From: Greg Kroah-Hartman Date: Tue, 24 Sep 2019 06:56:56 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.3.2~50 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=5fb55c40dd07572f05f2230b475c62cd230e3d23;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: hid-add-quirk-for-hp-x500-pixart-oem-mouse.patch hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch hid-prodikeys-fix-general-protection-fault-during-probe.patch hid-sony-fix-memory-corruption-issue-on-cleanup.patch ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch --- diff --git a/queue-4.19/hid-add-quirk-for-hp-x500-pixart-oem-mouse.patch b/queue-4.19/hid-add-quirk-for-hp-x500-pixart-oem-mouse.patch new file mode 100644 index 00000000000..f8410daabd1 --- /dev/null +++ b/queue-4.19/hid-add-quirk-for-hp-x500-pixart-oem-mouse.patch @@ -0,0 +1,46 @@ +From 2acf40f0454d41b8d51c95d317283c20c931164d Mon Sep 17 00:00:00 2001 +From: Sebastian Parschauer +Date: Mon, 2 Sep 2019 12:39:30 +0200 +Subject: HID: Add quirk for HP X500 PIXART OEM mouse + +From: Sebastian Parschauer + +commit 2acf40f0454d41b8d51c95d317283c20c931164d upstream. + +The PixArt OEM mice are known for disconnecting every minute in +runlevel 1 or 3 if they are not always polled. So add quirk +ALWAYS_POLL for this one as well. + +Ville Viinikka (viinikv) reported and tested the quirk. +Link: https://github.com/sriemer/fix-linux-mouse issue 15 + +Signed-off-by: Sebastian Parschauer +CC: stable@vger.kernel.org # v4.16+ +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -559,6 +559,7 @@ + #define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A 0x094a ++#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941 0x0941 + #define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641 0x0641 + + #define USB_VENDOR_ID_HUION 0x256c +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -94,6 +94,7 @@ static const struct hid_device_id hid_qu + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0941), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_0641), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_IDEACOM, USB_DEVICE_ID_IDEACOM_IDC6680), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI), HID_QUIRK_MULTI_INPUT }, diff --git a/queue-4.19/hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch b/queue-4.19/hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch new file mode 100644 index 00000000000..06177b840f0 --- /dev/null +++ b/queue-4.19/hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch @@ -0,0 +1,72 @@ +From 416dacb819f59180e4d86a5550052033ebb6d72c Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 21 Aug 2019 13:27:12 -0400 +Subject: HID: hidraw: Fix invalid read in hidraw_ioctl + +From: Alan Stern + +commit 416dacb819f59180e4d86a5550052033ebb6d72c upstream. + +The syzbot fuzzer has reported a pair of problems in the +hidraw_ioctl() function: slab-out-of-bounds read and use-after-free +read. An example of the first: + +BUG: KASAN: slab-out-of-bounds in strlen+0x79/0x90 lib/string.c:525 +Read of size 1 at addr ffff8881c8035f38 by task syz-executor.4/2833 + +CPU: 1 PID: 2833 Comm: syz-executor.4 Not tainted 5.3.0-rc2+ #1 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xca/0x13e lib/dump_stack.c:113 + print_address_description+0x6a/0x32c mm/kasan/report.c:351 + __kasan_report.cold+0x1a/0x33 mm/kasan/report.c:482 + kasan_report+0xe/0x12 mm/kasan/common.c:612 + strlen+0x79/0x90 lib/string.c:525 + strlen include/linux/string.h:281 [inline] + hidraw_ioctl+0x245/0xae0 drivers/hid/hidraw.c:446 + vfs_ioctl fs/ioctl.c:46 [inline] + file_ioctl fs/ioctl.c:509 [inline] + do_vfs_ioctl+0xd2d/0x1330 fs/ioctl.c:696 + ksys_ioctl+0x9b/0xc0 fs/ioctl.c:713 + __do_sys_ioctl fs/ioctl.c:720 [inline] + __se_sys_ioctl fs/ioctl.c:718 [inline] + __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 + do_syscall_64+0xb7/0x580 arch/x86/entry/common.c:296 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x459829 +Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 +48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff +ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007f7a68f6dc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829 +RDX: 0000000000000000 RSI: 0000000080404805 RDI: 0000000000000004 +RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7a68f6e6d4 +R13: 00000000004c21de R14: 00000000004d5620 R15: 00000000ffffffff + +The two problems have the same cause: hidraw_ioctl() fails to test +whether the device has been removed. This patch adds the missing test. + +Reported-and-tested-by: syzbot+5a6c4ec678a0c6ee84ba@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hidraw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -378,7 +378,7 @@ static long hidraw_ioctl(struct file *fi + + mutex_lock(&minors_lock); + dev = hidraw_table[minor]; +- if (!dev) { ++ if (!dev || !dev->exist) { + ret = -ENODEV; + goto out; + } diff --git a/queue-4.19/hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch b/queue-4.19/hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch new file mode 100644 index 00000000000..09b8a030cca --- /dev/null +++ b/queue-4.19/hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch @@ -0,0 +1,108 @@ +From 5f9242775bb61f390f0885f23fc16397262c7538 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Tue, 20 Aug 2019 16:00:21 -0400 +Subject: HID: logitech: Fix general protection fault caused by Logitech driver + +From: Alan Stern + +commit 5f9242775bb61f390f0885f23fc16397262c7538 upstream. + +The syzbot fuzzer found a general protection fault in the HID subsystem: + +kasan: CONFIG_KASAN_INLINE enabled +kasan: GPF could be caused by NULL-ptr deref or user memory access +general protection fault: 0000 [#1] SMP KASAN +CPU: 0 PID: 3715 Comm: syz-executor.3 Not tainted 5.2.0-rc6+ #15 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +RIP: 0010:__pm_runtime_resume+0x49/0x180 drivers/base/power/runtime.c:1069 +Code: ed 74 d5 fe 45 85 ed 0f 85 9a 00 00 00 e8 6f 73 d5 fe 48 8d bd c1 02 +00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 +89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 fe 00 00 00 +RSP: 0018:ffff8881d99d78e0 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: 0000000000000020 RCX: ffffc90003f3f000 +RDX: 0000000416d8686d RSI: ffffffff82676841 RDI: 00000020b6c3436a +RBP: 00000020b6c340a9 R08: ffff8881c6d64800 R09: fffffbfff0e84c25 +R10: ffff8881d99d7940 R11: ffffffff87426127 R12: 0000000000000004 +R13: 0000000000000000 R14: ffff8881d9b94000 R15: ffffffff897f9048 +FS: 00007f047f542700(0000) GS:ffff8881db200000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000001b30f21000 CR3: 00000001ca032000 CR4: 00000000001406f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + pm_runtime_get_sync include/linux/pm_runtime.h:226 [inline] + usb_autopm_get_interface+0x1b/0x50 drivers/usb/core/driver.c:1707 + usbhid_power+0x7c/0xe0 drivers/hid/usbhid/hid-core.c:1234 + hid_hw_power include/linux/hid.h:1038 [inline] + hidraw_open+0x20d/0x740 drivers/hid/hidraw.c:282 + chrdev_open+0x219/0x5c0 fs/char_dev.c:413 + do_dentry_open+0x497/0x1040 fs/open.c:778 + do_last fs/namei.c:3416 [inline] + path_openat+0x1430/0x3ff0 fs/namei.c:3533 + do_filp_open+0x1a1/0x280 fs/namei.c:3563 + do_sys_open+0x3c0/0x580 fs/open.c:1070 + do_syscall_64+0xb7/0x560 arch/x86/entry/common.c:301 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +It turns out the fault was caused by a bug in the HID Logitech driver, +which violates the requirement that every pathway calling +hid_hw_start() must also call hid_hw_stop(). This patch fixes the bug +by making sure the requirement is met. + +Reported-and-tested-by: syzbot+3cbe5cd105d2ad56a1df@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-lg.c | 10 ++++++---- + drivers/hid/hid-lg4ff.c | 1 - + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -763,7 +763,7 @@ static int lg_probe(struct hid_device *h + + if (!buf) { + ret = -ENOMEM; +- goto err_free; ++ goto err_stop; + } + + ret = hid_hw_raw_request(hdev, buf[0], buf, sizeof(cbuf), +@@ -795,9 +795,12 @@ static int lg_probe(struct hid_device *h + ret = lg4ff_init(hdev); + + if (ret) +- goto err_free; ++ goto err_stop; + + return 0; ++ ++err_stop: ++ hid_hw_stop(hdev); + err_free: + kfree(drv_data); + return ret; +@@ -808,8 +811,7 @@ static void lg_remove(struct hid_device + struct lg_drv_data *drv_data = hid_get_drvdata(hdev); + if (drv_data->quirks & LG_FF4) + lg4ff_deinit(hdev); +- else +- hid_hw_stop(hdev); ++ hid_hw_stop(hdev); + kfree(drv_data); + } + +--- a/drivers/hid/hid-lg4ff.c ++++ b/drivers/hid/hid-lg4ff.c +@@ -1483,7 +1483,6 @@ int lg4ff_deinit(struct hid_device *hid) + } + } + #endif +- hid_hw_stop(hid); + drv_data->device_props = NULL; + + kfree(entry); diff --git a/queue-4.19/hid-prodikeys-fix-general-protection-fault-during-probe.patch b/queue-4.19/hid-prodikeys-fix-general-protection-fault-during-probe.patch new file mode 100644 index 00000000000..bdcc3593763 --- /dev/null +++ b/queue-4.19/hid-prodikeys-fix-general-protection-fault-during-probe.patch @@ -0,0 +1,76 @@ +From 98375b86c79137416e9fd354177b85e768c16e56 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 4 Sep 2019 11:54:20 -0400 +Subject: HID: prodikeys: Fix general protection fault during probe + +From: Alan Stern + +commit 98375b86c79137416e9fd354177b85e768c16e56 upstream. + +The syzbot fuzzer provoked a general protection fault in the +hid-prodikeys driver: + +kasan: CONFIG_KASAN_INLINE enabled +kasan: GPF could be caused by NULL-ptr deref or user memory access +general protection fault: 0000 [#1] SMP KASAN +CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.3.0-rc5+ #28 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Workqueue: usb_hub_wq hub_event +RIP: 0010:pcmidi_submit_output_report drivers/hid/hid-prodikeys.c:300 [inline] +RIP: 0010:pcmidi_set_operational drivers/hid/hid-prodikeys.c:558 [inline] +RIP: 0010:pcmidi_snd_initialise drivers/hid/hid-prodikeys.c:686 [inline] +RIP: 0010:pk_probe+0xb51/0xfd0 drivers/hid/hid-prodikeys.c:836 +Code: 0f 85 50 04 00 00 48 8b 04 24 4c 89 7d 10 48 8b 58 08 e8 b2 53 e4 fc +48 8b 54 24 20 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f +85 13 04 00 00 48 ba 00 00 00 00 00 fc ff df 49 8b + +The problem is caused by the fact that pcmidi_get_output_report() will +return an error if the HID device doesn't provide the right sort of +output report, but pcmidi_set_operational() doesn't bother to check +the return code and assumes the function call always succeeds. + +This patch adds the missing check and aborts the probe operation if +necessary. + +Reported-and-tested-by: syzbot+1088533649dafa1c9004@syzkaller.appspotmail.com +Signed-off-by: Alan Stern +CC: +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-prodikeys.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-prodikeys.c ++++ b/drivers/hid/hid-prodikeys.c +@@ -555,10 +555,14 @@ static void pcmidi_setup_extra_keys( + + static int pcmidi_set_operational(struct pcmidi_snd *pm) + { ++ int rc; ++ + if (pm->ifnum != 1) + return 0; /* only set up ONCE for interace 1 */ + +- pcmidi_get_output_report(pm); ++ rc = pcmidi_get_output_report(pm); ++ if (rc < 0) ++ return rc; + pcmidi_submit_output_report(pm, 0xc1); + return 0; + } +@@ -687,7 +691,11 @@ static int pcmidi_snd_initialise(struct + spin_lock_init(&pm->rawmidi_in_lock); + + init_sustain_timers(pm); +- pcmidi_set_operational(pm); ++ err = pcmidi_set_operational(pm); ++ if (err < 0) { ++ pk_error("failed to find output report\n"); ++ goto fail_register; ++ } + + /* register it */ + err = snd_card_register(card); diff --git a/queue-4.19/hid-sony-fix-memory-corruption-issue-on-cleanup.patch b/queue-4.19/hid-sony-fix-memory-corruption-issue-on-cleanup.patch new file mode 100644 index 00000000000..c99e267617a --- /dev/null +++ b/queue-4.19/hid-sony-fix-memory-corruption-issue-on-cleanup.patch @@ -0,0 +1,42 @@ +From 2bcdacb70327013ca2066bfcf2af1009eff01f1d Mon Sep 17 00:00:00 2001 +From: Roderick Colenbrander +Date: Wed, 4 Sep 2019 14:22:11 -0700 +Subject: HID: sony: Fix memory corruption issue on cleanup. + +From: Roderick Colenbrander + +commit 2bcdacb70327013ca2066bfcf2af1009eff01f1d upstream. + +The sony driver is not properly cleaning up from potential failures in +sony_input_configured. Currently it calls hid_hw_stop, while hid_connect +is still running. This is not a good idea, instead hid_hw_stop should +be moved to sony_probe. Similar changes were recently made to Logitech +drivers, which were also doing improper cleanup. + +Signed-off-by: Roderick Colenbrander +CC: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-sony.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-sony.c ++++ b/drivers/hid/hid-sony.c +@@ -2806,7 +2806,6 @@ err_stop: + sony_cancel_work_sync(sc); + sony_remove_dev_list(sc); + sony_release_device_id(sc); +- hid_hw_stop(hdev); + return ret; + } + +@@ -2868,6 +2867,7 @@ static int sony_probe(struct hid_device + */ + if (!(hdev->claimed & HID_CLAIMED_INPUT)) { + hid_err(hdev, "failed to claim input\n"); ++ hid_hw_stop(hdev); + return -ENODEV; + } + diff --git a/queue-4.19/ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch b/queue-4.19/ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch new file mode 100644 index 00000000000..95bd03b591f --- /dev/null +++ b/queue-4.19/ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch @@ -0,0 +1,167 @@ +From f794809a7259dfaa3d47d90ef5a86007cf48b1ce Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Mon, 27 Aug 2018 08:35:55 +0300 +Subject: IB/core: Add an unbound WQ type to the new CQ API + +From: Jack Morgenstein + +commit f794809a7259dfaa3d47d90ef5a86007cf48b1ce upstream. + +The upstream kernel commit cited below modified the workqueue in the +new CQ API to be bound to a specific CPU (instead of being unbound). +This caused ALL users of the new CQ API to use the same bound WQ. + +Specifically, MAD handling was severely delayed when the CPU bound +to the WQ was busy handling (higher priority) interrupts. + +This caused a delay in the MAD "heartbeat" response handling, +which resulted in ports being incorrectly classified as "down". + +To fix this, add a new "unbound" WQ type to the new CQ API, so that users +have the option to choose either a bound WQ or an unbound WQ. + +For MADs, choose the new "unbound" WQ. + +Fixes: b7363e67b23e ("IB/device: Convert ib-comp-wq to be CPU-bound") +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Reviewed-by: Sagi Grimberg +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cq.c | 8 ++++++-- + drivers/infiniband/core/device.c | 15 ++++++++++++++- + drivers/infiniband/core/mad.c | 2 +- + include/rdma/ib_verbs.h | 9 ++++++--- + 4 files changed, 27 insertions(+), 7 deletions(-) + +--- a/drivers/infiniband/core/cq.c ++++ b/drivers/infiniband/core/cq.c +@@ -112,12 +112,12 @@ static void ib_cq_poll_work(struct work_ + IB_POLL_BATCH); + if (completed >= IB_POLL_BUDGET_WORKQUEUE || + ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0) +- queue_work(ib_comp_wq, &cq->work); ++ queue_work(cq->comp_wq, &cq->work); + } + + static void ib_cq_completion_workqueue(struct ib_cq *cq, void *private) + { +- queue_work(ib_comp_wq, &cq->work); ++ queue_work(cq->comp_wq, &cq->work); + } + + /** +@@ -175,9 +175,12 @@ struct ib_cq *__ib_alloc_cq(struct ib_de + ib_req_notify_cq(cq, IB_CQ_NEXT_COMP); + break; + case IB_POLL_WORKQUEUE: ++ case IB_POLL_UNBOUND_WORKQUEUE: + cq->comp_handler = ib_cq_completion_workqueue; + INIT_WORK(&cq->work, ib_cq_poll_work); + ib_req_notify_cq(cq, IB_CQ_NEXT_COMP); ++ cq->comp_wq = (cq->poll_ctx == IB_POLL_WORKQUEUE) ? ++ ib_comp_wq : ib_comp_unbound_wq; + break; + default: + ret = -EINVAL; +@@ -213,6 +216,7 @@ void ib_free_cq(struct ib_cq *cq) + irq_poll_disable(&cq->iop); + break; + case IB_POLL_WORKQUEUE: ++ case IB_POLL_UNBOUND_WORKQUEUE: + cancel_work_sync(&cq->work); + break; + default: +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -61,6 +61,7 @@ struct ib_client_data { + }; + + struct workqueue_struct *ib_comp_wq; ++struct workqueue_struct *ib_comp_unbound_wq; + struct workqueue_struct *ib_wq; + EXPORT_SYMBOL_GPL(ib_wq); + +@@ -1166,10 +1167,19 @@ static int __init ib_core_init(void) + goto err; + } + ++ ib_comp_unbound_wq = ++ alloc_workqueue("ib-comp-unb-wq", ++ WQ_UNBOUND | WQ_HIGHPRI | WQ_MEM_RECLAIM | ++ WQ_SYSFS, WQ_UNBOUND_MAX_ACTIVE); ++ if (!ib_comp_unbound_wq) { ++ ret = -ENOMEM; ++ goto err_comp; ++ } ++ + ret = class_register(&ib_class); + if (ret) { + pr_warn("Couldn't create InfiniBand device class\n"); +- goto err_comp; ++ goto err_comp_unbound; + } + + ret = rdma_nl_init(); +@@ -1218,6 +1228,8 @@ err_ibnl: + rdma_nl_exit(); + err_sysfs: + class_unregister(&ib_class); ++err_comp_unbound: ++ destroy_workqueue(ib_comp_unbound_wq); + err_comp: + destroy_workqueue(ib_comp_wq); + err: +@@ -1236,6 +1248,7 @@ static void __exit ib_core_cleanup(void) + addr_cleanup(); + rdma_nl_exit(); + class_unregister(&ib_class); ++ destroy_workqueue(ib_comp_unbound_wq); + destroy_workqueue(ib_comp_wq); + /* Make sure that any pending umem accounting work is done. */ + destroy_workqueue(ib_wq); +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -3190,7 +3190,7 @@ static int ib_mad_port_open(struct ib_de + } + + port_priv->cq = ib_alloc_cq(port_priv->device, port_priv, cq_size, 0, +- IB_POLL_WORKQUEUE); ++ IB_POLL_UNBOUND_WORKQUEUE); + if (IS_ERR(port_priv->cq)) { + dev_err(&device->dev, "Couldn't create ib_mad CQ\n"); + ret = PTR_ERR(port_priv->cq); +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -71,6 +71,7 @@ + + extern struct workqueue_struct *ib_wq; + extern struct workqueue_struct *ib_comp_wq; ++extern struct workqueue_struct *ib_comp_unbound_wq; + + union ib_gid { + u8 raw[16]; +@@ -1576,9 +1577,10 @@ struct ib_ah { + typedef void (*ib_comp_handler)(struct ib_cq *cq, void *cq_context); + + enum ib_poll_context { +- IB_POLL_DIRECT, /* caller context, no hw completions */ +- IB_POLL_SOFTIRQ, /* poll from softirq context */ +- IB_POLL_WORKQUEUE, /* poll from workqueue */ ++ IB_POLL_DIRECT, /* caller context, no hw completions */ ++ IB_POLL_SOFTIRQ, /* poll from softirq context */ ++ IB_POLL_WORKQUEUE, /* poll from workqueue */ ++ IB_POLL_UNBOUND_WORKQUEUE, /* poll from unbound workqueue */ + }; + + struct ib_cq { +@@ -1595,6 +1597,7 @@ struct ib_cq { + struct irq_poll iop; + struct work_struct work; + }; ++ struct workqueue_struct *comp_wq; + /* + * Implementation details of the RDMA core, don't use in drivers: + */ diff --git a/queue-4.19/mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch b/queue-4.19/mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch new file mode 100644 index 00000000000..9760e8d0518 --- /dev/null +++ b/queue-4.19/mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch @@ -0,0 +1,85 @@ +From 37c673ade35c707d50583b5b25091ff8ebdeafd7 Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Tue, 6 Aug 2019 04:03:18 +0900 +Subject: mtd: cfi_cmdset_0002: Use chip_good() to retry in do_write_oneword() + +From: Tokunori Ikegami + +commit 37c673ade35c707d50583b5b25091ff8ebdeafd7 upstream. + +As reported by the OpenWRT team, write requests sometimes fail on some +platforms. +Currently to check the state chip_ready() is used correctly as described by +the flash memory S29GL256P11TFI01 datasheet. +Also chip_good() is used to check if the write is succeeded and it was +implemented by the commit fb4a90bfcd6d8 ("[MTD] CFI-0002 - Improve error +checking"). +But actually the write failure is caused on some platforms and also it can +be fixed by using chip_good() to check the state and retry instead. +Also it seems that it is caused after repeated about 1,000 times to retry +the write one word with the reset command. +By using chip_good() to check the state to be done it can be reduced the +retry with reset. +It is depended on the actual flash chip behavior so the root cause is +unknown. + +Cc: Chris Packham +Cc: Joakim Tjernlund +Cc: linux-mtd@lists.infradead.org +Cc: stable@vger.kernel.org +Reported-by: Fabio Bettoni +Signed-off-by: Felix Fietkau +Signed-off-by: Hauke Mehrtens +Signed-off-by: Tokunori Ikegami +[vigneshr@ti.com: Fix a checkpatch warning] +Signed-off-by: Vignesh Raghavendra +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -1627,29 +1627,35 @@ static int __xipram do_write_oneword(str + continue; + } + +- if (time_after(jiffies, timeo) && !chip_ready(map, adr)){ ++ /* ++ * We check "time_after" and "!chip_good" before checking ++ * "chip_good" to avoid the failure due to scheduling. ++ */ ++ if (time_after(jiffies, timeo) && !chip_good(map, adr, datum)) { + xip_enable(map, chip, adr); + printk(KERN_WARNING "MTD %s(): software timeout\n", __func__); + xip_disable(map, chip, adr); ++ ret = -EIO; + break; + } + +- if (chip_ready(map, adr)) ++ if (chip_good(map, adr, datum)) + break; + + /* Latency issues. Drop the lock, wait a while and retry */ + UDELAY(map, chip, adr, 1); + } ++ + /* Did we succeed? */ +- if (!chip_good(map, adr, datum)) { ++ if (ret) { + /* reset on all failures. */ + map_write(map, CMD(0xF0), chip->start); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) { ++ ret = 0; + goto retry; +- +- ret = -EIO; ++ } + } + xip_enable(map, chip, adr); + op_done: diff --git a/queue-4.19/series b/queue-4.19/series index a0d01bff56d..2cba4da9838 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -3,3 +3,10 @@ net-ibmvnic-free-reset-work-of-removed-device-from-q.patch rdma-restrack-protect-from-reentry-to-resource-return-path.patch powerpc-xive-fix-bogus-error-code-returned-by-opal.patch drm-amd-display-readd-msse2-to-prevent-clang-from-em.patch +ib-core-add-an-unbound-wq-type-to-the-new-cq-api.patch +hid-prodikeys-fix-general-protection-fault-during-probe.patch +hid-sony-fix-memory-corruption-issue-on-cleanup.patch +hid-logitech-fix-general-protection-fault-caused-by-logitech-driver.patch +hid-hidraw-fix-invalid-read-in-hidraw_ioctl.patch +hid-add-quirk-for-hp-x500-pixart-oem-mouse.patch +mtd-cfi_cmdset_0002-use-chip_good-to-retry-in-do_write_oneword.patch