to a circular locking dependency if the lock acquired with +disabled bottom halves is also acquired with enabled bottom halves +followed by disabling bottom halves. This is the reverse locking order. +It has been observed with inet_listen_hashbucket::lock: + +local_bh_disable() + spin_lock(&ilb->lock): + inet_listen() + inet_csk_listen_start() + sk->sk_prot->hash() := inet_hash() + local_bh_disable() + __inet_hash() + spin_lock(&ilb->lock); + acquire(&ilb->lock); + +Reverse order: spin_lock(&ilb2->lock) + local_bh_disable(): + tcp_seq_next() + listening_get_next() + spin_lock(&ilb2->lock); + acquire(&ilb2->lock); + + tcp4_seq_show() + get_tcp4_sock() + sock_i_ino() + read_lock_bh(&sk->sk_callback_lock); + acquire(softirq_ctrl) // <---- whoops + acquire(&sk->sk_callback_lock) + +Drop local_bh_disable() around __inet_hash() which acquires +listening_hash->lock. Split inet_unhash() and acquire the +listen_hashbucket lock without disabling bottom halves; the inet_ehash +lock with disabled bottom halves. + +Reported-by: Mike Galbraith +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lkml.kernel.org/r/12d6f9879a97cd56c09fb53dee343cbb14f7f1f7.camel@gmx.de +Link: https://lkml.kernel.org/r/X9CheYjuXWc75Spa@hirez.programming.kicks-ass.net +Link: https://lore.kernel.org/r/YgQOebeZ10eNx1W6@linutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 53 ++++++++++++++++++++++--------------- + net/ipv6/inet6_hashtables.c | 5 +--- + 2 files changed, 33 insertions(+), 25 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index e093847c334d..915b8e1bd9ef 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -637,7 +637,9 @@ int __inet_hash(struct sock *sk, struct sock *osk) + int err = 0; + + if (sk->sk_state != TCP_LISTEN) { ++ local_bh_disable(); + inet_ehash_nolisten(sk, osk, NULL); ++ local_bh_enable(); + return 0; + } + WARN_ON(!sk_unhashed(sk)); +@@ -669,45 +671,54 @@ int inet_hash(struct sock *sk) + { + int err = 0; + +- if (sk->sk_state != TCP_CLOSE) { +- local_bh_disable(); ++ if (sk->sk_state != TCP_CLOSE) + err = __inet_hash(sk, NULL); +- local_bh_enable(); +- } + + return err; + } + EXPORT_SYMBOL_GPL(inet_hash); + +-void inet_unhash(struct sock *sk) ++static void __inet_unhash(struct sock *sk, struct inet_listen_hashbucket *ilb) + { +- struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; +- struct inet_listen_hashbucket *ilb = NULL; +- spinlock_t *lock; +- + if (sk_unhashed(sk)) + return; + +- if (sk->sk_state == TCP_LISTEN) { +- ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)]; +- lock = &ilb->lock; +- } else { +- lock = inet_ehash_lockp(hashinfo, sk->sk_hash); +- } +- spin_lock_bh(lock); +- if (sk_unhashed(sk)) +- goto unlock; +- + if (rcu_access_pointer(sk->sk_reuseport_cb)) + reuseport_detach_sock(sk); + if (ilb) { ++ struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; ++ + inet_unhash2(hashinfo, sk); + ilb->count--; + } + __sk_nulls_del_node_init_rcu(sk); + sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); +-unlock: +- spin_unlock_bh(lock); ++} ++ ++void inet_unhash(struct sock *sk) ++{ ++ struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; ++ ++ if (sk_unhashed(sk)) ++ return; ++ ++ if (sk->sk_state == TCP_LISTEN) { ++ struct inet_listen_hashbucket *ilb; ++ ++ ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)]; ++ /* Don't disable bottom halves while acquiring the lock to ++ * avoid circular locking dependency on PREEMPT_RT. ++ */ ++ spin_lock(&ilb->lock); ++ __inet_unhash(sk, ilb); ++ spin_unlock(&ilb->lock); ++ } else { ++ spinlock_t *lock = inet_ehash_lockp(hashinfo, sk->sk_hash); ++ ++ spin_lock_bh(lock); ++ __inet_unhash(sk, NULL); ++ spin_unlock_bh(lock); ++ } + } + EXPORT_SYMBOL_GPL(inet_unhash); + +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index 67c9114835c8..0a2e7f228391 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -333,11 +333,8 @@ int inet6_hash(struct sock *sk) + { + int err = 0; + +- if (sk->sk_state != TCP_CLOSE) { +- local_bh_disable(); ++ if (sk->sk_state != TCP_CLOSE) + err = __inet_hash(sk, NULL); +- local_bh_enable(); +- } + + return err; + } +-- +2.35.1 + diff --git a/queue-5.10/tuntap-add-sanity-checks-about-msg_controllen-in-sen.patch b/queue-5.10/tuntap-add-sanity-checks-about-msg_controllen-in-sen.patch new file mode 100644 index 00000000000..3499e9ba756 --- /dev/null +++ b/queue-5.10/tuntap-add-sanity-checks-about-msg_controllen-in-sen.patch @@ -0,0 +1,71 @@ +From 2f451ea3695e31e9c292c0e6afbe1e1e119ccd0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 10:24:40 +0800 +Subject: tuntap: add sanity checks about msg_controllen in sendmsg + +From: Harold Huang + +[ Upstream commit 74a335a07a17d131b9263bfdbdcb5e40673ca9ca ] + +In patch [1], tun_msg_ctl was added to allow pass batched xdp buffers to +tun_sendmsg. Although we donot use msg_controllen in this path, we should +check msg_controllen to make sure the caller pass a valid msg_ctl. + +[1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe8dd45bb7556246c6b76277b1ba4296c91c2505 + +Reported-by: Eric Dumazet +Suggested-by: Jason Wang +Signed-off-by: Harold Huang +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20220303022441.383865-1-baymaxhuang@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/tap.c | 3 ++- + drivers/net/tun.c | 3 ++- + drivers/vhost/net.c | 1 + + 3 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index f549d3a8e59c..8f7bb15206e9 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -1202,7 +1202,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, + struct xdp_buff *xdp; + int i; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + for (i = 0; i < ctl->num; i++) { + xdp = &((struct xdp_buff *)ctl->ptr)[i]; + tap_get_user_xdp(q, xdp); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index ffbc7eda95ee..55ce141c93c7 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2499,7 +2499,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + if (!tun) + return -EBADFD; + +- if (ctl && (ctl->type == TUN_MSG_PTR)) { ++ if (m->msg_controllen == sizeof(struct tun_msg_ctl) && ++ ctl && ctl->type == TUN_MSG_PTR) { + struct tun_page tpage; + int n = ctl->num; + int flush = 0; +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index da02c3e96e7b..e303f6f073d2 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, + goto signal_used; + + msghdr->msg_control = &ctl; ++ msghdr->msg_controllen = sizeof(ctl); + err = sock->ops->sendmsg(sock, msghdr, 0); + if (unlikely(err < 0)) { + vq_err(&nvq->vq, "Fail to batch sending packets\n"); +-- +2.35.1 + diff --git a/queue-5.10/ubifs-rectify-space-amount-budget-for-mkdir-tmpfile-.patch b/queue-5.10/ubifs-rectify-space-amount-budget-for-mkdir-tmpfile-.patch new file mode 100644 index 00000000000..f485f51cd90 --- /dev/null +++ b/queue-5.10/ubifs-rectify-space-amount-budget-for-mkdir-tmpfile-.patch @@ -0,0 +1,71 @@ +From 3cb8ceb80469e9402bf9b31c8f47463ff9e3a089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 11:22:38 +0800 +Subject: ubifs: Rectify space amount budget for mkdir/tmpfile operations + +From: Zhihao Cheng + +[ Upstream commit a6dab6607d4681d227905d5198710b575dbdb519 ] + +UBIFS should make sure the flash has enough space to store dirty (Data +that is newer than disk) data (in memory), space budget is exactly +designed to do that. If space budget calculates less data than we need, +'make_reservation()' will do more work(return -ENOSPC if no free space +lelf, sometimes we can see "cannot reserve xxx bytes in jhead xxx, error +-28" in ubifs error messages) with ubifs inodes locked, which may effect +other syscalls. + +A simple way to decide how much space do we need when make a budget: +See how much space is needed by 'make_reservation()' in ubifs_jnl_xxx() +function according to corresponding operation. + +It's better to report ENOSPC in ubifs_budget_space(), as early as we can. + +Fixes: 474b93704f32163 ("ubifs: Implement O_TMPFILE") +Fixes: 1e51764a3c2ac05 ("UBIFS: add new flash file system") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/dir.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index 5daffd46369d..9257ee893bdb 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -353,15 +353,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, + { + struct inode *inode; + struct ubifs_info *c = dir->i_sb->s_fs_info; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; + struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); + int err, instantiated = 0; + struct fscrypt_name nm; + + /* +- * Budget request settings: new dirty inode, new direntry, +- * budget for dirtied inode will be released via writeback. ++ * Budget request settings: new inode, new direntry, changing the ++ * parent directory inode. ++ * Allocate budget separately for new dirtied inode, the budget will ++ * be released via writeback. + */ + + dbg_gen("dent '%pd', mode %#hx in dir ino %lu", +@@ -949,7 +952,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + struct ubifs_inode *dir_ui = ubifs_inode(dir); + struct ubifs_info *c = dir->i_sb->s_fs_info; + int err, sz_change; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct fscrypt_name nm; + + /* +-- +2.35.1 + diff --git a/queue-5.10/usb-dwc3-omap-fix-unbalanced-disables-for-smps10_out.patch b/queue-5.10/usb-dwc3-omap-fix-unbalanced-disables-for-smps10_out.patch new file mode 100644 index 00000000000..450fe17615e --- /dev/null +++ b/queue-5.10/usb-dwc3-omap-fix-unbalanced-disables-for-smps10_out.patch @@ -0,0 +1,75 @@ +From ff94e9f4e539f313145e5293af832d5b548be5b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 14:03:37 +0100 +Subject: usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on + omap5evm + +From: H. Nikolaus Schaller + +[ Upstream commit ac01df343e5a6c6bcead2ed421af1fde30f73e7e ] + +Usually, the vbus_regulator (smps10 on omap5evm) boots up disabled. + +Hence calling regulator_disable() indirectly through dwc3_omap_set_mailbox() +during probe leads to: + +[ 10.332764] WARNING: CPU: 0 PID: 1628 at drivers/regulator/core.c:2853 _regulator_disable+0x40/0x164 +[ 10.351919] unbalanced disables for smps10_out1 +[ 10.361298] Modules linked in: dwc3_omap(+) clk_twl6040 at24 gpio_twl6040 palmas_gpadc palmas_pwrbutton +industrialio snd_soc_omap_mcbsp(+) snd_soc_ti_sdma display_connector ti_tpd12s015 drm leds_gpio +drm_panel_orientation_quirks ip_tables x_tables ipv6 autofs4 +[ 10.387818] CPU: 0 PID: 1628 Comm: systemd-udevd Not tainted 5.17.0-rc1-letux-lpae+ #8139 +[ 10.405129] Hardware name: Generic OMAP5 (Flattened Device Tree) +[ 10.411455] unwind_backtrace from show_stack+0x10/0x14 +[ 10.416970] show_stack from dump_stack_lvl+0x40/0x4c +[ 10.422313] dump_stack_lvl from __warn+0xb8/0x170 +[ 10.427377] __warn from warn_slowpath_fmt+0x70/0x9c +[ 10.432595] warn_slowpath_fmt from _regulator_disable+0x40/0x164 +[ 10.439037] _regulator_disable from regulator_disable+0x30/0x64 +[ 10.445382] regulator_disable from dwc3_omap_set_mailbox+0x8c/0xf0 [dwc3_omap] +[ 10.453116] dwc3_omap_set_mailbox [dwc3_omap] from dwc3_omap_probe+0x2b8/0x394 [dwc3_omap] +[ 10.467021] dwc3_omap_probe [dwc3_omap] from platform_probe+0x58/0xa8 +[ 10.481762] platform_probe from really_probe+0x168/0x2fc +[ 10.481782] really_probe from __driver_probe_device+0xc4/0xd8 +[ 10.481782] __driver_probe_device from driver_probe_device+0x24/0xa4 +[ 10.503762] driver_probe_device from __driver_attach+0xc4/0xd8 +[ 10.510018] __driver_attach from bus_for_each_dev+0x64/0xa0 +[ 10.516001] bus_for_each_dev from bus_add_driver+0x148/0x1a4 +[ 10.524880] bus_add_driver from driver_register+0xb4/0xf8 +[ 10.530678] driver_register from do_one_initcall+0x90/0x1c4 +[ 10.536661] do_one_initcall from do_init_module+0x4c/0x200 +[ 10.536683] do_init_module from load_module+0x13dc/0x1910 +[ 10.551159] load_module from sys_finit_module+0xc8/0xd8 +[ 10.561319] sys_finit_module from __sys_trace_return+0x0/0x18 +[ 10.561336] Exception stack(0xc344bfa8 to 0xc344bff0) +[ 10.561341] bfa0: b6fb5778 b6fab8d8 00000007 b6ecfbb8 00000000 b6ed0398 +[ 10.561341] bfc0: b6fb5778 b6fab8d8 855c0500 0000017b 00020000 b6f9a3cc 00000000 b6fb5778 +[ 10.595500] bfe0: bede18f8 bede18e8 b6ec9aeb b6dda1c2 +[ 10.601345] ---[ end trace 0000000000000000 ]--- + +Fix this unnecessary warning by checking if the regulator is enabled. + +Signed-off-by: H. Nikolaus Schaller +Link: https://lore.kernel.org/r/af3b750dc2265d875deaabcf5f80098c9645da45.1646744616.git.hns@goldelico.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index e196673f5c64..efaf0db595f4 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -242,7 +242,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + break; + + case OMAP_DWC3_ID_FLOAT: +- if (omap->vbus_reg) ++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) + regulator_disable(omap->vbus_reg); + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; +-- +2.35.1 + diff --git a/queue-5.10/usb-ehci-add-pci-device-support-for-aspeed-platforms.patch b/queue-5.10/usb-ehci-add-pci-device-support-for-aspeed-platforms.patch new file mode 100644 index 00000000000..cb02f0c17f0 --- /dev/null +++ b/queue-5.10/usb-ehci-add-pci-device-support-for-aspeed-platforms.patch @@ -0,0 +1,52 @@ +From d0d35fa48f3c394a75758c1aef2feb7944ec2015 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 18:16:57 +0800 +Subject: usb: ehci: add pci device support for Aspeed platforms + +From: Neal Liu + +[ Upstream commit c3c9cee592828528fd228b01d312c7526c584a42 ] + +Enable Aspeed quirks in commit 7f2d73788d90 ("usb: ehci: +handshake CMD_RUN instead of STS_HALT") to support Aspeed +ehci-pci device. + +Acked-by: Alan Stern +Signed-off-by: Neal Liu +Link: https://lore.kernel.org/r/20220208101657.76459-1-neal_liu@aspeedtech.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-pci.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index e87cf3a00fa4..638f03b89739 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; + /* defined here to avoid adding to pci_ids.h for single instance use */ + #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 + ++#define PCI_VENDOR_ID_ASPEED 0x1a03 ++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 ++ + /*-------------------------------------------------------------------------*/ + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 + static inline bool is_intel_quark_x1000(struct pci_dev *pdev) +@@ -222,6 +225,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci->has_synopsys_hc_bug = 1; + } + break; ++ case PCI_VENDOR_ID_ASPEED: ++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { ++ ehci_info(ehci, "applying Aspeed HC workaround\n"); ++ ehci->is_aspeed = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +-- +2.35.1 + diff --git a/queue-5.10/usb-gadget-tegra-xudc-do-not-program-sparam.patch b/queue-5.10/usb-gadget-tegra-xudc-do-not-program-sparam.patch new file mode 100644 index 00000000000..c85cdc5df7a --- /dev/null +++ b/queue-5.10/usb-gadget-tegra-xudc-do-not-program-sparam.patch @@ -0,0 +1,52 @@ +From 9041102d3eab05275b8668f2947406acafcb49e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 17:04:43 +0800 +Subject: usb: gadget: tegra-xudc: Do not program SPARAM + +From: Wayne Chang + +[ Upstream commit 62fb61580eb48fc890b7bc9fb5fd263367baeca8 ] + +According to the Tegra Technical Reference Manual, SPARAM +is a read-only register and should not be programmed in +the driver. + +The change removes the wrong SPARAM usage. + +Signed-off-by: Wayne Chang +Link: https://lore.kernel.org/r/20220107090443.149021-1-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 57ee72fead45..1dd0d50c6b56 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -32,9 +32,6 @@ + #include + + /* XUSB_DEV registers */ +-#define SPARAM 0x000 +-#define SPARAM_ERSTMAX_MASK GENMASK(20, 16) +-#define SPARAM_ERSTMAX(x) (((x) << 16) & SPARAM_ERSTMAX_MASK) + #define DB 0x004 + #define DB_TARGET_MASK GENMASK(15, 8) + #define DB_TARGET(x) (((x) << 8) & DB_TARGET_MASK) +@@ -3295,11 +3292,6 @@ static void tegra_xudc_init_event_ring(struct tegra_xudc *xudc) + unsigned int i; + u32 val; + +- val = xudc_readl(xudc, SPARAM); +- val &= ~(SPARAM_ERSTMAX_MASK); +- val |= SPARAM_ERSTMAX(XUDC_NR_EVENT_RINGS); +- xudc_writel(xudc, val, SPARAM); +- + for (i = 0; i < ARRAY_SIZE(xudc->event_ring); i++) { + memset(xudc->event_ring[i], 0, XUDC_EVENT_RING_SIZE * + sizeof(*xudc->event_ring[i])); +-- +2.35.1 + diff --git a/queue-5.10/usb-gadget-tegra-xudc-fix-control-endpoint-s-definit.patch b/queue-5.10/usb-gadget-tegra-xudc-fix-control-endpoint-s-definit.patch new file mode 100644 index 00000000000..3ab82dd2e46 --- /dev/null +++ b/queue-5.10/usb-gadget-tegra-xudc-fix-control-endpoint-s-definit.patch @@ -0,0 +1,64 @@ +From 4187d59e4849f6c9950d9d46efed02337adb1efc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 17:13:49 +0800 +Subject: usb: gadget: tegra-xudc: Fix control endpoint's definitions + +From: Wayne Chang + +[ Upstream commit 7bd42fb95eb4f98495ccadf467ad15124208ec49 ] + +According to the Tegra Technical Reference Manual, the seq_num +field of control endpoint is not [31:24] but [31:27]. Bit 24 +is reserved and bit 26 is splitxstate. + +The change fixes the wrong control endpoint's definitions. + +Signed-off-by: Wayne Chang +Link: https://lore.kernel.org/r/20220107091349.149798-1-waynec@nvidia.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/tegra-xudc.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c +index 1dd0d50c6b56..de178bf264c2 100644 +--- a/drivers/usb/gadget/udc/tegra-xudc.c ++++ b/drivers/usb/gadget/udc/tegra-xudc.c +@@ -272,8 +272,10 @@ BUILD_EP_CONTEXT_RW(deq_hi, deq_hi, 0, 0xffffffff) + BUILD_EP_CONTEXT_RW(avg_trb_len, tx_info, 0, 0xffff) + BUILD_EP_CONTEXT_RW(max_esit_payload, tx_info, 16, 0xffff) + BUILD_EP_CONTEXT_RW(edtla, rsvd[0], 0, 0xffffff) +-BUILD_EP_CONTEXT_RW(seq_num, rsvd[0], 24, 0xff) ++BUILD_EP_CONTEXT_RW(rsvd, rsvd[0], 24, 0x1) + BUILD_EP_CONTEXT_RW(partial_td, rsvd[0], 25, 0x1) ++BUILD_EP_CONTEXT_RW(splitxstate, rsvd[0], 26, 0x1) ++BUILD_EP_CONTEXT_RW(seq_num, rsvd[0], 27, 0x1f) + BUILD_EP_CONTEXT_RW(cerrcnt, rsvd[1], 18, 0x3) + BUILD_EP_CONTEXT_RW(data_offset, rsvd[2], 0, 0x1ffff) + BUILD_EP_CONTEXT_RW(numtrbs, rsvd[2], 22, 0x1f) +@@ -1554,6 +1556,9 @@ static int __tegra_xudc_ep_set_halt(struct tegra_xudc_ep *ep, bool halt) + ep_reload(xudc, ep->index); + + ep_ctx_write_state(ep->context, EP_STATE_RUNNING); ++ ep_ctx_write_rsvd(ep->context, 0); ++ ep_ctx_write_partial_td(ep->context, 0); ++ ep_ctx_write_splitxstate(ep->context, 0); + ep_ctx_write_seq_num(ep->context, 0); + + ep_reload(xudc, ep->index); +@@ -2809,7 +2814,10 @@ static void tegra_xudc_reset(struct tegra_xudc *xudc) + xudc->setup_seq_num = 0; + xudc->queued_setup_packet = false; + +- ep_ctx_write_seq_num(ep0->context, xudc->setup_seq_num); ++ ep_ctx_write_rsvd(ep0->context, 0); ++ ep_ctx_write_partial_td(ep0->context, 0); ++ ep_ctx_write_splitxstate(ep0->context, 0); ++ ep_ctx_write_seq_num(ep0->context, 0); + + deq_ptr = trb_virt_to_phys(ep0, &ep0->transfer_ring[ep0->deq_ptr]); + +-- +2.35.1 + diff --git a/queue-5.10/virtio_console-eliminate-anonymous-module_init-modul.patch b/queue-5.10/virtio_console-eliminate-anonymous-module_init-modul.patch new file mode 100644 index 00000000000..97c94744c50 --- /dev/null +++ b/queue-5.10/virtio_console-eliminate-anonymous-module_init-modul.patch @@ -0,0 +1,76 @@ +From b6c17e221f75872d24e644cd2d164dcfbe590b3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 12:20:03 -0700 +Subject: virtio_console: eliminate anonymous module_init & module_exit + +From: Randy Dunlap + +[ Upstream commit fefb8a2a941338d871e2d83fbd65fbfa068857bd ] + +Eliminate anonymous module_init() and module_exit(), which can lead to +confusion or ambiguity when reading System.map, crashes/oops/bugs, +or an initcall_debug log. + +Give each of these init and exit functions unique driver-specific +names to eliminate the anonymous names. + +Example 1: (System.map) + ffffffff832fc78c t init + ffffffff832fc79e t init + ffffffff832fc8f8 t init + +Example 2: (initcall_debug log) + calling init+0x0/0x12 @ 1 + initcall init+0x0/0x12 returned 0 after 15 usecs + calling init+0x0/0x60 @ 1 + initcall init+0x0/0x60 returned 0 after 2 usecs + calling init+0x0/0x9a @ 1 + initcall init+0x0/0x9a returned 0 after 74 usecs + +Signed-off-by: Randy Dunlap +Reviewed-by: Amit Shah +Cc: virtualization@lists.linux-foundation.org +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20220316192010.19001-3-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/virtio_console.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 3dd4deb60adb..6d361420ffe8 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -2239,7 +2239,7 @@ static struct virtio_driver virtio_rproc_serial = { + .remove = virtcons_remove, + }; + +-static int __init init(void) ++static int __init virtio_console_init(void) + { + int err; + +@@ -2276,7 +2276,7 @@ static int __init init(void) + return err; + } + +-static void __exit fini(void) ++static void __exit virtio_console_fini(void) + { + reclaim_dma_bufs(); + +@@ -2286,8 +2286,8 @@ static void __exit fini(void) + class_destroy(pdrvdata.class); + debugfs_remove_recursive(pdrvdata.debugfs_dir); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_console_init); ++module_exit(virtio_console_fini); + + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +-- +2.35.1 + diff --git a/queue-5.10/w1-w1_therm-fixes-w1_seq-for-ds28ea00-sensors.patch b/queue-5.10/w1-w1_therm-fixes-w1_seq-for-ds28ea00-sensors.patch new file mode 100644 index 00000000000..12a2386155f --- /dev/null +++ b/queue-5.10/w1-w1_therm-fixes-w1_seq-for-ds28ea00-sensors.patch @@ -0,0 +1,52 @@ +From dc4c39ff874c20266bba4d720a00507845cfe177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Feb 2022 11:35:55 +0000 +Subject: w1: w1_therm: fixes w1_seq for ds28ea00 sensors + +From: Lucas Denefle + +[ Upstream commit 41a92a89eee819298f805c40187ad8b02bb53426 ] + +w1_seq was failing due to several devices responding to the +CHAIN_DONE at the same time. Now properly selects the current +device in the chain with MATCH_ROM. Also acknowledgment was +read twice. + +Signed-off-by: Lucas Denefle +Link: https://lore.kernel.org/r/20220223113558.232750-1-lucas.denefle@converge.io +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_therm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 974d02bb3a45..6546d029c7fd 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -2092,16 +2092,20 @@ static ssize_t w1_seq_show(struct device *device, + if (sl->reg_num.id == reg_num->id) + seq = i; + ++ if (w1_reset_bus(sl->master)) ++ goto error; ++ ++ /* Put the device into chain DONE state */ ++ w1_write_8(sl->master, W1_MATCH_ROM); ++ w1_write_block(sl->master, (u8 *)&rn, 8); + w1_write_8(sl->master, W1_42_CHAIN); + w1_write_8(sl->master, W1_42_CHAIN_DONE); + w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); +- w1_read_block(sl->master, &ack, sizeof(ack)); + + /* check for acknowledgment */ + ack = w1_read_8(sl->master); + if (ack != W1_42_SUCCESS_CONFIRM_BYTE) + goto error; +- + } + + /* Exit from CHAIN state */ +-- +2.35.1 + diff --git a/queue-5.10/x86-kconfig-do-not-allow-config_x86_x32_abi-y-with-l.patch b/queue-5.10/x86-kconfig-do-not-allow-config_x86_x32_abi-y-with-l.patch new file mode 100644 index 00000000000..8bcd275c6aa --- /dev/null +++ b/queue-5.10/x86-kconfig-do-not-allow-config_x86_x32_abi-y-with-l.patch @@ -0,0 +1,61 @@ +From 5b6a526e7c6b070dd121533e96c0d05379f94a43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 12:48:42 -0700 +Subject: x86/Kconfig: Do not allow CONFIG_X86_X32_ABI=y with llvm-objcopy + +From: Nathan Chancellor + +[ Upstream commit aaeed6ecc1253ce1463fa1aca0b70a4ccbc9fa75 ] + +There are two outstanding issues with CONFIG_X86_X32_ABI and +llvm-objcopy, with similar root causes: + +1. llvm-objcopy does not properly convert .note.gnu.property when going + from x86_64 to x86_x32, resulting in a corrupted section when + linking: + + https://github.com/ClangBuiltLinux/linux/issues/1141 + +2. llvm-objcopy produces corrupted compressed debug sections when going + from x86_64 to x86_x32, also resulting in an error when linking: + + https://github.com/ClangBuiltLinux/linux/issues/514 + +After commit 41c5ef31ad71 ("x86/ibt: Base IBT bits"), the +.note.gnu.property section is always generated when +CONFIG_X86_KERNEL_IBT is enabled, which causes the first issue to become +visible with an allmodconfig build: + + ld.lld: error: arch/x86/entry/vdso/vclock_gettime-x32.o:(.note.gnu.property+0x1c): program property is too short + +To avoid this error, do not allow CONFIG_X86_X32_ABI to be selected when +using llvm-objcopy. If the two issues ever get fixed in llvm-objcopy, +this can be turned into a feature check. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20220314194842.3452-3-nathan@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index fb873a7bb65c..db95ac482e0e 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2865,6 +2865,11 @@ config IA32_AOUT + config X86_X32 + bool "x32 ABI for 64-bit mode" + depends on X86_64 ++ # llvm-objcopy does not convert x86_64 .note.gnu.property or ++ # compressed debug sections to x86_x32 properly: ++ # https://github.com/ClangBuiltLinux/linux/issues/514 ++ # https://github.com/ClangBuiltLinux/linux/issues/1141 ++ depends on $(success,$(OBJCOPY) --version | head -n1 | grep -qv llvm) + help + Include code to run binaries for the x32 native 32-bit ABI + for 64-bit processors. An x32 process gets access to the +-- +2.35.1 + diff --git a/queue-5.10/xen-delay-xen_hvm_init_time_ops-if-kdump-is-boot-on-.patch b/queue-5.10/xen-delay-xen_hvm_init_time_ops-if-kdump-is-boot-on-.patch new file mode 100644 index 00000000000..040722e3eeb --- /dev/null +++ b/queue-5.10/xen-delay-xen_hvm_init_time_ops-if-kdump-is-boot-on-.patch @@ -0,0 +1,124 @@ +From 7c65fab141efec2b35bc25ea94b3c69fde84cdf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 08:40:32 -0800 +Subject: xen: delay xen_hvm_init_time_ops() if kdump is boot on vcpu>=32 + +From: Dongli Zhang + +[ Upstream commit eed05744322da07dd7e419432dcedf3c2e017179 ] + +The sched_clock() can be used very early since commit 857baa87b642 +("sched/clock: Enable sched clock early"). In addition, with commit +38669ba205d1 ("x86/xen/time: Output xen sched_clock time from 0"), kdump +kernel in Xen HVM guest may panic at very early stage when accessing +&__this_cpu_read(xen_vcpu)->time as in below: + +setup_arch() + -> init_hypervisor_platform() + -> x86_init.hyper.init_platform = xen_hvm_guest_init() + -> xen_hvm_init_time_ops() + -> xen_clocksource_read() + -> src = &__this_cpu_read(xen_vcpu)->time; + +This is because Xen HVM supports at most MAX_VIRT_CPUS=32 'vcpu_info' +embedded inside 'shared_info' during early stage until xen_vcpu_setup() is +used to allocate/relocate 'vcpu_info' for boot cpu at arbitrary address. + +However, when Xen HVM guest panic on vcpu >= 32, since +xen_vcpu_info_reset(0) would set per_cpu(xen_vcpu, cpu) = NULL when +vcpu >= 32, xen_clocksource_read() on vcpu >= 32 would panic. + +This patch calls xen_hvm_init_time_ops() again later in +xen_hvm_smp_prepare_boot_cpu() after the 'vcpu_info' for boot vcpu is +registered when the boot vcpu is >= 32. + +This issue can be reproduced on purpose via below command at the guest +side when kdump/kexec is enabled: + +"taskset -c 33 echo c > /proc/sysrq-trigger" + +The bugfix for PVM is not implemented due to the lack of testing +environment. + +[boris: xen_hvm_init_time_ops() returns on errors instead of jumping to end] + +Cc: Joe Jin +Signed-off-by: Dongli Zhang +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20220302164032.14569-3-dongli.zhang@oracle.com +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +--- + arch/x86/xen/smp_hvm.c | 6 ++++++ + arch/x86/xen/time.c | 24 +++++++++++++++++++++++- + 2 files changed, 29 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c +index 6ff3c887e0b9..b70afdff419c 100644 +--- a/arch/x86/xen/smp_hvm.c ++++ b/arch/x86/xen/smp_hvm.c +@@ -19,6 +19,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) + */ + xen_vcpu_setup(0); + ++ /* ++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. ++ * Refer to comments in xen_hvm_init_time_ops(). ++ */ ++ xen_hvm_init_time_ops(); ++ + /* + * The alternative logic (which patches the unlock/lock) runs before + * the smp bootup up code is activated. Hence we need to set this up +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index 91f5b330dcc6..8183d17e1cf1 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -556,6 +556,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + + void __init xen_hvm_init_time_ops(void) + { ++ static bool hvm_time_initialized; ++ ++ if (hvm_time_initialized) ++ return; ++ + /* + * vector callback is needed otherwise we cannot receive interrupts + * on cpu > 0 and at this point we don't know how many cpus are +@@ -565,7 +570,22 @@ void __init xen_hvm_init_time_ops(void) + return; + + if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { +- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); ++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); ++ return; ++ } ++ ++ /* ++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. ++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest ++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access ++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. ++ * ++ * The xen_hvm_init_time_ops() should be called again later after ++ * __this_cpu_read(xen_vcpu) is available. ++ */ ++ if (!__this_cpu_read(xen_vcpu)) { ++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", ++ xen_vcpu_nr(0)); + return; + } + +@@ -577,6 +597,8 @@ void __init xen_hvm_init_time_ops(void) + x86_platform.calibrate_tsc = xen_tsc_khz; + x86_platform.get_wallclock = xen_get_wallclock; + x86_platform.set_wallclock = xen_set_wallclock; ++ ++ hvm_time_initialized = true; + } + #endif + +-- +2.35.1 + diff --git a/queue-5.10/xtensa-fix-dtc-warning-unit_address_format.patch b/queue-5.10/xtensa-fix-dtc-warning-unit_address_format.patch new file mode 100644 index 00000000000..976cfbc1916 --- /dev/null +++ b/queue-5.10/xtensa-fix-dtc-warning-unit_address_format.patch @@ -0,0 +1,103 @@ +From 3850f112017ba91efd68b314729593b26c036c41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 02:49:41 -0700 +Subject: xtensa: fix DTC warning unit_address_format + +From: Max Filippov + +[ Upstream commit e85d29ba4b24f68e7a78cb85c55e754362eeb2de ] + +DTC issues the following warnings when building xtfpga device trees: + + /soc/flash@00000000/partition@0x0: unit name should not have leading "0x" + /soc/flash@00000000/partition@0x6000000: unit name should not have leading "0x" + /soc/flash@00000000/partition@0x6800000: unit name should not have leading "0x" + /soc/flash@00000000/partition@0x7fe0000: unit name should not have leading "0x" + +Drop leading 0x from flash partition unit names. + +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi | 8 ++++---- + arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi | 8 ++++---- + arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi | 4 ++-- + 3 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +index 9bf8bad1dd18..c33932568aa7 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x00000000 0x08000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "data"; + reg = <0x00000000 0x06000000>; + }; +- partition@0x6000000 { ++ partition@6000000 { + label = "boot loader area"; + reg = <0x06000000 0x00800000>; + }; +- partition@0x6800000 { ++ partition@6800000 { + label = "kernel image"; + reg = <0x06800000 0x017e0000>; + }; +- partition@0x7fe0000 { ++ partition@7fe0000 { + label = "boot environment"; + reg = <0x07fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +index 40c2f81f7cb6..7bde2ab2d6fb 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x08000000 0x01000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x00400000>; + }; +- partition@0x400000 { ++ partition@400000 { + label = "kernel image"; + reg = <0x00400000 0x00600000>; + }; +- partition@0xa00000 { ++ partition@a00000 { + label = "data"; + reg = <0x00a00000 0x005e0000>; + }; +- partition@0xfe0000 { ++ partition@fe0000 { + label = "boot environment"; + reg = <0x00fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +index fb8d3a9f33c2..0655b868749a 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +@@ -8,11 +8,11 @@ + reg = <0x08000000 0x00400000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x003f0000>; + }; +- partition@0x3f0000 { ++ partition@3f0000 { + label = "boot environment"; + reg = <0x003f0000 0x00010000>; + }; +-- +2.35.1 +