From: Sasha Levin Date: Sun, 23 Jan 2022 14:49:17 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.4.300~132^2~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6b0b7eeae96884a8d595c5b01d2ea5290def482b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/acpi-battery-add-the-thinkpad-not-charging-quirk.patch b/queue-5.4/acpi-battery-add-the-thinkpad-not-charging-quirk.patch new file mode 100644 index 00000000000..1c94cacba53 --- /dev/null +++ b/queue-5.4/acpi-battery-add-the-thinkpad-not-charging-quirk.patch @@ -0,0 +1,85 @@ +From 4f1a6d784b124bdcd5a124d4ba57985e68ab9e20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 22:20:14 +0100 +Subject: ACPI: battery: Add the ThinkPad "Not Charging" quirk +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Thomas Weißschuh + +[ Upstream commit e96c1197aca628f7d2480a1cc3214912b40b3414 ] + +The EC/ACPI firmware on Lenovo ThinkPads used to report a status +of "Unknown" when the battery is between the charge start and +charge stop thresholds. On Windows, it reports "Not Charging" +so the quirk has been added to also report correctly. + +Now the "status" attribute returns "Not Charging" when the +battery on ThinkPads is not physicaly charging. + +Signed-off-by: Thomas Weißschuh +Reviewed-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/battery.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c +index 6e96ed68b3379..4e0aea5f008e3 100644 +--- a/drivers/acpi/battery.c ++++ b/drivers/acpi/battery.c +@@ -65,6 +65,7 @@ static int battery_bix_broken_package; + static int battery_notification_delay_ms; + static int battery_ac_is_broken; + static int battery_check_pmic = 1; ++static int battery_quirk_notcharging; + static unsigned int cache_time = 1000; + module_param(cache_time, uint, 0644); + MODULE_PARM_DESC(cache_time, "cache time in milliseconds"); +@@ -233,6 +234,8 @@ static int acpi_battery_get_property(struct power_supply *psy, + val->intval = POWER_SUPPLY_STATUS_CHARGING; + else if (acpi_battery_is_charged(battery)) + val->intval = POWER_SUPPLY_STATUS_FULL; ++ else if (battery_quirk_notcharging) ++ val->intval = POWER_SUPPLY_STATUS_NOT_CHARGING; + else + val->intval = POWER_SUPPLY_STATUS_UNKNOWN; + break; +@@ -1337,6 +1340,12 @@ battery_do_not_check_pmic_quirk(const struct dmi_system_id *d) + return 0; + } + ++static int __init battery_quirk_not_charging(const struct dmi_system_id *d) ++{ ++ battery_quirk_notcharging = 1; ++ return 0; ++} ++ + static const struct dmi_system_id bat_dmi_table[] __initconst = { + { + /* NEC LZ750/LS */ +@@ -1381,6 +1390,19 @@ static const struct dmi_system_id bat_dmi_table[] __initconst = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 320-10ICR"), + }, + }, ++ { ++ /* ++ * On Lenovo ThinkPads the BIOS specification defines ++ * a state when the bits for charging and discharging ++ * are both set to 0. That state is "Not Charging". ++ */ ++ .callback = battery_quirk_not_charging, ++ .ident = "Lenovo ThinkPad", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad"), ++ }, ++ }, + {}, + }; + +-- +2.34.1 + diff --git a/queue-5.4/acpi-ec-rework-flushing-of-ec-work-while-suspended-t.patch b/queue-5.4/acpi-ec-rework-flushing-of-ec-work-while-suspended-t.patch new file mode 100644 index 00000000000..c28807d0931 --- /dev/null +++ b/queue-5.4/acpi-ec-rework-flushing-of-ec-work-while-suspended-t.patch @@ -0,0 +1,218 @@ +From d33578bd34c3f4a3a8f288ad2a7dd6ceb9a9343d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 19:36:51 +0100 +Subject: ACPI: EC: Rework flushing of EC work while suspended to idle + +From: Rafael J. Wysocki + +[ Upstream commit 4a9af6cac050dce2e895ec3205c4615383ad9112 ] + +The flushing of pending work in the EC driver uses drain_workqueue() +to flush the event handling work that can requeue itself via +advance_transaction(), but this is problematic, because that +work may also be requeued from the query workqueue. + +Namely, if an EC transaction is carried out during the execution of +a query handler, it involves calling advance_transaction() which +may queue up the event handling work again. This causes the kernel +to complain about attempts to add a work item to the EC event +workqueue while it is being drained and worst-case it may cause a +valid event to be skipped. + +To avoid this problem, introduce two new counters, events_in_progress +and queries_in_progress, incremented when a work item is queued on +the event workqueue or the query workqueue, respectively, and +decremented at the end of the corresponding work function, and make +acpi_ec_dispatch_gpe() the workqueues in a loop until the both of +these counters are zero (or system wakeup is pending) instead of +calling acpi_ec_flush_work(). + +At the same time, change __acpi_ec_flush_work() to call +flush_workqueue() instead of drain_workqueue() to flush the event +workqueue. + +While at it, use the observation that the work item queued in +acpi_ec_query() cannot be pending at that time, because it is used +only once, to simplify the code in there. + +Additionally, clean up a comment in acpi_ec_query() and adjust white +space in acpi_ec_event_processor(). + +Fixes: f0ac20c3f613 ("ACPI: EC: Fix flushing of pending work") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 57 +++++++++++++++++++++++++++++++---------- + drivers/acpi/internal.h | 2 ++ + 2 files changed, 45 insertions(+), 14 deletions(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 258a8df235cfb..e5b92958c299e 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -167,6 +167,7 @@ struct acpi_ec_query { + struct transaction transaction; + struct work_struct work; + struct acpi_ec_query_handler *handler; ++ struct acpi_ec *ec; + }; + + static int acpi_ec_query(struct acpi_ec *ec, u8 *data); +@@ -462,6 +463,7 @@ static void acpi_ec_submit_query(struct acpi_ec *ec) + ec_dbg_evt("Command(%s) submitted/blocked", + acpi_ec_cmd_string(ACPI_EC_COMMAND_QUERY)); + ec->nr_pending_queries++; ++ ec->events_in_progress++; + queue_work(ec_wq, &ec->work); + } + } +@@ -528,7 +530,7 @@ static void acpi_ec_enable_event(struct acpi_ec *ec) + #ifdef CONFIG_PM_SLEEP + static void __acpi_ec_flush_work(void) + { +- drain_workqueue(ec_wq); /* flush ec->work */ ++ flush_workqueue(ec_wq); /* flush ec->work */ + flush_workqueue(ec_query_wq); /* flush queries */ + } + +@@ -1119,7 +1121,7 @@ void acpi_ec_remove_query_handler(struct acpi_ec *ec, u8 query_bit) + } + EXPORT_SYMBOL_GPL(acpi_ec_remove_query_handler); + +-static struct acpi_ec_query *acpi_ec_create_query(u8 *pval) ++static struct acpi_ec_query *acpi_ec_create_query(struct acpi_ec *ec, u8 *pval) + { + struct acpi_ec_query *q; + struct transaction *t; +@@ -1127,11 +1129,13 @@ static struct acpi_ec_query *acpi_ec_create_query(u8 *pval) + q = kzalloc(sizeof (struct acpi_ec_query), GFP_KERNEL); + if (!q) + return NULL; ++ + INIT_WORK(&q->work, acpi_ec_event_processor); + t = &q->transaction; + t->command = ACPI_EC_COMMAND_QUERY; + t->rdata = pval; + t->rlen = 1; ++ q->ec = ec; + return q; + } + +@@ -1148,13 +1152,21 @@ static void acpi_ec_event_processor(struct work_struct *work) + { + struct acpi_ec_query *q = container_of(work, struct acpi_ec_query, work); + struct acpi_ec_query_handler *handler = q->handler; ++ struct acpi_ec *ec = q->ec; + + ec_dbg_evt("Query(0x%02x) started", handler->query_bit); ++ + if (handler->func) + handler->func(handler->data); + else if (handler->handle) + acpi_evaluate_object(handler->handle, NULL, NULL, NULL); ++ + ec_dbg_evt("Query(0x%02x) stopped", handler->query_bit); ++ ++ spin_lock_irq(&ec->lock); ++ ec->queries_in_progress--; ++ spin_unlock_irq(&ec->lock); ++ + acpi_ec_delete_query(q); + } + +@@ -1164,7 +1176,7 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) + int result; + struct acpi_ec_query *q; + +- q = acpi_ec_create_query(&value); ++ q = acpi_ec_create_query(ec, &value); + if (!q) + return -ENOMEM; + +@@ -1186,19 +1198,20 @@ static int acpi_ec_query(struct acpi_ec *ec, u8 *data) + } + + /* +- * It is reported that _Qxx are evaluated in a parallel way on +- * Windows: ++ * It is reported that _Qxx are evaluated in a parallel way on Windows: + * https://bugzilla.kernel.org/show_bug.cgi?id=94411 + * +- * Put this log entry before schedule_work() in order to make +- * it appearing before any other log entries occurred during the +- * work queue execution. ++ * Put this log entry before queue_work() to make it appear in the log ++ * before any other messages emitted during workqueue handling. + */ + ec_dbg_evt("Query(0x%02x) scheduled", value); +- if (!queue_work(ec_query_wq, &q->work)) { +- ec_dbg_evt("Query(0x%02x) overlapped", value); +- result = -EBUSY; +- } ++ ++ spin_lock_irq(&ec->lock); ++ ++ ec->queries_in_progress++; ++ queue_work(ec_query_wq, &q->work); ++ ++ spin_unlock_irq(&ec->lock); + + err_exit: + if (result) +@@ -1256,6 +1269,10 @@ static void acpi_ec_event_handler(struct work_struct *work) + ec_dbg_evt("Event stopped"); + + acpi_ec_check_event(ec); ++ ++ spin_lock_irqsave(&ec->lock, flags); ++ ec->events_in_progress--; ++ spin_unlock_irqrestore(&ec->lock, flags); + } + + static u32 acpi_ec_gpe_handler(acpi_handle gpe_device, +@@ -1972,6 +1989,7 @@ void acpi_ec_set_gpe_wake_mask(u8 action) + + bool acpi_ec_dispatch_gpe(void) + { ++ bool work_in_progress; + u32 ret; + + if (!first_ec) +@@ -1992,8 +2010,19 @@ bool acpi_ec_dispatch_gpe(void) + if (ret == ACPI_INTERRUPT_HANDLED) + pm_pr_dbg("EC GPE dispatched\n"); + +- /* Flush the event and query workqueues. */ +- acpi_ec_flush_work(); ++ /* Drain EC work. */ ++ do { ++ acpi_ec_flush_work(); ++ ++ pm_pr_dbg("ACPI EC work flushed\n"); ++ ++ spin_lock_irq(&first_ec->lock); ++ ++ work_in_progress = first_ec->events_in_progress + ++ first_ec->queries_in_progress > 0; ++ ++ spin_unlock_irq(&first_ec->lock); ++ } while (work_in_progress && !pm_wakeup_pending()); + + return false; + } +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index 159c422601bc4..62b6b36f3a37c 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -183,6 +183,8 @@ struct acpi_ec { + struct work_struct work; + unsigned long timestamp; + unsigned long nr_pending_queries; ++ unsigned int events_in_progress; ++ unsigned int queries_in_progress; + bool busy_polling; + unsigned int polling_guard; + }; +-- +2.34.1 + diff --git a/queue-5.4/acpi-scan-create-platform-device-for-bcm4752-and-lnv.patch b/queue-5.4/acpi-scan-create-platform-device-for-bcm4752-and-lnv.patch new file mode 100644 index 00000000000..a8f14e565d1 --- /dev/null +++ b/queue-5.4/acpi-scan-create-platform-device-for-bcm4752-and-lnv.patch @@ -0,0 +1,79 @@ +From b8b18ca038b3baed318e1677cbb1a7cb03440ae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 12:57:47 +0100 +Subject: ACPI: scan: Create platform device for BCM4752 and LNV4752 ACPI nodes + +From: Hans de Goede + +[ Upstream commit f85196bdd5a50da74670250564740fc852b3c239 ] + +BCM4752 and LNV4752 ACPI nodes describe a Broadcom 4752 GPS module +attached to an UART of the system. + +The GPS modules talk a custom protocol which only works with a closed- +source Android gpsd daemon which knows this protocol. + +The ACPI nodes also describe GPIOs to turn the GPS on/off these are +handled by the net/rfkill/rfkill-gpio.c code. This handling predates the +addition of enumeration of ACPI instantiated serdevs to the kernel and +was broken by that addition, because the ACPI scan code now no longer +instantiates platform_device-s for these nodes. + +Rename the i2c_multi_instantiate_ids HID list to ignore_serial_bus_ids +and add the BCM4752 and LNV4752 HIDs, so that rfkill-gpio gets +a platform_device to bind to again; and so that a tty cdev for gpsd +gets created for these. + +Fixes: e361d1f85855 ("ACPI / scan: Fix enumeration for special UART devices") +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/scan.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 95d119ff76b65..5d4be80ee6cb4 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1577,6 +1577,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) + { + struct list_head resource_list; + bool is_serial_bus_slave = false; ++ static const struct acpi_device_id ignore_serial_bus_ids[] = { + /* + * These devices have multiple I2cSerialBus resources and an i2c-client + * must be instantiated for each, each with its own i2c_device_id. +@@ -1585,11 +1586,18 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) + * drivers/platform/x86/i2c-multi-instantiate.c driver, which knows + * which i2c_device_id to use for each resource. + */ +- static const struct acpi_device_id i2c_multi_instantiate_ids[] = { + {"BSG1160", }, + {"BSG2150", }, + {"INT33FE", }, + {"INT3515", }, ++ /* ++ * HIDs of device with an UartSerialBusV2 resource for which userspace ++ * expects a regular tty cdev to be created (instead of the in kernel ++ * serdev) and which have a kernel driver which expects a platform_dev ++ * such as the rfkill-gpio driver. ++ */ ++ {"BCM4752", }, ++ {"LNV4752", }, + {} + }; + +@@ -1603,8 +1611,7 @@ static bool acpi_device_enumeration_by_parent(struct acpi_device *device) + fwnode_property_present(&device->fwnode, "baud"))) + return true; + +- /* Instantiate a pdev for the i2c-multi-instantiate drv to bind to */ +- if (!acpi_match_device_ids(device, i2c_multi_instantiate_ids)) ++ if (!acpi_match_device_ids(device, ignore_serial_bus_ids)) + return false; + + INIT_LIST_HEAD(&resource_list); +-- +2.34.1 + diff --git a/queue-5.4/acpica-actypes.h-expand-the-acpi_access_-definitions.patch b/queue-5.4/acpica-actypes.h-expand-the-acpi_access_-definitions.patch new file mode 100644 index 00000000000..12231217984 --- /dev/null +++ b/queue-5.4/acpica-actypes.h-expand-the-acpi_access_-definitions.patch @@ -0,0 +1,56 @@ +From b9ebdd3fe7016e416bb07645c7d8a58d821bec0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 16:57:34 +0100 +Subject: ACPICA: actypes.h: Expand the ACPI_ACCESS_ definitions + +From: Mark Langsdorf + +[ Upstream commit f81bdeaf816142e0729eea0cc84c395ec9673151 ] + +ACPICA commit bc02c76d518135531483dfc276ed28b7ee632ce1 + +The current ACPI_ACCESS_*_WIDTH defines do not provide a way to +test that size is small enough to not cause an overflow when +applied to a 32-bit integer. + +Rather than adding more magic numbers, add ACPI_ACCESS_*_SHIFT, +ACPI_ACCESS_*_MAX, and ACPI_ACCESS_*_DEFAULT #defines and +redefine ACPI_ACCESS_*_WIDTH in terms of the new #defines. + +This was inititally reported on Linux where a size of 102 in +ACPI_ACCESS_BIT_WIDTH caused an overflow error in the SPCR +initialization code. + +Link: https://github.com/acpica/acpica/commit/bc02c76d +Signed-off-by: Mark Langsdorf +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/acpi/actypes.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h +index 9373662cdb44f..ff5fecff51167 100644 +--- a/include/acpi/actypes.h ++++ b/include/acpi/actypes.h +@@ -536,8 +536,14 @@ typedef u64 acpi_integer; + * Can be used with access_width of struct acpi_generic_address and access_size of + * struct acpi_resource_generic_register. + */ +-#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + 2)) +-#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) - 1)) ++#define ACPI_ACCESS_BIT_SHIFT 2 ++#define ACPI_ACCESS_BYTE_SHIFT -1 ++#define ACPI_ACCESS_BIT_MAX (31 - ACPI_ACCESS_BIT_SHIFT) ++#define ACPI_ACCESS_BYTE_MAX (31 - ACPI_ACCESS_BYTE_SHIFT) ++#define ACPI_ACCESS_BIT_DEFAULT (8 - ACPI_ACCESS_BIT_SHIFT) ++#define ACPI_ACCESS_BYTE_DEFAULT (8 - ACPI_ACCESS_BYTE_SHIFT) ++#define ACPI_ACCESS_BIT_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BIT_SHIFT)) ++#define ACPI_ACCESS_BYTE_WIDTH(size) (1 << ((size) + ACPI_ACCESS_BYTE_SHIFT)) + + /******************************************************************************* + * +-- +2.34.1 + diff --git a/queue-5.4/acpica-executer-fix-the-refclass_refof-case-in-acpi_.patch b/queue-5.4/acpica-executer-fix-the-refclass_refof-case-in-acpi_.patch new file mode 100644 index 00000000000..4b7a6af1649 --- /dev/null +++ b/queue-5.4/acpica-executer-fix-the-refclass_refof-case-in-acpi_.patch @@ -0,0 +1,57 @@ +From 62bf8f6e26ab1bbebc751018805e1a55299c71e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 17:31:05 +0100 +Subject: ACPICA: Executer: Fix the REFCLASS_REFOF case in + acpi_ex_opcode_1A_0T_1R() + +From: Rafael J. Wysocki + +[ Upstream commit 24ea5f90ec9548044a6209685c5010edd66ffe8f ] + +ACPICA commit d984f12041392fa4156b52e2f7e5c5e7bc38ad9e + +If Operand[0] is a reference of the ACPI_REFCLASS_REFOF class, +acpi_ex_opcode_1A_0T_1R () calls acpi_ns_get_attached_object () to +obtain return_desc which may require additional resolution with +the help of acpi_ex_read_data_from_field (). If the latter fails, +the reference counter of the original return_desc is decremented +which is incorrect, because acpi_ns_get_attached_object () does not +increment the reference counter of the object returned by it. + +This issue may lead to premature deletion of the attached object +while it is still attached and a use-after-free and crash in the +host OS. For example, this may happen when on evaluation of ref_of() +a local region field where there is no registered handler for the +given Operation Region. + +Fix it by making acpi_ex_opcode_1A_0T_1R () return Status right away +after a acpi_ex_read_data_from_field () failure. + +Link: https://github.com/acpica/acpica/commit/d984f120 +Link: https://github.com/acpica/acpica/pull/685 +Reported-by: Lenny Szubowicz +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exoparg1.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpica/exoparg1.c b/drivers/acpi/acpica/exoparg1.c +index 06e35ea098234..6d84618ba3871 100644 +--- a/drivers/acpi/acpica/exoparg1.c ++++ b/drivers/acpi/acpica/exoparg1.c +@@ -1007,7 +1007,8 @@ acpi_status acpi_ex_opcode_1A_0T_1R(struct acpi_walk_state *walk_state) + (walk_state, return_desc, + &temp_desc); + if (ACPI_FAILURE(status)) { +- goto cleanup; ++ return_ACPI_STATUS ++ (status); + } + + return_desc = temp_desc; +-- +2.34.1 + diff --git a/queue-5.4/acpica-fix-wrong-interpretation-of-pcc-address.patch b/queue-5.4/acpica-fix-wrong-interpretation-of-pcc-address.patch new file mode 100644 index 00000000000..896cadfe4fa --- /dev/null +++ b/queue-5.4/acpica-fix-wrong-interpretation-of-pcc-address.patch @@ -0,0 +1,86 @@ +From 4c19ae7b18564479824cae6b072648c0aa0c96ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 17:31:54 +0100 +Subject: ACPICA: Fix wrong interpretation of PCC address + +From: Sudeep Holla + +[ Upstream commit 9a3b8655db1ada31c82189ae13f40eb25da48c35 ] + +ACPICA commit 41be6afacfdaec2dba3a5ed368736babc2a7aa5c + +With the PCC Opregion in the firmware and we are hitting below kernel crash: + +-->8 +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 + Workqueue: pm pm_runtime_work + pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) + pc : __memcpy+0x54/0x260 + lr : acpi_ex_write_data_to_field+0xb8/0x194 + Call trace: + __memcpy+0x54/0x260 + acpi_ex_store_object_to_node+0xa4/0x1d4 + acpi_ex_store+0x44/0x164 + acpi_ex_opcode_1A_1T_1R+0x25c/0x508 + acpi_ds_exec_end_op+0x1b4/0x44c + acpi_ps_parse_loop+0x3a8/0x614 + acpi_ps_parse_aml+0x90/0x2f4 + acpi_ps_execute_method+0x11c/0x19c + acpi_ns_evaluate+0x1ec/0x2b0 + acpi_evaluate_object+0x170/0x2b0 + acpi_device_set_power+0x118/0x310 + acpi_dev_suspend+0xd4/0x180 + acpi_subsys_runtime_suspend+0x28/0x38 + __rpm_callback+0x74/0x328 + rpm_suspend+0x2d8/0x624 + pm_runtime_work+0xa4/0xb8 + process_one_work+0x194/0x25c + worker_thread+0x260/0x49c + kthread+0x14c/0x30c + ret_from_fork+0x10/0x20 + Code: f9000006 f81f80a7 d65f03c0 361000c2 (b9400026) + ---[ end trace 24d8a032fa77b68a ]--- + +The reason for the crash is that the PCC channel index passed via region.address +in acpi_ex_store_object_to_node is interpreted as the channel subtype +incorrectly. + +Assuming the PCC op_region support is not used by any other type, let us +remove the subtype check as the AML has no access to the subtype information. +Once we remove it, the kernel crash disappears and correctly complains about +missing PCC Opregion handler. + +ACPI Error: No handler for Region [PFRM] ((____ptrval____)) [PCC] (20210730/evregion-130) +ACPI Error: Region PCC (ID=10) has no handler (20210730/exfldio-261) +ACPI Error: Aborting method \_SB.ETH0._PS3 due to previous error (AE_NOT_EXIST) (20210730/psparse-531) + +Link: https://github.com/acpica/acpica/commit/41be6afa +Signed-off-by: Sudeep Holla +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/exfield.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/acpi/acpica/exfield.c b/drivers/acpi/acpica/exfield.c +index d3d2dbfba680c..cd3debefe990d 100644 +--- a/drivers/acpi/acpica/exfield.c ++++ b/drivers/acpi/acpica/exfield.c +@@ -320,12 +320,7 @@ acpi_ex_write_data_to_field(union acpi_operand_object *source_desc, + obj_desc->field.base_byte_offset, + source_desc->buffer.pointer, data_length); + +- if ((obj_desc->field.region_obj->region.address == +- PCC_MASTER_SUBSPACE +- && MASTER_SUBSPACE_COMMAND(obj_desc->field. +- base_byte_offset)) +- || GENERIC_SUBSPACE_COMMAND(obj_desc->field. +- base_byte_offset)) { ++ if (MASTER_SUBSPACE_COMMAND(obj_desc->field.base_byte_offset)) { + + /* Perform the write */ + +-- +2.34.1 + diff --git a/queue-5.4/acpica-hardware-do-not-flush-cpu-cache-when-entering.patch b/queue-5.4/acpica-hardware-do-not-flush-cpu-cache-when-entering.patch new file mode 100644 index 00000000000..89940a8dd33 --- /dev/null +++ b/queue-5.4/acpica-hardware-do-not-flush-cpu-cache-when-entering.patch @@ -0,0 +1,82 @@ +From 500b52942394684f079bfb7405ab7509f6103b33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 17:33:51 +0100 +Subject: ACPICA: Hardware: Do not flush CPU cache when entering S4 and S5 + +From: Kirill A. Shutemov + +[ Upstream commit 1d4e0b3abb168b2ee1eca99c527cffa1b80b6161 ] + +ACPICA commit 3dd7e1f3996456ef81bfe14cba29860e8d42949e + +According to ACPI 6.4, Section 16.2, the CPU cache flushing is +required on entering to S1, S2, and S3, but the ACPICA code +flushes the CPU cache regardless of the sleep state. + +Blind cache flush on entering S5 causes problems for TDX. + +Flushing happens with WBINVD that is not supported in the TDX +environment. + +TDX only supports S5 and adjusting ACPICA code to conform to the +spec more strictly fixes the issue. + +Link: https://github.com/acpica/acpica/commit/3dd7e1f3 +Signed-off-by: Kirill A. Shutemov +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/hwesleep.c | 4 +++- + drivers/acpi/acpica/hwsleep.c | 4 +++- + drivers/acpi/acpica/hwxfsleep.c | 2 -- + 3 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/acpi/acpica/hwesleep.c b/drivers/acpi/acpica/hwesleep.c +index aa502ae3b6b31..de0a59878e52d 100644 +--- a/drivers/acpi/acpica/hwesleep.c ++++ b/drivers/acpi/acpica/hwesleep.c +@@ -104,7 +104,9 @@ acpi_status acpi_hw_extended_sleep(u8 sleep_state) + + /* Flush caches, as per ACPI specification */ + +- ACPI_FLUSH_CPU_CACHE(); ++ if (sleep_state < ACPI_STATE_S4) { ++ ACPI_FLUSH_CPU_CACHE(); ++ } + + status = acpi_os_enter_sleep(sleep_state, sleep_control, 0); + if (status == AE_CTRL_TERMINATE) { +diff --git a/drivers/acpi/acpica/hwsleep.c b/drivers/acpi/acpica/hwsleep.c +index 5f7d63badbe9d..321aaad97e2f7 100644 +--- a/drivers/acpi/acpica/hwsleep.c ++++ b/drivers/acpi/acpica/hwsleep.c +@@ -110,7 +110,9 @@ acpi_status acpi_hw_legacy_sleep(u8 sleep_state) + + /* Flush caches, as per ACPI specification */ + +- ACPI_FLUSH_CPU_CACHE(); ++ if (sleep_state < ACPI_STATE_S4) { ++ ACPI_FLUSH_CPU_CACHE(); ++ } + + status = acpi_os_enter_sleep(sleep_state, pm1a_control, pm1b_control); + if (status == AE_CTRL_TERMINATE) { +diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c +index 79731efbe8fe2..4e3398819718d 100644 +--- a/drivers/acpi/acpica/hwxfsleep.c ++++ b/drivers/acpi/acpica/hwxfsleep.c +@@ -162,8 +162,6 @@ acpi_status acpi_enter_sleep_state_s4bios(void) + return_ACPI_STATUS(status); + } + +- ACPI_FLUSH_CPU_CACHE(); +- + status = acpi_hw_write_port(acpi_gbl_FADT.smi_command, + (u32)acpi_gbl_FADT.s4_bios_request, 8); + +-- +2.34.1 + diff --git a/queue-5.4/acpica-utilities-avoid-deleting-the-same-object-twic.patch b/queue-5.4/acpica-utilities-avoid-deleting-the-same-object-twic.patch new file mode 100644 index 00000000000..7f2ced3b7ad --- /dev/null +++ b/queue-5.4/acpica-utilities-avoid-deleting-the-same-object-twic.patch @@ -0,0 +1,48 @@ +From 99d0ba3d15d48936a0322391c59e9cfca4f2dec0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 17:29:45 +0100 +Subject: ACPICA: Utilities: Avoid deleting the same object twice in a row + +From: Rafael J. Wysocki + +[ Upstream commit 1cdfe9e346b4c5509ffe19ccde880fd259d9f7a3 ] + +ACPICA commit c11af67d8f7e3d381068ce7771322f2b5324d687 + +If original_count is 0 in acpi_ut_update_ref_count (), +acpi_ut_delete_internal_obj () is invoked for the target object, which is +incorrect, because that object has been deleted once already and the +memory allocated to store it may have been reclaimed and allocated +for a different purpose by the host OS. Moreover, a confusing debug +message following the "Reference Count is already zero, cannot +decrement" warning is printed in that case. + +To fix this issue, make acpi_ut_update_ref_count () return after finding +that original_count is 0 and printing the above warning. + +Link: https://github.com/acpica/acpica/commit/c11af67d +Link: https://github.com/acpica/acpica/pull/652 +Reported-by: Mark Asselstine +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/utdelete.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c +index 72d2c0b656339..cb1750e7a6281 100644 +--- a/drivers/acpi/acpica/utdelete.c ++++ b/drivers/acpi/acpica/utdelete.c +@@ -422,6 +422,7 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action) + ACPI_WARNING((AE_INFO, + "Obj %p, Reference Count is already zero, cannot decrement\n", + object)); ++ return; + } + + ACPI_DEBUG_PRINT_RAW((ACPI_DB_ALLOCATIONS, +-- +2.34.1 + diff --git a/queue-5.4/alsa-hda-add-missing-rwsem-around-snd_ctl_remove-cal.patch b/queue-5.4/alsa-hda-add-missing-rwsem-around-snd_ctl_remove-cal.patch new file mode 100644 index 00000000000..7be27d1efb5 --- /dev/null +++ b/queue-5.4/alsa-hda-add-missing-rwsem-around-snd_ctl_remove-cal.patch @@ -0,0 +1,40 @@ +From 5958eb8c5de5804540968300065bbf1360c0ab3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 08:13:14 +0100 +Subject: ALSA: hda: Add missing rwsem around snd_ctl_remove() calls + +From: Takashi Iwai + +[ Upstream commit 80bd64af75b4bb11c0329bc66c35da2ddfb66d88 ] + +snd_ctl_remove() has to be called with card->controls_rwsem held (when +called after the card instantiation). This patch add the missing +rwsem calls around it. + +Fixes: d13bd412dce2 ("ALSA: hda - Manage kcontrol lists") +Link: https://lore.kernel.org/r/20211116071314.15065-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_codec.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c +index 326f95ce5ceb1..c8847de8388f0 100644 +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -1721,8 +1721,11 @@ void snd_hda_ctls_clear(struct hda_codec *codec) + { + int i; + struct hda_nid_item *items = codec->mixers.list; ++ ++ down_write(&codec->card->controls_rwsem); + for (i = 0; i < codec->mixers.used; i++) + snd_ctl_remove(codec->card, items[i].kctl); ++ up_write(&codec->card->controls_rwsem); + snd_array_free(&codec->mixers); + snd_array_free(&codec->nids); + } +-- +2.34.1 + diff --git a/queue-5.4/alsa-jack-add-missing-rwsem-around-snd_ctl_remove-ca.patch b/queue-5.4/alsa-jack-add-missing-rwsem-around-snd_ctl_remove-ca.patch new file mode 100644 index 00000000000..8e57757e791 --- /dev/null +++ b/queue-5.4/alsa-jack-add-missing-rwsem-around-snd_ctl_remove-ca.patch @@ -0,0 +1,42 @@ +From 47513ebe24771ade27c2c921eca798a4850d67c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 08:13:12 +0100 +Subject: ALSA: jack: Add missing rwsem around snd_ctl_remove() calls + +From: Takashi Iwai + +[ Upstream commit 06764dc931848c3a9bc01a63bbf76a605408bb54 ] + +snd_ctl_remove() has to be called with card->controls_rwsem held (when +called after the card instantiation). This patch add the missing +rwsem calls around it. + +Fixes: 9058cbe1eed2 ("ALSA: jack: implement kctl creating for jack devices") +Link: https://lore.kernel.org/r/20211116071314.15065-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/jack.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/core/jack.c b/sound/core/jack.c +index 8b209750c7a9c..b00ae6f39f054 100644 +--- a/sound/core/jack.c ++++ b/sound/core/jack.c +@@ -54,10 +54,13 @@ static int snd_jack_dev_free(struct snd_device *device) + struct snd_card *card = device->card; + struct snd_jack_kctl *jack_kctl, *tmp_jack_kctl; + ++ down_write(&card->controls_rwsem); + list_for_each_entry_safe(jack_kctl, tmp_jack_kctl, &jack->kctl_list, list) { + list_del_init(&jack_kctl->list); + snd_ctl_remove(card, jack_kctl->kctl); + } ++ up_write(&card->controls_rwsem); ++ + if (jack->private_free) + jack->private_free(jack); + +-- +2.34.1 + diff --git a/queue-5.4/alsa-oss-fix-compile-error-when-oss_debug-is-enabled.patch b/queue-5.4/alsa-oss-fix-compile-error-when-oss_debug-is-enabled.patch new file mode 100644 index 00000000000..c31694abb50 --- /dev/null +++ b/queue-5.4/alsa-oss-fix-compile-error-when-oss_debug-is-enabled.patch @@ -0,0 +1,41 @@ +From c2fb2b277d317f7b8ad1659636df5ab5bb6ba9cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 16:58:54 +0800 +Subject: ALSA: oss: fix compile error when OSS_DEBUG is enabled + +From: Bixuan Cui + +[ Upstream commit 8e7daf318d97f25e18b2fc7eb5909e34cd903575 ] + +Fix compile error when OSS_DEBUG is enabled: + sound/core/oss/pcm_oss.c: In function 'snd_pcm_oss_set_trigger': + sound/core/oss/pcm_oss.c:2055:10: error: 'substream' undeclared (first + use in this function); did you mean 'csubstream'? + pcm_dbg(substream->pcm, "pcm_oss: trigger = 0x%x\n", trigger); + ^ + +Fixes: 61efcee8608c ("ALSA: oss: Use standard printk helpers") +Signed-off-by: Bixuan Cui +Link: https://lore.kernel.org/r/1638349134-110369-1-git-send-email-cuibixuan@linux.alibaba.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/oss/pcm_oss.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 9e31f4bd43826..841c0a12cc929 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -2055,7 +2055,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr + int err, cmd; + + #ifdef OSS_DEBUG +- pcm_dbg(substream->pcm, "pcm_oss: trigger = 0x%x\n", trigger); ++ pr_debug("pcm_oss: trigger = 0x%x\n", trigger); + #endif + + psubstream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK]; +-- +2.34.1 + diff --git a/queue-5.4/alsa-pcm-add-missing-rwsem-around-snd_ctl_remove-cal.patch b/queue-5.4/alsa-pcm-add-missing-rwsem-around-snd_ctl_remove-cal.patch new file mode 100644 index 00000000000..70b2a2b3947 --- /dev/null +++ b/queue-5.4/alsa-pcm-add-missing-rwsem-around-snd_ctl_remove-cal.patch @@ -0,0 +1,41 @@ +From b0fdeb1e43a6d16a035ae9753cb4771f30415c8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 08:13:13 +0100 +Subject: ALSA: PCM: Add missing rwsem around snd_ctl_remove() calls + +From: Takashi Iwai + +[ Upstream commit 5471e9762e1af4b7df057a96bfd46cc250979b88 ] + +snd_ctl_remove() has to be called with card->controls_rwsem held (when +called after the card instantiation). This patch add the missing +rwsem calls around it. + +Fixes: a8ff48cb7083 ("ALSA: pcm: Free chmap at PCM free callback, too") +Link: https://lore.kernel.org/r/20211116071314.15065-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index 9a72d641743d9..f8ce961c28d6e 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -810,7 +810,11 @@ EXPORT_SYMBOL(snd_pcm_new_internal); + static void free_chmap(struct snd_pcm_str *pstr) + { + if (pstr->chmap_kctl) { +- snd_ctl_remove(pstr->pcm->card, pstr->chmap_kctl); ++ struct snd_card *card = pstr->pcm->card; ++ ++ down_write(&card->controls_rwsem); ++ snd_ctl_remove(card, pstr->chmap_kctl); ++ up_write(&card->controls_rwsem); + pstr->chmap_kctl = NULL; + } + } +-- +2.34.1 + diff --git a/queue-5.4/alsa-seq-set-upper-limit-of-processed-events.patch b/queue-5.4/alsa-seq-set-upper-limit-of-processed-events.patch new file mode 100644 index 00000000000..64809751240 --- /dev/null +++ b/queue-5.4/alsa-seq-set-upper-limit-of-processed-events.patch @@ -0,0 +1,87 @@ +From 3c8ce375815f64f2bbf03fb3697482e70d6d0603 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 17:51:46 +0100 +Subject: ALSA: seq: Set upper limit of processed events + +From: Takashi Iwai + +[ Upstream commit 6fadb494a638d8b8a55864ecc6ac58194f03f327 ] + +Currently ALSA sequencer core tries to process the queued events as +much as possible when they become dispatchable. If applications try +to queue too massive events to be processed at the very same timing, +the sequencer core would still try to process such all events, either +in the interrupt context or via some notifier; in either away, it +might be a cause of RCU stall or such problems. + +As a potential workaround for those problems, this patch adds the +upper limit of the amount of events to be processed. The remaining +events are processed in the next batch, so they won't be lost. + +For the time being, it's limited up to 1000 events per queue, which +should be high enough for any normal usages. + +Reported-by: Zqiang +Reported-by: syzbot+bb950e68b400ab4f65f8@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20211102033222.3849-1-qiang.zhang1211@gmail.com +Link: https://lore.kernel.org/r/20211207165146.2888-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/seq_queue.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 71a6ea62c3be7..4ff0b927230c2 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -234,12 +234,15 @@ struct snd_seq_queue *snd_seq_queue_find_name(char *name) + + /* -------------------------------------------------------- */ + ++#define MAX_CELL_PROCESSES_IN_QUEUE 1000 ++ + void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + { + unsigned long flags; + struct snd_seq_event_cell *cell; + snd_seq_tick_time_t cur_tick; + snd_seq_real_time_t cur_time; ++ int processed = 0; + + if (q == NULL) + return; +@@ -262,6 +265,8 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + if (!cell) + break; + snd_seq_dispatch_event(cell, atomic, hop); ++ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) ++ goto out; /* the rest processed at the next batch */ + } + + /* Process time queue... */ +@@ -271,14 +276,19 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + if (!cell) + break; + snd_seq_dispatch_event(cell, atomic, hop); ++ if (++processed >= MAX_CELL_PROCESSES_IN_QUEUE) ++ goto out; /* the rest processed at the next batch */ + } + ++ out: + /* free lock */ + spin_lock_irqsave(&q->check_lock, flags); + if (q->check_again) { + q->check_again = 0; +- spin_unlock_irqrestore(&q->check_lock, flags); +- goto __again; ++ if (processed < MAX_CELL_PROCESSES_IN_QUEUE) { ++ spin_unlock_irqrestore(&q->check_lock, flags); ++ goto __again; ++ } + } + q->check_blocked = 0; + spin_unlock_irqrestore(&q->check_lock, flags); +-- +2.34.1 + diff --git a/queue-5.4/ar5523-fix-null-ptr-deref-with-unexpected-wdcmsg_tar.patch b/queue-5.4/ar5523-fix-null-ptr-deref-with-unexpected-wdcmsg_tar.patch new file mode 100644 index 00000000000..fcb21b0ba50 --- /dev/null +++ b/queue-5.4/ar5523-fix-null-ptr-deref-with-unexpected-wdcmsg_tar.patch @@ -0,0 +1,63 @@ +From c5971c474c341497215c49182da16ff3f342b6a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 18:37:49 -0400 +Subject: ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply + +From: Zekun Shen + +[ Upstream commit ae80b6033834342601e99f74f6a62ff5092b1cee ] + +Unexpected WDCMSG_TARGET_START replay can lead to null-ptr-deref +when ar->tx_cmd->odata is NULL. The patch adds a null check to +prevent such case. + +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] + ar5523_cmd+0x46a/0x581 [ar5523] + ar5523_probe.cold+0x1b7/0x18da [ar5523] + ? ar5523_cmd_rx_cb+0x7a0/0x7a0 [ar5523] + ? __pm_runtime_set_status+0x54a/0x8f0 + ? _raw_spin_trylock_bh+0x120/0x120 + ? pm_runtime_barrier+0x220/0x220 + ? __pm_runtime_resume+0xb1/0xf0 + usb_probe_interface+0x25b/0x710 + really_probe+0x209/0x5d0 + driver_probe_device+0xc6/0x1b0 + device_driver_attach+0xe2/0x120 + +I found the bug using a custome USBFuzz port. It's a research work +to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, +providing hand-crafted usb descriptors to QEMU. + +After fixing the code (fourth byte in usb packet) to WDCMSG_TARGET_START, +I got the null-ptr-deref bug. I believe the bug is triggerable whenever +cmd->odata is NULL. After patching, I tested with the same input and no +longer see the KASAN report. + +This was NOT tested on a real device. + +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YXsmPQ3awHFLuAj2@10-18-43-117.dynapool.wireless.nyu.edu +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c +index 4c57e79e5779a..58e189ec672f9 100644 +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -153,6 +153,10 @@ static void ar5523_cmd_rx_cb(struct urb *urb) + ar5523_err(ar, "Invalid reply to WDCMSG_TARGET_START"); + return; + } ++ if (!cmd->odata) { ++ ar5523_err(ar, "Unexpected WDCMSG_TARGET_START reply"); ++ return; ++ } + memcpy(cmd->odata, hdr + 1, sizeof(u32)); + cmd->olen = sizeof(u32); + cmd->res = 0; +-- +2.34.1 + diff --git a/queue-5.4/arm-9159-1-decompressor-avoid-unpredictable-nop-enco.patch b/queue-5.4/arm-9159-1-decompressor-avoid-unpredictable-nop-enco.patch new file mode 100644 index 00000000000..ab8d8acea31 --- /dev/null +++ b/queue-5.4/arm-9159-1-decompressor-avoid-unpredictable-nop-enco.patch @@ -0,0 +1,100 @@ +From 02c5445b115090e10c2cb1c44eb41b7896fd9fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 16:28:43 +0100 +Subject: ARM: 9159/1: decompressor: Avoid UNPREDICTABLE NOP encoding + +From: Andre Przywara + +[ Upstream commit a92882a4d270fbcc021ee6848de5e48b7f0d27f3 ] + +In the decompressor's head.S we need to start with an instruction that +is some kind of NOP, but also mimics as the PE/COFF header, when the +kernel is linked as an UEFI application. The clever solution here is +"tstne r0, #0x4d000", which in the worst case just clobbers the +condition flags, and bears the magic "MZ" signature in the lowest 16 bits. + +However the encoding used (0x13105a4d) is actually not valid, since bits +[15:12] are supposed to be 0 (written as "(0)" in the ARM ARM). +Violating this is UNPREDICTABLE, and *can* trigger an UNDEFINED +exception. Common Cortex cores seem to ignore those bits, but QEMU +chooses to trap, so the code goes fishing because of a missing exception +handler at this point. We are just saved by the fact that commonly (with +-kernel or when running from U-Boot) the "Z" bit is set, so the +instruction is never executed. See [0] for more details. + +To make things more robust and avoid UNPREDICTABLE behaviour in the +kernel code, lets replace this with a "two-instruction NOP": +The first instruction is an exclusive OR, the effect of which the second +instruction reverts. This does not leave any trace, neither in a +register nor in the condition flags. Also it's a perfectly valid +encoding. Kudos to Peter Maydell for coming up with this gem. + +[0] https://lore.kernel.org/qemu-devel/YTPIdbUCmwagL5%2FD@os.inf.tu-dresden.de/T/ + +Link: https://lore.kernel.org/linux-arm-kernel/20210908162617.104962-1-andre.przywara@arm.com/T/ + +Fixes: 81a0bc39ea19 ("ARM: add UEFI stub support") +Signed-off-by: Andre Przywara +Reported-by: Adam Lackorzynski +Suggested-by: Peter Maydell +Reviewed-by: Ard Biesheuvel +Reviewed-by: Linus Walleij +Signed-off-by: Russell King (Oracle) +Signed-off-by: Sasha Levin +--- + arch/arm/boot/compressed/efi-header.S | 22 ++++++++++++++-------- + arch/arm/boot/compressed/head.S | 3 ++- + 2 files changed, 16 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/compressed/efi-header.S b/arch/arm/boot/compressed/efi-header.S +index a5983588f96b8..dd53d6eb53ade 100644 +--- a/arch/arm/boot/compressed/efi-header.S ++++ b/arch/arm/boot/compressed/efi-header.S +@@ -9,16 +9,22 @@ + #include + + .macro __nop +-#ifdef CONFIG_EFI_STUB +- @ This is almost but not quite a NOP, since it does clobber the +- @ condition flags. But it is the best we can do for EFI, since +- @ PE/COFF expects the magic string "MZ" at offset 0, while the +- @ ARM/Linux boot protocol expects an executable instruction +- @ there. +- .inst MZ_MAGIC | (0x1310 << 16) @ tstne r0, #0x4d000 +-#else + AR_CLASS( mov r0, r0 ) + M_CLASS( nop.w ) ++ .endm ++ ++ .macro __initial_nops ++#ifdef CONFIG_EFI_STUB ++ @ This is a two-instruction NOP, which happens to bear the ++ @ PE/COFF signature "MZ" in the first two bytes, so the kernel ++ @ is accepted as an EFI binary. Booting via the UEFI stub ++ @ will not execute those instructions, but the ARM/Linux ++ @ boot protocol does, so we need some NOPs here. ++ .inst MZ_MAGIC | (0xe225 << 16) @ eor r5, r5, 0x4d000 ++ eor r5, r5, 0x4d000 @ undo previous insn ++#else ++ __nop ++ __nop + #endif + .endm + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index cbe126297f549..0a2410adc25b3 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -165,7 +165,8 @@ start: + * were patching the initial instructions of the kernel, i.e + * had started to exploit this "patch area". + */ +- .rept 7 ++ __initial_nops ++ .rept 5 + __nop + .endr + #ifndef CONFIG_THUMB2_KERNEL +-- +2.34.1 + diff --git a/queue-5.4/arm-dts-armada-38x-add-generic-compatible-to-uart-no.patch b/queue-5.4/arm-dts-armada-38x-add-generic-compatible-to-uart-no.patch new file mode 100644 index 00000000000..8cadaec4d34 --- /dev/null +++ b/queue-5.4/arm-dts-armada-38x-add-generic-compatible-to-uart-no.patch @@ -0,0 +1,51 @@ +From 1f02a2dcc52cafb719f879fdbc4bb3a6e02a9a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 17:46:04 +0100 +Subject: ARM: dts: armada-38x: Add generic compatible to UART nodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 62480772263ab6b52e758f2346c70a526abd1d28 ] + +Add generic compatible string "ns16550a" to serial port nodes of Armada +38x. + +This makes it possible to use earlycon. + +Fixes: 0d3d96ab0059 ("ARM: mvebu: add Device Tree description of the Armada 380/385 SoCs") +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-38x.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-38x.dtsi b/arch/arm/boot/dts/armada-38x.dtsi +index 669da3a33d82c..5b82e58a1cf06 100644 +--- a/arch/arm/boot/dts/armada-38x.dtsi ++++ b/arch/arm/boot/dts/armada-38x.dtsi +@@ -165,7 +165,7 @@ + }; + + uart0: serial@12000 { +- compatible = "marvell,armada-38x-uart"; ++ compatible = "marvell,armada-38x-uart", "ns16550a"; + reg = <0x12000 0x100>; + reg-shift = <2>; + interrupts = ; +@@ -175,7 +175,7 @@ + }; + + uart1: serial@12100 { +- compatible = "marvell,armada-38x-uart"; ++ compatible = "marvell,armada-38x-uart", "ns16550a"; + reg = <0x12100 0x100>; + reg-shift = <2>; + interrupts = ; +-- +2.34.1 + diff --git a/queue-5.4/arm-dts-gemini-nas4220-b-fis-index-block-with-128-ki.patch b/queue-5.4/arm-dts-gemini-nas4220-b-fis-index-block-with-128-ki.patch new file mode 100644 index 00000000000..46e7d60dacc --- /dev/null +++ b/queue-5.4/arm-dts-gemini-nas4220-b-fis-index-block-with-128-ki.patch @@ -0,0 +1,65 @@ +From 6f25b0e3cc7b91d44af9911989272e2fd3ae65c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Dec 2021 01:43:34 +0100 +Subject: ARM: dts: gemini: NAS4220-B: fis-index-block with 128 KiB sectors + +From: Christian Lamparter + +[ Upstream commit 4754eab7e5a78bdefe7a960c5c260c95ebbb5fa6 ] + +Steven Maddox reported in the OpenWrt bugzilla, that his +RaidSonic IB-NAS4220-B was no longer booting with the new +OpenWrt 21.02 (uses linux 5.10's device-tree). However, it was +working with the previous OpenWrt 19.07 series (uses 4.14). + +|[ 5.548038] No RedBoot partition table detected in 30000000.flash +|[ 5.618553] Searching for RedBoot partition table in 30000000.flash at offset 0x0 +|[ 5.739093] No RedBoot partition table detected in 30000000.flash +|... +|[ 7.039504] Waiting for root device /dev/mtdblock3... + +The provided bootlog shows that the RedBoot partition parser was +looking for the partition table "at offset 0x0". Which is strange +since the comment in the device-tree says it should be at 0xfe0000. + +Further digging on the internet led to a review site that took +some useful PCB pictures of their review unit back in February 2009. +Their picture shows a Spansion S29GL128N11TFI01 flash chip. + +>From Spansion's Datasheet: +"S29GL128N: One hundred twenty-eight 64 Kword (128 Kbyte) sectors" +Steven also provided a "cat /sys/class/mtd/mtd0/erasesize" from his +unit: "131072". + +With the 128 KiB Sector/Erasesize in mind. This patch changes the +fis-index-block property to (0xfe0000 / 0x20000) = 0x7f. + +Fixes: b5a923f8c739 ("ARM: dts: gemini: Switch to redboot partition parsing") +Reported-by: Steven Maddox +Signed-off-by: Christian Lamparter +Signed-off-by: Linus Walleij +Tested-by: Steven Maddox +Link: https://lore.kernel.org/r/20211206004334.4169408-1-linus.walleij@linaro.org' +Bugzilla: https://bugs.openwrt.org/index.php?do=details&task_id=4137 +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/gemini-nas4220b.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/gemini-nas4220b.dts b/arch/arm/boot/dts/gemini-nas4220b.dts +index e1020e07e1366..60cec653ac7c6 100644 +--- a/arch/arm/boot/dts/gemini-nas4220b.dts ++++ b/arch/arm/boot/dts/gemini-nas4220b.dts +@@ -84,7 +84,7 @@ + partitions { + compatible = "redboot-fis"; + /* Eraseblock at 0xfe0000 */ +- fis-index-block = <0x1fc>; ++ fis-index-block = <0x7f>; + }; + }; + +-- +2.34.1 + diff --git a/queue-5.4/arm-imx-rename-debug_imx21_imx27_uart-to-debug_imx27.patch b/queue-5.4/arm-imx-rename-debug_imx21_imx27_uart-to-debug_imx27.patch new file mode 100644 index 00000000000..19aada06de8 --- /dev/null +++ b/queue-5.4/arm-imx-rename-debug_imx21_imx27_uart-to-debug_imx27.patch @@ -0,0 +1,121 @@ +From eaa27926ce1c434c07492d09ace4a88e72a9150b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 16:19:33 +0200 +Subject: ARM: imx: rename DEBUG_IMX21_IMX27_UART to DEBUG_IMX27_UART + +From: Lukas Bulwahn + +[ Upstream commit b0100bce4ff82ec1ccd3c1f3d339fd2df6a81784 ] + +Since commit 4b563a066611 ("ARM: imx: Remove imx21 support"), the config +DEBUG_IMX21_IMX27_UART is really only debug support for IMX27. + +So, rename this option to DEBUG_IMX27_UART and adjust dependencies in +Kconfig and rename the definitions to IMX27 as further clean-up. + +This issue was discovered with ./scripts/checkkconfigsymbols.py, which +reported that DEBUG_IMX21_IMX27_UART depends on the non-existing config +SOC_IMX21. + +Signed-off-by: Lukas Bulwahn +Reviewed-by: Arnd Bergmann +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig.debug | 14 +++++++------- + arch/arm/include/debug/imx-uart.h | 18 +++++++++--------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index 8bcbd0cd739b5..5e2b44a9df18c 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -400,12 +400,12 @@ choice + Say Y here if you want kernel low-level debugging support + on i.MX25. + +- config DEBUG_IMX21_IMX27_UART +- bool "i.MX21 and i.MX27 Debug UART" +- depends on SOC_IMX21 || SOC_IMX27 ++ config DEBUG_IMX27_UART ++ bool "i.MX27 Debug UART" ++ depends on SOC_IMX27 + help + Say Y here if you want kernel low-level debugging support +- on i.MX21 or i.MX27. ++ on i.MX27. + + config DEBUG_IMX28_UART + bool "i.MX28 Debug UART" +@@ -1472,7 +1472,7 @@ config DEBUG_IMX_UART_PORT + int "i.MX Debug UART Port Selection" + depends on DEBUG_IMX1_UART || \ + DEBUG_IMX25_UART || \ +- DEBUG_IMX21_IMX27_UART || \ ++ DEBUG_IMX27_UART || \ + DEBUG_IMX31_UART || \ + DEBUG_IMX35_UART || \ + DEBUG_IMX50_UART || \ +@@ -1529,12 +1529,12 @@ config DEBUG_LL_INCLUDE + default "debug/icedcc.S" if DEBUG_ICEDCC + default "debug/imx.S" if DEBUG_IMX1_UART || \ + DEBUG_IMX25_UART || \ +- DEBUG_IMX21_IMX27_UART || \ ++ DEBUG_IMX27_UART || \ + DEBUG_IMX31_UART || \ + DEBUG_IMX35_UART || \ + DEBUG_IMX50_UART || \ + DEBUG_IMX51_UART || \ +- DEBUG_IMX53_UART ||\ ++ DEBUG_IMX53_UART || \ + DEBUG_IMX6Q_UART || \ + DEBUG_IMX6SL_UART || \ + DEBUG_IMX6SX_UART || \ +diff --git a/arch/arm/include/debug/imx-uart.h b/arch/arm/include/debug/imx-uart.h +index c8eb83d4b8964..3edbb3c5b42bf 100644 +--- a/arch/arm/include/debug/imx-uart.h ++++ b/arch/arm/include/debug/imx-uart.h +@@ -11,13 +11,6 @@ + #define IMX1_UART_BASE_ADDR(n) IMX1_UART##n##_BASE_ADDR + #define IMX1_UART_BASE(n) IMX1_UART_BASE_ADDR(n) + +-#define IMX21_UART1_BASE_ADDR 0x1000a000 +-#define IMX21_UART2_BASE_ADDR 0x1000b000 +-#define IMX21_UART3_BASE_ADDR 0x1000c000 +-#define IMX21_UART4_BASE_ADDR 0x1000d000 +-#define IMX21_UART_BASE_ADDR(n) IMX21_UART##n##_BASE_ADDR +-#define IMX21_UART_BASE(n) IMX21_UART_BASE_ADDR(n) +- + #define IMX25_UART1_BASE_ADDR 0x43f90000 + #define IMX25_UART2_BASE_ADDR 0x43f94000 + #define IMX25_UART3_BASE_ADDR 0x5000c000 +@@ -26,6 +19,13 @@ + #define IMX25_UART_BASE_ADDR(n) IMX25_UART##n##_BASE_ADDR + #define IMX25_UART_BASE(n) IMX25_UART_BASE_ADDR(n) + ++#define IMX27_UART1_BASE_ADDR 0x1000a000 ++#define IMX27_UART2_BASE_ADDR 0x1000b000 ++#define IMX27_UART3_BASE_ADDR 0x1000c000 ++#define IMX27_UART4_BASE_ADDR 0x1000d000 ++#define IMX27_UART_BASE_ADDR(n) IMX27_UART##n##_BASE_ADDR ++#define IMX27_UART_BASE(n) IMX27_UART_BASE_ADDR(n) ++ + #define IMX31_UART1_BASE_ADDR 0x43f90000 + #define IMX31_UART2_BASE_ADDR 0x43f94000 + #define IMX31_UART3_BASE_ADDR 0x5000c000 +@@ -112,10 +112,10 @@ + + #ifdef CONFIG_DEBUG_IMX1_UART + #define UART_PADDR IMX_DEBUG_UART_BASE(IMX1) +-#elif defined(CONFIG_DEBUG_IMX21_IMX27_UART) +-#define UART_PADDR IMX_DEBUG_UART_BASE(IMX21) + #elif defined(CONFIG_DEBUG_IMX25_UART) + #define UART_PADDR IMX_DEBUG_UART_BASE(IMX25) ++#elif defined(CONFIG_DEBUG_IMX27_UART) ++#define UART_PADDR IMX_DEBUG_UART_BASE(IMX27) + #elif defined(CONFIG_DEBUG_IMX31_UART) + #define UART_PADDR IMX_DEBUG_UART_BASE(IMX31) + #elif defined(CONFIG_DEBUG_IMX35_UART) +-- +2.34.1 + diff --git a/queue-5.4/arm-shmobile-rcar-gen2-add-missing-of_node_put.patch b/queue-5.4/arm-shmobile-rcar-gen2-add-missing-of_node_put.patch new file mode 100644 index 00000000000..a9278626754 --- /dev/null +++ b/queue-5.4/arm-shmobile-rcar-gen2-add-missing-of_node_put.patch @@ -0,0 +1,52 @@ +From e1666fe0761d66488247e518f8a32a06149744b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Oct 2021 21:45:03 -0400 +Subject: ARM: shmobile: rcar-gen2: Add missing of_node_put() + +From: Wan Jiabing + +[ Upstream commit 85744f2d938c5f3cfc44cb6533c157469634da93 ] + +Fix following coccicheck warning: +./arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c:156:1-33: Function +for_each_matching_node_and_match should have of_node_put() before break +and goto. + +Early exits from for_each_matching_node_and_match() should decrement the +node reference counter. + +Signed-off-by: Wan Jiabing +Link: https://lore.kernel.org/r/20211018014503.7598-1-wanjiabing@vivo.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +index ee949255ced3f..09ef73b99dd86 100644 +--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c ++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c +@@ -154,8 +154,10 @@ static int __init rcar_gen2_regulator_quirk(void) + return -ENODEV; + + for_each_matching_node_and_match(np, rcar_gen2_quirk_match, &id) { +- if (!of_device_is_available(np)) ++ if (!of_device_is_available(np)) { ++ of_node_put(np); + break; ++ } + + ret = of_property_read_u32(np, "reg", &addr); + if (ret) /* Skip invalid entry and continue */ +@@ -164,6 +166,7 @@ static int __init rcar_gen2_regulator_quirk(void) + quirk = kzalloc(sizeof(*quirk), GFP_KERNEL); + if (!quirk) { + ret = -ENOMEM; ++ of_node_put(np); + goto err_mem; + } + +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-ls1028a-qds-move-rtc-node-to-the-correct-i.patch b/queue-5.4/arm64-dts-ls1028a-qds-move-rtc-node-to-the-correct-i.patch new file mode 100644 index 00000000000..bc10d3cb22c --- /dev/null +++ b/queue-5.4/arm64-dts-ls1028a-qds-move-rtc-node-to-the-correct-i.patch @@ -0,0 +1,54 @@ +From 182af18c5ef5b38e9cfe16c9bb6e748904470e5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 03:32:38 -0600 +Subject: arm64: dts: ls1028a-qds: move rtc node to the correct i2c bus + +From: Biwen Li + +[ Upstream commit cbe9d948eadfe352ad45495a7cc5bf20a1b29d90 ] + +The i2c rtc is on i2c2 bus not i2c1 bus, so fix it in dts. + +Signed-off-by: Biwen Li +Signed-off-by: Li Yang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts +index 078a5010228cd..0b3a93c4155d2 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts +@@ -161,11 +161,6 @@ + vcc-supply = <&sb_3v3>; + }; + +- rtc@51 { +- compatible = "nxp,pcf2129"; +- reg = <0x51>; +- }; +- + eeprom@56 { + compatible = "atmel,24c512"; + reg = <0x56>; +@@ -209,6 +204,15 @@ + + }; + ++&i2c1 { ++ status = "okay"; ++ ++ rtc@51 { ++ compatible = "nxp,pcf2129"; ++ reg = <0x51>; ++ }; ++}; ++ + &enetc_port1 { + phy-handle = <&qds_phy1>; + phy-connection-type = "rgmii-id"; +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-hdmi-in-early-boot.patch b/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-hdmi-in-early-boot.patch new file mode 100644 index 00000000000..0ecefb42f36 --- /dev/null +++ b/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-hdmi-in-early-boot.patch @@ -0,0 +1,46 @@ +From ff89096dc4833858966e5a7456820461326ac948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 05:25:20 +0000 +Subject: arm64: dts: meson-gxbb-wetek: fix HDMI in early boot + +From: Christian Hewitt + +[ Upstream commit 8182a35868db5f053111d5d9d4da8fcb3f99259d ] + +Mark the VDDIO_AO18 regulator always-on and set hdmi-supply for the hdmi_tx +node to ensure HDMI is powered in the early stages of boot. + +Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2") + +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20211012052522.30873-2-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +index e3d17569d98ad..d7d0b65713841 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +@@ -64,6 +64,7 @@ + regulator-name = "VDDIO_AO18"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; ++ regulator-always-on; + }; + + vcc_3v3: regulator-vcc_3v3 { +@@ -157,6 +158,7 @@ + status = "okay"; + pinctrl-0 = <&hdmi_hpd_pins>, <&hdmi_i2c_pins>; + pinctrl-names = "default"; ++ hdmi-supply = <&vddio_ao18>; + }; + + &hdmi_tx_tmds_port { +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-missing-gpio-binding.patch b/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-missing-gpio-binding.patch new file mode 100644 index 00000000000..6b59d8b7af0 --- /dev/null +++ b/queue-5.4/arm64-dts-meson-gxbb-wetek-fix-missing-gpio-binding.patch @@ -0,0 +1,39 @@ +From a84a7e846cba96e8d774509d83cdb0910e3640e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 05:25:21 +0000 +Subject: arm64: dts: meson-gxbb-wetek: fix missing GPIO binding + +From: Christian Hewitt + +[ Upstream commit c019abb2feba3cbbd7cf7178f8e6499c4fa6fced ] + +The absence of this binding appears to be harmless in Linux but it breaks +Ethernet support in mainline u-boot. So add the binding (which is present +in all other u-boot supported GXBB device-trees). + +Fixes: fb72c03e0e32 ("ARM64: dts: meson-gxbb-wetek: add a wetek specific dtsi to cleanup hub and play2") + +Signed-off-by: Christian Hewitt +Reviewed-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://lore.kernel.org/r/20211012052522.30873-3-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +index d7d0b65713841..e94f09c2d4e32 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +@@ -6,6 +6,7 @@ + */ + + #include "meson-gxbb.dtsi" ++#include + + / { + aliases { +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-qcom-msm8916-fix-mmc-controller-aliases.patch b/queue-5.4/arm64-dts-qcom-msm8916-fix-mmc-controller-aliases.patch new file mode 100644 index 00000000000..9bd71c6b8e8 --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-msm8916-fix-mmc-controller-aliases.patch @@ -0,0 +1,40 @@ +From 9661df1133a8813e65eefa52720c605288c34dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 05:05:59 +0300 +Subject: arm64: dts: qcom: msm8916: fix MMC controller aliases + +From: Dmitry Baryshkov + +[ Upstream commit b0293c19d42f6d6951c2fab9a47fed50baf2c14d ] + +Change sdhcN aliases to mmcN to make them actually work. Currently the +board uses non-standard aliases sdhcN, which do not work, resulting in +mmc0 and mmc1 hosts randomly changing indices between boots. + +Fixes: c4da5a561627 ("arm64: dts: qcom: Add msm8916 sdhci configuration nodes") +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211201020559.1611890-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 449843f2184d8..301c1c467c0b7 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -16,8 +16,8 @@ + #size-cells = <2>; + + aliases { +- sdhc1 = &sdhc_1; /* SDC1 eMMC slot */ +- sdhc2 = &sdhc_2; /* SDC2 SD card slot */ ++ mmc0 = &sdhc_1; /* SDC1 eMMC slot */ ++ mmc1 = &sdhc_2; /* SDC2 SD card slot */ + }; + + chosen { }; +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-ti-k3-j721e-correct-cache-sets-info.patch b/queue-5.4/arm64-dts-ti-k3-j721e-correct-cache-sets-info.patch new file mode 100644 index 00000000000..699a76f157d --- /dev/null +++ b/queue-5.4/arm64-dts-ti-k3-j721e-correct-cache-sets-info.patch @@ -0,0 +1,51 @@ +From b928dea124af6c4041191a6803c02f5205c9117b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 14:31:55 +0800 +Subject: arm64: dts: ti: k3-j721e: correct cache-sets info + +From: Peng Fan + +[ Upstream commit 7a0df1f969c14939f60a7f9a6af72adcc314675f ] + +A72 Cluster has 48KB Icache, 32KB Dcache and 1MB L2 Cache + - ICache is 3-way set-associative + - Dcache is 2-way set-associative + - Line size are 64bytes + +So correct the cache-sets info. + +Fixes: 2d87061e70dea ("arm64: dts: ti: Add Support for J721E SoC") +Signed-off-by: Peng Fan +Reviewed-by: Nishanth Menon +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20211112063155.3485777-1-peng.fan@oss.nxp.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e.dtsi b/arch/arm64/boot/dts/ti/k3-j721e.dtsi +index 43ea1ba979220..f4d8f3b37d5bb 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721e.dtsi +@@ -60,7 +60,7 @@ + i-cache-sets = <256>; + d-cache-size = <0x8000>; + d-cache-line-size = <64>; +- d-cache-sets = <128>; ++ d-cache-sets = <256>; + next-level-cache = <&L2_0>; + }; + +@@ -74,7 +74,7 @@ + i-cache-sets = <256>; + d-cache-size = <0x8000>; + d-cache-line-size = <64>; +- d-cache-sets = <128>; ++ d-cache-sets = <256>; + next-level-cache = <&L2_0>; + }; + }; +-- +2.34.1 + diff --git a/queue-5.4/arm64-dts-ti-k3-j721e-fix-the-l2-cache-sets.patch b/queue-5.4/arm64-dts-ti-k3-j721e-fix-the-l2-cache-sets.patch new file mode 100644 index 00000000000..065da32d0c6 --- /dev/null +++ b/queue-5.4/arm64-dts-ti-k3-j721e-fix-the-l2-cache-sets.patch @@ -0,0 +1,47 @@ +From 1ca75b78e81b5473c4ca841e3c3250ef294d046d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 22:36:39 -0600 +Subject: arm64: dts: ti: k3-j721e: Fix the L2 cache sets + +From: Nishanth Menon + +[ Upstream commit e9ba3a5bc6fdc2c796c69fdaf5ed6c9957cf9f9d ] + +A72's L2 cache[1] on J721e[2] is 1MB. A72's L2 is fixed line length of +64 bytes and 16-way set-associative cache structure. + +1MB of L2 / 64 (line length) = 16384 ways +16384 ways / 16 = 1024 sets + +Fix the l2 cache-sets. + +[1] https://developer.arm.com/documentation/100095/0003/Level-2-Memory-System/About-the-L2-memory-system +[2] http://www.ti.com/lit/pdf/spruil1 + +Fixes: 2d87061e70de ("arm64: dts: ti: Add Support for J721E SoC") +Reported-by: Peng Fan +Signed-off-by: Nishanth Menon +Reviewed-by: Pratyush Yadav +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20211113043639.4413-1-nm@ti.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/ti/k3-j721e.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/ti/k3-j721e.dtsi b/arch/arm64/boot/dts/ti/k3-j721e.dtsi +index f4d8f3b37d5bb..5a6e74636d6fc 100644 +--- a/arch/arm64/boot/dts/ti/k3-j721e.dtsi ++++ b/arch/arm64/boot/dts/ti/k3-j721e.dtsi +@@ -84,7 +84,7 @@ + cache-level = <2>; + cache-size = <0x100000>; + cache-line-size = <64>; +- cache-sets = <2048>; ++ cache-sets = <1024>; + next-level-cache = <&msmc_l3>; + }; + +-- +2.34.1 + diff --git a/queue-5.4/arm64-tegra-adjust-length-of-ccplex-cluster-mmio-reg.patch b/queue-5.4/arm64-tegra-adjust-length-of-ccplex-cluster-mmio-reg.patch new file mode 100644 index 00000000000..2cb4951bd47 --- /dev/null +++ b/queue-5.4/arm64-tegra-adjust-length-of-ccplex-cluster-mmio-reg.patch @@ -0,0 +1,35 @@ +From f39ad2020e297ec59dea1d35e214c8312e4fbd55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 14:28:29 +0100 +Subject: arm64: tegra: Adjust length of CCPLEX cluster MMIO region + +From: Thierry Reding + +[ Upstream commit 2b14cbd643feea5fc17c6e8bead4e71088c69acd ] + +The Tegra186 CCPLEX cluster register region is 4 MiB is length, not 4 +MiB - 1. This was likely presumed to be the "limit" rather than length. +Fix it up. + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra186.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra186.dtsi b/arch/arm64/boot/dts/nvidia/tegra186.dtsi +index 9abf0cb1dd67f..4457262750734 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra186.dtsi +@@ -709,7 +709,7 @@ + + ccplex@e000000 { + compatible = "nvidia,tegra186-ccplex-cluster"; +- reg = <0x0 0x0e000000 0x0 0x3fffff>; ++ reg = <0x0 0x0e000000 0x0 0x400000>; + + nvidia,bpmp = <&bpmp>; + }; +-- +2.34.1 + diff --git a/queue-5.4/asoc-mediatek-check-for-error-clk-pointer.patch b/queue-5.4/asoc-mediatek-check-for-error-clk-pointer.patch new file mode 100644 index 00000000000..2ae227bfb8e --- /dev/null +++ b/queue-5.4/asoc-mediatek-check-for-error-clk-pointer.patch @@ -0,0 +1,68 @@ +From 947cf841ab462045495c43c4dcf08b4dafc7b8c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 09:51:57 +0800 +Subject: ASoC: mediatek: Check for error clk pointer + +From: Jiasheng Jiang + +[ Upstream commit 9de2b9286a6dd16966959b3cb34fc2ddfd39213e ] + +Yes, you are right and now the return code depending on the +init_clks(). + +Fixes: 6078c651947a ("soc: mediatek: Refine scpsys to support multiple platform") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20211222015157.1025853-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-scpsys.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c +index 75f25f08245fd..71afa2a99b17f 100644 +--- a/drivers/soc/mediatek/mtk-scpsys.c ++++ b/drivers/soc/mediatek/mtk-scpsys.c +@@ -333,12 +333,17 @@ out: + return ret; + } + +-static void init_clks(struct platform_device *pdev, struct clk **clk) ++static int init_clks(struct platform_device *pdev, struct clk **clk) + { + int i; + +- for (i = CLK_NONE + 1; i < CLK_MAX; i++) ++ for (i = CLK_NONE + 1; i < CLK_MAX; i++) { + clk[i] = devm_clk_get(&pdev->dev, clk_names[i]); ++ if (IS_ERR(clk[i])) ++ return PTR_ERR(clk[i]); ++ } ++ ++ return 0; + } + + static struct scp *init_scp(struct platform_device *pdev, +@@ -348,7 +353,7 @@ static struct scp *init_scp(struct platform_device *pdev, + { + struct genpd_onecell_data *pd_data; + struct resource *res; +- int i, j; ++ int i, j, ret; + struct scp *scp; + struct clk *clk[CLK_MAX]; + +@@ -403,7 +408,9 @@ static struct scp *init_scp(struct platform_device *pdev, + + pd_data->num_domains = num; + +- init_clks(pdev, clk); ++ ret = init_clks(pdev, clk); ++ if (ret) ++ return ERR_PTR(ret); + + for (i = 0; i < num; i++) { + struct scp_domain *scpd = &scp->domains[i]; +-- +2.34.1 + diff --git a/queue-5.4/asoc-mediatek-mt8173-fix-device_node-leak.patch b/queue-5.4/asoc-mediatek-mt8173-fix-device_node-leak.patch new file mode 100644 index 00000000000..629c310bd21 --- /dev/null +++ b/queue-5.4/asoc-mediatek-mt8173-fix-device_node-leak.patch @@ -0,0 +1,78 @@ +From 453c6de4bde1607898d90da2bf99c6c6b4fea816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Dec 2021 14:47:16 +0800 +Subject: ASoC: mediatek: mt8173: fix device_node leak + +From: Tzung-Bi Shih + +[ Upstream commit 493433785df0075afc0c106ab65f10a605d0b35d ] + +Fixes the device_node leak. + +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20211224064719.2031210-2-tzungbi@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/mt8173/mt8173-max98090.c | 3 +++ + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c | 2 ++ + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 2 ++ + sound/soc/mediatek/mt8173/mt8173-rt5650.c | 2 ++ + 4 files changed, 9 insertions(+) + +diff --git a/sound/soc/mediatek/mt8173/mt8173-max98090.c b/sound/soc/mediatek/mt8173/mt8173-max98090.c +index 22c00600c999f..de1410c2c446f 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-max98090.c ++++ b/sound/soc/mediatek/mt8173/mt8173-max98090.c +@@ -180,6 +180,9 @@ static int mt8173_max98090_dev_probe(struct platform_device *pdev) + if (ret) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); ++ ++ of_node_put(codec_node); ++ of_node_put(platform_node); + return ret; + } + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c +index 8717e87bfe264..6f8542329bab9 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5514.c +@@ -218,6 +218,8 @@ static int mt8173_rt5650_rt5514_dev_probe(struct platform_device *pdev) + if (ret) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); ++ ++ of_node_put(platform_node); + return ret; + } + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +index 9d4dd97211548..727ff0f7f20b1 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +@@ -285,6 +285,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev) + if (ret) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); ++ ++ of_node_put(platform_node); + return ret; + } + +diff --git a/sound/soc/mediatek/mt8173/mt8173-rt5650.c b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +index ef6f236752867..21e7d4d3ded5a 100644 +--- a/sound/soc/mediatek/mt8173/mt8173-rt5650.c ++++ b/sound/soc/mediatek/mt8173/mt8173-rt5650.c +@@ -309,6 +309,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev) + if (ret) + dev_err(&pdev->dev, "%s snd_soc_register_card fail %d\n", + __func__, ret); ++ ++ of_node_put(platform_node); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.4/asoc-rt5663-handle-device_property_read_u32_array-er.patch b/queue-5.4/asoc-rt5663-handle-device_property_read_u32_array-er.patch new file mode 100644 index 00000000000..f6322202abe --- /dev/null +++ b/queue-5.4/asoc-rt5663-handle-device_property_read_u32_array-er.patch @@ -0,0 +1,65 @@ +From 87651a7f67c3d60712526ceff613d3ebd4372c61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 11:15:50 +0800 +Subject: ASoC: rt5663: Handle device_property_read_u32_array error codes + +From: Jiasheng Jiang + +[ Upstream commit 2167c0b205960607fb136b4bb3c556a62be1569a ] + +The return value of device_property_read_u32_array() is not always 0. +To catch the exception in case that devm_kzalloc failed and the +rt5663->imp_table was NULL, which caused the failure of +device_property_read_u32_array. + +Fixes: 450f0f6a8fb4 ("ASoC: rt5663: Add the manual offset field to compensate the DC offset") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20211215031550.70702-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5663.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c +index 2943692f66edd..3610be1590fcc 100644 +--- a/sound/soc/codecs/rt5663.c ++++ b/sound/soc/codecs/rt5663.c +@@ -3461,6 +3461,7 @@ static void rt5663_calibrate(struct rt5663_priv *rt5663) + static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + { + int table_size; ++ int ret; + + device_property_read_u32(dev, "realtek,dc_offset_l_manual", + &rt5663->pdata.dc_offset_l_manual); +@@ -3477,9 +3478,11 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + table_size = sizeof(struct impedance_mapping_table) * + rt5663->pdata.impedance_sensing_num; + rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); +- device_property_read_u32_array(dev, ++ ret = device_property_read_u32_array(dev, + "realtek,impedance_sensing_table", + (u32 *)rt5663->imp_table, table_size); ++ if (ret) ++ return ret; + } + + return 0; +@@ -3504,8 +3507,11 @@ static int rt5663_i2c_probe(struct i2c_client *i2c, + + if (pdata) + rt5663->pdata = *pdata; +- else +- rt5663_parse_dp(rt5663, &i2c->dev); ++ else { ++ ret = rt5663_parse_dp(rt5663, &i2c->dev); ++ if (ret) ++ return ret; ++ } + + for (i = 0; i < ARRAY_SIZE(rt5663->supplies); i++) + rt5663->supplies[i].supply = rt5663_supply_names[i]; +-- +2.34.1 + diff --git a/queue-5.4/asoc-samsung-idma-check-of-ioremap-return-value.patch b/queue-5.4/asoc-samsung-idma-check-of-ioremap-return-value.patch new file mode 100644 index 00000000000..04bcee05b1e --- /dev/null +++ b/queue-5.4/asoc-samsung-idma-check-of-ioremap-return-value.patch @@ -0,0 +1,40 @@ +From 659a90c59bac0693d8b3705842430a2913a7c427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 11:40:26 +0800 +Subject: ASoC: samsung: idma: Check of ioremap return value + +From: Jiasheng Jiang + +[ Upstream commit 3ecb46755eb85456b459a1a9f952c52986bce8ec ] + +Because of the potential failure of the ioremap(), the buf->area could +be NULL. +Therefore, we need to check it and return -ENOMEM in order to transfer +the error. + +Fixes: f09aecd50f39 ("ASoC: SAMSUNG: Add I2S0 internal dma driver") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211228034026.1659385-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/idma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/samsung/idma.c b/sound/soc/samsung/idma.c +index 65497cd477a50..47f6f5d70853d 100644 +--- a/sound/soc/samsung/idma.c ++++ b/sound/soc/samsung/idma.c +@@ -363,6 +363,8 @@ static int preallocate_idma_buffer(struct snd_pcm *pcm, int stream) + buf->addr = idma.lp_tx_addr; + buf->bytes = idma_hardware.buffer_bytes_max; + buf->area = (unsigned char * __force)ioremap(buf->addr, buf->bytes); ++ if (!buf->area) ++ return -ENOMEM; + + return 0; + } +-- +2.34.1 + diff --git a/queue-5.4/asoc-uniphier-drop-selecting-non-existing-snd_soc_un.patch b/queue-5.4/asoc-uniphier-drop-selecting-non-existing-snd_soc_un.patch new file mode 100644 index 00000000000..33e42c9dec3 --- /dev/null +++ b/queue-5.4/asoc-uniphier-drop-selecting-non-existing-snd_soc_un.patch @@ -0,0 +1,53 @@ +From e4935906ed7a9a0def108c238eaeb1355244305a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 10:51:57 +0100 +Subject: ASoC: uniphier: drop selecting non-existing SND_SOC_UNIPHIER_AIO_DMA + +From: Lukas Bulwahn + +[ Upstream commit 49f893253ab43566e34332a969324531fea463f6 ] + +Commit f37fe2f9987b ("ASoC: uniphier: add support for UniPhier AIO common +driver") adds configs SND_SOC_UNIPHIER_{LD11,PXS2}, which select the +non-existing config SND_SOC_UNIPHIER_AIO_DMA. + +Hence, ./scripts/checkkconfigsymbols.py warns: + + SND_SOC_UNIPHIER_AIO_DMA + Referencing files: sound/soc/uniphier/Kconfig + +Probably, there is actually no further config intended to be selected +here. So, just drop selecting the non-existing config. + +Fixes: f37fe2f9987b ("ASoC: uniphier: add support for UniPhier AIO common driver") +Signed-off-by: Lukas Bulwahn +Link: https://lore.kernel.org/r/20211125095158.8394-2-lukas.bulwahn@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/uniphier/Kconfig | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/uniphier/Kconfig b/sound/soc/uniphier/Kconfig +index aa3592ee1358b..ddfa6424c656b 100644 +--- a/sound/soc/uniphier/Kconfig ++++ b/sound/soc/uniphier/Kconfig +@@ -23,7 +23,6 @@ config SND_SOC_UNIPHIER_LD11 + tristate "UniPhier LD11/LD20 Device Driver" + depends on SND_SOC_UNIPHIER + select SND_SOC_UNIPHIER_AIO +- select SND_SOC_UNIPHIER_AIO_DMA + help + This adds ASoC driver for Socionext UniPhier LD11/LD20 + input and output that can be used with other codecs. +@@ -34,7 +33,6 @@ config SND_SOC_UNIPHIER_PXS2 + tristate "UniPhier PXs2 Device Driver" + depends on SND_SOC_UNIPHIER + select SND_SOC_UNIPHIER_AIO +- select SND_SOC_UNIPHIER_AIO_DMA + help + This adds ASoC driver for Socionext UniPhier PXs2 + input and output that can be used with other codecs. +-- +2.34.1 + diff --git a/queue-5.4/ath10k-fix-tx-hanging.patch b/queue-5.4/ath10k-fix-tx-hanging.patch new file mode 100644 index 00000000000..5c1d7049c99 --- /dev/null +++ b/queue-5.4/ath10k-fix-tx-hanging.patch @@ -0,0 +1,56 @@ +From 125505dbdec215dac0d532521a8f6e1f5c9fa144 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 15:58:06 +0700 +Subject: ath10k: Fix tx hanging + +From: Sebastian Gottschall + +[ Upstream commit e8a91863eba3966a447d2daa1526082d52b5db2a ] + +While running stress tests in roaming scenarios (switching ap's every 5 +seconds, we discovered a issue which leads to tx hangings of exactly 5 +seconds while or after scanning for new accesspoints. We found out that +this hanging is triggered by ath10k_mac_wait_tx_complete since the +empty_tx_wq was not wake when the num_tx_pending counter reaches zero. +To fix this, we simply move the wake_up call to htt_tx_dec_pending, +since this call was missed on several locations within the ath10k code. + +Signed-off-by: Sebastian Gottschall +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210505085806.11474-1-s.gottschall@dd-wrt.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/htt_tx.c | 3 +++ + drivers/net/wireless/ath/ath10k/txrx.c | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c +index c38e1963ebc05..f73ed1044390c 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_tx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_tx.c +@@ -147,6 +147,9 @@ void ath10k_htt_tx_dec_pending(struct ath10k_htt *htt) + htt->num_pending_tx--; + if (htt->num_pending_tx == htt->max_num_pending_tx - 1) + ath10k_mac_tx_unlock(htt->ar, ATH10K_TX_PAUSE_Q_FULL); ++ ++ if (htt->num_pending_tx == 0) ++ wake_up(&htt->empty_tx_wq); + } + + int ath10k_htt_tx_inc_pending(struct ath10k_htt *htt) +diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c +index f46b9083bbf10..2c254f43790d2 100644 +--- a/drivers/net/wireless/ath/ath10k/txrx.c ++++ b/drivers/net/wireless/ath/ath10k/txrx.c +@@ -80,8 +80,6 @@ int ath10k_txrx_tx_unref(struct ath10k_htt *htt, + + ath10k_htt_tx_free_msdu_id(htt, tx_done->msdu_id); + ath10k_htt_tx_dec_pending(htt); +- if (htt->num_pending_tx == 0) +- wake_up(&htt->empty_tx_wq); + spin_unlock_bh(&htt->tx_lock); + + rcu_read_lock(); +-- +2.34.1 + diff --git a/queue-5.4/ath9k-fix-out-of-bound-memcpy-in-ath9k_hif_usb_rx_st.patch b/queue-5.4/ath9k-fix-out-of-bound-memcpy-in-ath9k_hif_usb_rx_st.patch new file mode 100644 index 00000000000..1db7d82cb3b --- /dev/null +++ b/queue-5.4/ath9k-fix-out-of-bound-memcpy-in-ath9k_hif_usb_rx_st.patch @@ -0,0 +1,90 @@ +From 6294832832ffe539c9e92d8752dd24b383dcabcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 18:21:42 -0400 +Subject: ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream + +From: Zekun Shen + +[ Upstream commit 6ce708f54cc8d73beca213cec66ede5ce100a781 ] + +Large pkt_len can lead to out-out-bound memcpy. Current +ath9k_hif_usb_rx_stream allows combining the content of two urb +inputs to one pkt. The first input can indicate the size of the +pkt. Any remaining size is saved in hif_dev->rx_remain_len. +While processing the next input, memcpy is used with rx_remain_len. + +4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 +maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for +pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. + +BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] +Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 + +CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), +BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 +Workqueue: events request_firmware_work_func +Call Trace: + + dump_stack+0x76/0xa0 + print_address_description.constprop.0+0x16/0x200 + ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] + ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] + __kasan_report.cold+0x37/0x7c + ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] + kasan_report+0xe/0x20 + check_memory_region+0x15a/0x1d0 + memcpy+0x20/0x50 + ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] + ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] + ? _raw_spin_lock_irqsave+0x7b/0xd0 + ? _raw_spin_trylock_bh+0x120/0x120 + ? __usb_unanchor_urb+0x12f/0x210 + __usb_hcd_giveback_urb+0x1e4/0x380 + usb_giveback_urb_bh+0x241/0x4f0 + ? __hrtimer_run_queues+0x316/0x740 + ? __usb_hcd_giveback_urb+0x380/0x380 + tasklet_action_common.isra.0+0x135/0x330 + __do_softirq+0x18c/0x634 + irq_exit+0x114/0x140 + smp_apic_timer_interrupt+0xde/0x380 + apic_timer_interrupt+0xf/0x20 + +I found the bug using a custome USBFuzz port. It's a research work +to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, +providing hand-crafted usb descriptors to QEMU. + +After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU +emulation, I found the KASAN report. The bug is triggerable whenever +pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes +to test the driver works when applying the patch. + +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wireless.nyu.edu +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 2ed98aaed6fb5..c8c7afe0e343e 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -590,6 +590,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, + return; + } + ++ if (pkt_len > 2 * MAX_RX_BUF_SIZE) { ++ dev_err(&hif_dev->udev->dev, ++ "ath9k_htc: invalid pkt_len (%x)\n", pkt_len); ++ RX_STAT_INC(skb_dropped); ++ return; ++ } ++ + pad_len = 4 - (pkt_len & 0x3); + if (pad_len == 4) + pad_len = 0; +-- +2.34.1 + diff --git a/queue-5.4/audit-ensure-userspace-is-penalized-the-same-as-the-.patch b/queue-5.4/audit-ensure-userspace-is-penalized-the-same-as-the-.patch new file mode 100644 index 00000000000..a5672ab4c06 --- /dev/null +++ b/queue-5.4/audit-ensure-userspace-is-penalized-the-same-as-the-.patch @@ -0,0 +1,71 @@ +From 9143bcd0decca161c6223646955c42134d745816 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Dec 2021 15:45:20 -0500 +Subject: audit: ensure userspace is penalized the same as the kernel when + under pressure + +From: Paul Moore + +[ Upstream commit 8f110f530635af44fff1f4ee100ecef0bac62510 ] + +Due to the audit control mutex necessary for serializing audit +userspace messages we haven't been able to block/penalize userspace +processes that attempt to send audit records while the system is +under audit pressure. The result is that privileged userspace +applications have a priority boost with respect to audit as they are +not bound by the same audit queue throttling as the other tasks on +the system. + +This patch attempts to restore some balance to the system when under +audit pressure by blocking these privileged userspace tasks after +they have finished their audit processing, and dropped the audit +control mutex, but before they return to userspace. + +Reported-by: Gaosheng Cui +Tested-by: Gaosheng Cui +Reviewed-by: Richard Guy Briggs +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/audit.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/kernel/audit.c b/kernel/audit.c +index d67fce9e3f8b8..146edff0c73ec 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1528,6 +1528,20 @@ static void audit_receive(struct sk_buff *skb) + nlh = nlmsg_next(nlh, &len); + } + audit_ctl_unlock(); ++ ++ /* can't block with the ctrl lock, so penalize the sender now */ ++ if (audit_backlog_limit && ++ (skb_queue_len(&audit_queue) > audit_backlog_limit)) { ++ DECLARE_WAITQUEUE(wait, current); ++ ++ /* wake kauditd to try and flush the queue */ ++ wake_up_interruptible(&kauditd_wait); ++ ++ add_wait_queue_exclusive(&audit_backlog_wait, &wait); ++ set_current_state(TASK_UNINTERRUPTIBLE); ++ schedule_timeout(audit_backlog_wait_time); ++ remove_wait_queue(&audit_backlog_wait, &wait); ++ } + } + + /* Run custom bind function on netlink socket group connect or bind requests. */ +@@ -1772,7 +1786,9 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask, + * task_tgid_vnr() since auditd_pid is set in audit_receive_msg() + * using a PID anchored in the caller's namespace + * 2. generator holding the audit_cmd_mutex - we don't want to block +- * while holding the mutex */ ++ * while holding the mutex, although we do penalize the sender ++ * later in audit_receive() when it is safe to block ++ */ + if (!(auditd_test_task(current) || audit_ctl_owner_current())) { + long stime = audit_backlog_wait_time; + +-- +2.34.1 + diff --git a/queue-5.4/batman-adv-allow-netlink-usage-in-unprivileged-conta.patch b/queue-5.4/batman-adv-allow-netlink-usage-in-unprivileged-conta.patch new file mode 100644 index 00000000000..da293c27a10 --- /dev/null +++ b/queue-5.4/batman-adv-allow-netlink-usage-in-unprivileged-conta.patch @@ -0,0 +1,174 @@ +From d8ed61d611c04d7c86e4d13b9fe5023bc77c4621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Oct 2021 22:30:12 +0100 +Subject: batman-adv: allow netlink usage in unprivileged containers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +[ Upstream commit 9057d6c23e7388ee9d037fccc9a7bc8557ce277b ] + +Currently, creating a batman-adv interface in an unprivileged LXD +container and attaching secondary interfaces to it with "ip" or "batctl" +works fine. However all batctl debug and configuration commands +fail: + + root@container:~# batctl originators + Error received: Operation not permitted + root@container:~# batctl orig_interval + 1000 + root@container:~# batctl orig_interval 2000 + root@container:~# batctl orig_interval + 1000 + +To fix this change the generic netlink permissions from GENL_ADMIN_PERM +to GENL_UNS_ADMIN_PERM. This way a batman-adv interface is fully +maintainable as root from within a user namespace, from an unprivileged +container. + +All except one batman-adv netlink setting are per interface and do not +leak information or change settings from the host system and are +therefore save to retrieve or modify as root from within an unprivileged +container. + +"batctl routing_algo" / BATADV_CMD_GET_ROUTING_ALGOS is the only +exception: It provides the batman-adv kernel module wide default routing +algorithm. However it is read-only from netlink and an unprivileged +container is still not allowed to modify +/sys/module/batman_adv/parameters/routing_algo. Instead it is advised to +use the newly introduced "batctl if create routing_algo RA_NAME" / +IFLA_BATADV_ALGO_NAME to set the routing algorithm on interface +creation, which already works fine in an unprivileged container. + +Cc: Tycho Andersen +Signed-off-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/netlink.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/net/batman-adv/netlink.c b/net/batman-adv/netlink.c +index 7e052d6f759b6..e59c5aa27ee0b 100644 +--- a/net/batman-adv/netlink.c ++++ b/net/batman-adv/netlink.c +@@ -1351,21 +1351,21 @@ static const struct genl_ops batadv_netlink_ops[] = { + { + .cmd = BATADV_CMD_TP_METER, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .doit = batadv_netlink_tp_meter_start, + .internal_flags = BATADV_FLAG_NEED_MESH, + }, + { + .cmd = BATADV_CMD_TP_METER_CANCEL, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .doit = batadv_netlink_tp_meter_cancel, + .internal_flags = BATADV_FLAG_NEED_MESH, + }, + { + .cmd = BATADV_CMD_GET_ROUTING_ALGOS, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_algo_dump, + }, + { +@@ -1380,68 +1380,68 @@ static const struct genl_ops batadv_netlink_ops[] = { + { + .cmd = BATADV_CMD_GET_TRANSTABLE_LOCAL, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_tt_local_dump, + }, + { + .cmd = BATADV_CMD_GET_TRANSTABLE_GLOBAL, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_tt_global_dump, + }, + { + .cmd = BATADV_CMD_GET_ORIGINATORS, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_orig_dump, + }, + { + .cmd = BATADV_CMD_GET_NEIGHBORS, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_hardif_neigh_dump, + }, + { + .cmd = BATADV_CMD_GET_GATEWAYS, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_gw_dump, + }, + { + .cmd = BATADV_CMD_GET_BLA_CLAIM, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_bla_claim_dump, + }, + { + .cmd = BATADV_CMD_GET_BLA_BACKBONE, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_bla_backbone_dump, + }, + { + .cmd = BATADV_CMD_GET_DAT_CACHE, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_dat_cache_dump, + }, + { + .cmd = BATADV_CMD_GET_MCAST_FLAGS, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .dumpit = batadv_mcast_flags_dump, + }, + { + .cmd = BATADV_CMD_SET_MESH, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .doit = batadv_netlink_set_mesh, + .internal_flags = BATADV_FLAG_NEED_MESH, + }, + { + .cmd = BATADV_CMD_SET_HARDIF, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .doit = batadv_netlink_set_hardif, + .internal_flags = BATADV_FLAG_NEED_MESH | + BATADV_FLAG_NEED_HARDIF, +@@ -1457,7 +1457,7 @@ static const struct genl_ops batadv_netlink_ops[] = { + { + .cmd = BATADV_CMD_SET_VLAN, + .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, +- .flags = GENL_ADMIN_PERM, ++ .flags = GENL_UNS_ADMIN_PERM, + .doit = batadv_netlink_set_vlan, + .internal_flags = BATADV_FLAG_NEED_MESH | + BATADV_FLAG_NEED_VLAN, +-- +2.34.1 + diff --git a/queue-5.4/binder-fix-handling-of-error-during-copy.patch b/queue-5.4/binder-fix-handling-of-error-during-copy.patch new file mode 100644 index 00000000000..344f5e06952 --- /dev/null +++ b/queue-5.4/binder-fix-handling-of-error-during-copy.patch @@ -0,0 +1,47 @@ +From 10efd978f1b55fba2495b172c7117d0c668a200c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 10:51:49 -0800 +Subject: binder: fix handling of error during copy + +From: Todd Kjos + +[ Upstream commit fe6b1869243f23a485a106c214bcfdc7aa0ed593 ] + +If a memory copy function fails to copy the whole buffer, +a positive integar with the remaining bytes is returned. +In binder_translate_fd_array() this can result in an fd being +skipped due to the failed copy, but the loop continues +processing fds since the early return condition expects a +negative integer on error. + +Fix by returning "ret > 0 ? -EINVAL : ret" to handle this case. + +Fixes: bb4a2e48d510 ("binder: return errors from buffer copy functions") +Suggested-by: Dan Carpenter +Acked-by: Christian Brauner +Signed-off-by: Todd Kjos +Link: https://lore.kernel.org/r/20211130185152.437403-2-tkjos@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 0512af0f04646..b9fb2a9269443 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2660,8 +2660,8 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda, + if (!ret) + ret = binder_translate_fd(fd, offset, t, thread, + in_reply_to); +- if (ret < 0) +- return ret; ++ if (ret) ++ return ret > 0 ? -EINVAL : ret; + } + return 0; + } +-- +2.34.1 + diff --git a/queue-5.4/bluetooth-btmtksdio-fix-resume-failure.patch b/queue-5.4/bluetooth-btmtksdio-fix-resume-failure.patch new file mode 100644 index 00000000000..c326425ef02 --- /dev/null +++ b/queue-5.4/bluetooth-btmtksdio-fix-resume-failure.patch @@ -0,0 +1,39 @@ +From 35ebb13ac87d1caa8425fc0f932f7e3d9617a9d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 02:02:47 +0800 +Subject: Bluetooth: btmtksdio: fix resume failure + +From: Sean Wang + +[ Upstream commit 561ae1d46a8ddcbc13162d5771f5ed6c8249e730 ] + +btmtksdio have to rely on MMC_PM_KEEP_POWER in pm_flags to avoid that +SDIO power is being shut off during the device is in suspend. That fixes +the SDIO command fails to access the bus after the device is resumed. + +Fixes: 7f3c563c575e7 ("Bluetooth: btmtksdio: Add runtime PM support to SDIO based Bluetooth") +Co-developed-by: Mark-yw Chen +Signed-off-by: Mark-yw Chen +Signed-off-by: Sean Wang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 304178be1ef40..c2eb64bcd5d5d 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -1041,6 +1041,8 @@ static int btmtksdio_runtime_suspend(struct device *dev) + if (!bdev) + return 0; + ++ sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER); ++ + sdio_claim_host(bdev->func); + + sdio_writel(bdev->func, C_FW_OWN_REQ_SET, MTK_REG_CHLPCR, &err); +-- +2.34.1 + diff --git a/queue-5.4/bluetooth-cmtp-fix-possible-panic-when-cmtp_init_soc.patch b/queue-5.4/bluetooth-cmtp-fix-possible-panic-when-cmtp_init_soc.patch new file mode 100644 index 00000000000..b1660e52f58 --- /dev/null +++ b/queue-5.4/bluetooth-cmtp-fix-possible-panic-when-cmtp_init_soc.patch @@ -0,0 +1,54 @@ +From bd11d292e2b4ea7d75b68f8bee6021d76b334c56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Oct 2021 21:10:12 +0800 +Subject: Bluetooth: cmtp: fix possible panic when cmtp_init_sockets() fails + +From: Wang Hai + +[ Upstream commit 2a7ca7459d905febf519163bd9e3eed894de6bb7 ] + +I got a kernel BUG report when doing fault injection test: + +------------[ cut here ]------------ +kernel BUG at lib/list_debug.c:45! +... +RIP: 0010:__list_del_entry_valid.cold+0x12/0x4d +... +Call Trace: + proto_unregister+0x83/0x220 + cmtp_cleanup_sockets+0x37/0x40 [cmtp] + cmtp_exit+0xe/0x1f [cmtp] + do_syscall_64+0x35/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +If cmtp_init_sockets() in cmtp_init() fails, cmtp_init() still returns +success. This will cause a kernel bug when accessing uncreated ctmp +related data when the module exits. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/cmtp/core.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c +index 0a2d78e811cf5..83eb84e8e688f 100644 +--- a/net/bluetooth/cmtp/core.c ++++ b/net/bluetooth/cmtp/core.c +@@ -501,9 +501,7 @@ static int __init cmtp_init(void) + { + BT_INFO("CMTP (CAPI Emulation) ver %s", VERSION); + +- cmtp_init_sockets(); +- +- return 0; ++ return cmtp_init_sockets(); + } + + static void __exit cmtp_exit(void) +-- +2.34.1 + diff --git a/queue-5.4/bluetooth-fix-debugfs-entry-leak-in-hci_register_dev.patch b/queue-5.4/bluetooth-fix-debugfs-entry-leak-in-hci_register_dev.patch new file mode 100644 index 00000000000..e8cb8da9198 --- /dev/null +++ b/queue-5.4/bluetooth-fix-debugfs-entry-leak-in-hci_register_dev.patch @@ -0,0 +1,40 @@ +From 9592eb854e73edcc93d2a2b7241ea0acd225726a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Oct 2021 16:55:46 +0800 +Subject: Bluetooth: Fix debugfs entry leak in hci_register_dev() + +From: Wei Yongjun + +[ Upstream commit 5a4bb6a8e981d3d0d492aa38412ee80b21033177 ] + +Fault injection test report debugfs entry leak as follows: + +debugfs: Directory 'hci0' with parent 'bluetooth' already present! + +When register_pm_notifier() failed in hci_register_dev(), the debugfs +create by debugfs_create_dir() do not removed in the error handing path. + +Add the remove debugfs code to fix it. + +Signed-off-by: Wei Yongjun +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index c50e3e8afbd34..2edaa601df13a 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3387,6 +3387,7 @@ int hci_register_dev(struct hci_dev *hdev) + return id; + + err_wqueue: ++ debugfs_remove_recursive(hdev->debugfs); + destroy_workqueue(hdev->workqueue); + destroy_workqueue(hdev->req_workqueue); + err: +-- +2.34.1 + diff --git a/queue-5.4/bluetooth-hci_bcm-check-for-error-irq.patch b/queue-5.4/bluetooth-hci_bcm-check-for-error-irq.patch new file mode 100644 index 00000000000..2c5358aeb4c --- /dev/null +++ b/queue-5.4/bluetooth-hci_bcm-check-for-error-irq.patch @@ -0,0 +1,46 @@ +From 0874c914b35d4b7c2406e55e9190bc209cd54167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Dec 2021 10:53:18 +0800 +Subject: Bluetooth: hci_bcm: Check for error irq + +From: Jiasheng Jiang + +[ Upstream commit b38cd3b42fba66cc538edb9cf77e07881f43f8e2 ] + +For the possible failure of the platform_get_irq(), the returned irq +could be error number and will finally cause the failure of the +request_irq(). +Consider that platform_get_irq() can now in certain cases return +-EPROBE_DEFER, and the consequences of letting request_irq() effectively +convert that into -EINVAL, even at probe time rather than later on. +So it might be better to check just now. + +Fixes: 0395ffc1ee05 ("Bluetooth: hci_bcm: Add PM for BCM devices") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 94ed734c1d7eb..c6bb380806f9b 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -1127,7 +1127,12 @@ static int bcm_probe(struct platform_device *pdev) + return -ENOMEM; + + dev->dev = &pdev->dev; +- dev->irq = platform_get_irq(pdev, 0); ++ ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ return ret; ++ ++ dev->irq = ret; + + if (has_acpi_companion(&pdev->dev)) { + ret = bcm_acpi_probe(dev); +-- +2.34.1 + diff --git a/queue-5.4/bluetooth-stop-proccessing-malicious-adv-data.patch b/queue-5.4/bluetooth-stop-proccessing-malicious-adv-data.patch new file mode 100644 index 00000000000..95c16f72d02 --- /dev/null +++ b/queue-5.4/bluetooth-stop-proccessing-malicious-adv-data.patch @@ -0,0 +1,54 @@ +From cb7802c1a29fc582f910e1db38043acedbb9f730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 10:12:12 +0300 +Subject: Bluetooth: stop proccessing malicious adv data + +From: Pavel Skripkin + +[ Upstream commit 3a56ef719f0b9682afb8a86d64b2399e36faa4e6 ] + +Syzbot reported slab-out-of-bounds read in hci_le_adv_report_evt(). The +problem was in missing validaion check. + +We should check if data is not malicious and we can read next data block. +If we won't check ptr validness, code can read a way beyond skb->end and +it can cause problems, of course. + +Fixes: e95beb414168 ("Bluetooth: hci_le_adv_report_evt code refactoring") +Reported-and-tested-by: syzbot+e3fcb9c4f3c2a931dc40@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 31469ff084cd3..40f1593651e84 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5506,7 +5506,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) + struct hci_ev_le_advertising_info *ev = ptr; + s8 rssi; + +- if (ev->length <= HCI_MAX_AD_LENGTH) { ++ if (ev->length <= HCI_MAX_AD_LENGTH && ++ ev->data + ev->length <= skb_tail_pointer(skb)) { + rssi = ev->data[ev->length]; + process_adv_report(hdev, ev->evt_type, &ev->bdaddr, + ev->bdaddr_type, NULL, 0, rssi, +@@ -5516,6 +5517,11 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) + } + + ptr += sizeof(*ev) + ev->length + 1; ++ ++ if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) { ++ bt_dev_err(hdev, "Malicious advertising data. Stopping processing"); ++ break; ++ } + } + + hci_dev_unlock(hdev); +-- +2.34.1 + diff --git a/queue-5.4/bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch b/queue-5.4/bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch new file mode 100644 index 00000000000..70490457873 --- /dev/null +++ b/queue-5.4/bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch @@ -0,0 +1,51 @@ +From c19e98cad4b9a253896e39c9de7126b48e1be78d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 11:08:06 +0100 +Subject: bpf: Do not WARN in bpf_warn_invalid_xdp_action() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Abeni + +[ Upstream commit 2cbad989033bff0256675c38f96f5faab852af4b ] + +The WARN_ONCE() in bpf_warn_invalid_xdp_action() can be triggered by +any bugged program, and even attaching a correct program to a NIC +not supporting the given action. + +The resulting splat, beyond polluting the logs, fouls automated tools: +e.g. a syzkaller reproducers using an XDP program returning an +unsupported action will never pass validation. + +Replace the WARN_ONCE with a less intrusive pr_warn_once(). + +Signed-off-by: Paolo Abeni +Signed-off-by: Daniel Borkmann +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/bpf/016ceec56e4817ebb2a9e35ce794d5c917df572c.1638189075.git.pabeni@redhat.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index b90c0b5a10112..92ce4d46f02e4 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -6912,9 +6912,9 @@ void bpf_warn_invalid_xdp_action(u32 act) + { + const u32 act_max = XDP_REDIRECT; + +- WARN_ONCE(1, "%s XDP return value %u, expect packet loss!\n", +- act > act_max ? "Illegal" : "Driver unsupported", +- act); ++ pr_warn_once("%s XDP return value %u, expect packet loss!\n", ++ act > act_max ? "Illegal" : "Driver unsupported", ++ act); + } + EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action); + +-- +2.34.1 + diff --git a/queue-5.4/bpf-fix-so_rcvbuf-so_sndbuf-handling-in-_bpf_setsock.patch b/queue-5.4/bpf-fix-so_rcvbuf-so_sndbuf-handling-in-_bpf_setsock.patch new file mode 100644 index 00000000000..75d98ec962a --- /dev/null +++ b/queue-5.4/bpf-fix-so_rcvbuf-so_sndbuf-handling-in-_bpf_setsock.patch @@ -0,0 +1,46 @@ +From a1f686bb69ead48294e696f6a162aa17a3bac8cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 10:31:48 +0900 +Subject: bpf: Fix SO_RCVBUF/SO_SNDBUF handling in _bpf_setsockopt(). + +From: Kuniyuki Iwashima + +[ Upstream commit 04c350b1ae6bdb12b84009a4d0bf5ab4e621c47b ] + +The commit 4057765f2dee ("sock: consistent handling of extreme +SO_SNDBUF/SO_RCVBUF values") added a change to prevent underflow +in setsockopt() around SO_SNDBUF/SO_RCVBUF. + +This patch adds the same change to _bpf_setsockopt(). + +Fixes: 4057765f2dee ("sock: consistent handling of extreme SO_SNDBUF/SO_RCVBUF values") +Signed-off-by: Kuniyuki Iwashima +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20220104013153.97906-2-kuniyu@amazon.co.jp +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 5ebc973ed4c50..b90c0b5a10112 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -4248,12 +4248,14 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock, + switch (optname) { + case SO_RCVBUF: + val = min_t(u32, val, sysctl_rmem_max); ++ val = min_t(int, val, INT_MAX / 2); + sk->sk_userlocks |= SOCK_RCVBUF_LOCK; + WRITE_ONCE(sk->sk_rcvbuf, + max_t(int, val * 2, SOCK_MIN_RCVBUF)); + break; + case SO_SNDBUF: + val = min_t(u32, val, sysctl_wmem_max); ++ val = min_t(int, val, INT_MAX / 2); + sk->sk_userlocks |= SOCK_SNDBUF_LOCK; + WRITE_ONCE(sk->sk_sndbuf, + max_t(int, val * 2, SOCK_MIN_SNDBUF)); +-- +2.34.1 + diff --git a/queue-5.4/bpftool-enable-line-buffering-for-stdout.patch b/queue-5.4/bpftool-enable-line-buffering-for-stdout.patch new file mode 100644 index 00000000000..76c5bed998f --- /dev/null +++ b/queue-5.4/bpftool-enable-line-buffering-for-stdout.patch @@ -0,0 +1,41 @@ +From 25f9880e3a57ab5ea0a08159c7cbb4ad05bf4ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 22:45:28 +0100 +Subject: bpftool: Enable line buffering for stdout + +From: Paul Chaignon + +[ Upstream commit 1a1a0b0364ad291bd8e509da104ac8b5b1afec5d ] + +The output of bpftool prog tracelog is currently buffered, which is +inconvenient when piping the output into other commands. A simple +tracelog | grep will typically not display anything. This patch fixes it +by enabling line buffering on stdout for the whole bpftool binary. + +Fixes: 30da46b5dc3a ("tools: bpftool: add a command to dump the trace pipe") +Signed-off-by: Quentin Monnet +Signed-off-by: Paul Chaignon +Signed-off-by: Andrii Nakryiko +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20211220214528.GA11706@Mem +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/bpf/bpftool/main.c b/tools/bpf/bpftool/main.c +index 7d3cfb0ccbe61..4b03983acbefe 100644 +--- a/tools/bpf/bpftool/main.c ++++ b/tools/bpf/bpftool/main.c +@@ -362,6 +362,8 @@ int main(int argc, char **argv) + }; + int opt, ret; + ++ setlinebuf(stdout); ++ + last_do_help = do_help; + pretty_output = false; + json_output = false; +-- +2.34.1 + diff --git a/queue-5.4/btrfs-remove-bug_on-eie-in-find_parent_nodes.patch b/queue-5.4/btrfs-remove-bug_on-eie-in-find_parent_nodes.patch new file mode 100644 index 00000000000..58e7f8ad965 --- /dev/null +++ b/queue-5.4/btrfs-remove-bug_on-eie-in-find_parent_nodes.patch @@ -0,0 +1,54 @@ +From 084a9f4c363b3cfe302b923bb645c856a8015220 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 16:45:35 -0400 +Subject: btrfs: remove BUG_ON(!eie) in find_parent_nodes + +From: Josef Bacik + +[ Upstream commit 9f05c09d6baef789726346397438cca4ec43c3ee ] + +If we're looking for leafs that point to a data extent we want to record +the extent items that point at our bytenr. At this point we have the +reference and we know for a fact that this leaf should have a reference +to our bytenr. However if there's some sort of corruption we may not +find any references to our leaf, and thus could end up with eie == NULL. +Replace this BUG_ON() with an ASSERT() and then return -EUCLEAN for the +mortals. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/backref.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 9044e7282d0b2..c701a19fac533 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1361,10 +1361,18 @@ again: + goto out; + if (!ret && extent_item_pos) { + /* +- * we've recorded that parent, so we must extend +- * its inode list here ++ * We've recorded that parent, so we must extend ++ * its inode list here. ++ * ++ * However if there was corruption we may not ++ * have found an eie, return an error in this ++ * case. + */ +- BUG_ON(!eie); ++ ASSERT(eie); ++ if (!eie) { ++ ret = -EUCLEAN; ++ goto out; ++ } + while (eie->next) + eie = eie->next; + eie->next = ref->inode_list; +-- +2.34.1 + diff --git a/queue-5.4/btrfs-remove-bug_on-in-find_parent_nodes.patch b/queue-5.4/btrfs-remove-bug_on-in-find_parent_nodes.patch new file mode 100644 index 00000000000..33ed5b611e9 --- /dev/null +++ b/queue-5.4/btrfs-remove-bug_on-in-find_parent_nodes.patch @@ -0,0 +1,42 @@ +From 67753d2bc9cb8be760640f4525a162a551812d6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 16:45:34 -0400 +Subject: btrfs: remove BUG_ON() in find_parent_nodes() + +From: Josef Bacik + +[ Upstream commit fcba0120edf88328524a4878d1d6f4ad39f2ec81 ] + +We search for an extent entry with .offset = -1, which shouldn't be a +thing, but corruption happens. Add an ASSERT() for the developers, +return -EUCLEAN for mortals. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/backref.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 7f644a58db511..9044e7282d0b2 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1208,7 +1208,12 @@ again: + ret = btrfs_search_slot(trans, fs_info->extent_root, &key, path, 0, 0); + if (ret < 0) + goto out; +- BUG_ON(ret == 0); ++ if (ret == 0) { ++ /* This shouldn't happen, indicates a bug or fs corruption. */ ++ ASSERT(ret != 0); ++ ret = -EUCLEAN; ++ goto out; ++ } + + #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS + if (trans && likely(trans->type != __TRANS_DUMMY) && +-- +2.34.1 + diff --git a/queue-5.4/can-softing-softing_startstop-fix-set-but-not-used-v.patch b/queue-5.4/can-softing-softing_startstop-fix-set-but-not-used-v.patch new file mode 100644 index 00000000000..dba73f034ab --- /dev/null +++ b/queue-5.4/can-softing-softing_startstop-fix-set-but-not-used-v.patch @@ -0,0 +1,63 @@ +From 2036e5adf01612b5e14db2afbc19b56527d20a6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jan 2022 21:57:51 +0100 +Subject: can: softing: softing_startstop(): fix set but not used variable + warning + +From: Marc Kleine-Budde + +[ Upstream commit 370d988cc529598ebaec6487d4f84c2115dc696b ] + +In the function softing_startstop() the variable error_reporting is +assigned but not used. The code that uses this variable is commented +out. Its stated that the functionality is not finally verified. + +To fix the warning: + +| drivers/net/can/softing/softing_fw.c:424:9: error: variable 'error_reporting' set but not used [-Werror,-Wunused-but-set-variable] + +remove the comment, activate the code, but add a "0 &&" to the if +expression and rely on the optimizer rather than the preprocessor to +remove the code. + +Link: https://lore.kernel.org/all/20220109103126.1872833-1-mkl@pengutronix.de +Fixes: 03fd3cf5a179 ("can: add driver for Softing card") +Cc: Kurt Van Dijck +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/softing/softing_fw.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/softing/softing_fw.c b/drivers/net/can/softing/softing_fw.c +index 8f44fdd8804bf..1c2afa17c26d1 100644 +--- a/drivers/net/can/softing/softing_fw.c ++++ b/drivers/net/can/softing/softing_fw.c +@@ -565,18 +565,19 @@ int softing_startstop(struct net_device *dev, int up) + if (ret < 0) + goto failed; + } +- /* enable_error_frame */ +- /* ++ ++ /* enable_error_frame ++ * + * Error reporting is switched off at the moment since + * the receiving of them is not yet 100% verified + * This should be enabled sooner or later +- * +- if (error_reporting) { ++ */ ++ if (0 && error_reporting) { + ret = softing_fct_cmd(card, 51, "enable_error_frame"); + if (ret < 0) + goto failed; + } +- */ ++ + /* initialize interface */ + iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 2]); + iowrite16(1, &card->dpram[DPRAM_FCT_PARAM + 4]); +-- +2.34.1 + diff --git a/queue-5.4/can-xilinx_can-xcan_probe-check-for-error-irq.patch b/queue-5.4/can-xilinx_can-xcan_probe-check-for-error-irq.patch new file mode 100644 index 00000000000..59b6f753939 --- /dev/null +++ b/queue-5.4/can-xilinx_can-xcan_probe-check-for-error-irq.patch @@ -0,0 +1,48 @@ +From 927983d6d30b2f20069a57674b006caff63edc31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Dec 2021 10:13:24 +0800 +Subject: can: xilinx_can: xcan_probe(): check for error irq + +From: Jiasheng Jiang + +[ Upstream commit c6564c13dae25cd7f8e1de5127b4da4500ee5844 ] + +For the possible failure of the platform_get_irq(), the returned irq +could be error number and will finally cause the failure of the +request_irq(). + +Consider that platform_get_irq() can now in certain cases return +-EPROBE_DEFER, and the consequences of letting request_irq() +effectively convert that into -EINVAL, even at probe time rather than +later on. So it might be better to check just now. + +Fixes: b1201e44f50b ("can: xilinx CAN controller support") +Link: https://lore.kernel.org/all/20211224021324.1447494-1-jiasheng@iscas.ac.cn +Signed-off-by: Jiasheng Jiang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/xilinx_can.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 0de39ebb35662..008d3d492bd1c 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -1753,7 +1753,12 @@ static int xcan_probe(struct platform_device *pdev) + spin_lock_init(&priv->tx_lock); + + /* Get IRQ for the device */ +- ndev->irq = platform_get_irq(pdev, 0); ++ ret = platform_get_irq(pdev, 0); ++ if (ret < 0) ++ goto err_free; ++ ++ ndev->irq = ret; ++ + ndev->flags |= IFF_ECHO; /* We support local echo */ + + platform_set_drvdata(pdev, ndev); +-- +2.34.1 + diff --git a/queue-5.4/char-mwave-adjust-io-port-register-size.patch b/queue-5.4/char-mwave-adjust-io-port-register-size.patch new file mode 100644 index 00000000000..e63fe7ac328 --- /dev/null +++ b/queue-5.4/char-mwave-adjust-io-port-register-size.patch @@ -0,0 +1,51 @@ +From 3eb7888448bf51348b6ec2a42c1408fa206356bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 00:42:06 -0800 +Subject: char/mwave: Adjust io port register size + +From: Kees Cook + +[ Upstream commit f5912cc19acd7c24b2dbf65a6340bf194244f085 ] + +Using MKWORD() on a byte-sized variable results in OOB read. Expand the +size of the reserved area so both MKWORD and MKBYTE continue to work +without overflow. Silences this warning on a -Warray-bounds build: + +drivers/char/mwave/3780i.h:346:22: error: array subscript 'short unsigned int[0]' is partly outside array bounds of 'DSP_ISA_SLAVE_CONTROL[1]' [-Werror=array-bounds] + 346 | #define MKWORD(var) (*((unsigned short *)(&var))) + | ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/char/mwave/3780i.h:356:40: note: in definition of macro 'OutWordDsp' + 356 | #define OutWordDsp(index,value) outw(value,usDspBaseIO+index) + | ^~~~~ +drivers/char/mwave/3780i.c:373:41: note: in expansion of macro 'MKWORD' + 373 | OutWordDsp(DSP_IsaSlaveControl, MKWORD(rSlaveControl)); + | ^~~~~~ +drivers/char/mwave/3780i.c:358:31: note: while referencing 'rSlaveControl' + 358 | DSP_ISA_SLAVE_CONTROL rSlaveControl; + | ^~~~~~~~~~~~~ + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20211203084206.3104326-1-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/mwave/3780i.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/mwave/3780i.h b/drivers/char/mwave/3780i.h +index 9ccb6b270b071..95164246afd1a 100644 +--- a/drivers/char/mwave/3780i.h ++++ b/drivers/char/mwave/3780i.h +@@ -68,7 +68,7 @@ typedef struct { + unsigned char ClockControl:1; /* RW: Clock control: 0=normal, 1=stop 3780i clocks */ + unsigned char SoftReset:1; /* RW: Soft reset 0=normal, 1=soft reset active */ + unsigned char ConfigMode:1; /* RW: Configuration mode, 0=normal, 1=config mode */ +- unsigned char Reserved:5; /* 0: Reserved */ ++ unsigned short Reserved:13; /* 0: Reserved */ + } DSP_ISA_SLAVE_CONTROL; + + +-- +2.34.1 + diff --git a/queue-5.4/clk-bcm-2835-pick-the-closest-clock-rate.patch b/queue-5.4/clk-bcm-2835-pick-the-closest-clock-rate.patch new file mode 100644 index 00000000000..873240f53ad --- /dev/null +++ b/queue-5.4/clk-bcm-2835-pick-the-closest-clock-rate.patch @@ -0,0 +1,46 @@ +From b3cf33233cc8330e496246f76394a63ecc7a9cbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 14:54:15 +0200 +Subject: clk: bcm-2835: Pick the closest clock rate + +From: Maxime Ripard + +[ Upstream commit 5517357a4733d7cf7c17fc79d0530cfa47add372 ] + +The driver currently tries to pick the closest rate that is lower than +the rate being requested. + +This causes an issue with clk_set_min_rate() since it actively checks +for the rounded rate to be above the minimum that was just set. + +Let's change the logic a bit to pick the closest rate to the requested +rate, no matter if it's actually higher or lower. + +Fixes: 6d18b8adbe67 ("clk: bcm2835: Support for clock parent selection") +Signed-off-by: Maxime Ripard +Acked-by: Stephen Boyd +Reviewed-by: Nicolas Saenz Julienne +Tested-by: Nicolas Saenz Julienne # boot and basic functionality +Tested-by: Michael Stapelberg +Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-2-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/clk/bcm/clk-bcm2835.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index c5486537b9284..b2af320d1b6c5 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1216,7 +1216,7 @@ static int bcm2835_clock_determine_rate(struct clk_hw *hw, + rate = bcm2835_clock_choose_div_and_prate(hw, i, req->rate, + &div, &prate, + &avgrate); +- if (rate > best_rate && rate <= req->rate) { ++ if (abs(req->rate - rate) < abs(req->rate - best_rate)) { + best_parent = parent; + best_prate = prate; + best_rate = rate; +-- +2.34.1 + diff --git a/queue-5.4/clk-bcm-2835-remove-rounding-up-the-dividers.patch b/queue-5.4/clk-bcm-2835-remove-rounding-up-the-dividers.patch new file mode 100644 index 00000000000..07898782760 --- /dev/null +++ b/queue-5.4/clk-bcm-2835-remove-rounding-up-the-dividers.patch @@ -0,0 +1,82 @@ +From f1f614614d9d2ac49fda9eabe22d086d006ccfa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 14:54:16 +0200 +Subject: clk: bcm-2835: Remove rounding up the dividers + +From: Maxime Ripard + +[ Upstream commit 8ca011ef4af48a7af7b15afd8a4a44039dd04cea ] + +The driver, once it found a divider, tries to round it up by increasing +the least significant bit of the fractional part by one when the +round_up argument is set and there's a remainder. + +However, since it increases the divider it will actually reduce the +clock rate below what we were asking for, leading to issues with +clk_set_min_rate() that will complain that our rounded clock rate is +below the minimum of the rate. + +Since the dividers are fairly precise already, let's remove that part so +that we can have clk_set_min_rate() working. + +This is effectively a revert of 9c95b32ca093 ("clk: bcm2835: add a round +up ability to the clock divisor"). + +Fixes: 9c95b32ca093 ("clk: bcm2835: add a round up ability to the clock divisor") +Signed-off-by: Maxime Ripard +Acked-by: Stephen Boyd +Reviewed-by: Nicolas Saenz Julienne +Tested-by: Nicolas Saenz Julienne # boot and basic functionality +Tested-by: Michael Stapelberg +Link: https://patchwork.freedesktop.org/patch/msgid/20210922125419.4125779-3-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/clk/bcm/clk-bcm2835.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index b2af320d1b6c5..e637bd6b295bd 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -932,8 +932,7 @@ static int bcm2835_clock_is_on(struct clk_hw *hw) + + static u32 bcm2835_clock_choose_div(struct clk_hw *hw, + unsigned long rate, +- unsigned long parent_rate, +- bool round_up) ++ unsigned long parent_rate) + { + struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); + const struct bcm2835_clock_data *data = clock->data; +@@ -945,10 +944,6 @@ static u32 bcm2835_clock_choose_div(struct clk_hw *hw, + + rem = do_div(temp, rate); + div = temp; +- +- /* Round up and mask off the unused bits */ +- if (round_up && ((div & unused_frac_mask) != 0 || rem != 0)) +- div += unused_frac_mask + 1; + div &= ~unused_frac_mask; + + /* different clamping limits apply for a mash clock */ +@@ -1079,7 +1074,7 @@ static int bcm2835_clock_set_rate(struct clk_hw *hw, + struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); + struct bcm2835_cprman *cprman = clock->cprman; + const struct bcm2835_clock_data *data = clock->data; +- u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate, false); ++ u32 div = bcm2835_clock_choose_div(hw, rate, parent_rate); + u32 ctl; + + spin_lock(&cprman->regs_lock); +@@ -1130,7 +1125,7 @@ static unsigned long bcm2835_clock_choose_div_and_prate(struct clk_hw *hw, + + if (!(BIT(parent_idx) & data->set_rate_parent)) { + *prate = clk_hw_get_rate(parent); +- *div = bcm2835_clock_choose_div(hw, rate, *prate, true); ++ *div = bcm2835_clock_choose_div(hw, rate, *prate); + + *avgrate = bcm2835_clock_rate_from_divisor(clock, *prate, *div); + +-- +2.34.1 + diff --git a/queue-5.4/clk-imx8mn-fix-imx8mn_clko1_sels.patch b/queue-5.4/clk-imx8mn-fix-imx8mn_clko1_sels.patch new file mode 100644 index 00000000000..7d34ef56840 --- /dev/null +++ b/queue-5.4/clk-imx8mn-fix-imx8mn_clko1_sels.patch @@ -0,0 +1,50 @@ +From 63964daa306acff625a39bed86c704ae10d07665 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 07:32:02 -0600 +Subject: clk: imx8mn: Fix imx8mn_clko1_sels + +From: Adam Ford + +[ Upstream commit 570727e9acfac1c2330a01dd5e1272e9c3acec08 ] + +When attempting to use sys_pll1_80m as the parent for clko1, the +system hangs. This is due to the fact that the source select +for sys_pll1_80m was incorrectly pointing to m7_alt_pll_clk, which +doesn't yet exist. + +According to Rev 3 of the TRM, The imx8mn_clko1_sels also incorrectly +references an osc_27m which does not exist, nor does an entry for +source select bits 010b. Fix both by inserting a dummy clock into +the missing space in the table and renaming the incorrectly name clock +with dummy. + +Fixes: 96d6392b54db ("clk: imx: Add support for i.MX8MN clock driver") +Signed-off-by: Adam Ford +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/20211117133202.775633-1-aford173@gmail.com +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mn.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mn.c b/drivers/clk/imx/clk-imx8mn.c +index 58b5acee38306..882b42efd2582 100644 +--- a/drivers/clk/imx/clk-imx8mn.c ++++ b/drivers/clk/imx/clk-imx8mn.c +@@ -358,9 +358,9 @@ static const char * const imx8mn_pdm_sels[] = {"osc_24m", "sys_pll2_100m", "audi + + static const char * const imx8mn_dram_core_sels[] = {"dram_pll_out", "dram_alt_root", }; + +-static const char * const imx8mn_clko1_sels[] = {"osc_24m", "sys_pll1_800m", "osc_27m", +- "sys_pll1_200m", "audio_pll2_out", "vpu_pll", +- "sys_pll1_80m", }; ++static const char * const imx8mn_clko1_sels[] = {"osc_24m", "sys_pll1_800m", "dummy", ++ "sys_pll1_200m", "audio_pll2_out", "sys_pll2_500m", ++ "dummy", "sys_pll1_80m", }; + static const char * const imx8mn_clko2_sels[] = {"osc_24m", "sys_pll2_200m", "sys_pll1_400m", + "sys_pll2_166m", "sys_pll3_out", "audio_pll1_out", + "video_pll1_out", "osc_32k", }; +-- +2.34.1 + diff --git a/queue-5.4/clk-meson-gxbb-fix-the-sdm_en-bit-for-mpll0-on-gxbb.patch b/queue-5.4/clk-meson-gxbb-fix-the-sdm_en-bit-for-mpll0-on-gxbb.patch new file mode 100644 index 00000000000..015124dbde7 --- /dev/null +++ b/queue-5.4/clk-meson-gxbb-fix-the-sdm_en-bit-for-mpll0-on-gxbb.patch @@ -0,0 +1,144 @@ +From 3c2c1c10f1eb4ef62dd41a285890b67ff8172d0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Oct 2021 14:50:06 +0100 +Subject: clk: meson: gxbb: Fix the SDM_EN bit for MPLL0 on GXBB + +From: Martin Blumenstingl + +[ Upstream commit ff54938dd190d85f740b9bf9dde59b550936b621 ] + +There are reports that 48kHz audio does not work on the WeTek Play 2 +(which uses a GXBB SoC), while 44.1kHz audio works fine on the same +board. There are also reports of 48kHz audio working fine on GXL and +GXM SoCs, which are using an (almost) identical AIU (audio controller). + +Experimenting has shown that MPLL0 is causing this problem. In the .dts +we have by default: + assigned-clocks = <&clkc CLKID_MPLL0>, + <&clkc CLKID_MPLL1>, + <&clkc CLKID_MPLL2>; + assigned-clock-rates = <294912000>, + <270950400>, + <393216000>; +The MPLL0 rate is divisible by 48kHz without remainder and the MPLL1 +rate is divisible by 44.1kHz without remainder. Swapping these two clock +rates "fixes" 48kHz audio but breaks 44.1kHz audio. + +Everything looks normal when looking at the info provided by the common +clock framework while playing 48kHz audio (via I2S with mclk-fs = 256): + mpll_prediv 1 1 0 2000000000 + mpll0_div 1 1 0 294909641 + mpll0 1 1 0 294909641 + cts_amclk_sel 1 1 0 294909641 + cts_amclk_div 1 1 0 12287902 + cts_amclk 1 1 0 12287902 + +meson-clk-msr however shows that the actual MPLL0 clock is off by more +than 38MHz: + mp0_out 333322917 +/-10416Hz + +The rate seen by meson-clk-msr is very close to what we would get when +SDM (the fractional part) was ignored: + (2000000000Hz * 16384) / ((16384 * 6) = 333.33MHz +If SDM was considered the we should get close to: + (2000000000Hz * 16384) / ((16384 * 6) + 12808) = 294.9MHz + +Further experimenting shows that HHI_MPLL_CNTL7[15] does not have any +effect on the rate of MPLL0 as seen my meson-clk-msr (regardless of +whether that bit is zero or one the rate is always the same according to +meson-clk-msr). Using HHI_MPLL_CNTL[25] on the other hand as SDM_EN +results in SDM being considered for the rate output by the hardware. The +rate - as seen by meson-clk-msr - matches with what we expect when +SDM_EN is enabled (fractional part is being considered, resulting in a +294.9MHz output) or disable (fractional part being ignored, resulting in +a 333.33MHz output). + +Reported-by: Christian Hewitt +Tested-by: Christian Hewitt +Signed-off-by: Martin Blumenstingl +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20211031135006.1508796-1-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/gxbb.c | 44 +++++++++++++++++++++++++++++++++++++--- + 1 file changed, 41 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 1f9c056e684ce..e8e36ec70b27f 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -712,6 +712,35 @@ static struct clk_regmap gxbb_mpll_prediv = { + }; + + static struct clk_regmap gxbb_mpll0_div = { ++ .data = &(struct meson_clk_mpll_data){ ++ .sdm = { ++ .reg_off = HHI_MPLL_CNTL7, ++ .shift = 0, ++ .width = 14, ++ }, ++ .sdm_en = { ++ .reg_off = HHI_MPLL_CNTL, ++ .shift = 25, ++ .width = 1, ++ }, ++ .n2 = { ++ .reg_off = HHI_MPLL_CNTL7, ++ .shift = 16, ++ .width = 9, ++ }, ++ .lock = &meson_clk_lock, ++ }, ++ .hw.init = &(struct clk_init_data){ ++ .name = "mpll0_div", ++ .ops = &meson_clk_mpll_ops, ++ .parent_hws = (const struct clk_hw *[]) { ++ &gxbb_mpll_prediv.hw ++ }, ++ .num_parents = 1, ++ }, ++}; ++ ++static struct clk_regmap gxl_mpll0_div = { + .data = &(struct meson_clk_mpll_data){ + .sdm = { + .reg_off = HHI_MPLL_CNTL7, +@@ -748,7 +777,16 @@ static struct clk_regmap gxbb_mpll0 = { + .hw.init = &(struct clk_init_data){ + .name = "mpll0", + .ops = &clk_regmap_gate_ops, +- .parent_hws = (const struct clk_hw *[]) { &gxbb_mpll0_div.hw }, ++ .parent_data = &(const struct clk_parent_data) { ++ /* ++ * Note: ++ * GXL and GXBB have different SDM_EN registers. We ++ * fallback to the global naming string mechanism so ++ * mpll0_div picks up the appropriate one. ++ */ ++ .name = "mpll0_div", ++ .index = -1, ++ }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + }, +@@ -3036,7 +3074,7 @@ static struct clk_hw_onecell_data gxl_hw_onecell_data = { + [CLKID_VAPB_1] = &gxbb_vapb_1.hw, + [CLKID_VAPB_SEL] = &gxbb_vapb_sel.hw, + [CLKID_VAPB] = &gxbb_vapb.hw, +- [CLKID_MPLL0_DIV] = &gxbb_mpll0_div.hw, ++ [CLKID_MPLL0_DIV] = &gxl_mpll0_div.hw, + [CLKID_MPLL1_DIV] = &gxbb_mpll1_div.hw, + [CLKID_MPLL2_DIV] = &gxbb_mpll2_div.hw, + [CLKID_MPLL_PREDIV] = &gxbb_mpll_prediv.hw, +@@ -3430,7 +3468,7 @@ static struct clk_regmap *const gxl_clk_regmaps[] = { + &gxbb_mpll0, + &gxbb_mpll1, + &gxbb_mpll2, +- &gxbb_mpll0_div, ++ &gxl_mpll0_div, + &gxbb_mpll1_div, + &gxbb_mpll2_div, + &gxbb_cts_amclk_div, +-- +2.34.1 + diff --git a/queue-5.4/clk-stm32-fix-ltdc-s-clock-turn-off-by-clk_disable_u.patch b/queue-5.4/clk-stm32-fix-ltdc-s-clock-turn-off-by-clk_disable_u.patch new file mode 100644 index 00000000000..8f491cad2e0 --- /dev/null +++ b/queue-5.4/clk-stm32-fix-ltdc-s-clock-turn-off-by-clk_disable_u.patch @@ -0,0 +1,75 @@ +From 5043b5cbeb7d7d80731c0b7e31643cd98824e2cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 15:11:21 +0800 +Subject: clk: stm32: Fix ltdc's clock turn off by clk_disable_unused() after + system enter shell + +From: Dillon Min + +[ Upstream commit 6fc058a72f3b7b07fc4de6d66ad1f68951b00f6e ] + +stm32's clk driver register two ltdc gate clk to clk core by +clk_hw_register_gate() and clk_hw_register_composite() + +first: 'stm32f429_gates[]', clk name is 'ltdc', which no user to use. +second: 'stm32f429_aux_clk[]', clk name is 'lcd-tft', used by ltdc driver + +both of them point to the same offset of stm32's RCC register. after +kernel enter console, clk core turn off ltdc's clk as 'stm32f429_gates[]' +is no one to use. but, actually 'stm32f429_aux_clk[]' is in use. + +stm32f469/746/769 have the same issue, fix it. + +Fixes: daf2d117cbca ("clk: stm32f4: Add lcd-tft clock") +Link: https://lore.kernel.org/linux-arm-kernel/1590564453-24499-7-git-send-email-dillon.minfei@gmail.com/ +Link: https://lore.kernel.org/lkml/CAPTRvHkf0cK_4ZidM17rPo99gWDmxgqFt4CDUjqFFwkOeQeFDg@mail.gmail.com/ +Signed-off-by: Dillon Min +Reviewed-by: Patrice Chotard +Acked-by: Gabriel Fernandez +Acked-by: Stephen Boyd +Link: https://lore.kernel.org/r/1635232282-3992-10-git-send-email-dillon.minfei@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-stm32f4.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c +index 5c75e3d906c20..682a18b392f08 100644 +--- a/drivers/clk/clk-stm32f4.c ++++ b/drivers/clk/clk-stm32f4.c +@@ -129,7 +129,6 @@ static const struct stm32f4_gate_data stm32f429_gates[] __initconst = { + { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, +- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, + }; + + static const struct stm32f4_gate_data stm32f469_gates[] __initconst = { +@@ -211,7 +210,6 @@ static const struct stm32f4_gate_data stm32f469_gates[] __initconst = { + { STM32F4_RCC_APB2ENR, 20, "spi5", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, +- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, + }; + + static const struct stm32f4_gate_data stm32f746_gates[] __initconst = { +@@ -286,7 +284,6 @@ static const struct stm32f4_gate_data stm32f746_gates[] __initconst = { + { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, +- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, + }; + + static const struct stm32f4_gate_data stm32f769_gates[] __initconst = { +@@ -364,7 +361,6 @@ static const struct stm32f4_gate_data stm32f769_gates[] __initconst = { + { STM32F4_RCC_APB2ENR, 21, "spi6", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 22, "sai1", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 23, "sai2", "apb2_div" }, +- { STM32F4_RCC_APB2ENR, 26, "ltdc", "apb2_div" }, + { STM32F4_RCC_APB2ENR, 30, "mdio", "apb2_div" }, + }; + +-- +2.34.1 + diff --git a/queue-5.4/cpufreq-fix-initialization-of-min-and-max-frequency-.patch b/queue-5.4/cpufreq-fix-initialization-of-min-and-max-frequency-.patch new file mode 100644 index 00000000000..7b6fb3b5780 --- /dev/null +++ b/queue-5.4/cpufreq-fix-initialization-of-min-and-max-frequency-.patch @@ -0,0 +1,54 @@ +From 465e4090ff3a960247560c54584faa8464359f68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Dec 2021 20:32:15 +0100 +Subject: cpufreq: Fix initialization of min and max frequency QoS requests + +From: Rafael J. Wysocki + +[ Upstream commit 521223d8b3ec078f670c7c35a1a04b1b2af07966 ] + +The min and max frequency QoS requests in the cpufreq core are +initialized to whatever the current min and max frequency values are +at the init time, but if any of these values change later (for +example, cpuinfo.max_freq is updated by the driver), these initial +request values will be limiting the CPU frequency unnecessarily +unless they are changed by user space via sysfs. + +To address this, initialize min_freq_req and max_freq_req to +FREQ_QOS_MIN_DEFAULT_VALUE and FREQ_QOS_MAX_DEFAULT_VALUE, +respectively, so they don't really limit anything until user +space updates them. + +Reported-by: Srinivas Pandruvada +Tested-by: Srinivas Pandruvada +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index cb7949a2ac0ca..af9f348048629 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1393,7 +1393,7 @@ static int cpufreq_online(unsigned int cpu) + + ret = freq_qos_add_request(&policy->constraints, + policy->min_freq_req, FREQ_QOS_MIN, +- policy->min); ++ FREQ_QOS_MIN_DEFAULT_VALUE); + if (ret < 0) { + /* + * So we don't call freq_qos_remove_request() for an +@@ -1413,7 +1413,7 @@ static int cpufreq_online(unsigned int cpu) + + ret = freq_qos_add_request(&policy->constraints, + policy->max_freq_req, FREQ_QOS_MAX, +- policy->max); ++ FREQ_QOS_MAX_DEFAULT_VALUE); + if (ret < 0) { + policy->max_freq_req = NULL; + goto out_destroy_policy; +-- +2.34.1 + diff --git a/queue-5.4/crypto-qce-fix-uaf-on-qce_ahash_register_one.patch b/queue-5.4/crypto-qce-fix-uaf-on-qce_ahash_register_one.patch new file mode 100644 index 00000000000..d425b820467 --- /dev/null +++ b/queue-5.4/crypto-qce-fix-uaf-on-qce_ahash_register_one.patch @@ -0,0 +1,39 @@ +From ae4e4b4ed90f14d1b7d862e3f4beca623cb7c741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 06:38:31 -0700 +Subject: crypto: qce - fix uaf on qce_ahash_register_one + +From: Chengfeng Ye + +[ Upstream commit b4cb4d31631912842eb7dce02b4350cbb7562d5e ] + +Pointer base points to sub field of tmpl, it +is dereferenced after tmpl is freed. Fix +this by accessing base before free tmpl. + +Fixes: ec8f5d8f ("crypto: qce - Qualcomm crypto engine driver") +Signed-off-by: Chengfeng Ye +Acked-by: Thara Gopinath +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qce/sha.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qce/sha.c b/drivers/crypto/qce/sha.c +index 0853e74583ade..29b0bad2507b1 100644 +--- a/drivers/crypto/qce/sha.c ++++ b/drivers/crypto/qce/sha.c +@@ -512,8 +512,8 @@ static int qce_ahash_register_one(const struct qce_ahash_def *def, + + ret = crypto_register_ahash(alg); + if (ret) { +- kfree(tmpl); + dev_err(qce->dev, "%s registration failed\n", base->cra_name); ++ kfree(tmpl); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.4/crypto-stm32-cryp-fix-double-pm-exit.patch b/queue-5.4/crypto-stm32-cryp-fix-double-pm-exit.patch new file mode 100644 index 00000000000..ebc9e59a3de --- /dev/null +++ b/queue-5.4/crypto-stm32-cryp-fix-double-pm-exit.patch @@ -0,0 +1,38 @@ +From 6d08d9752cbd57741c91136ca19758ec36ff29bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 08:54:58 +0100 +Subject: crypto: stm32/cryp - fix double pm exit + +From: Nicolas Toromanoff + +[ Upstream commit 6c12e742785bf9333faf60bfb96575bdd763448e ] + +Delete extraneous lines in probe error handling code: pm was +disabled twice. + +Fixes: 65f9aa36ee47 ("crypto: stm32/cryp - Add power management support") + +Reported-by: Marek Vasut +Signed-off-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-cryp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c +index 92472a48c0454..c41e66211c5b4 100644 +--- a/drivers/crypto/stm32/stm32-cryp.c ++++ b/drivers/crypto/stm32/stm32-cryp.c +@@ -2034,8 +2034,6 @@ err_engine1: + list_del(&cryp->list); + spin_unlock(&cryp_list.lock); + +- pm_runtime_disable(dev); +- pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); + pm_runtime_put_noidle(dev); + +-- +2.34.1 + diff --git a/queue-5.4/crypto-stm32-cryp-fix-lrw-chaining-mode.patch b/queue-5.4/crypto-stm32-cryp-fix-lrw-chaining-mode.patch new file mode 100644 index 00000000000..88c68eb1679 --- /dev/null +++ b/queue-5.4/crypto-stm32-cryp-fix-lrw-chaining-mode.patch @@ -0,0 +1,41 @@ +From 03e2043ba4f09666b26aab03e7fe9db6ad2e6809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 08:54:59 +0100 +Subject: crypto: stm32/cryp - fix lrw chaining mode + +From: Nicolas Toromanoff + +[ Upstream commit fa97dc2d48b476ea98199d808d3248d285987e99 ] + +This fixes the lrw autotest if lrw uses the CRYP as the AES block cipher +provider (as ecb(aes)). At end of request, CRYP should not update the IV +in case of ECB chaining mode. Indeed the ECB chaining mode never uses +the IV, but the software LRW chaining mode uses the IV field as +a counter and due to the (unexpected) update done by CRYP while the AES +block process, the counter get a wrong value when the IV overflow. + +Fixes: 5f49f18d27cd ("crypto: stm32/cryp - update to return iv_out") + +Signed-off-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-cryp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c +index c41e66211c5b4..69c2468f1053d 100644 +--- a/drivers/crypto/stm32/stm32-cryp.c ++++ b/drivers/crypto/stm32/stm32-cryp.c +@@ -639,7 +639,7 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err) + /* Phase 4 : output tag */ + err = stm32_cryp_read_auth_tag(cryp); + +- if (!err && (!(is_gcm(cryp) || is_ccm(cryp)))) ++ if (!err && (!(is_gcm(cryp) || is_ccm(cryp) || is_ecb(cryp)))) + stm32_cryp_get_iv(cryp); + + if (cryp->sgs_copied) { +-- +2.34.1 + diff --git a/queue-5.4/crypto-stm32-cryp-fix-xts-and-race-condition-in-cryp.patch b/queue-5.4/crypto-stm32-cryp-fix-xts-and-race-condition-in-cryp.patch new file mode 100644 index 00000000000..459a49accdd --- /dev/null +++ b/queue-5.4/crypto-stm32-cryp-fix-xts-and-race-condition-in-cryp.patch @@ -0,0 +1,42 @@ +From a9d42400336b37143cba5f27aaff64dddcb179c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 08:54:56 +0100 +Subject: crypto: stm32/cryp - fix xts and race condition in crypto_engine + requests + +From: Nicolas Toromanoff + +[ Upstream commit d703c7a994ee34b7fa89baf21631fca0aa9f17fc ] + +Don't erase key: +If key is erased before the crypto_finalize_.*_request() call, some +pending process will run with a key={ 0 }. +Moreover if the key is reset at end of request, it breaks xts chaining +mode, as for last xts block (in case input len is not a multiple of +block) a new AES request is started without calling again set_key(). + +Fixes: 9e054ec21ef8 ("crypto: stm32 - Support for STM32 CRYP crypto module") + +Signed-off-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/stm32-cryp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/crypto/stm32/stm32-cryp.c b/drivers/crypto/stm32/stm32-cryp.c +index 9b3511236ba25..92472a48c0454 100644 +--- a/drivers/crypto/stm32/stm32-cryp.c ++++ b/drivers/crypto/stm32/stm32-cryp.c +@@ -669,8 +669,6 @@ static void stm32_cryp_finish_req(struct stm32_cryp *cryp, int err) + else + crypto_finalize_ablkcipher_request(cryp->engine, cryp->req, + err); +- +- memset(cryp->ctx->key, 0, cryp->ctx->keylen); + } + + static int stm32_cryp_cpu_start(struct stm32_cryp *cryp) +-- +2.34.1 + diff --git a/queue-5.4/debugfs-lockdown-allow-reading-debugfs-files-that-ar.patch b/queue-5.4/debugfs-lockdown-allow-reading-debugfs-files-that-ar.patch new file mode 100644 index 00000000000..df579b15081 --- /dev/null +++ b/queue-5.4/debugfs-lockdown-allow-reading-debugfs-files-that-ar.patch @@ -0,0 +1,40 @@ +From d4c59d5f40366dbb0350445623e0d89377dbd2e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 18:05:05 +0100 +Subject: debugfs: lockdown: Allow reading debugfs files that are not world + readable + +From: Michal Suchanek + +[ Upstream commit 358fcf5ddbec4e6706405847d6a666f5933a6c25 ] + +When the kernel is locked down the kernel allows reading only debugfs +files with mode 444. Mode 400 is also valid but is not allowed. + +Make the 444 into a mask. + +Fixes: 5496197f9b08 ("debugfs: Restrict debugfs when the kernel is locked down") +Signed-off-by: Michal Suchanek +Link: https://lore.kernel.org/r/20220104170505.10248-1-msuchanek@suse.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/debugfs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c +index a32c5c7dcfd89..da87615ad69a7 100644 +--- a/fs/debugfs/file.c ++++ b/fs/debugfs/file.c +@@ -146,7 +146,7 @@ static int debugfs_locked_down(struct inode *inode, + struct file *filp, + const struct file_operations *real_fops) + { +- if ((inode->i_mode & 07777) == 0444 && ++ if ((inode->i_mode & 07777 & ~0444) == 0 && + !(filp->f_mode & FMODE_WRITE) && + !real_fops->unlocked_ioctl && + !real_fops->compat_ioctl && +-- +2.34.1 + diff --git a/queue-5.4/dm-btree-add-a-defensive-bounds-check-to-insert_at.patch b/queue-5.4/dm-btree-add-a-defensive-bounds-check-to-insert_at.patch new file mode 100644 index 00000000000..68df3d2d53c --- /dev/null +++ b/queue-5.4/dm-btree-add-a-defensive-bounds-check-to-insert_at.patch @@ -0,0 +1,45 @@ +From 1afd09c16fa958397c3569f1b5e652f279a8bd14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 13:44:13 +0000 +Subject: dm btree: add a defensive bounds check to insert_at() + +From: Joe Thornber + +[ Upstream commit 85bca3c05b6cca31625437eedf2060e846c4bbad ] + +Corrupt metadata could trigger an out of bounds write. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/persistent-data/dm-btree.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c +index 8aae0624a2971..6383afb88f319 100644 +--- a/drivers/md/persistent-data/dm-btree.c ++++ b/drivers/md/persistent-data/dm-btree.c +@@ -83,14 +83,16 @@ void inc_children(struct dm_transaction_manager *tm, struct btree_node *n, + } + + static int insert_at(size_t value_size, struct btree_node *node, unsigned index, +- uint64_t key, void *value) +- __dm_written_to_disk(value) ++ uint64_t key, void *value) ++ __dm_written_to_disk(value) + { + uint32_t nr_entries = le32_to_cpu(node->header.nr_entries); ++ uint32_t max_entries = le32_to_cpu(node->header.max_entries); + __le64 key_le = cpu_to_le64(key); + + if (index > nr_entries || +- index >= le32_to_cpu(node->header.max_entries)) { ++ index >= max_entries || ++ nr_entries >= max_entries) { + DMERR("too many entries in btree node for insert"); + __dm_unbless_for_disk(value); + return -ENOMEM; +-- +2.34.1 + diff --git a/queue-5.4/dm-space-map-common-add-bounds-check-to-sm_ll_lookup.patch b/queue-5.4/dm-space-map-common-add-bounds-check-to-sm_ll_lookup.patch new file mode 100644 index 00000000000..764106c5328 --- /dev/null +++ b/queue-5.4/dm-space-map-common-add-bounds-check-to-sm_ll_lookup.patch @@ -0,0 +1,37 @@ +From fa3b4db21e9ed73b98ffb1ccdbb4f58671bb1044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 13:49:53 +0000 +Subject: dm space map common: add bounds check to sm_ll_lookup_bitmap() + +From: Joe Thornber + +[ Upstream commit cba23ac158db7f3cd48a923d6861bee2eb7a2978 ] + +Corrupted metadata could warrant returning error from sm_ll_lookup_bitmap(). + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/persistent-data/dm-space-map-common.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/md/persistent-data/dm-space-map-common.c b/drivers/md/persistent-data/dm-space-map-common.c +index a213bf11738fb..85853ab629717 100644 +--- a/drivers/md/persistent-data/dm-space-map-common.c ++++ b/drivers/md/persistent-data/dm-space-map-common.c +@@ -281,6 +281,11 @@ int sm_ll_lookup_bitmap(struct ll_disk *ll, dm_block_t b, uint32_t *result) + struct disk_index_entry ie_disk; + struct dm_block *blk; + ++ if (b >= ll->nr_blocks) { ++ DMERR_LIMIT("metadata block out of bounds"); ++ return -EINVAL; ++ } ++ + b = do_div(index, ll->entries_per_block); + r = ll->load_ie(ll, index, &ie_disk); + if (r < 0) +-- +2.34.1 + diff --git a/queue-5.4/dmaengine-pxa-mmp-stop-referencing-config-slave_id.patch b/queue-5.4/dmaengine-pxa-mmp-stop-referencing-config-slave_id.patch new file mode 100644 index 00000000000..5e9675582fe --- /dev/null +++ b/queue-5.4/dmaengine-pxa-mmp-stop-referencing-config-slave_id.patch @@ -0,0 +1,63 @@ +From 25183d3b0371a4c28c3a3770f375c81b6d310210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Nov 2021 23:21:58 +0100 +Subject: dmaengine: pxa/mmp: stop referencing config->slave_id + +From: Arnd Bergmann + +[ Upstream commit 134c37fa250a87a7e77c80a7c59ae16c462e46e0 ] + +The last driver referencing the slave_id on Marvell PXA and MMP platforms +was the SPI driver, but this stopped doing so a long time ago, so the +TODO from the earlier patch can no be removed. + +Fixes: b729bf34535e ("spi/pxa2xx: Don't use slave_id of dma_slave_config") +Fixes: 13b3006b8ebd ("dma: mmp_pdma: add filter function") +Signed-off-by: Arnd Bergmann +Acked-by: Mark Brown +Link: https://lore.kernel.org/r/20211122222203.4103644-7-arnd@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mmp_pdma.c | 6 ------ + drivers/dma/pxa_dma.c | 7 ------- + 2 files changed, 13 deletions(-) + +diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c +index 7fe494fc50d4e..ec186cf8b8af1 100644 +--- a/drivers/dma/mmp_pdma.c ++++ b/drivers/dma/mmp_pdma.c +@@ -728,12 +728,6 @@ static int mmp_pdma_config_write(struct dma_chan *dchan, + + chan->dir = direction; + chan->dev_addr = addr; +- /* FIXME: drivers should be ported over to use the filter +- * function. Once that's done, the following two lines can +- * be removed. +- */ +- if (cfg->slave_id) +- chan->drcmr = cfg->slave_id; + + return 0; + } +diff --git a/drivers/dma/pxa_dma.c b/drivers/dma/pxa_dma.c +index 349fb312c8725..b4ef4f19f7dec 100644 +--- a/drivers/dma/pxa_dma.c ++++ b/drivers/dma/pxa_dma.c +@@ -911,13 +911,6 @@ static void pxad_get_config(struct pxad_chan *chan, + *dcmd |= PXA_DCMD_BURST16; + else if (maxburst == 32) + *dcmd |= PXA_DCMD_BURST32; +- +- /* FIXME: drivers should be ported over to use the filter +- * function. Once that's done, the following two lines can +- * be removed. +- */ +- if (chan->cfg.slave_id) +- chan->drcmr = chan->cfg.slave_id; + } + + static struct dma_async_tx_descriptor * +-- +2.34.1 + diff --git a/queue-5.4/drm-amdgpu-fix-a-null-pointer-dereference-in-amdgpu_.patch b/queue-5.4/drm-amdgpu-fix-a-null-pointer-dereference-in-amdgpu_.patch new file mode 100644 index 00000000000..758e3e5ea58 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-a-null-pointer-dereference-in-amdgpu_.patch @@ -0,0 +1,65 @@ +From 12dea635d082a3da8e887c33bbea9dcf54a79f24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 00:17:36 +0800 +Subject: drm/amdgpu: Fix a NULL pointer dereference in + amdgpu_connector_lcd_native_mode() + +From: Zhou Qingyang + +[ Upstream commit b220110e4cd442156f36e1d9b4914bb9e87b0d00 ] + +In amdgpu_connector_lcd_native_mode(), the return value of +drm_mode_duplicate() is assigned to mode, and there is a dereference +of it in amdgpu_connector_lcd_native_mode(), which will lead to a NULL +pointer dereference on failure of drm_mode_duplicate(). + +Fix this bug add a check of mode. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_DRM_AMDGPU=m show no new warnings, and +our static analyzer no longer warns about this code. + +Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") +Signed-off-by: Zhou Qingyang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 0d39e386f6e9c..0e1cacf731698 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -389,6 +389,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) + native_mode->vdisplay != 0 && + native_mode->clock != 0) { + mode = drm_mode_duplicate(dev, native_mode); ++ if (!mode) ++ return NULL; ++ + mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; + drm_mode_set_name(mode); + +@@ -403,6 +406,9 @@ amdgpu_connector_lcd_native_mode(struct drm_encoder *encoder) + * simpler. + */ + mode = drm_cvt_mode(dev, native_mode->hdisplay, native_mode->vdisplay, 60, true, false, false); ++ if (!mode) ++ return NULL; ++ + mode->type = DRM_MODE_TYPE_PREFERRED | DRM_MODE_TYPE_DRIVER; + DRM_DEBUG_KMS("Adding cvt approximation of native panel mode %s\n", mode->name); + } +-- +2.34.1 + diff --git a/queue-5.4/drm-amdgpu-fixup-bad-vram-size-on-gmc-v8.patch b/queue-5.4/drm-amdgpu-fixup-bad-vram-size-on-gmc-v8.patch new file mode 100644 index 00000000000..df6f99f9fe8 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fixup-bad-vram-size-on-gmc-v8.patch @@ -0,0 +1,61 @@ +From f2481cb61c19cc8512402ff38f5d1b2286c1ca54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 17:23:37 +0800 +Subject: drm/amdgpu: fixup bad vram size on gmc v8 + +From: Zongmin Zhou + +[ Upstream commit 11544d77e3974924c5a9c8a8320b996a3e9b2f8b ] + +Some boards(like RX550) seem to have garbage in the upper +16 bits of the vram size register. Check for +this and clamp the size properly. Fixes +boards reporting bogus amounts of vram. + +after add this patch,the maximum GPU VRAM size is 64GB, +otherwise only 64GB vram size will be used. + +Signed-off-by: Zongmin Zhou +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +index ea764dd9245db..2975331a7b867 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c +@@ -524,10 +524,10 @@ static void gmc_v8_0_mc_program(struct amdgpu_device *adev) + static int gmc_v8_0_mc_init(struct amdgpu_device *adev) + { + int r; ++ u32 tmp; + + adev->gmc.vram_width = amdgpu_atombios_get_vram_width(adev); + if (!adev->gmc.vram_width) { +- u32 tmp; + int chansize, numchan; + + /* Get VRAM informations */ +@@ -571,8 +571,15 @@ static int gmc_v8_0_mc_init(struct amdgpu_device *adev) + adev->gmc.vram_width = numchan * chansize; + } + /* size in MB on si */ +- adev->gmc.mc_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; +- adev->gmc.real_vram_size = RREG32(mmCONFIG_MEMSIZE) * 1024ULL * 1024ULL; ++ tmp = RREG32(mmCONFIG_MEMSIZE); ++ /* some boards may have garbage in the upper 16 bits */ ++ if (tmp & 0xffff0000) { ++ DRM_INFO("Probable bad vram size: 0x%08x\n", tmp); ++ if (tmp & 0xffff) ++ tmp &= 0xffff; ++ } ++ adev->gmc.mc_vram_size = tmp * 1024ULL * 1024ULL; ++ adev->gmc.real_vram_size = adev->gmc.mc_vram_size; + + if (!(adev->flags & AMD_IS_APU)) { + r = amdgpu_device_resize_fb_bar(adev); +-- +2.34.1 + diff --git a/queue-5.4/drm-bridge-megachips-ensure-both-bridges-are-probed-.patch b/queue-5.4/drm-bridge-megachips-ensure-both-bridges-are-probed-.patch new file mode 100644 index 00000000000..96362594e38 --- /dev/null +++ b/queue-5.4/drm-bridge-megachips-ensure-both-bridges-are-probed-.patch @@ -0,0 +1,251 @@ +From 5e2847cc2a1628df49669a8d21e17aaa8d3005a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 10:53:02 +0000 +Subject: drm/bridge: megachips: Ensure both bridges are probed before + registration + +From: Martyn Welch + +[ Upstream commit 11632d4aa2b3f126790e81a4415d6c23103cf8bb ] + +In the configuration used by the b850v3, the STDP2690 is used to read EDID +data whilst it's the STDP4028 which can detect when monitors are connected. + +This can result in problems at boot with monitors connected when the +STDP4028 is probed first, a monitor is detected and an attempt is made to +read the EDID data before the STDP2690 has probed: + +[ 3.795721] Unable to handle kernel NULL pointer dereference at virtual address 00000018 +[ 3.803845] pgd = (ptrval) +[ 3.806581] [00000018] *pgd=00000000 +[ 3.810180] Internal error: Oops: 5 [#1] SMP ARM +[ 3.814813] Modules linked in: +[ 3.817879] CPU: 0 PID: 64 Comm: kworker/u4:1 Not tainted 5.15.0 #1 +[ 3.824161] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 3.830705] Workqueue: events_unbound deferred_probe_work_func +[ 3.836565] PC is at stdp2690_get_edid+0x44/0x19c +[ 3.841286] LR is at ge_b850v3_lvds_get_modes+0x2c/0x5c +[ 3.846526] pc : [<805eae10>] lr : [<805eb138>] psr: 80000013 +[ 3.852802] sp : 81c359d0 ip : 7dbb550b fp : 81c35a1c +[ 3.858037] r10: 81c73840 r9 : 81c73894 r8 : 816d9800 +[ 3.863270] r7 : 00000000 r6 : 81c34000 r5 : 00000000 r4 : 810c35f0 +[ 3.869808] r3 : 80e3e294 r2 : 00000080 r1 : 00000cc0 r0 : 81401180 +[ 3.876349] Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 3.883499] Control: 10c5387d Table: 1000404a DAC: 00000051 +[ 3.889254] Register r0 information: slab kmem_cache start 81401180 pointer offset 0 +[ 3.897034] Register r1 information: non-paged memory +[ 3.902097] Register r2 information: non-paged memory +[ 3.907160] Register r3 information: non-slab/vmalloc memory +[ 3.912832] Register r4 information: non-slab/vmalloc memory +[ 3.918503] Register r5 information: NULL pointer +[ 3.923217] Register r6 information: non-slab/vmalloc memory +[ 3.928887] Register r7 information: NULL pointer +[ 3.933601] Register r8 information: slab kmalloc-1k start 816d9800 pointer offset 0 size 1024 +[ 3.942244] Register r9 information: slab kmalloc-2k start 81c73800 pointer offset 148 size 2048 +[ 3.951058] Register r10 information: slab kmalloc-2k start 81c73800 pointer offset 64 size 2048 +[ 3.959873] Register r11 information: non-slab/vmalloc memory +[ 3.965632] Register r12 information: non-paged memory +[ 3.970781] Process kworker/u4:1 (pid: 64, stack limit = 0x(ptrval)) +[ 3.977148] Stack: (0x81c359d0 to 0x81c36000) +[ 3.981517] 59c0: 80b2b668 80b2b5bc 000002e2 0000034e +[ 3.989712] 59e0: 81c35a8c 816d98e8 81c35a14 7dbb550b 805bfcd0 810c35f0 81c73840 824addc0 +[ 3.997906] 5a00: 00001000 816d9800 81c73894 81c73840 81c35a34 81c35a20 805eb138 805eadd8 +[ 4.006099] 5a20: 810c35f0 00000045 81c35adc 81c35a38 80594188 805eb118 80d7c788 80dd1848 +[ 4.014292] 5a40: 00000000 81c35a50 80dca950 811194d3 80dca7c4 80dca944 80dca91c 816d9800 +[ 4.022485] 5a60: 81c34000 81c760a8 816d9800 80c58c98 810c35f0 816d98e8 00001000 00001000 +[ 4.030678] 5a80: 00000000 00000000 8017712c 81c60000 00000002 00000001 00000000 00000000 +[ 4.038870] 5aa0: 816d9900 816d9900 00000000 7dbb550b 805c700c 00000008 826282c8 826282c8 +[ 4.047062] 5ac0: 00001000 81e1ce40 00001000 00000002 81c35bf4 81c35ae0 805d9694 80593fc0 +[ 4.055255] 5ae0: 8017a970 80179ad8 00000179 00000000 81c35bcc 81c35b00 80177108 8017a950 +[ 4.063447] 5b00: 00000000 81c35b10 81c34000 00000000 81004fd8 81010a38 00000000 00000059 +[ 4.071639] 5b20: 816d98d4 81fbb718 00000013 826282c8 8017a940 81c35b40 81134448 00000400 +[ 4.079831] 5b40: 00000178 00000000 e063b9c1 00000000 c2000049 00000040 00000000 00000008 +[ 4.088024] 5b60: 82628300 82628380 00000000 00000000 81c34000 00000000 81fbb700 82628340 +[ 4.096216] 5b80: 826283c0 00001000 00000000 00000010 816d9800 826282c0 801766f8 00000000 +[ 4.104408] 5ba0: 00000000 81004fd8 00000049 00000000 00000000 00000001 80dcf940 80178de4 +[ 4.112601] 5bc0: 81c35c0c 7dbb550b 80178de4 81fbb700 00000010 00000010 810c35f4 81e1ce40 +[ 4.120793] 5be0: 81c40908 0000000c 81c35c64 81c35bf8 805a7f18 805d94a0 81c35c3c 816d9800 +[ 4.128985] 5c00: 00000010 81c34000 81c35c2c 81c35c18 8012fce0 805be90c 81c35c3c 81c35c28 +[ 4.137178] 5c20: 805be90c 80173210 81fbb600 81fbb6b4 81c35c5c 7dbb550b 81c35c64 81fbb700 +[ 4.145370] 5c40: 816d9800 00000010 810c35f4 81e1ce40 81c40908 0000000c 81c35c84 81c35c68 +[ 4.153565] 5c60: 805a8c78 805a7ed0 816d9800 81fbb700 00000010 00000000 81c35cac 81c35c88 +[ 4.161758] 5c80: 805a8dc4 805a8b68 816d9800 00000000 816d9800 00000000 8179f810 810c42d0 +[ 4.169950] 5ca0: 81c35ccc 81c35cb0 805e47b0 805a8d18 824aa240 81e1ea80 81c40908 81126b60 +[ 4.178144] 5cc0: 81c35d14 81c35cd0 8060db1c 805e46cc 81c35d14 81c35ce0 80dd90f8 810c4d58 +[ 4.186338] 5ce0: 80dd90dc 81fe9740 fffffffe 81fe9740 81e1ea80 00000000 810c4d6c 80c4b95c +[ 4.194531] 5d00: 80dd9a3c 815c6810 81c35d34 81c35d18 8060dc9c 8060d8fc 8246b440 815c6800 +[ 4.202724] 5d20: 815c6810 eefd8e00 81c35d44 81c35d38 8060dd80 8060dbec 81c35d6c 81c35d48 +[ 4.210918] 5d40: 805e98a4 8060dd70 00000000 815c6810 810c45b0 81126e90 81126e90 80dd9a3c +[ 4.219112] 5d60: 81c35d8c 81c35d70 80619574 805e9808 815c6810 00000000 810c45b0 81126e90 +[ 4.227305] 5d80: 81c35db4 81c35d90 806168dc 80619514 80625df0 80623c80 815c6810 810c45b0 +[ 4.235498] 5da0: 81c35e6c 815c6810 81c35dec 81c35db8 80616d04 80616800 81c35de4 81c35dc8 +[ 4.243691] 5dc0: 808382b0 80b2f444 8116e310 8116e314 81c35e6c 815c6810 00000003 80dd9a3c +[ 4.251884] 5de0: 81c35e14 81c35df0 80616ec8 80616c60 00000001 810c45b0 81c35e6c 815c6810 +[ 4.260076] 5e00: 00000001 80dd9a3c 81c35e34 81c35e18 80617338 80616e90 00000000 81c35e6c +[ 4.268269] 5e20: 80617284 81c34000 81c35e64 81c35e38 80614730 80617290 81c35e64 8171a06c +[ 4.276461] 5e40: 81e220b8 7dbb550b 815c6810 81c34000 815c6854 81126e90 81c35e9c 81c35e68 +[ 4.284654] 5e60: 8061673c 806146a8 8060f5e0 815c6810 00000001 7dbb550b 00000000 810c5080 +[ 4.292847] 5e80: 810c5320 815c6810 81126e90 00000000 81c35eac 81c35ea0 80617554 80616650 +[ 4.301040] 5ea0: 81c35ecc 81c35eb0 80615694 80617544 810c5080 810c5080 810c5094 81126e90 +[ 4.309233] 5ec0: 81c35efc 81c35ed0 80615c6c 8061560c 80615bc0 810c50c0 817eeb00 81412800 +[ 4.317425] 5ee0: 814c3000 00000000 814c300d 81119a60 81c35f3c 81c35f00 80141488 80615bcc +[ 4.325618] 5f00: 81c60000 81c34000 81c35f24 81c35f18 80143078 817eeb00 81412800 817eeb18 +[ 4.333811] 5f20: 81412818 81003d00 00000088 81412800 81c35f74 81c35f40 80141a48 80141298 +[ 4.342005] 5f40: 81c35f74 81c34000 801481ac 817efa40 817efc00 801417d8 817eeb00 00000000 +[ 4.350199] 5f60: 815a7e7c 81c34000 81c35fac 81c35f78 80149b1c 801417e4 817efc20 817efc20 +[ 4.358391] 5f80: ffffe000 817efa40 801499a8 00000000 00000000 00000000 00000000 00000000 +[ 4.366583] 5fa0: 00000000 81c35fb0 80100130 801499b4 00000000 00000000 00000000 00000000 +[ 4.374774] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 4.382966] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 +[ 4.391155] Backtrace: +[ 4.393613] [<805eadcc>] (stdp2690_get_edid) from [<805eb138>] (ge_b850v3_lvds_get_modes+0x2c/0x5c) +[ 4.402691] r10:81c73840 r9:81c73894 r8:816d9800 r7:00001000 r6:824addc0 r5:81c73840 +[ 4.410534] r4:810c35f0 +[ 4.413073] [<805eb10c>] (ge_b850v3_lvds_get_modes) from [<80594188>] (drm_helper_probe_single_connector_modes+0x1d4/0x84c) +[ 4.424240] r5:00000045 r4:810c35f0 +[ 4.427822] [<80593fb4>] (drm_helper_probe_single_connector_modes) from [<805d9694>] (drm_client_modeset_probe+0x200/0x1384) +[ 4.439074] r10:00000002 r9:00001000 r8:81e1ce40 r7:00001000 r6:826282c8 r5:826282c8 +[ 4.446917] r4:00000008 +[ 4.449455] [<805d9494>] (drm_client_modeset_probe) from [<805a7f18>] (__drm_fb_helper_initial_config_and_unlock+0x54/0x5b4) +[ 4.460713] r10:0000000c r9:81c40908 r8:81e1ce40 r7:810c35f4 r6:00000010 r5:00000010 +[ 4.468556] r4:81fbb700 +[ 4.471095] [<805a7ec4>] (__drm_fb_helper_initial_config_and_unlock) from [<805a8c78>] (drm_fbdev_client_hotplug+0x11c/0x1b0) +[ 4.482434] r10:0000000c r9:81c40908 r8:81e1ce40 r7:810c35f4 r6:00000010 r5:816d9800 +[ 4.490276] r4:81fbb700 +[ 4.492814] [<805a8b5c>] (drm_fbdev_client_hotplug) from [<805a8dc4>] (drm_fbdev_generic_setup+0xb8/0x1a4) +[ 4.502494] r7:00000000 r6:00000010 r5:81fbb700 r4:816d9800 +[ 4.508160] [<805a8d0c>] (drm_fbdev_generic_setup) from [<805e47b0>] (imx_drm_bind+0xf0/0x130) +[ 4.516805] r7:810c42d0 r6:8179f810 r5:00000000 r4:816d9800 +[ 4.522474] [<805e46c0>] (imx_drm_bind) from [<8060db1c>] (try_to_bring_up_master+0x22c/0x2f0) +[ 4.531116] r7:81126b60 r6:81c40908 r5:81e1ea80 r4:824aa240 +[ 4.536783] [<8060d8f0>] (try_to_bring_up_master) from [<8060dc9c>] (__component_add+0xbc/0x184) +[ 4.545597] r10:815c6810 r9:80dd9a3c r8:80c4b95c r7:810c4d6c r6:00000000 r5:81e1ea80 +[ 4.553440] r4:81fe9740 +[ 4.555980] [<8060dbe0>] (__component_add) from [<8060dd80>] (component_add+0x1c/0x20) +[ 4.563921] r7:eefd8e00 r6:815c6810 r5:815c6800 r4:8246b440 +[ 4.569589] [<8060dd64>] (component_add) from [<805e98a4>] (dw_hdmi_imx_probe+0xa8/0xe8) +[ 4.577702] [<805e97fc>] (dw_hdmi_imx_probe) from [<80619574>] (platform_probe+0x6c/0xc8) +[ 4.585908] r9:80dd9a3c r8:81126e90 r7:81126e90 r6:810c45b0 r5:815c6810 r4:00000000 +[ 4.593662] [<80619508>] (platform_probe) from [<806168dc>] (really_probe+0xe8/0x460) +[ 4.601524] r7:81126e90 r6:810c45b0 r5:00000000 r4:815c6810 +[ 4.607191] [<806167f4>] (really_probe) from [<80616d04>] (__driver_probe_device+0xb0/0x230) +[ 4.615658] r7:815c6810 r6:81c35e6c r5:810c45b0 r4:815c6810 +[ 4.621326] [<80616c54>] (__driver_probe_device) from [<80616ec8>] (driver_probe_device+0x44/0xe0) +[ 4.630313] r9:80dd9a3c r8:00000003 r7:815c6810 r6:81c35e6c r5:8116e314 r4:8116e310 +[ 4.638068] [<80616e84>] (driver_probe_device) from [<80617338>] (__device_attach_driver+0xb4/0x12c) +[ 4.647227] r9:80dd9a3c r8:00000001 r7:815c6810 r6:81c35e6c r5:810c45b0 r4:00000001 +[ 4.654981] [<80617284>] (__device_attach_driver) from [<80614730>] (bus_for_each_drv+0x94/0xd8) +[ 4.663794] r7:81c34000 r6:80617284 r5:81c35e6c r4:00000000 +[ 4.669461] [<8061469c>] (bus_for_each_drv) from [<8061673c>] (__device_attach+0xf8/0x190) +[ 4.677753] r7:81126e90 r6:815c6854 r5:81c34000 r4:815c6810 +[ 4.683419] [<80616644>] (__device_attach) from [<80617554>] (device_initial_probe+0x1c/0x20) +[ 4.691971] r8:00000000 r7:81126e90 r6:815c6810 r5:810c5320 r4:810c5080 +[ 4.698681] [<80617538>] (device_initial_probe) from [<80615694>] (bus_probe_device+0x94/0x9c) +[ 4.707318] [<80615600>] (bus_probe_device) from [<80615c6c>] (deferred_probe_work_func+0xac/0xf0) +[ 4.716305] r7:81126e90 r6:810c5094 r5:810c5080 r4:810c5080 +[ 4.721973] [<80615bc0>] (deferred_probe_work_func) from [<80141488>] (process_one_work+0x1fc/0x54c) +[ 4.731139] r10:81119a60 r9:814c300d r8:00000000 r7:814c3000 r6:81412800 r5:817eeb00 +[ 4.738981] r4:810c50c0 r3:80615bc0 +[ 4.742563] [<8014128c>] (process_one_work) from [<80141a48>] (worker_thread+0x270/0x570) +[ 4.750765] r10:81412800 r9:00000088 r8:81003d00 r7:81412818 r6:817eeb18 r5:81412800 +[ 4.758608] r4:817eeb00 +[ 4.761147] [<801417d8>] (worker_thread) from [<80149b1c>] (kthread+0x174/0x190) +[ 4.768574] r10:81c34000 r9:815a7e7c r8:00000000 r7:817eeb00 r6:801417d8 r5:817efc00 +[ 4.776417] r4:817efa40 +[ 4.778955] [<801499a8>] (kthread) from [<80100130>] (ret_from_fork+0x14/0x24) +[ 4.786201] Exception stack(0x81c35fb0 to 0x81c35ff8) +[ 4.791266] 5fa0: 00000000 00000000 00000000 00000000 +[ 4.799459] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 4.807651] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 +[ 4.814279] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:801499a8 +[ 4.822120] r4:817efa40 +[ 4.824664] Code: e3a02080 e593001c e3a01d33 e3a05000 (e5979018) + +Split the registration from the STDP4028 probe routine and only perform +registration once both the STDP4028 and STDP2690 have probed. + +Signed-off-by: Martyn Welch +CC: Peter Senna Tschudin +CC: Martyn Welch +CC: Neil Armstrong +CC: Robert Foss +CC: Laurent Pinchart +CC: Jonas Karlman +CC: Jernej Skrabec +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/43552c3404e8fdf92d8bc5658fac24e9f03c2c57.1637836606.git.martyn.welch@collabora.com +Signed-off-by: Sasha Levin +--- + .../bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 40 +++++++++++++------ + 1 file changed, 28 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +index b050fd1f3d201..5302dd90a7a5f 100644 +--- a/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c ++++ b/drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c +@@ -291,19 +291,10 @@ out: + mutex_unlock(&ge_b850v3_lvds_dev_mutex); + } + +-static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, +- const struct i2c_device_id *id) ++static int ge_b850v3_register(void) + { ++ struct i2c_client *stdp4028_i2c = ge_b850v3_lvds_ptr->stdp4028_i2c; + struct device *dev = &stdp4028_i2c->dev; +- int ret; +- +- ret = ge_b850v3_lvds_init(dev); +- +- if (ret) +- return ret; +- +- ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c; +- i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); + + /* drm bridge initialization */ + ge_b850v3_lvds_ptr->bridge.funcs = &ge_b850v3_lvds_funcs; +@@ -325,6 +316,27 @@ static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, + "ge-b850v3-lvds-dp", ge_b850v3_lvds_ptr); + } + ++static int stdp4028_ge_b850v3_fw_probe(struct i2c_client *stdp4028_i2c, ++ const struct i2c_device_id *id) ++{ ++ struct device *dev = &stdp4028_i2c->dev; ++ int ret; ++ ++ ret = ge_b850v3_lvds_init(dev); ++ ++ if (ret) ++ return ret; ++ ++ ge_b850v3_lvds_ptr->stdp4028_i2c = stdp4028_i2c; ++ i2c_set_clientdata(stdp4028_i2c, ge_b850v3_lvds_ptr); ++ ++ /* Only register after both bridges are probed */ ++ if (!ge_b850v3_lvds_ptr->stdp2690_i2c) ++ return 0; ++ ++ return ge_b850v3_register(); ++} ++ + static int stdp4028_ge_b850v3_fw_remove(struct i2c_client *stdp4028_i2c) + { + ge_b850v3_lvds_remove(); +@@ -368,7 +380,11 @@ static int stdp2690_ge_b850v3_fw_probe(struct i2c_client *stdp2690_i2c, + ge_b850v3_lvds_ptr->stdp2690_i2c = stdp2690_i2c; + i2c_set_clientdata(stdp2690_i2c, ge_b850v3_lvds_ptr); + +- return 0; ++ /* Only register after both bridges are probed */ ++ if (!ge_b850v3_lvds_ptr->stdp4028_i2c) ++ return 0; ++ ++ return ge_b850v3_register(); + } + + static int stdp2690_ge_b850v3_fw_remove(struct i2c_client *stdp2690_i2c) +-- +2.34.1 + diff --git a/queue-5.4/drm-bridge-ti-sn65dsi86-set-max-register-for-regmap.patch b/queue-5.4/drm-bridge-ti-sn65dsi86-set-max-register-for-regmap.patch new file mode 100644 index 00000000000..e551c14d494 --- /dev/null +++ b/queue-5.4/drm-bridge-ti-sn65dsi86-set-max-register-for-regmap.patch @@ -0,0 +1,40 @@ +From 891b2c531926b42da913cdc5883e528002871845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 16:25:29 -0800 +Subject: drm/bridge: ti-sn65dsi86: Set max register for regmap + +From: Stephen Boyd + +[ Upstream commit 0b665d4af35837f0a0ae63135b84a3c187c1db3b ] + +Set the maximum register to 0xff so we can dump the registers for this +device in debugfs. + +Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") +Cc: Rob Clark +Cc: Douglas Anderson +Cc: Laurent Pinchart +Signed-off-by: Stephen Boyd +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20211215002529.382383-1-swboyd@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/ti-sn65dsi86.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/ti-sn65dsi86.c b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +index f1de4bb6558ca..dbb4a374cb646 100644 +--- a/drivers/gpu/drm/bridge/ti-sn65dsi86.c ++++ b/drivers/gpu/drm/bridge/ti-sn65dsi86.c +@@ -115,6 +115,7 @@ static const struct regmap_config ti_sn_bridge_regmap_config = { + .val_bits = 8, + .volatile_table = &ti_sn_bridge_volatile_table, + .cache_type = REGCACHE_NONE, ++ .max_register = 0xFF, + }; + + static void ti_sn_bridge_write_u16(struct ti_sn_bridge *pdata, +-- +2.34.1 + diff --git a/queue-5.4/drm-lima-fix-warning-when-config_debug_sg-y-config_d.patch b/queue-5.4/drm-lima-fix-warning-when-config_debug_sg-y-config_d.patch new file mode 100644 index 00000000000..4e7746a3e03 --- /dev/null +++ b/queue-5.4/drm-lima-fix-warning-when-config_debug_sg-y-config_d.patch @@ -0,0 +1,39 @@ +From 6f7e81a3c1aadd72675eb0c20f2d0289f35f7273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 Oct 2021 12:16:04 +0800 +Subject: drm/lima: fix warning when CONFIG_DEBUG_SG=y & CONFIG_DMA_API_DEBUG=y + +From: Qiang Yu + +[ Upstream commit 89636a06fa2ee7826a19c39c19a9bc99ab9340a9 ] + +Otherwise get following warning: + +DMA-API: lima 1c40000.gpu: mapping sg segment longer than device claims to support [len=4149248] [max=65536] + +See: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5496 + +Reviewed-by: Vasily Khoruzhick +Reported-by: Roman Stratiienko +Signed-off-by: Qiang Yu +Link: https://patchwork.freedesktop.org/patch/msgid/20211031041604.187216-1-yuq825@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/lima/lima_device.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/lima/lima_device.c b/drivers/gpu/drm/lima/lima_device.c +index d86b8d81a483a..155971c57b2d5 100644 +--- a/drivers/gpu/drm/lima/lima_device.c ++++ b/drivers/gpu/drm/lima/lima_device.c +@@ -293,6 +293,7 @@ int lima_device_init(struct lima_device *ldev) + struct resource *res; + + dma_set_coherent_mask(ldev->dev, DMA_BIT_MASK(32)); ++ dma_set_max_seg_size(ldev->dev, UINT_MAX); + + err = lima_clk_init(ldev); + if (err) +-- +2.34.1 + diff --git a/queue-5.4/drm-msm-dpu-fix-safe-status-debugfs-file.patch b/queue-5.4/drm-msm-dpu-fix-safe-status-debugfs-file.patch new file mode 100644 index 00000000000..dbe5b7b75a1 --- /dev/null +++ b/queue-5.4/drm-msm-dpu-fix-safe-status-debugfs-file.patch @@ -0,0 +1,41 @@ +From bf956ab1178c36c46dc6bbe4cf683ee0bef5f67d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 01:26:27 +0300 +Subject: drm/msm/dpu: fix safe status debugfs file + +From: Dmitry Baryshkov + +[ Upstream commit f31b0e24d31e18b4503eeaf0032baeacc0beaff6 ] + +Make safe_status debugfs fs file actually return safe status rather than +danger status data. + +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Link: https://lore.kernel.org/r/20211201222633.2476780-3-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +index 58b0485dc3750..72f487692adbb 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c +@@ -88,8 +88,8 @@ static int _dpu_danger_signal_status(struct seq_file *s, + &status); + } else { + seq_puts(s, "\nSafe signal status:\n"); +- if (kms->hw_mdp->ops.get_danger_status) +- kms->hw_mdp->ops.get_danger_status(kms->hw_mdp, ++ if (kms->hw_mdp->ops.get_safe_status) ++ kms->hw_mdp->ops.get_safe_status(kms->hw_mdp, + &status); + } + pm_runtime_put_sync(&kms->pdev->dev); +-- +2.34.1 + diff --git a/queue-5.4/drm-nouveau-pmu-gm200-avoid-touching-pmu-outside-of-.patch b/queue-5.4/drm-nouveau-pmu-gm200-avoid-touching-pmu-outside-of-.patch new file mode 100644 index 00000000000..f49aea7979d --- /dev/null +++ b/queue-5.4/drm-nouveau-pmu-gm200-avoid-touching-pmu-outside-of-.patch @@ -0,0 +1,104 @@ +From a1c3d8313eed6eb67e491d9390dac088d8e7b801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 19:29:52 +1000 +Subject: drm/nouveau/pmu/gm200-: avoid touching PMU outside of + DEVINIT/PREOS/ACR + +From: Ben Skeggs + +[ Upstream commit 1d2271d2fb85e54bfc9630a6c30ac0feb9ffb983 ] + +There have been reports of the WFI timing out on some boards, and a +patch was proposed to just remove it. This stuff is rather fragile, +and I believe the WFI might be needed with our FW prior to GM200. + +However, we probably should not be touching PMU during init on GPUs +where we depend on NVIDIA FW, outside of limited circumstances, so +this should be a somewhat safer change that achieves the desired +result. + +Reported-by: Diego Viola +Signed-off-by: Ben Skeggs +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/10 +Signed-off-by: Sasha Levin +--- + .../gpu/drm/nouveau/nvkm/subdev/pmu/base.c | 37 +++++++++++-------- + 1 file changed, 21 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c +index ea2e11771bca5..105b4be467a3e 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/base.c +@@ -88,20 +88,13 @@ nvkm_pmu_fini(struct nvkm_subdev *subdev, bool suspend) + return 0; + } + +-static int ++static void + nvkm_pmu_reset(struct nvkm_pmu *pmu) + { + struct nvkm_device *device = pmu->subdev.device; + + if (!pmu->func->enabled(pmu)) +- return 0; +- +- /* Inhibit interrupts, and wait for idle. */ +- nvkm_wr32(device, 0x10a014, 0x0000ffff); +- nvkm_msec(device, 2000, +- if (!nvkm_rd32(device, 0x10a04c)) +- break; +- ); ++ return; + + /* Reset. */ + if (pmu->func->reset) +@@ -112,25 +105,37 @@ nvkm_pmu_reset(struct nvkm_pmu *pmu) + if (!(nvkm_rd32(device, 0x10a10c) & 0x00000006)) + break; + ); +- +- return 0; + } + + static int + nvkm_pmu_preinit(struct nvkm_subdev *subdev) + { + struct nvkm_pmu *pmu = nvkm_pmu(subdev); +- return nvkm_pmu_reset(pmu); ++ nvkm_pmu_reset(pmu); ++ return 0; + } + + static int + nvkm_pmu_init(struct nvkm_subdev *subdev) + { + struct nvkm_pmu *pmu = nvkm_pmu(subdev); +- int ret = nvkm_pmu_reset(pmu); +- if (ret == 0 && pmu->func->init) +- ret = pmu->func->init(pmu); +- return ret; ++ struct nvkm_device *device = pmu->subdev.device; ++ ++ if (!pmu->func->init) ++ return 0; ++ ++ if (pmu->func->enabled(pmu)) { ++ /* Inhibit interrupts, and wait for idle. */ ++ nvkm_wr32(device, 0x10a014, 0x0000ffff); ++ nvkm_msec(device, 2000, ++ if (!nvkm_rd32(device, 0x10a04c)) ++ break; ++ ); ++ ++ nvkm_pmu_reset(pmu); ++ } ++ ++ return pmu->func->init(pmu); + } + + static int +-- +2.34.1 + diff --git a/queue-5.4/drm-panel-innolux-p079zca-delete-panel-on-attach-fai.patch b/queue-5.4/drm-panel-innolux-p079zca-delete-panel-on-attach-fai.patch new file mode 100644 index 00000000000..8a9b4e716fd --- /dev/null +++ b/queue-5.4/drm-panel-innolux-p079zca-delete-panel-on-attach-fai.patch @@ -0,0 +1,57 @@ +From 8fc1c4eb3906190d47b099b4248efec054b533a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 17:33:54 -0700 +Subject: drm/panel: innolux-p079zca: Delete panel on attach() failure + +From: Brian Norris + +[ Upstream commit 32a267e9c057e1636e7afdd20599aa5741a73079 ] + +If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't +ready), we leave a dangling drm_panel reference to freed memory. Clean +that up on failure. + +This problem exists since the driver's introduction, but is especially +relevant after refactored for dual-DSI variants. + +Fixes: 14c8f2e9f8ea ("drm/panel: add Innolux P079ZCA panel driver") +Fixes: 7ad4e4636c54 ("drm/panel: p079zca: Refactor panel driver to support multiple panels") +Signed-off-by: Brian Norris +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.2.I9023cf8811a3abf4964ed84eb681721d8bb489d6@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-innolux-p079zca.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-innolux-p079zca.c b/drivers/gpu/drm/panel/panel-innolux-p079zca.c +index d92d1c98878c1..df90b66079816 100644 +--- a/drivers/gpu/drm/panel/panel-innolux-p079zca.c ++++ b/drivers/gpu/drm/panel/panel-innolux-p079zca.c +@@ -509,6 +509,7 @@ static void innolux_panel_del(struct innolux_panel *innolux) + static int innolux_panel_probe(struct mipi_dsi_device *dsi) + { + const struct panel_desc *desc; ++ struct innolux_panel *innolux; + int err; + + desc = of_device_get_match_data(&dsi->dev); +@@ -520,7 +521,14 @@ static int innolux_panel_probe(struct mipi_dsi_device *dsi) + if (err < 0) + return err; + +- return mipi_dsi_attach(dsi); ++ err = mipi_dsi_attach(dsi); ++ if (err < 0) { ++ innolux = mipi_dsi_get_drvdata(dsi); ++ innolux_panel_del(innolux); ++ return err; ++ } ++ ++ return 0; + } + + static int innolux_panel_remove(struct mipi_dsi_device *dsi) +-- +2.34.1 + diff --git a/queue-5.4/drm-panel-kingdisplay-kd097d04-delete-panel-on-attac.patch b/queue-5.4/drm-panel-kingdisplay-kd097d04-delete-panel-on-attac.patch new file mode 100644 index 00000000000..99a96412e68 --- /dev/null +++ b/queue-5.4/drm-panel-kingdisplay-kd097d04-delete-panel-on-attac.patch @@ -0,0 +1,44 @@ +From 319737f5598f3b7f2046271f4a771e62df3eb11c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 17:33:53 -0700 +Subject: drm/panel: kingdisplay-kd097d04: Delete panel on attach() failure + +From: Brian Norris + +[ Upstream commit 5f31dbeae8a88f31c3eb4eb526ab4807c40da241 ] + +If we fail to attach (e.g., because 1 of 2 dual-DSI controllers aren't +ready), we leave a dangling drm_panel reference to freed memory. Clean +that up on failure. + +Fixes: 2a994cbed6b2 ("drm/panel: Add Kingdisplay KD097D04 panel driver") +Signed-off-by: Brian Norris +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20210923173336.1.Icb4d9dbc1817f4e826361a4f1cea7461541668f0@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c +index 3ac04eb8d0fe5..1e7fecab72a9f 100644 +--- a/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c ++++ b/drivers/gpu/drm/panel/panel-kingdisplay-kd097d04.c +@@ -424,7 +424,13 @@ static int kingdisplay_panel_probe(struct mipi_dsi_device *dsi) + if (err < 0) + return err; + +- return mipi_dsi_attach(dsi); ++ err = mipi_dsi_attach(dsi); ++ if (err < 0) { ++ kingdisplay_panel_del(kingdisplay); ++ return err; ++ } ++ ++ return 0; + } + + static int kingdisplay_panel_remove(struct mipi_dsi_device *dsi) +-- +2.34.1 + diff --git a/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-the-lenov.patch b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-the-lenov.patch new file mode 100644 index 00000000000..76b828f740b --- /dev/null +++ b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-the-lenov.patch @@ -0,0 +1,43 @@ +From a27716af85b0ed2e604740c545e415afd12cac84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 14:02:27 +0100 +Subject: drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book + X91F/L + +From: Hans de Goede + +[ Upstream commit bc30c3b0c8a1904d83d5f0d60fb8650a334b207b ] + +The Lenovo Yoga Book X91F/L uses a panel which has been mounted +90 degrees rotated. Add a quirk for this. + +Cc: Yauhen Kharuzhy +Signed-off-by: Hans de Goede +Acked-by: Simon Ser +Tested-by: Yauhen Kharuzhy +Link: https://patchwork.freedesktop.org/patch/msgid/20211106130227.11927-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index a950d5db211c5..9d1bd8f491ad7 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -248,6 +248,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, ++ }, { /* Lenovo Yoga Book X90F / X91F / X91L */ ++ .matches = { ++ /* Non exact match to match all versions */ ++ DMI_MATCH(DMI_PRODUCT_NAME, "Lenovo YB1-X9"), ++ }, ++ .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* OneGX1 Pro */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"), +-- +2.34.1 + diff --git a/queue-5.4/drm-radeon-radeon_kms-fix-a-null-pointer-dereference.patch b/queue-5.4/drm-radeon-radeon_kms-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..9215f16442a --- /dev/null +++ b/queue-5.4/drm-radeon-radeon_kms-fix-a-null-pointer-dereference.patch @@ -0,0 +1,122 @@ +From 994dafe7272e71959f945a9bd197d3dd043dba80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 23:13:10 +0800 +Subject: drm/radeon/radeon_kms: Fix a NULL pointer dereference in + radeon_driver_open_kms() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhou Qingyang + +[ Upstream commit ab50cb9df8896b39aae65c537a30de2c79c19735 ] + +In radeon_driver_open_kms(), radeon_vm_bo_add() is assigned to +vm->ib_bo_va and passes and used in radeon_vm_bo_set_addr(). In +radeon_vm_bo_set_addr(), there is a dereference of vm->ib_bo_va, +which could lead to a NULL pointer dereference on failure of +radeon_vm_bo_add(). + +Fix this bug by adding a check of vm->ib_bo_va. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_DRM_RADEON=m show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: cc9e67e3d700 ("drm/radeon: fix VM IB handling") +Reviewed-by: Christian König +Signed-off-by: Zhou Qingyang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_kms.c | 36 ++++++++++++++++------------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c +index 03d3550ecc7cb..5d04dd744af3d 100644 +--- a/drivers/gpu/drm/radeon/radeon_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_kms.c +@@ -634,6 +634,8 @@ void radeon_driver_lastclose_kms(struct drm_device *dev) + int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + { + struct radeon_device *rdev = dev->dev_private; ++ struct radeon_fpriv *fpriv; ++ struct radeon_vm *vm; + int r; + + file_priv->driver_priv = NULL; +@@ -646,8 +648,6 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + + /* new gpu have virtual address space support */ + if (rdev->family >= CHIP_CAYMAN) { +- struct radeon_fpriv *fpriv; +- struct radeon_vm *vm; + + fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL); + if (unlikely(!fpriv)) { +@@ -658,35 +658,39 @@ int radeon_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + if (rdev->accel_working) { + vm = &fpriv->vm; + r = radeon_vm_init(rdev, vm); +- if (r) { +- kfree(fpriv); +- goto out_suspend; +- } ++ if (r) ++ goto out_fpriv; + + r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false); +- if (r) { +- radeon_vm_fini(rdev, vm); +- kfree(fpriv); +- goto out_suspend; +- } ++ if (r) ++ goto out_vm_fini; + + /* map the ib pool buffer read only into + * virtual address space */ + vm->ib_bo_va = radeon_vm_bo_add(rdev, vm, + rdev->ring_tmp_bo.bo); ++ if (!vm->ib_bo_va) { ++ r = -ENOMEM; ++ goto out_vm_fini; ++ } ++ + r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va, + RADEON_VA_IB_OFFSET, + RADEON_VM_PAGE_READABLE | + RADEON_VM_PAGE_SNOOPED); +- if (r) { +- radeon_vm_fini(rdev, vm); +- kfree(fpriv); +- goto out_suspend; +- } ++ if (r) ++ goto out_vm_fini; + } + file_priv->driver_priv = fpriv; + } + ++ if (!r) ++ goto out_suspend; ++ ++out_vm_fini: ++ radeon_vm_fini(rdev, vm); ++out_fpriv: ++ kfree(fpriv); + out_suspend: + pm_runtime_mark_last_busy(dev->dev); + pm_runtime_put_autosuspend(dev->dev); +-- +2.34.1 + diff --git a/queue-5.4/drm-rockchip-dsi-fix-unbalanced-clock-on-probe-error.patch b/queue-5.4/drm-rockchip-dsi-fix-unbalanced-clock-on-probe-error.patch new file mode 100644 index 00000000000..dd1caf48019 --- /dev/null +++ b/queue-5.4/drm-rockchip-dsi-fix-unbalanced-clock-on-probe-error.patch @@ -0,0 +1,51 @@ +From 6416259ad3a49cdf230687b8388d2e898fd10d9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 14:35:51 -0700 +Subject: drm/rockchip: dsi: Fix unbalanced clock on probe error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Brian Norris + +[ Upstream commit 251888398753924059f3bb247a44153a2853137f ] + +Our probe() function never enabled this clock, so we shouldn't disable +it if we fail to probe the bridge. + +Noted by inspection. + +Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver") +Signed-off-by: Brian Norris +Reviewed-by: Chen-Yu Tsai +Tested-by: Nícolas F. R. A. Prado +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20210928143413.v3.3.Ie8ceefb51ab6065a1151869b6fcda41a467d4d2c@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +index 8dc91c2d916a8..5f05a8e660287 100644 +--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c ++++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +@@ -986,14 +986,10 @@ static int dw_mipi_dsi_rockchip_probe(struct platform_device *pdev) + if (ret != -EPROBE_DEFER) + DRM_DEV_ERROR(dev, + "Failed to probe dw_mipi_dsi: %d\n", ret); +- goto err_clkdisable; ++ return ret; + } + + return 0; +- +-err_clkdisable: +- clk_disable_unprepare(dsi->pllref_clk); +- return ret; + } + + static int dw_mipi_dsi_rockchip_remove(struct platform_device *pdev) +-- +2.34.1 + diff --git a/queue-5.4/edac-synopsys-use-the-quirk-for-version-instead-of-d.patch b/queue-5.4/edac-synopsys-use-the-quirk-for-version-instead-of-d.patch new file mode 100644 index 00000000000..f414adc028e --- /dev/null +++ b/queue-5.4/edac-synopsys-use-the-quirk-for-version-instead-of-d.patch @@ -0,0 +1,38 @@ +From 0327d91362fccb0077c3dc45624875b1301f2d9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 14:07:06 -0500 +Subject: EDAC/synopsys: Use the quirk for version instead of ddr version + +From: Dinh Nguyen + +[ Upstream commit bd1d6da17c296bd005bfa656952710d256e77dd3 ] + +Version 2.40a supports DDR_ECC_INTR_SUPPORT for a quirk, so use that +quirk to determine a call to setup_address_map(). + +Signed-off-by: Dinh Nguyen +Signed-off-by: Borislav Petkov +Reviewed-by: Michal Simek +Link: https://lkml.kernel.org/r/20211012190709.1504152-1-dinguyen@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/synopsys_edac.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c +index 6becf3363ad57..d23a0782fb49c 100644 +--- a/drivers/edac/synopsys_edac.c ++++ b/drivers/edac/synopsys_edac.c +@@ -1351,8 +1351,7 @@ static int mc_probe(struct platform_device *pdev) + } + } + +- if (of_device_is_compatible(pdev->dev.of_node, +- "xlnx,zynqmp-ddrc-2.40a")) ++ if (priv->p_data->quirks & DDR_ECC_INTR_SUPPORT) + setup_address_map(priv); + #endif + +-- +2.34.1 + diff --git a/queue-5.4/ext4-avoid-trim-error-on-fs-with-small-groups.patch b/queue-5.4/ext4-avoid-trim-error-on-fs-with-small-groups.patch new file mode 100644 index 00000000000..f645c9579f5 --- /dev/null +++ b/queue-5.4/ext4-avoid-trim-error-on-fs-with-small-groups.patch @@ -0,0 +1,72 @@ +From 90f62be461fb0d75b56e758bff144f73acd7afcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 16:22:02 +0100 +Subject: ext4: avoid trim error on fs with small groups + +From: Jan Kara + +[ Upstream commit 173b6e383d2a204c9921ffc1eca3b87aa2106c33 ] + +A user reported FITRIM ioctl failing for him on ext4 on some devices +without apparent reason. After some debugging we've found out that +these devices (being LVM volumes) report rather large discard +granularity of 42MB and the filesystem had 1k blocksize and thus group +size of 8MB. Because ext4 FITRIM implementation puts discard +granularity into minlen, ext4_trim_fs() declared the trim request as +invalid. However just silently doing nothing seems to be a more +appropriate reaction to such combination of parameters since user did +not specify anything wrong. + +CC: Lukas Czerner +Fixes: 5c2ed62fd447 ("ext4: Adjust minlen with discard_granularity in the FITRIM ioctl") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20211112152202.26614-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ioctl.c | 2 -- + fs/ext4/mballoc.c | 8 ++++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index ba13fbb443d58..9fa20f9ba52b5 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -1120,8 +1120,6 @@ resizefs_out: + sizeof(range))) + return -EFAULT; + +- range.minlen = max((unsigned int)range.minlen, +- q->limits.discard_granularity); + ret = ext4_trim_fs(sb, &range); + if (ret < 0) + return ret; +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index b67ea979f0cf7..0307702d114db 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -5270,6 +5270,7 @@ out: + */ + int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) + { ++ struct request_queue *q = bdev_get_queue(sb->s_bdev); + struct ext4_group_info *grp; + ext4_group_t group, first_group, last_group; + ext4_grpblk_t cnt = 0, first_cluster, last_cluster; +@@ -5288,6 +5289,13 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) + start >= max_blks || + range->len < sb->s_blocksize) + return -EINVAL; ++ /* No point to try to trim less than discard granularity */ ++ if (range->minlen < q->limits.discard_granularity) { ++ minlen = EXT4_NUM_B2C(EXT4_SB(sb), ++ q->limits.discard_granularity >> sb->s_blocksize_bits); ++ if (minlen > EXT4_CLUSTERS_PER_GROUP(sb)) ++ goto out; ++ } + if (end >= max_blks) + end = max_blks - 1; + if (end <= first_data_blk) +-- +2.34.1 + diff --git a/queue-5.4/floppy-add-max-size-check-for-user-space-request.patch b/queue-5.4/floppy-add-max-size-check-for-user-space-request.patch new file mode 100644 index 00000000000..0afd862b747 --- /dev/null +++ b/queue-5.4/floppy-add-max-size-check-for-user-space-request.patch @@ -0,0 +1,82 @@ +From b6b3f61c8abef9073f444943a7c10a3909872319 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 21:10:33 +0800 +Subject: floppy: Add max size check for user space request + +From: Xiongwei Song + +[ Upstream commit 545a32498c536ee152331cd2e7d2416aa0f20e01 ] + +We need to check the max request size that is from user space before +allocating pages. If the request size exceeds the limit, return -EINVAL. +This check can avoid the warning below from page allocator. + +WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 current_gfp_context include/linux/sched/mm.h:195 [inline] +WARNING: CPU: 3 PID: 16525 at mm/page_alloc.c:5344 __alloc_pages+0x45d/0x500 mm/page_alloc.c:5356 +Modules linked in: +CPU: 3 PID: 16525 Comm: syz-executor.3 Not tainted 5.15.0-syzkaller #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 +RIP: 0010:__alloc_pages+0x45d/0x500 mm/page_alloc.c:5344 +Code: be c9 00 00 00 48 c7 c7 20 4a 97 89 c6 05 62 32 a7 0b 01 e8 74 9a 42 07 e9 6a ff ff ff 0f 0b e9 a0 fd ff ff 40 80 e5 3f eb 88 <0f> 0b e9 18 ff ff ff 4c 89 ef 44 89 e6 45 31 ed e8 1e 76 ff ff e9 +RSP: 0018:ffffc90023b87850 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: 1ffff92004770f0b RCX: dffffc0000000000 +RDX: 0000000000000000 RSI: 0000000000000033 RDI: 0000000000010cc1 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 +R10: ffffffff81bb4686 R11: 0000000000000001 R12: ffffffff902c1960 +R13: 0000000000000033 R14: 0000000000000000 R15: ffff88804cf64a30 +FS: 0000000000000000(0000) GS:ffff88802cd00000(0063) knlGS:00000000f44b4b40 +CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 +CR2: 000000002c921000 CR3: 000000004f507000 CR4: 0000000000150ee0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + alloc_pages+0x1a7/0x300 mm/mempolicy.c:2191 + __get_free_pages+0x8/0x40 mm/page_alloc.c:5418 + raw_cmd_copyin drivers/block/floppy.c:3113 [inline] + raw_cmd_ioctl drivers/block/floppy.c:3160 [inline] + fd_locked_ioctl+0x12e5/0x2820 drivers/block/floppy.c:3528 + fd_ioctl drivers/block/floppy.c:3555 [inline] + fd_compat_ioctl+0x891/0x1b60 drivers/block/floppy.c:3869 + compat_blkdev_ioctl+0x3b8/0x810 block/ioctl.c:662 + __do_compat_sys_ioctl+0x1c7/0x290 fs/ioctl.c:972 + do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] + __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 + do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c + +Reported-by: syzbot+23a02c7df2cf2bc93fa2@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20211116131033.27685-1-sxwjean@me.com +Signed-off-by: Xiongwei Song +Signed-off-by: Denis Efremov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/floppy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index 212a1e1ce0d9e..02af4f109e59f 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -3112,6 +3112,8 @@ static void raw_cmd_free(struct floppy_raw_cmd **ptr) + } + } + ++#define MAX_LEN (1UL << MAX_ORDER << PAGE_SHIFT) ++ + static int raw_cmd_copyin(int cmd, void __user *param, + struct floppy_raw_cmd **rcmd) + { +@@ -3149,7 +3151,7 @@ loop: + ptr->resultcode = 0; + + if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { +- if (ptr->length <= 0) ++ if (ptr->length <= 0 || ptr->length >= MAX_LEN) + return -EINVAL; + ptr->kernel_data = (char *)fd_dma_mem_alloc(ptr->length); + fallback_on_nodma_alloc(&ptr->kernel_data, ptr->length); +-- +2.34.1 + diff --git a/queue-5.4/floppy-fix-hang-in-watchdog-when-disk-is-ejected.patch b/queue-5.4/floppy-fix-hang-in-watchdog-when-disk-is-ejected.patch new file mode 100644 index 00000000000..ac08d963b30 --- /dev/null +++ b/queue-5.4/floppy-fix-hang-in-watchdog-when-disk-is-ejected.patch @@ -0,0 +1,52 @@ +From e1f35bee7a18c8949a76ecd5769c9563566e89a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Sep 2021 09:47:58 +0300 +Subject: floppy: Fix hang in watchdog when disk is ejected + +From: Tasos Sahanidis + +[ Upstream commit fb48febce7e30baed94dd791e19521abd2c3fd83 ] + +When the watchdog detects a disk change, it calls cancel_activity(), +which in turn tries to cancel the fd_timer delayed work. + +In the above scenario, fd_timer_fn is set to fd_watchdog(), meaning +it is trying to cancel its own work. +This results in a hang as cancel_delayed_work_sync() is waiting for the +watchdog (itself) to return, which never happens. + +This can be reproduced relatively consistently by attempting to read a +broken floppy, and ejecting it while IO is being attempted and retried. + +To resolve this, this patch calls cancel_delayed_work() instead, which +cancels the work without waiting for the watchdog to return and finish. + +Before this regression was introduced, the code in this section used +del_timer(), and not del_timer_sync() to delete the watchdog timer. + +Link: https://lore.kernel.org/r/399e486c-6540-db27-76aa-7a271b061f76@tasossah.com +Fixes: 070ad7e793dc ("floppy: convert to delayed work and single-thread wq") +Signed-off-by: Tasos Sahanidis +Signed-off-by: Denis Efremov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/floppy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index ac97a1e2e5ddc..212a1e1ce0d9e 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -1003,7 +1003,7 @@ static DECLARE_DELAYED_WORK(fd_timer, fd_timer_workfn); + static void cancel_activity(void) + { + do_floppy = NULL; +- cancel_delayed_work_sync(&fd_timer); ++ cancel_delayed_work(&fd_timer); + cancel_work_sync(&floppy_work); + } + +-- +2.34.1 + diff --git a/queue-5.4/fs-dlm-filter-user-dlm-messages-for-kernel-locks.patch b/queue-5.4/fs-dlm-filter-user-dlm-messages-for-kernel-locks.patch new file mode 100644 index 00000000000..310add4a9cf --- /dev/null +++ b/queue-5.4/fs-dlm-filter-user-dlm-messages-for-kernel-locks.patch @@ -0,0 +1,118 @@ +From c21bc41c1a4aad12b808586f3247e148b9e532fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Nov 2021 15:17:24 -0400 +Subject: fs: dlm: filter user dlm messages for kernel locks + +From: Alexander Aring + +[ Upstream commit 6c2e3bf68f3e5e5a647aa52be246d5f552d7496d ] + +This patch fixes the following crash by receiving a invalid message: + +[ 160.672220] ================================================================== +[ 160.676206] BUG: KASAN: user-memory-access in dlm_user_add_ast+0xc3/0x370 +[ 160.679659] Read of size 8 at addr 00000000deadbeef by task kworker/u32:13/319 +[ 160.681447] +[ 160.681824] CPU: 10 PID: 319 Comm: kworker/u32:13 Not tainted 5.14.0-rc2+ #399 +[ 160.683472] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.14.0-1.module+el8.6.0+12648+6ede71a5 04/01/2014 +[ 160.685574] Workqueue: dlm_recv process_recv_sockets +[ 160.686721] Call Trace: +[ 160.687310] dump_stack_lvl+0x56/0x6f +[ 160.688169] ? dlm_user_add_ast+0xc3/0x370 +[ 160.689116] kasan_report.cold.14+0x116/0x11b +[ 160.690138] ? dlm_user_add_ast+0xc3/0x370 +[ 160.690832] dlm_user_add_ast+0xc3/0x370 +[ 160.691502] _receive_unlock_reply+0x103/0x170 +[ 160.692241] _receive_message+0x11df/0x1ec0 +[ 160.692926] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 160.693700] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 160.694427] ? lock_acquire+0x175/0x400 +[ 160.695058] ? do_purge.isra.51+0x200/0x200 +[ 160.695744] ? lock_acquired+0x360/0x5d0 +[ 160.696400] ? lock_contended+0x6a0/0x6a0 +[ 160.697055] ? lock_release+0x21d/0x5e0 +[ 160.697686] ? lock_is_held_type+0xe0/0x110 +[ 160.698352] ? lock_is_held_type+0xe0/0x110 +[ 160.699026] ? ___might_sleep+0x1cc/0x1e0 +[ 160.699698] ? dlm_wait_requestqueue+0x94/0x140 +[ 160.700451] ? dlm_process_requestqueue+0x240/0x240 +[ 160.701249] ? down_write_killable+0x2b0/0x2b0 +[ 160.701988] ? do_raw_spin_unlock+0xa2/0x130 +[ 160.702690] dlm_receive_buffer+0x1a5/0x210 +[ 160.703385] dlm_process_incoming_buffer+0x726/0x9f0 +[ 160.704210] receive_from_sock+0x1c0/0x3b0 +[ 160.704886] ? dlm_tcp_shutdown+0x30/0x30 +[ 160.705561] ? lock_acquire+0x175/0x400 +[ 160.706197] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 160.706941] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 160.707681] process_recv_sockets+0x32/0x40 +[ 160.708366] process_one_work+0x55e/0xad0 +[ 160.709045] ? pwq_dec_nr_in_flight+0x110/0x110 +[ 160.709820] worker_thread+0x65/0x5e0 +[ 160.710423] ? process_one_work+0xad0/0xad0 +[ 160.711087] kthread+0x1ed/0x220 +[ 160.711628] ? set_kthread_struct+0x80/0x80 +[ 160.712314] ret_from_fork+0x22/0x30 + +The issue is that we received a DLM message for a user lock but the +destination lock is a kernel lock. Note that the address which is trying +to derefence is 00000000deadbeef, which is in a kernel lock +lkb->lkb_astparam, this field should never be derefenced by the DLM +kernel stack. In case of a user lock lkb->lkb_astparam is lkb->lkb_ua +(memory is shared by a union field). The struct lkb_ua will be handled +by the DLM kernel stack but on a kernel lock it will contain invalid +data and ends in most likely crashing the kernel. + +It can be reproduced with two cluster nodes. + +node 2: +dlm_tool join test +echo "862 fooobaar 1 2 1" > /sys/kernel/debug/dlm/test_locks +echo "862 3 1" > /sys/kernel/debug/dlm/test_waiters + +node 1: +dlm_tool join test + +python: +foo = DLM(h_cmd=3, o_nextcmd=1, h_nodeid=1, h_lockspace=0x77222027, \ + m_type=7, m_flags=0x1, m_remid=0x862, m_result=0xFFFEFFFE) +newFile = open("/sys/kernel/debug/dlm/comms/2/rawmsg", "wb") +newFile.write(bytes(foo)) + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lock.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c +index 18d81599522f3..53500b555bfa8 100644 +--- a/fs/dlm/lock.c ++++ b/fs/dlm/lock.c +@@ -3975,6 +3975,14 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms) + int from = ms->m_header.h_nodeid; + int error = 0; + ++ /* currently mixing of user/kernel locks are not supported */ ++ if (ms->m_flags & DLM_IFL_USER && ~lkb->lkb_flags & DLM_IFL_USER) { ++ log_error(lkb->lkb_resource->res_ls, ++ "got user dlm message for a kernel lock"); ++ error = -EINVAL; ++ goto out; ++ } ++ + switch (ms->m_type) { + case DLM_MSG_CONVERT: + case DLM_MSG_UNLOCK: +@@ -4003,6 +4011,7 @@ static int validate_message(struct dlm_lkb *lkb, struct dlm_message *ms) + error = -EINVAL; + } + ++out: + if (error) + log_error(lkb->lkb_resource->res_ls, + "ignore invalid message %d from %d %x %x %x %d", +-- +2.34.1 + diff --git a/queue-5.4/fsl-fman-check-for-null-pointer-after-calling-devm_i.patch b/queue-5.4/fsl-fman-check-for-null-pointer-after-calling-devm_i.patch new file mode 100644 index 00000000000..27c2d67fe44 --- /dev/null +++ b/queue-5.4/fsl-fman-check-for-null-pointer-after-calling-devm_i.patch @@ -0,0 +1,96 @@ +From 847e83661dccc45646cee98a6d40b69ac8e7752f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 18:04:10 +0800 +Subject: fsl/fman: Check for null pointer after calling devm_ioremap + +From: Jiasheng Jiang + +[ Upstream commit d5a73ec96cc57cf67e51b12820fc2354e7ca46f8 ] + +As the possible failure of the allocation, the devm_ioremap() may return +NULL pointer. +Take tgec_initialization() as an example. +If allocation fails, the params->base_addr will be NULL pointer and will +be assigned to tgec->regs in tgec_config(). +Then it will cause the dereference of NULL pointer in set_mac_address(), +which is called by tgec_init(). +Therefore, it should be better to add the sanity check after the calling +of the devm_ioremap(). + +Fixes: 3933961682a3 ("fsl/fman: Add FMan MAC driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fman/mac.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fman/mac.c b/drivers/net/ethernet/freescale/fman/mac.c +index 7ab8095db1928..147126e79986c 100644 +--- a/drivers/net/ethernet/freescale/fman/mac.c ++++ b/drivers/net/ethernet/freescale/fman/mac.c +@@ -94,14 +94,17 @@ static void mac_exception(void *handle, enum fman_mac_exceptions ex) + __func__, ex); + } + +-static void set_fman_mac_params(struct mac_device *mac_dev, +- struct fman_mac_params *params) ++static int set_fman_mac_params(struct mac_device *mac_dev, ++ struct fman_mac_params *params) + { + struct mac_priv_s *priv = mac_dev->priv; + + params->base_addr = (typeof(params->base_addr)) + devm_ioremap(priv->dev, mac_dev->res->start, + resource_size(mac_dev->res)); ++ if (!params->base_addr) ++ return -ENOMEM; ++ + memcpy(¶ms->addr, mac_dev->addr, sizeof(mac_dev->addr)); + params->max_speed = priv->max_speed; + params->phy_if = mac_dev->phy_if; +@@ -112,6 +115,8 @@ static void set_fman_mac_params(struct mac_device *mac_dev, + params->event_cb = mac_exception; + params->dev_id = mac_dev; + params->internal_phy_node = priv->internal_phy_node; ++ ++ return 0; + } + + static int tgec_initialization(struct mac_device *mac_dev) +@@ -123,7 +128,9 @@ static int tgec_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + mac_dev->fman_mac = tgec_config(¶ms); + if (!mac_dev->fman_mac) { +@@ -169,7 +176,9 @@ static int dtsec_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + mac_dev->fman_mac = dtsec_config(¶ms); + if (!mac_dev->fman_mac) { +@@ -218,7 +227,9 @@ static int memac_initialization(struct mac_device *mac_dev) + + priv = mac_dev->priv; + +- set_fman_mac_params(mac_dev, ¶ms); ++ err = set_fman_mac_params(mac_dev, ¶ms); ++ if (err) ++ goto _return; + + if (priv->max_speed == SPEED_10000) + params.phy_if = PHY_INTERFACE_MODE_XGMII; +-- +2.34.1 + diff --git a/queue-5.4/gpio-aspeed-convert-aspeed_gpio.lock-to-raw_spinlock.patch b/queue-5.4/gpio-aspeed-convert-aspeed_gpio.lock-to-raw_spinlock.patch new file mode 100644 index 00000000000..7701ce5a6e7 --- /dev/null +++ b/queue-5.4/gpio-aspeed-convert-aspeed_gpio.lock-to-raw_spinlock.patch @@ -0,0 +1,258 @@ +From 4593470206f24329ca5544ab4629351afca0da9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Dec 2021 18:10:26 +0100 +Subject: gpio: aspeed: Convert aspeed_gpio.lock to raw_spinlock + +From: Iwona Winiarska + +[ Upstream commit 61a7904b6ace99b1bde0d0e867fa3097f5c8cee2 ] + +The gpio-aspeed driver implements an irq_chip which need to be invoked +from hardirq context. Since spin_lock() can sleep with PREEMPT_RT, it is +no longer legal to invoke it while interrupts are disabled. +This also causes lockdep to complain about: +[ 0.649797] [ BUG: Invalid wait context ] +because aspeed_gpio.lock (spin_lock_t) is taken under irq_desc.lock +(raw_spinlock_t). +Let's use of raw_spinlock_t instead of spinlock_t. + +Signed-off-by: Iwona Winiarska +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed.c | 52 +++++++++++++++++++------------------- + 1 file changed, 26 insertions(+), 26 deletions(-) + +diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c +index 2820c59b5f071..22e0d6fcab1c4 100644 +--- a/drivers/gpio/gpio-aspeed.c ++++ b/drivers/gpio/gpio-aspeed.c +@@ -53,7 +53,7 @@ struct aspeed_gpio_config { + struct aspeed_gpio { + struct gpio_chip chip; + struct irq_chip irqc; +- spinlock_t lock; ++ raw_spinlock_t lock; + void __iomem *base; + int irq; + const struct aspeed_gpio_config *config; +@@ -413,14 +413,14 @@ static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset, + unsigned long flags; + bool copro; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + copro = aspeed_gpio_copro_request(gpio, offset); + + __aspeed_gpio_set(gc, offset, val); + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + } + + static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) +@@ -435,7 +435,7 @@ static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) + if (!have_input(gpio, offset)) + return -ENOTSUPP; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + reg = ioread32(addr); + reg &= ~GPIO_BIT(offset); +@@ -445,7 +445,7 @@ static int aspeed_gpio_dir_in(struct gpio_chip *gc, unsigned int offset) + if (copro) + aspeed_gpio_copro_release(gpio, offset); + +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return 0; + } +@@ -463,7 +463,7 @@ static int aspeed_gpio_dir_out(struct gpio_chip *gc, + if (!have_output(gpio, offset)) + return -ENOTSUPP; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + reg = ioread32(addr); + reg |= GPIO_BIT(offset); +@@ -474,7 +474,7 @@ static int aspeed_gpio_dir_out(struct gpio_chip *gc, + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return 0; + } +@@ -492,11 +492,11 @@ static int aspeed_gpio_get_direction(struct gpio_chip *gc, unsigned int offset) + if (!have_output(gpio, offset)) + return 1; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + val = ioread32(bank_reg(gpio, bank, reg_dir)) & GPIO_BIT(offset); + +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return !val; + +@@ -540,14 +540,14 @@ static void aspeed_gpio_irq_ack(struct irq_data *d) + + status_addr = bank_reg(gpio, bank, reg_irq_status); + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + copro = aspeed_gpio_copro_request(gpio, offset); + + iowrite32(bit, status_addr); + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + } + + static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) +@@ -566,7 +566,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) + + addr = bank_reg(gpio, bank, reg_irq_enable); + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + copro = aspeed_gpio_copro_request(gpio, offset); + + reg = ioread32(addr); +@@ -578,7 +578,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + } + + static void aspeed_gpio_irq_mask(struct irq_data *d) +@@ -630,7 +630,7 @@ static int aspeed_gpio_set_type(struct irq_data *d, unsigned int type) + return -EINVAL; + } + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + copro = aspeed_gpio_copro_request(gpio, offset); + + addr = bank_reg(gpio, bank, reg_irq_type0); +@@ -650,7 +650,7 @@ static int aspeed_gpio_set_type(struct irq_data *d, unsigned int type) + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + irq_set_handler_locked(d, handler); + +@@ -720,7 +720,7 @@ static int aspeed_gpio_reset_tolerance(struct gpio_chip *chip, + + treg = bank_reg(gpio, to_bank(offset), reg_tolerance); + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + copro = aspeed_gpio_copro_request(gpio, offset); + + val = readl(treg); +@@ -734,7 +734,7 @@ static int aspeed_gpio_reset_tolerance(struct gpio_chip *chip, + + if (copro) + aspeed_gpio_copro_release(gpio, offset); +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return 0; + } +@@ -860,7 +860,7 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset, + return rc; + } + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + if (timer_allocation_registered(gpio, offset)) { + rc = unregister_allocated_timer(gpio, offset); +@@ -920,7 +920,7 @@ static int enable_debounce(struct gpio_chip *chip, unsigned int offset, + configure_timer(gpio, offset, i); + + out: +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return rc; + } +@@ -931,13 +931,13 @@ static int disable_debounce(struct gpio_chip *chip, unsigned int offset) + unsigned long flags; + int rc; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + rc = unregister_allocated_timer(gpio, offset); + if (!rc) + configure_timer(gpio, offset, 0); + +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + + return rc; + } +@@ -1019,7 +1019,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc, + return -EINVAL; + bindex = offset >> 3; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + /* Sanity check, this shouldn't happen */ + if (gpio->cf_copro_bankmap[bindex] == 0xff) { +@@ -1040,7 +1040,7 @@ int aspeed_gpio_copro_grab_gpio(struct gpio_desc *desc, + if (bit) + *bit = GPIO_OFFSET(offset); + bail: +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + return rc; + } + EXPORT_SYMBOL_GPL(aspeed_gpio_copro_grab_gpio); +@@ -1064,7 +1064,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc) + return -EINVAL; + bindex = offset >> 3; + +- spin_lock_irqsave(&gpio->lock, flags); ++ raw_spin_lock_irqsave(&gpio->lock, flags); + + /* Sanity check, this shouldn't happen */ + if (gpio->cf_copro_bankmap[bindex] == 0) { +@@ -1078,7 +1078,7 @@ int aspeed_gpio_copro_release_gpio(struct gpio_desc *desc) + aspeed_gpio_change_cmd_source(gpio, bank, bindex, + GPIO_CMDSRC_ARM); + bail: +- spin_unlock_irqrestore(&gpio->lock, flags); ++ raw_spin_unlock_irqrestore(&gpio->lock, flags); + return rc; + } + EXPORT_SYMBOL_GPL(aspeed_gpio_copro_release_gpio); +@@ -1151,7 +1151,7 @@ static int __init aspeed_gpio_probe(struct platform_device *pdev) + if (IS_ERR(gpio->base)) + return PTR_ERR(gpio->base); + +- spin_lock_init(&gpio->lock); ++ raw_spin_lock_init(&gpio->lock); + + gpio_id = of_match_node(aspeed_gpio_of_table, pdev->dev.of_node); + if (!gpio_id) +-- +2.34.1 + diff --git a/queue-5.4/gpiolib-acpi-do-not-set-the-irq-type-if-the-irq-is-a.patch b/queue-5.4/gpiolib-acpi-do-not-set-the-irq-type-if-the-irq-is-a.patch new file mode 100644 index 00000000000..0c30b6d81be --- /dev/null +++ b/queue-5.4/gpiolib-acpi-do-not-set-the-irq-type-if-the-irq-is-a.patch @@ -0,0 +1,61 @@ +From aa19ae298836053fed33980f64b742430b89b2ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 21:30:10 +0100 +Subject: gpiolib: acpi: Do not set the IRQ type if the IRQ is already in use + +From: Hans de Goede + +[ Upstream commit bdfd6ab8fdccd8b138837efff66f4a1911496378 ] + +If the IRQ is already in use, then acpi_dev_gpio_irq_get_by() really +should not change the type underneath the current owner. + +I specifically hit an issue with this an a Chuwi Hi8 Super (CWI509) Bay +Trail tablet, when the Boot OS selection in the BIOS is set to Android. +In this case _STA for a MAX17047 ACPI I2C device wrongly returns 0xf and +the _CRS resources for this device include a GpioInt pointing to a GPIO +already in use by an _AEI handler, with a different type then specified +in the _CRS for the MAX17047 device. Leading to the acpi_dev_gpio_irq_get() +call done by the i2c-core-acpi.c code changing the type breaking the +_AEI handler. + +Now this clearly is a bug in the DSDT of this tablet (in Android mode), +but in general calling irq_set_irq_type() on an IRQ which already is +in use seems like a bad idea. + +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index e3ddc99c105d4..13c6eee481da7 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -953,10 +953,17 @@ int acpi_dev_gpio_irq_get(struct acpi_device *adev, int index) + irq_flags = acpi_dev_get_irq_type(info.triggering, + info.polarity); + +- /* Set type if specified and different than the current one */ +- if (irq_flags != IRQ_TYPE_NONE && +- irq_flags != irq_get_trigger_type(irq)) +- irq_set_irq_type(irq, irq_flags); ++ /* ++ * If the IRQ is not already in use then set type ++ * if specified and different than the current one. ++ */ ++ if (can_request_irq(irq, irq_flags)) { ++ if (irq_flags != IRQ_TYPE_NONE && ++ irq_flags != irq_get_trigger_type(irq)) ++ irq_set_irq_type(irq, irq_flags); ++ } else { ++ dev_dbg(&adev->dev, "IRQ %d already in use\n", irq); ++ } + + return irq; + } +-- +2.34.1 + diff --git a/queue-5.4/hid-apple-do-not-reset-quirks-when-the-fn-key-is-not.patch b/queue-5.4/hid-apple-do-not-reset-quirks-when-the-fn-key-is-not.patch new file mode 100644 index 00000000000..1f226726ad6 --- /dev/null +++ b/queue-5.4/hid-apple-do-not-reset-quirks-when-the-fn-key-is-not.patch @@ -0,0 +1,38 @@ +From d3e2b1b89137e67ffef7978442b569b965b0ed34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Nov 2021 08:29:53 +0100 +Subject: HID: apple: Do not reset quirks when the Fn key is not found +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit a5fe7864d8ada170f19cc47d176bf8260ffb4263 ] + +When a keyboard without a function key is detected, instead of removing +all quirks, remove only the APPLE_HAS_FN quirk. + +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 07df64daf7dae..efce31d035ef5 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -389,7 +389,7 @@ static int apple_input_configured(struct hid_device *hdev, + + if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { + hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); +- asc->quirks = 0; ++ asc->quirks &= ~APPLE_HAS_FN; + } + + return 0; +-- +2.34.1 + diff --git a/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch new file mode 100644 index 00000000000..5bc88149eaa --- /dev/null +++ b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch @@ -0,0 +1,62 @@ +From 49033c588beaf1e4f080816414e071877415f6f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 18:29:12 +0100 +Subject: HID: hid-uclogic-params: Invalid parameter check in + uclogic_params_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit f364c571a5c77e96de2d32062ff019d6b8d2e2bc ] + +The function performs a check on its input parameters, however, the +hdev parameter is used before the check. + +Initialize the stack variables after checking the input parameters to +avoid a possible NULL pointer dereference. + +Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module") +Addresses-Coverity-ID: 1443831 ("Null pointer dereference") +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index ed4ede52b017f..0afd368115891 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -832,10 +832,10 @@ int uclogic_params_init(struct uclogic_params *params, + struct hid_device *hdev) + { + int rc; +- struct usb_device *udev = hid_to_usb_dev(hdev); +- __u8 bNumInterfaces = udev->config->desc.bNumInterfaces; +- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); +- __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_device *udev; ++ __u8 bNumInterfaces; ++ struct usb_interface *iface; ++ __u8 bInterfaceNumber; + bool found; + /* The resulting parameters (noop) */ + struct uclogic_params p = {0, }; +@@ -846,6 +846,11 @@ int uclogic_params_init(struct uclogic_params *params, + goto cleanup; + } + ++ udev = hid_to_usb_dev(hdev); ++ bNumInterfaces = udev->config->desc.bNumInterfaces; ++ iface = to_usb_interface(hdev->dev.parent); ++ bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; ++ + /* + * Set replacement report descriptor if the original matches the + * specified size. Otherwise keep interface unchanged. +-- +2.34.1 + diff --git a/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-10015 b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-10015 new file mode 100644 index 00000000000..61e11d1a7f9 --- /dev/null +++ b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-10015 @@ -0,0 +1,53 @@ +From d25bf92050978e956e2fab95d3fa15df4a62176c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 18:29:13 +0100 +Subject: HID: hid-uclogic-params: Invalid parameter check in + uclogic_params_get_str_desc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit 0a94131d6920916ccb6a357037c535533af08819 ] + +The function performs a check on the hdev input parameters, however, it +is used before the check. + +Initialize the udev variable after the sanity check to avoid a +possible NULL pointer dereference. + +Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module") +Addresses-Coverity-ID: 1443827 ("Null pointer dereference") +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 0afd368115891..1f3ea6c93ef44 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -65,7 +65,7 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, + __u8 idx, size_t len) + { + int rc; +- struct usb_device *udev = hid_to_usb_dev(hdev); ++ struct usb_device *udev; + __u8 *buf = NULL; + + /* Check arguments */ +@@ -74,6 +74,8 @@ static int uclogic_params_get_str_desc(__u8 **pbuf, struct hid_device *hdev, + goto cleanup; + } + ++ udev = hid_to_usb_dev(hdev); ++ + buf = kmalloc(len, GFP_KERNEL); + if (buf == NULL) { + rc = -ENOMEM; +-- +2.34.1 + diff --git a/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-1092 b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-1092 new file mode 100644 index 00000000000..7d568a38a28 --- /dev/null +++ b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-1092 @@ -0,0 +1,59 @@ +From 37937d4ddc1270432695e019044efdf4952e32d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 18:29:14 +0100 +Subject: HID: hid-uclogic-params: Invalid parameter check in + uclogic_params_huion_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit ff6b548afe4d9d1ff3a0f6ef79e8cbca25d8f905 ] + +The function performs a check on its input parameters, however, the +hdev parameter is used before the check. + +Initialize the stack variables after checking the input parameters to +avoid a possible NULL pointer dereference. + +Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module") +Addresses-Coverity-ID: 1443804 ("Null pointer dereference") +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 1f3ea6c93ef44..0fdac91c5f510 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -707,9 +707,9 @@ static int uclogic_params_huion_init(struct uclogic_params *params, + struct hid_device *hdev) + { + int rc; +- struct usb_device *udev = hid_to_usb_dev(hdev); +- struct usb_interface *iface = to_usb_interface(hdev->dev.parent); +- __u8 bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; ++ struct usb_device *udev; ++ struct usb_interface *iface; ++ __u8 bInterfaceNumber; + bool found; + /* The resulting parameters (noop) */ + struct uclogic_params p = {0, }; +@@ -723,6 +723,10 @@ static int uclogic_params_huion_init(struct uclogic_params *params, + goto cleanup; + } + ++ udev = hid_to_usb_dev(hdev); ++ iface = to_usb_interface(hdev->dev.parent); ++ bInterfaceNumber = iface->cur_altsetting->desc.bInterfaceNumber; ++ + /* If it's not a pen interface */ + if (bInterfaceNumber != 0) { + /* TODO: Consider marking the interface invalid */ +-- +2.34.1 + diff --git a/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-28733 b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-28733 new file mode 100644 index 00000000000..c865b7ff6ce --- /dev/null +++ b/queue-5.4/hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-28733 @@ -0,0 +1,53 @@ +From 24afe2eb6e6cd29c0ea21f94bcaaa41a987ca52d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 18:29:15 +0100 +Subject: HID: hid-uclogic-params: Invalid parameter check in + uclogic_params_frame_init_v1_buttonpad +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit aa320fdbbbb482c19100f51461bd0069753ce3d7 ] + +The function performs a check on the hdev input parameters, however, it +is used before the check. + +Initialize the udev variable after the sanity check to avoid a +possible NULL pointer dereference. + +Fixes: 9614219e9310e ("HID: uclogic: Extract tablet parameter discovery into a module") +Addresses-Coverity-ID: 1443763 ("Null pointer dereference") +Signed-off-by: José Expósito +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-uclogic-params.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-uclogic-params.c b/drivers/hid/hid-uclogic-params.c +index 0fdac91c5f510..191aba9f6b497 100644 +--- a/drivers/hid/hid-uclogic-params.c ++++ b/drivers/hid/hid-uclogic-params.c +@@ -451,7 +451,7 @@ static int uclogic_params_frame_init_v1_buttonpad( + { + int rc; + bool found = false; +- struct usb_device *usb_dev = hid_to_usb_dev(hdev); ++ struct usb_device *usb_dev; + char *str_buf = NULL; + const size_t str_len = 16; + +@@ -461,6 +461,8 @@ static int uclogic_params_frame_init_v1_buttonpad( + goto cleanup; + } + ++ usb_dev = hid_to_usb_dev(hdev); ++ + /* + * Enable generic button mode + */ +-- +2.34.1 + diff --git a/queue-5.4/hid-quirks-allow-inverting-the-absolute-x-y-values.patch b/queue-5.4/hid-quirks-allow-inverting-the-absolute-x-y-values.patch new file mode 100644 index 00000000000..9b0dd8c90a0 --- /dev/null +++ b/queue-5.4/hid-quirks-allow-inverting-the-absolute-x-y-values.patch @@ -0,0 +1,55 @@ +From b273e399792ab0ff6005700dd0ce4f7175e3508b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 22:40:43 +1000 +Subject: HID: quirks: Allow inverting the absolute X/Y values + +From: Alistair Francis + +[ Upstream commit fd8d135b2c5e88662f2729e034913f183455a667 ] + +Add a HID_QUIRK_X_INVERT/HID_QUIRK_Y_INVERT quirk that can be used +to invert the X/Y values. + +Signed-off-by: Alistair Francis +[bentiss: silence checkpatch warning] +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20211208124045.61815-2-alistair@alistair23.me +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 6 ++++++ + include/linux/hid.h | 2 ++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index ea4c97f5b0736..749558aa27e78 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -1288,6 +1288,12 @@ void hidinput_hid_event(struct hid_device *hid, struct hid_field *field, struct + + input = field->hidinput->input; + ++ if (usage->type == EV_ABS && ++ (((*quirks & HID_QUIRK_X_INVERT) && usage->code == ABS_X) || ++ ((*quirks & HID_QUIRK_Y_INVERT) && usage->code == ABS_Y))) { ++ value = field->logical_maximum - value; ++ } ++ + if (usage->hat_min < usage->hat_max || usage->hat_dir) { + int hat_dir = usage->hat_dir; + if (!hat_dir) +diff --git a/include/linux/hid.h b/include/linux/hid.h +index ad46ed41e8836..d5f9bbf8afa51 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -344,6 +344,8 @@ struct hid_item { + /* BIT(9) reserved for backward compatibility, was NO_INIT_INPUT_REPORTS */ + #define HID_QUIRK_ALWAYS_POLL BIT(10) + #define HID_QUIRK_INPUT_PER_APP BIT(11) ++#define HID_QUIRK_X_INVERT BIT(12) ++#define HID_QUIRK_Y_INVERT BIT(13) + #define HID_QUIRK_SKIP_OUTPUT_REPORTS BIT(16) + #define HID_QUIRK_SKIP_OUTPUT_REPORT_ID BIT(17) + #define HID_QUIRK_NO_OUTPUT_REPORTS_ON_INTR_EP BIT(18) +-- +2.34.1 + diff --git a/queue-5.4/hsi-core-fix-return-freed-object-in-hsi_new_client.patch b/queue-5.4/hsi-core-fix-return-freed-object-in-hsi_new_client.patch new file mode 100644 index 00000000000..7d1be2edee6 --- /dev/null +++ b/queue-5.4/hsi-core-fix-return-freed-object-in-hsi_new_client.patch @@ -0,0 +1,35 @@ +From def0fd71e80ff40593fc953d19396bbe4109a7ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 06:45:07 -0700 +Subject: HSI: core: Fix return freed object in hsi_new_client + +From: Chengfeng Ye + +[ Upstream commit a1ee1c08fcd5af03187dcd41dcab12fd5b379555 ] + +cl is freed on error of calling device_register, but this +object is return later, which will cause uaf issue. Fix it +by return NULL on error. + +Signed-off-by: Chengfeng Ye +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/hsi_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hsi/hsi_core.c b/drivers/hsi/hsi_core.c +index a5f92e2889cb8..a330f58d45fc6 100644 +--- a/drivers/hsi/hsi_core.c ++++ b/drivers/hsi/hsi_core.c +@@ -102,6 +102,7 @@ struct hsi_client *hsi_new_client(struct hsi_port *port, + if (device_register(&cl->device) < 0) { + pr_err("hsi: failed to register client: %s\n", info->name); + put_device(&cl->device); ++ goto err; + } + + return cl; +-- +2.34.1 + diff --git a/queue-5.4/i2c-designware-pci-fix-to-change-data-types-of-hcnt-.patch b/queue-5.4/i2c-designware-pci-fix-to-change-data-types-of-hcnt-.patch new file mode 100644 index 00000000000..4f4baeb7483 --- /dev/null +++ b/queue-5.4/i2c-designware-pci-fix-to-change-data-types-of-hcnt-.patch @@ -0,0 +1,45 @@ +From b5a27825db621cfe514df32c687047e7acf3495e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 17:12:01 +0200 +Subject: i2c: designware-pci: Fix to change data types of hcnt and lcnt + parameters + +From: Lakshmi Sowjanya D + +[ Upstream commit d52097010078c1844348dc0e467305e5f90fd317 ] + +The data type of hcnt and lcnt in the struct dw_i2c_dev is of type u16. +It's better to have same data type in struct dw_scl_sda_cfg as well. + +Reported-by: Wolfram Sang +Signed-off-by: Lakshmi Sowjanya D +Signed-off-by: Andy Shevchenko +Signed-off-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-pcidrv.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c +index 05b35ac33ce33..735326e5eb8cf 100644 +--- a/drivers/i2c/busses/i2c-designware-pcidrv.c ++++ b/drivers/i2c/busses/i2c-designware-pcidrv.c +@@ -37,10 +37,10 @@ enum dw_pci_ctl_id_t { + }; + + struct dw_scl_sda_cfg { +- u32 ss_hcnt; +- u32 fs_hcnt; +- u32 ss_lcnt; +- u32 fs_lcnt; ++ u16 ss_hcnt; ++ u16 fs_hcnt; ++ u16 ss_lcnt; ++ u16 fs_lcnt; + u32 sda_hold; + }; + +-- +2.34.1 + diff --git a/queue-5.4/i2c-i801-don-t-silently-correct-invalid-transfer-siz.patch b/queue-5.4/i2c-i801-don-t-silently-correct-invalid-transfer-siz.patch new file mode 100644 index 00000000000..45861dd6ba4 --- /dev/null +++ b/queue-5.4/i2c-i801-don-t-silently-correct-invalid-transfer-siz.patch @@ -0,0 +1,63 @@ +From 318b129b973f687af25fc5606e7fda9a3ef85b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 22:57:00 +0100 +Subject: i2c: i801: Don't silently correct invalid transfer size + +From: Heiner Kallweit + +[ Upstream commit effa453168a7eeb8a562ff4edc1dbf9067360a61 ] + +If an invalid block size is provided, reject it instead of silently +changing it to a supported value. Especially critical I see the case of +a write transfer with block length 0. In this case we have no guarantee +that the byte we would write is valid. When silently reducing a read to +32 bytes then we don't return an error and the caller may falsely +assume that we returned the full requested data. + +If this change should break any (broken) caller, then I think we should +fix the caller. + +Signed-off-by: Heiner Kallweit +Reviewed-by: Jean Delvare +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-i801.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index a959062ded4f8..4e6d0b722ddcd 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -785,6 +785,11 @@ static int i801_block_transaction(struct i801_priv *priv, + int result = 0; + unsigned char hostc; + ++ if (read_write == I2C_SMBUS_READ && command == I2C_SMBUS_BLOCK_DATA) ++ data->block[0] = I2C_SMBUS_BLOCK_MAX; ++ else if (data->block[0] < 1 || data->block[0] > I2C_SMBUS_BLOCK_MAX) ++ return -EPROTO; ++ + if (command == I2C_SMBUS_I2C_BLOCK_DATA) { + if (read_write == I2C_SMBUS_WRITE) { + /* set I2C_EN bit in configuration register */ +@@ -798,16 +803,6 @@ static int i801_block_transaction(struct i801_priv *priv, + } + } + +- if (read_write == I2C_SMBUS_WRITE +- || command == I2C_SMBUS_I2C_BLOCK_DATA) { +- if (data->block[0] < 1) +- data->block[0] = 1; +- if (data->block[0] > I2C_SMBUS_BLOCK_MAX) +- data->block[0] = I2C_SMBUS_BLOCK_MAX; +- } else { +- data->block[0] = 32; /* max for SMBus block reads */ +- } +- + /* Experience has shown that the block buffer can only be used for + SMBus (not I2C) block transactions, even though the datasheet + doesn't mention this limitation. */ +-- +2.34.1 + diff --git a/queue-5.4/i2c-mpc-correct-i2c-reset-procedure.patch b/queue-5.4/i2c-mpc-correct-i2c-reset-procedure.patch new file mode 100644 index 00000000000..307db724934 --- /dev/null +++ b/queue-5.4/i2c-mpc-correct-i2c-reset-procedure.patch @@ -0,0 +1,70 @@ +From 0fefe490aaf4e56e79ecae6bbdb1a9da9fd48c4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 May 2017 14:20:33 +0200 +Subject: i2c: mpc: Correct I2C reset procedure + +From: Joakim Tjernlund + +[ Upstream commit ebe82cf92cd4825c3029434cabfcd2f1780e64be ] + +Current I2C reset procedure is broken in two ways: +1) It only generate 1 START instead of 9 STARTs and STOP. +2) It leaves the bus Busy so every I2C xfer after the first + fixup calls the reset routine again, for every xfer there after. + +This fixes both errors. + +Signed-off-by: Joakim Tjernlund +Acked-by: Scott Wood +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index af349661fd769..8de8296d25831 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -105,23 +105,30 @@ static irqreturn_t mpc_i2c_isr(int irq, void *dev_id) + /* Sometimes 9th clock pulse isn't generated, and slave doesn't release + * the bus, because it wants to send ACK. + * Following sequence of enabling/disabling and sending start/stop generates +- * the 9 pulses, so it's all OK. ++ * the 9 pulses, each with a START then ending with STOP, so it's all OK. + */ + static void mpc_i2c_fixup(struct mpc_i2c *i2c) + { + int k; +- u32 delay_val = 1000000 / i2c->real_clk + 1; +- +- if (delay_val < 2) +- delay_val = 2; ++ unsigned long flags; + + for (k = 9; k; k--) { + writeccr(i2c, 0); +- writeccr(i2c, CCR_MSTA | CCR_MTX | CCR_MEN); ++ writeb(0, i2c->base + MPC_I2C_SR); /* clear any status bits */ ++ writeccr(i2c, CCR_MEN | CCR_MSTA); /* START */ ++ readb(i2c->base + MPC_I2C_DR); /* init xfer */ ++ udelay(15); /* let it hit the bus */ ++ local_irq_save(flags); /* should not be delayed further */ ++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSTA); /* delay SDA */ + readb(i2c->base + MPC_I2C_DR); +- writeccr(i2c, CCR_MEN); +- udelay(delay_val << 1); ++ if (k != 1) ++ udelay(5); ++ local_irq_restore(flags); + } ++ writeccr(i2c, CCR_MEN); /* Initiate STOP */ ++ readb(i2c->base + MPC_I2C_DR); ++ udelay(15); /* Let STOP propagate */ ++ writeccr(i2c, 0); + } + + static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) +-- +2.34.1 + diff --git a/queue-5.4/iommu-io-pgtable-arm-fix-table-descriptor-paddr-form.patch b/queue-5.4/iommu-io-pgtable-arm-fix-table-descriptor-paddr-form.patch new file mode 100644 index 00000000000..f976b68f9b1 --- /dev/null +++ b/queue-5.4/iommu-io-pgtable-arm-fix-table-descriptor-paddr-form.patch @@ -0,0 +1,69 @@ +From 20f266e1ce214dde032ff46b3a8e435336e5ecff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Nov 2021 12:13:43 +0900 +Subject: iommu/io-pgtable-arm: Fix table descriptor paddr formatting + +From: Hector Martin + +[ Upstream commit 9abe2ac834851a7d0b0756e295cf7a292c45ca53 ] + +Table descriptors were being installed without properly formatting the +address using paddr_to_iopte, which does not match up with the +iopte_deref in __arm_lpae_map. This is incorrect for the LPAE pte +format, as it does not handle the high bits properly. + +This was found on Apple T6000 DARTs, which require a new pte format +(different shift); adding support for that to +paddr_to_iopte/iopte_to_paddr caused it to break badly, as even <48-bit +addresses would end up incorrect in that case. + +Fixes: 6c89928ff7a0 ("iommu/io-pgtable-arm: Support 52-bit physical address") +Acked-by: Robin Murphy +Signed-off-by: Hector Martin +Link: https://lore.kernel.org/r/20211120031343.88034-1-marcan@marcan.st +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/io-pgtable-arm.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c +index ca51036aa53c7..975237ca03267 100644 +--- a/drivers/iommu/io-pgtable-arm.c ++++ b/drivers/iommu/io-pgtable-arm.c +@@ -351,11 +351,12 @@ static int arm_lpae_init_pte(struct arm_lpae_io_pgtable *data, + static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, + arm_lpae_iopte *ptep, + arm_lpae_iopte curr, +- struct io_pgtable_cfg *cfg) ++ struct arm_lpae_io_pgtable *data) + { + arm_lpae_iopte old, new; ++ struct io_pgtable_cfg *cfg = &data->iop.cfg; + +- new = __pa(table) | ARM_LPAE_PTE_TYPE_TABLE; ++ new = paddr_to_iopte(__pa(table), data) | ARM_LPAE_PTE_TYPE_TABLE; + if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) + new |= ARM_LPAE_PTE_NSTABLE; + +@@ -406,7 +407,7 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, + if (!cptep) + return -ENOMEM; + +- pte = arm_lpae_install_table(cptep, ptep, 0, cfg); ++ pte = arm_lpae_install_table(cptep, ptep, 0, data); + if (pte) + __arm_lpae_free_pages(cptep, tblsz, cfg); + } else if (!cfg->coherent_walk && !(pte & ARM_LPAE_PTE_SW_SYNC)) { +@@ -575,7 +576,7 @@ static size_t arm_lpae_split_blk_unmap(struct arm_lpae_io_pgtable *data, + __arm_lpae_init_pte(data, blk_paddr, pte, lvl, &tablep[i]); + } + +- pte = arm_lpae_install_table(tablep, ptep, blk_pte, cfg); ++ pte = arm_lpae_install_table(tablep, ptep, blk_pte, data); + if (pte != blk_pte) { + __arm_lpae_free_pages(tablep, tablesz, cfg); + /* +-- +2.34.1 + diff --git a/queue-5.4/iommu-iova-fix-race-between-fq-timeout-and-teardown.patch b/queue-5.4/iommu-iova-fix-race-between-fq-timeout-and-teardown.patch new file mode 100644 index 00000000000..317c7f5b27e --- /dev/null +++ b/queue-5.4/iommu-iova-fix-race-between-fq-timeout-and-teardown.patch @@ -0,0 +1,53 @@ +From 3f1fdc63710e6388c438323031c20a8375e0dda8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 15:30:55 +0000 +Subject: iommu/iova: Fix race between FQ timeout and teardown + +From: Xiongfeng Wang + +[ Upstream commit d7061627d701c90e1cac1e1e60c45292f64f3470 ] + +It turns out to be possible for hotplugging out a device to reach the +stage of tearing down the device's group and default domain before the +domain's flush queue has drained naturally. At this point, it is then +possible for the timeout to expire just before the del_timer() call +in free_iova_flush_queue(), such that we then proceed to free the FQ +resources while fq_flush_timeout() is still accessing them on another +CPU. Crashes due to this have been observed in the wild while removing +NVMe devices. + +Close the race window by using del_timer_sync() to safely wait for any +active timeout handler to finish before we start to free things. We +already avoid any locking in free_iova_flush_queue() since the FQ is +supposed to be inactive anyway, so the potential deadlock scenario does +not apply. + +Fixes: 9a005a800ae8 ("iommu/iova: Add flush timer") +Reviewed-by: John Garry +Signed-off-by: Xiongfeng Wang +[ rm: rewrite commit message ] +Signed-off-by: Robin Murphy +Link: https://lore.kernel.org/r/0a365e5b07f14b7344677ad6a9a734966a8422ce.1639753638.git.robin.murphy@arm.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iova.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c +index 612cbf668adf8..906582a21124d 100644 +--- a/drivers/iommu/iova.c ++++ b/drivers/iommu/iova.c +@@ -64,8 +64,7 @@ static void free_iova_flush_queue(struct iova_domain *iovad) + if (!has_iova_flush_queue(iovad)) + return; + +- if (timer_pending(&iovad->fq_timer)) +- del_timer(&iovad->fq_timer); ++ del_timer_sync(&iovad->fq_timer); + + fq_destroy_all_entries(iovad); + +-- +2.34.1 + diff --git a/queue-5.4/iwlwifi-fix-leaks-bad-data-after-failed-firmware-loa.patch b/queue-5.4/iwlwifi-fix-leaks-bad-data-after-failed-firmware-loa.patch new file mode 100644 index 00000000000..8160e3ad4b3 --- /dev/null +++ b/queue-5.4/iwlwifi-fix-leaks-bad-data-after-failed-firmware-loa.patch @@ -0,0 +1,69 @@ +From 1bebfbd25a672d63cc4784adb523fa25dd89c542 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 11:12:42 +0200 +Subject: iwlwifi: fix leaks/bad data after failed firmware load + +From: Johannes Berg + +[ Upstream commit ab07506b0454bea606095951e19e72c282bfbb42 ] + +If firmware load fails after having loaded some parts of the +firmware, e.g. the IML image, then this would leak. For the +host command list we'd end up running into a WARN on the next +attempt to load another firmware image. + +Fix this by calling iwl_dealloc_ucode() on failures, and make +that also clear the data so we start fresh on the next round. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20211210110539.1f742f0eb58a.I1315f22f6aa632d94ae2069f85e1bca5e734dce0@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +index e68366f248fe3..c1a2fb154fe91 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +@@ -183,6 +183,9 @@ static void iwl_dealloc_ucode(struct iwl_drv *drv) + + for (i = 0; i < IWL_UCODE_TYPE_MAX; i++) + iwl_free_fw_img(drv, drv->fw.img + i); ++ ++ /* clear the data for the aborted load case */ ++ memset(&drv->fw, 0, sizeof(drv->fw)); + } + + static int iwl_alloc_fw_desc(struct iwl_drv *drv, struct fw_desc *desc, +@@ -1338,6 +1341,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) + int i; + bool load_module = false; + bool usniffer_images = false; ++ bool failure = true; + + fw->ucode_capa.max_probe_length = IWL_DEFAULT_MAX_PROBE_LENGTH; + fw->ucode_capa.standard_phy_calibration_size = +@@ -1604,6 +1608,7 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) + op->name, err); + #endif + } ++ failure = false; + goto free; + + try_again: +@@ -1619,6 +1624,9 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) + complete(&drv->request_firmware_complete); + device_release_driver(drv->trans->dev); + free: ++ if (failure) ++ iwl_dealloc_ucode(drv); ++ + if (pieces) { + for (i = 0; i < ARRAY_SIZE(pieces->img); i++) + kfree(pieces->img[i].sec); +-- +2.34.1 + diff --git a/queue-5.4/iwlwifi-mvm-fix-calculation-of-frame-length.patch b/queue-5.4/iwlwifi-mvm-fix-calculation-of-frame-length.patch new file mode 100644 index 00000000000..bc757feb986 --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-fix-calculation-of-frame-length.patch @@ -0,0 +1,72 @@ +From 834aaef203557d8f296da17ee679daed656e6b7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Dec 2021 12:18:16 +0200 +Subject: iwlwifi: mvm: Fix calculation of frame length + +From: Ilan Peer + +[ Upstream commit 40a0b38d7a7f91a6027287e0df54f5f547e8d27e ] + +The RADA might include in the Rx frame the MIC and CRC bytes. +These bytes should be removed for non monitor interfaces and +should not be passed to mac80211. + +Fix the Rx processing to remove the extra bytes on non monitor +cases. + +Signed-off-by: Ilan Peer +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20211219121514.098be12c801e.I1d81733d8a75b84c3b20eb6e0d14ab3405ca6a86@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 27 +++++++++++++++++++ + 1 file changed, 27 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index a6e2a30eb3109..52c6edc621ced 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -177,12 +177,39 @@ static int iwl_mvm_create_skb(struct iwl_mvm *mvm, struct sk_buff *skb, + struct iwl_rx_mpdu_desc *desc = (void *)pkt->data; + unsigned int headlen, fraglen, pad_len = 0; + unsigned int hdrlen = ieee80211_hdrlen(hdr->frame_control); ++ u8 mic_crc_len = u8_get_bits(desc->mac_flags1, ++ IWL_RX_MPDU_MFLG1_MIC_CRC_LEN_MASK) << 1; + + if (desc->mac_flags2 & IWL_RX_MPDU_MFLG2_PAD) { + len -= 2; + pad_len = 2; + } + ++ /* ++ * For non monitor interface strip the bytes the RADA might not have ++ * removed. As monitor interface cannot exist with other interfaces ++ * this removal is safe. ++ */ ++ if (mic_crc_len && !ieee80211_hw_check(mvm->hw, RX_INCLUDES_FCS)) { ++ u32 pkt_flags = le32_to_cpu(pkt->len_n_flags); ++ ++ /* ++ * If RADA was not enabled then decryption was not performed so ++ * the MIC cannot be removed. ++ */ ++ if (!(pkt_flags & FH_RSCSR_RADA_EN)) { ++ if (WARN_ON(crypt_len > mic_crc_len)) ++ return -EINVAL; ++ ++ mic_crc_len -= crypt_len; ++ } ++ ++ if (WARN_ON(mic_crc_len > len)) ++ return -EINVAL; ++ ++ len -= mic_crc_len; ++ } ++ + /* If frame is small enough to fit in skb->head, pull it completely. + * If not, only pull ieee80211_hdr (including crypto if present, and + * an additional 8 bytes for SNAP/ethertype, see below) so that +-- +2.34.1 + diff --git a/queue-5.4/iwlwifi-mvm-synchronize-with-fw-after-multicast-comm.patch b/queue-5.4/iwlwifi-mvm-synchronize-with-fw-after-multicast-comm.patch new file mode 100644 index 00000000000..c7c64ef4156 --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-synchronize-with-fw-after-multicast-comm.patch @@ -0,0 +1,72 @@ +From 120118556b10706c8bf4c1d21f4d1cd6e142235a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Dec 2021 08:35:45 +0200 +Subject: iwlwifi: mvm: synchronize with FW after multicast commands + +From: Johannes Berg + +[ Upstream commit db66abeea3aefed481391ecc564fb7b7fb31d742 ] + +If userspace installs a lot of multicast groups very quickly, then +we may run out of command queue space as we send the updates in an +asynchronous fashion (due to locking concerns), and the CPU can +create them faster than the firmware can process them. This is true +even when mac80211 has a work struct that gets scheduled. + +Fix this by synchronizing with the firmware after sending all those +commands - outside of the iteration we can send a synchronous echo +command that just has the effect of the CPU waiting for the prior +asynchronous commands to finish. This also will cause fewer of the +commands to be sent to the firmware overall, because the work will +only run once when rescheduled multiple times while it's running. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=213649 +Suggested-by: Emmanuel Grumbach +Reported-by: Maximilian Ernestus +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20211204083238.51aea5b79ea4.I88a44798efda16e9fe480fb3e94224931d311b29@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index c942255aa1dbc..29ad7804d77aa 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -1696,6 +1696,7 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm) + struct iwl_mvm_mc_iter_data iter_data = { + .mvm = mvm, + }; ++ int ret; + + lockdep_assert_held(&mvm->mutex); + +@@ -1705,6 +1706,22 @@ static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm) + ieee80211_iterate_active_interfaces_atomic( + mvm->hw, IEEE80211_IFACE_ITER_NORMAL, + iwl_mvm_mc_iface_iterator, &iter_data); ++ ++ /* ++ * Send a (synchronous) ech command so that we wait for the ++ * multiple asynchronous MCAST_FILTER_CMD commands sent by ++ * the interface iterator. Otherwise, we might get here over ++ * and over again (by userspace just sending a lot of these) ++ * and the CPU can send them faster than the firmware can ++ * process them. ++ * Note that the CPU is still faster - but with this we'll ++ * actually send fewer commands overall because the CPU will ++ * not schedule the work in mac80211 as frequently if it's ++ * still running when rescheduled (possibly multiple times). ++ */ ++ ret = iwl_mvm_send_cmd_pdu(mvm, ECHO_CMD, 0, 0, NULL); ++ if (ret) ++ IWL_ERR(mvm, "Failed to synchronize multicast groups update\n"); + } + + static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw, +-- +2.34.1 + diff --git a/queue-5.4/iwlwifi-remove-module-loading-failure-message.patch b/queue-5.4/iwlwifi-remove-module-loading-failure-message.patch new file mode 100644 index 00000000000..6104eb8336b --- /dev/null +++ b/queue-5.4/iwlwifi-remove-module-loading-failure-message.patch @@ -0,0 +1,51 @@ +From ff99f1bc4aec7e6f9c107c540ccddb5807de106c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 11:12:45 +0200 +Subject: iwlwifi: remove module loading failure message + +From: Johannes Berg + +[ Upstream commit 6518f83ffa51131daaf439b66094f684da3fb0ae ] + +When CONFIG_DEBUG_TEST_DRIVER_REMOVE is set, iwlwifi crashes +when the opmode module cannot be loaded, due to completing +the completion before using drv->dev, which can then already +be freed. + +Fix this by removing the (fairly useless) message. Moving the +completion later causes a deadlock instead, so that's not an +option. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/20211210091245.289008-2-luca@coelho.fi +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +index c1a2fb154fe91..83cb2ad03451b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +@@ -1599,15 +1599,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) + * else from proceeding if the module fails to load + * or hangs loading. + */ +- if (load_module) { ++ if (load_module) + request_module("%s", op->name); +-#ifdef CONFIG_IWLWIFI_OPMODE_MODULAR +- if (err) +- IWL_ERR(drv, +- "failed to load module %s (error %d), is dynamic loading enabled?\n", +- op->name, err); +-#endif +- } + failure = false; + goto free; + +-- +2.34.1 + diff --git a/queue-5.4/jffs2-gc-deadlock-reading-a-page-that-is-used-in-jff.patch b/queue-5.4/jffs2-gc-deadlock-reading-a-page-that-is-used-in-jff.patch new file mode 100644 index 00000000000..dd5a5298596 --- /dev/null +++ b/queue-5.4/jffs2-gc-deadlock-reading-a-page-that-is-used-in-jff.patch @@ -0,0 +1,133 @@ +From 3086a8d5cd4ad7d2f366f0d259e13b25e3d8c266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jul 2017 16:22:38 +1200 +Subject: jffs2: GC deadlock reading a page that is used in jffs2_write_begin() + +From: Kyeong Yoo + +[ Upstream commit aa39cc675799bc92da153af9a13d6f969c348e82 ] + +GC task can deadlock in read_cache_page() because it may attempt +to release a page that is actually allocated by another task in +jffs2_write_begin(). +The reason is that in jffs2_write_begin() there is a small window +a cache page is allocated for use but not set Uptodate yet. + +This ends up with a deadlock between two tasks: +1) A task (e.g. file copy) + - jffs2_write_begin() locks a cache page + - jffs2_write_end() tries to lock "alloc_sem" from + jffs2_reserve_space() <-- STUCK +2) GC task (jffs2_gcd_mtd3) + - jffs2_garbage_collect_pass() locks "alloc_sem" + - try to lock the same cache page in read_cache_page() <-- STUCK + +So to avoid this deadlock, hold "alloc_sem" in jffs2_write_begin() +while reading data in a cache page. + +Signed-off-by: Kyeong Yoo +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/jffs2/file.c | 40 +++++++++++++++++++++++++--------------- + 1 file changed, 25 insertions(+), 15 deletions(-) + +diff --git a/fs/jffs2/file.c b/fs/jffs2/file.c +index f8fb89b10227c..34880a4c21732 100644 +--- a/fs/jffs2/file.c ++++ b/fs/jffs2/file.c +@@ -135,20 +135,15 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + struct page *pg; + struct inode *inode = mapping->host; + struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode); ++ struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); + pgoff_t index = pos >> PAGE_SHIFT; + uint32_t pageofs = index << PAGE_SHIFT; + int ret = 0; + +- pg = grab_cache_page_write_begin(mapping, index, flags); +- if (!pg) +- return -ENOMEM; +- *pagep = pg; +- + jffs2_dbg(1, "%s()\n", __func__); + + if (pageofs > inode->i_size) { + /* Make new hole frag from old EOF to new page */ +- struct jffs2_sb_info *c = JFFS2_SB_INFO(inode->i_sb); + struct jffs2_raw_inode ri; + struct jffs2_full_dnode *fn; + uint32_t alloc_len; +@@ -159,7 +154,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + ret = jffs2_reserve_space(c, sizeof(ri), &alloc_len, + ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE); + if (ret) +- goto out_page; ++ goto out_err; + + mutex_lock(&f->sem); + memset(&ri, 0, sizeof(ri)); +@@ -189,7 +184,7 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + ret = PTR_ERR(fn); + jffs2_complete_reservation(c); + mutex_unlock(&f->sem); +- goto out_page; ++ goto out_err; + } + ret = jffs2_add_full_dnode_to_inode(c, f, fn); + if (f->metadata) { +@@ -204,13 +199,26 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + jffs2_free_full_dnode(fn); + jffs2_complete_reservation(c); + mutex_unlock(&f->sem); +- goto out_page; ++ goto out_err; + } + jffs2_complete_reservation(c); + inode->i_size = pageofs; + mutex_unlock(&f->sem); + } + ++ /* ++ * While getting a page and reading data in, lock c->alloc_sem until ++ * the page is Uptodate. Otherwise GC task may attempt to read the same ++ * page in read_cache_page(), which causes a deadlock. ++ */ ++ mutex_lock(&c->alloc_sem); ++ pg = grab_cache_page_write_begin(mapping, index, flags); ++ if (!pg) { ++ ret = -ENOMEM; ++ goto release_sem; ++ } ++ *pagep = pg; ++ + /* + * Read in the page if it wasn't already present. Cannot optimize away + * the whole page write case until jffs2_write_end can handle the +@@ -220,15 +228,17 @@ static int jffs2_write_begin(struct file *filp, struct address_space *mapping, + mutex_lock(&f->sem); + ret = jffs2_do_readpage_nolock(inode, pg); + mutex_unlock(&f->sem); +- if (ret) +- goto out_page; ++ if (ret) { ++ unlock_page(pg); ++ put_page(pg); ++ goto release_sem; ++ } + } + jffs2_dbg(1, "end write_begin(). pg->flags %lx\n", pg->flags); +- return ret; + +-out_page: +- unlock_page(pg); +- put_page(pg); ++release_sem: ++ mutex_unlock(&c->alloc_sem); ++out_err: + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.4/kvm-ppc-book3s-suppress-failed-alloc-warning-in-h_co.patch b/queue-5.4/kvm-ppc-book3s-suppress-failed-alloc-warning-in-h_co.patch new file mode 100644 index 00000000000..99ecd00bf38 --- /dev/null +++ b/queue-5.4/kvm-ppc-book3s-suppress-failed-alloc-warning-in-h_co.patch @@ -0,0 +1,44 @@ +From 2c7814fe4223e9b6e2b4990151648f1b78b5d85d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 18:45:50 +1000 +Subject: KVM: PPC: Book3S: Suppress failed alloc warning in + H_COPY_TOFROM_GUEST + +From: Alexey Kardashevskiy + +[ Upstream commit 792020907b11c6f9246c21977cab3bad985ae4b6 ] + +H_COPY_TOFROM_GUEST is an hcall for an upper level VM to access its nested +VMs memory. The userspace can trigger WARN_ON_ONCE(!(gfp & __GFP_NOWARN)) +in __alloc_pages() by constructing a tiny VM which only does +H_COPY_TOFROM_GUEST with a too big GPR9 (number of bytes to copy). + +This silences the warning by adding __GFP_NOWARN. + +Spotted by syzkaller. + +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: Fabiano Rosas +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210901084550.1658699-1-aik@ozlabs.ru +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv_nested.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_hv_nested.c b/arch/powerpc/kvm/book3s_hv_nested.c +index 9906d203d9d39..613d24b707abe 100644 +--- a/arch/powerpc/kvm/book3s_hv_nested.c ++++ b/arch/powerpc/kvm/book3s_hv_nested.c +@@ -510,7 +510,7 @@ long kvmhv_copy_tofrom_guest_nested(struct kvm_vcpu *vcpu) + if (eaddr & (0xFFFUL << 52)) + return H_PARAMETER; + +- buf = kzalloc(n, GFP_KERNEL); ++ buf = kzalloc(n, GFP_KERNEL | __GFP_NOWARN); + if (!buf) + return H_NO_MEM; + +-- +2.34.1 + diff --git a/queue-5.4/libbpf-validate-that-.btf-and-.btf.ext-sections-cont.patch b/queue-5.4/libbpf-validate-that-.btf-and-.btf.ext-sections-cont.patch new file mode 100644 index 00000000000..da5bdb9eb6e --- /dev/null +++ b/queue-5.4/libbpf-validate-that-.btf-and-.btf.ext-sections-cont.patch @@ -0,0 +1,43 @@ +From 2c8310d2705aea870ef92f89c49c504648aea9fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Nov 2021 10:32:11 -0700 +Subject: libbpf: Validate that .BTF and .BTF.ext sections contain data + +From: Andrii Nakryiko + +[ Upstream commit 62554d52e71797eefa3fc15b54008038837bb2d4 ] + +.BTF and .BTF.ext ELF sections should have SHT_PROGBITS type and contain +data. If they are not, ELF is invalid or corrupted, so bail out. +Otherwise this can lead to data->d_buf being NULL and SIGSEGV later on. +Reported by oss-fuzz project. + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20211103173213.1376990-4-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 2a1dbf52fc9a5..54e776886bf1e 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1578,8 +1578,12 @@ static int bpf_object__elf_collect(struct bpf_object *obj, int flags) + } else if (strcmp(name, MAPS_ELF_SEC) == 0) { + obj->efile.btf_maps_shndx = idx; + } else if (strcmp(name, BTF_ELF_SEC) == 0) { ++ if (sh->sh_type != SHT_PROGBITS) ++ return -LIBBPF_ERRNO__FORMAT; + btf_data = data; + } else if (strcmp(name, BTF_EXT_ELF_SEC) == 0) { ++ if (sh->sh_type != SHT_PROGBITS) ++ return -LIBBPF_ERRNO__FORMAT; + btf_ext_data = data; + } else if (sh.sh_type == SHT_SYMTAB) { + if (obj->efile.symbols) { +-- +2.34.1 + diff --git a/queue-5.4/mac80211-allow-non-standard-vht-mcs-10-11.patch b/queue-5.4/mac80211-allow-non-standard-vht-mcs-10-11.patch new file mode 100644 index 00000000000..13076fd5b46 --- /dev/null +++ b/queue-5.4/mac80211-allow-non-standard-vht-mcs-10-11.patch @@ -0,0 +1,49 @@ +From e252082bdf2ad2590d4f0616a6daabed049c38ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jan 2022 09:36:21 +0800 +Subject: mac80211: allow non-standard VHT MCS-10/11 + +From: Ping-Ke Shih + +[ Upstream commit 04be6d337d37400ad5b3d5f27ca87645ee5a18a3 ] + +Some AP can possibly try non-standard VHT rate and mac80211 warns and drops +packets, and leads low TCP throughput. + + Rate marked as a VHT rate but data is invalid: MCS: 10, NSS: 2 + WARNING: CPU: 1 PID: 7817 at net/mac80211/rx.c:4856 ieee80211_rx_list+0x223/0x2f0 [mac8021 + +Since commit c27aa56a72b8 ("cfg80211: add VHT rate entries for MCS-10 and MCS-11") +has added, mac80211 adds this support as well. + +After this patch, throughput is good and iw can get the bitrate: + rx bitrate: 975.1 MBit/s VHT-MCS 10 80MHz short GI VHT-NSS 2 +or + rx bitrate: 1083.3 MBit/s VHT-MCS 11 80MHz short GI VHT-NSS 2 + +Buglink: https://bugzilla.suse.com/show_bug.cgi?id=1192891 +Reported-by: Goldwyn Rodrigues +Signed-off-by: Ping-Ke Shih +Link: https://lore.kernel.org/r/20220103013623.17052-1-pkshih@realtek.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 282bf336b15a4..464029892478f 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4693,7 +4693,7 @@ void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, + goto drop; + break; + case RX_ENC_VHT: +- if (WARN_ONCE(status->rate_idx > 9 || ++ if (WARN_ONCE(status->rate_idx > 11 || + !status->nss || + status->nss > 8, + "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", +-- +2.34.1 + diff --git a/queue-5.4/media-aspeed-fix-mode-detect-always-time-out-at-2nd-.patch b/queue-5.4/media-aspeed-fix-mode-detect-always-time-out-at-2nd-.patch new file mode 100644 index 00000000000..92e46158375 --- /dev/null +++ b/queue-5.4/media-aspeed-fix-mode-detect-always-time-out-at-2nd-.patch @@ -0,0 +1,56 @@ +From ccf4350695d9c61380c6621b1b7fc24a9d70852f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Nov 2021 08:23:54 +0000 +Subject: media: aspeed: fix mode-detect always time out at 2nd run + +From: Jammy Huang + +[ Upstream commit 62cea52ad4bead0ae4be2cfe1142eb0aae0e9fbd ] + +aspeed_video_get_resolution() will try to do res-detect again if the +timing got in last try is invalid. But it will always time out because +VE_SEQ_CTRL_TRIG_MODE_DET is only cleared after 1st mode-detect. + +To fix the problem, just clear VE_SEQ_CTRL_TRIG_MODE_DET before setting +it in aspeed_video_enable_mode_detect(). + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Signed-off-by: Jammy Huang +Acked-by: Paul Menzel +Reviewed-by: Joel Stanley +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/aspeed-video.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index 6dde49d9aa4c2..be1238f22b8ae 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -477,6 +477,10 @@ static void aspeed_video_enable_mode_detect(struct aspeed_video *video) + aspeed_video_update(video, VE_INTERRUPT_CTRL, 0, + VE_INTERRUPT_MODE_DETECT); + ++ /* Disable mode detect in order to re-trigger */ ++ aspeed_video_update(video, VE_SEQ_CTRL, ++ VE_SEQ_CTRL_TRIG_MODE_DET, 0); ++ + /* Trigger mode detect */ + aspeed_video_update(video, VE_SEQ_CTRL, 0, VE_SEQ_CTRL_TRIG_MODE_DET); + } +@@ -764,10 +768,6 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + return; + } + +- /* Disable mode detect in order to re-trigger */ +- aspeed_video_update(video, VE_SEQ_CTRL, +- VE_SEQ_CTRL_TRIG_MODE_DET, 0); +- + aspeed_video_check_and_set_polarity(video); + + aspeed_video_enable_mode_detect(video); +-- +2.34.1 + diff --git a/queue-5.4/media-aspeed-update-signal-status-immediately-to-ens.patch b/queue-5.4/media-aspeed-update-signal-status-immediately-to-ens.patch new file mode 100644 index 00000000000..1b71751d9c0 --- /dev/null +++ b/queue-5.4/media-aspeed-update-signal-status-immediately-to-ens.patch @@ -0,0 +1,66 @@ +From 33d108a0a8192b4953950a2b446762ff8ff43a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Nov 2021 03:12:27 +0000 +Subject: media: aspeed: Update signal status immediately to ensure sane hw + state + +From: Jammy Huang + +[ Upstream commit af6d1bde395cac174ee71adcd3fa43f6435c7206 ] + +If res-chg, VE_INTERRUPT_MODE_DETECT_WD irq will be raised. But +v4l2_input_status won't be updated to no-signal immediately until +aspeed_video_get_resolution() in aspeed_video_resolution_work(). + +During the period of time, aspeed_video_start_frame() could be called +because it doesn't know signal becomes unstable now. If it goes with +aspeed_video_init_regs() of aspeed_video_irq_res_change() +simultaneously, it will mess up hw state. + +To fix this problem, v4l2_input_status is updated to no-signal +immediately for VE_INTERRUPT_MODE_DETECT_WD irq. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Signed-off-by: Jammy Huang +Acked-by: Paul Menzel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/aspeed-video.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index be1238f22b8ae..1e0867016bf37 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -533,6 +533,8 @@ static void aspeed_video_irq_res_change(struct aspeed_video *video, ulong delay) + set_bit(VIDEO_RES_CHANGE, &video->flags); + clear_bit(VIDEO_FRAME_INPRG, &video->flags); + ++ video->v4l2_input_status = V4L2_IN_ST_NO_SIGNAL; ++ + aspeed_video_off(video); + aspeed_video_bufs_done(video, VB2_BUF_STATE_ERROR); + +@@ -1315,7 +1317,6 @@ static void aspeed_video_resolution_work(struct work_struct *work) + struct delayed_work *dwork = to_delayed_work(work); + struct aspeed_video *video = container_of(dwork, struct aspeed_video, + res_work); +- u32 input_status = video->v4l2_input_status; + + aspeed_video_on(video); + +@@ -1328,8 +1329,7 @@ static void aspeed_video_resolution_work(struct work_struct *work) + aspeed_video_get_resolution(video); + + if (video->detected_timings.width != video->active_timings.width || +- video->detected_timings.height != video->active_timings.height || +- input_status != video->v4l2_input_status) { ++ video->detected_timings.height != video->active_timings.height) { + static const struct v4l2_event ev = { + .type = V4L2_EVENT_SOURCE_CHANGE, + .u.src_change.changes = V4L2_EVENT_SRC_CH_RESOLUTION, +-- +2.34.1 + diff --git a/queue-5.4/media-b2c2-add-missing-check-in-flexcop_pci_isr.patch b/queue-5.4/media-b2c2-add-missing-check-in-flexcop_pci_isr.patch new file mode 100644 index 00000000000..2de04a8b3f9 --- /dev/null +++ b/queue-5.4/media-b2c2-add-missing-check-in-flexcop_pci_isr.patch @@ -0,0 +1,163 @@ +From d61290260fbb32a26633b86b1dd80bcc573570bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 10:00:03 +0100 +Subject: media: b2c2: Add missing check in flexcop_pci_isr: + +From: Zheyu Ma + +[ Upstream commit b13203032e679674c7c518f52a7ec0801ca3a829 ] + +A out-of-bounds bug can be triggered by an interrupt, the reason for +this bug is the lack of checking of register values. + +In flexcop_pci_isr, the driver reads value from a register and uses it as +a dma address. Finally, this address will be passed to the count parameter +of find_next_packet. If this value is larger than the size of dma, the +index of buffer will be out-of-bounds. + +Fix this by adding a check after reading the value of the register. + +The following KASAN report reveals it: + +BUG: KASAN: slab-out-of-bounds in find_next_packet +drivers/media/dvb-core/dvb_demux.c:528 [inline] +BUG: KASAN: slab-out-of-bounds in _dvb_dmx_swfilter +drivers/media/dvb-core/dvb_demux.c:572 [inline] +BUG: KASAN: slab-out-of-bounds in dvb_dmx_swfilter+0x3fa/0x420 +drivers/media/dvb-core/dvb_demux.c:603 +Read of size 1 at addr ffff8880608c00a0 by task swapper/2/0 + +CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef #25 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xec/0x156 lib/dump_stack.c:118 + print_address_description+0x78/0x290 mm/kasan/report.c:256 + kasan_report_error mm/kasan/report.c:354 [inline] + kasan_report+0x25b/0x380 mm/kasan/report.c:412 + __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:430 + find_next_packet drivers/media/dvb-core/dvb_demux.c:528 [inline] + _dvb_dmx_swfilter drivers/media/dvb-core/dvb_demux.c:572 [inline] + dvb_dmx_swfilter+0x3fa/0x420 drivers/media/dvb-core/dvb_demux.c:603 + flexcop_pass_dmx_data+0x2e/0x40 drivers/media/common/b2c2/flexcop.c:167 + flexcop_pci_isr+0x3d1/0x5d0 drivers/media/pci/b2c2/flexcop-pci.c:212 + __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 + handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 + handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 + handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 + generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] + handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 + do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 + common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 + +RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 +Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 62 2f 8c 48 89 e5 e8 fb 31 +e8 f8 8b 05 75 4f 8e 03 85 c0 7e 07 0f 00 2d 8a 61 66 00 fb f4 <5d> c3 +90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 +RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde +RAX: 0000000000000000 RBX: ffffffff8bde44c8 RCX: ffffffff88a11285 +RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2f6200 +RBP: ffff88806b71fcc8 R08: fffffbfff185ec40 R09: fffffbfff185ec40 +R10: 0000000000000001 R11: fffffbfff185ec40 R12: 0000000000000002 +R13: ffffffff8be9d6e0 R14: 0000000000000000 R15: 0000000000000000 + arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] + default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 + arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 + default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 + cpuidle_idle_call kernel/sched/idle.c:153 [inline] + do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 + cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 + start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 + secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 + +Allocated by task 1: + save_stack+0x43/0xd0 mm/kasan/kasan.c:448 + set_track mm/kasan/kasan.c:460 [inline] + kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:553 + kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 + slab_post_alloc_hook mm/slab.h:445 [inline] + slab_alloc_node mm/slub.c:2741 [inline] + slab_alloc mm/slub.c:2749 [inline] + kmem_cache_alloc+0xeb/0x280 mm/slub.c:2754 + kmem_cache_zalloc include/linux/slab.h:699 [inline] + __kernfs_new_node+0xe2/0x6f0 fs/kernfs/dir.c:633 + kernfs_new_node+0x9a/0x120 fs/kernfs/dir.c:693 + __kernfs_create_file+0x5f/0x340 fs/kernfs/file.c:992 + sysfs_add_file_mode_ns+0x22a/0x4e0 fs/sysfs/file.c:306 + create_files fs/sysfs/group.c:63 [inline] + internal_create_group+0x34e/0xc30 fs/sysfs/group.c:147 + sysfs_create_group fs/sysfs/group.c:173 [inline] + sysfs_create_groups+0x9c/0x140 fs/sysfs/group.c:200 + driver_add_groups+0x3e/0x50 drivers/base/driver.c:129 + bus_add_driver+0x3a5/0x790 drivers/base/bus.c:684 + driver_register+0x1cd/0x410 drivers/base/driver.c:170 + __pci_register_driver+0x197/0x200 drivers/pci/pci-driver.c:1411 + cx88_audio_pci_driver_init+0x23/0x25 drivers/media/pci/cx88/cx88-alsa.c: + 1017 + do_one_initcall+0xe0/0x610 init/main.c:884 + do_initcall_level init/main.c:952 [inline] + do_initcalls init/main.c:960 [inline] + do_basic_setup init/main.c:978 [inline] + kernel_init_freeable+0x4d0/0x592 init/main.c:1145 + kernel_init+0x18/0x190 init/main.c:1062 + ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 + +Freed by task 0: +(stack is not available) + +The buggy address belongs to the object at ffff8880608c0000 + which belongs to the cache kernfs_node_cache of size 160 +The buggy address is located 0 bytes to the right of + 160-byte region [ffff8880608c0000, ffff8880608c00a0) +The buggy address belongs to the page: +page:ffffea0001823000 count:1 mapcount:0 mapping:ffff88806bed1e00 +index:0x0 compound_mapcount: 0 +flags: 0x100000000008100(slab|head) +raw: 0100000000008100 dead000000000100 dead000000000200 ffff88806bed1e00 +raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff8880608bff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffff8880608c0000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +>ffff8880608c0080: 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 00 + ^ + ffff8880608c0100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffff8880608c0180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 +================================================================== + +Link: https://lore.kernel.org/linux-media/1620723603-30912-1-git-send-email-zheyuma97@gmail.com +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/b2c2/flexcop-pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/b2c2/flexcop-pci.c b/drivers/media/pci/b2c2/flexcop-pci.c +index a9d9520a94c6d..c9e6c7d663768 100644 +--- a/drivers/media/pci/b2c2/flexcop-pci.c ++++ b/drivers/media/pci/b2c2/flexcop-pci.c +@@ -185,6 +185,8 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id) + dma_addr_t cur_addr = + fc->read_ibi_reg(fc,dma1_008).dma_0x8.dma_cur_addr << 2; + u32 cur_pos = cur_addr - fc_pci->dma[0].dma_addr0; ++ if (cur_pos > fc_pci->dma[0].size * 2) ++ goto error; + + deb_irq("%u irq: %08x cur_addr: %llx: cur_pos: %08x, last_cur_pos: %08x ", + jiffies_to_usecs(jiffies - fc_pci->last_irq), +@@ -225,6 +227,7 @@ static irqreturn_t flexcop_pci_isr(int irq, void *dev_id) + ret = IRQ_NONE; + } + ++error: + spin_unlock_irqrestore(&fc_pci->irq_lock, flags); + return ret; + } +-- +2.34.1 + diff --git a/queue-5.4/media-coda-imx-vdoa-handle-dma_set_coherent_mask-err.patch b/queue-5.4/media-coda-imx-vdoa-handle-dma_set_coherent_mask-err.patch new file mode 100644 index 00000000000..f79237f4f64 --- /dev/null +++ b/queue-5.4/media-coda-imx-vdoa-handle-dma_set_coherent_mask-err.patch @@ -0,0 +1,41 @@ +From 731e556757f9776e0898b1097cbaf2fd9c8cd3a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Dec 2021 03:22:01 +0100 +Subject: media: coda/imx-vdoa: Handle dma_set_coherent_mask error codes + +From: Jiasheng Jiang + +[ Upstream commit 43f0633f89947df57fe0b5025bdd741768007708 ] + +The return value of dma_set_coherent_mask() is not always 0. +To catch the exception in case that dma is not support the mask. + +Link: https://lore.kernel.org/linux-media/20211206022201.1639460-1-jiasheng@iscas.ac.cn +Fixes: b0444f18e0b1 ("[media] coda: add i.MX6 VDOA driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/imx-vdoa.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/coda/imx-vdoa.c b/drivers/media/platform/coda/imx-vdoa.c +index 8bc0d83718193..dd6e2e320264e 100644 +--- a/drivers/media/platform/coda/imx-vdoa.c ++++ b/drivers/media/platform/coda/imx-vdoa.c +@@ -287,7 +287,11 @@ static int vdoa_probe(struct platform_device *pdev) + struct resource *res; + int ret; + +- dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ if (ret) { ++ dev_err(&pdev->dev, "DMA enable failed\n"); ++ return ret; ++ } + + vdoa = devm_kzalloc(&pdev->dev, sizeof(*vdoa), GFP_KERNEL); + if (!vdoa) +-- +2.34.1 + diff --git a/queue-5.4/media-dib8000-fix-a-memleak-in-dib8000_init.patch b/queue-5.4/media-dib8000-fix-a-memleak-in-dib8000_init.patch new file mode 100644 index 00000000000..c45aeafac9a --- /dev/null +++ b/queue-5.4/media-dib8000-fix-a-memleak-in-dib8000_init.patch @@ -0,0 +1,55 @@ +From 1de5be17abc774b7b57f3f8dd02c3b12cdfd936a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 16:38:05 +0100 +Subject: media: dib8000: Fix a memleak in dib8000_init() + +From: Zhou Qingyang + +[ Upstream commit 8dbdcc7269a83305ee9d677b75064d3530a48ee2 ] + +In dib8000_init(), the variable fe is not freed or passed out on the +failure of dib8000_identify(&state->i2c), which could lead to a memleak. + +Fix this bug by adding a kfree of fe in the error path. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_DVB_DIB8000=m show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 77e2c0f5d471 ("V4L/DVB (12900): DiB8000: added support for DiBcom ISDB-T/ISDB-Tsb demodulator DiB8000") +Signed-off-by: Zhou Qingyang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/dib8000.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/dib8000.c b/drivers/media/dvb-frontends/dib8000.c +index bb02354a48b81..d67f2dd997d06 100644 +--- a/drivers/media/dvb-frontends/dib8000.c ++++ b/drivers/media/dvb-frontends/dib8000.c +@@ -4473,8 +4473,10 @@ static struct dvb_frontend *dib8000_init(struct i2c_adapter *i2c_adap, u8 i2c_ad + + state->timf_default = cfg->pll->timf; + +- if (dib8000_identify(&state->i2c) == 0) ++ if (dib8000_identify(&state->i2c) == 0) { ++ kfree(fe); + goto error; ++ } + + dibx000_init_i2c_master(&state->i2c_master, DIB8000, state->i2c.adap, state->i2c.addr); + +-- +2.34.1 + diff --git a/queue-5.4/media-dmxdev-fix-uaf-when-dvb_register_device-fails.patch b/queue-5.4/media-dmxdev-fix-uaf-when-dvb_register_device-fails.patch new file mode 100644 index 00000000000..819c1393d9a --- /dev/null +++ b/queue-5.4/media-dmxdev-fix-uaf-when-dvb_register_device-fails.patch @@ -0,0 +1,104 @@ +From 55a46343c1daf8c494605acb4b2ef9bd65b04cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 16:57:41 +0800 +Subject: media: dmxdev: fix UAF when dvb_register_device() fails + +From: Wang Hai + +[ Upstream commit ab599eb11882f834951c436cc080c3455ba32b9b ] + +I got a use-after-free report: + +dvbdev: dvb_register_device: failed to create device dvb1.dvr0 (-12) +... +================================================================== +BUG: KASAN: use-after-free in dvb_dmxdev_release+0xce/0x2f0 +... +Call Trace: + dump_stack_lvl+0x6c/0x8b + print_address_description.constprop.0+0x48/0x70 + kasan_report.cold+0x82/0xdb + __asan_load4+0x6b/0x90 + dvb_dmxdev_release+0xce/0x2f0 +... +Allocated by task 7666: + kasan_save_stack+0x23/0x50 + __kasan_kmalloc+0x83/0xa0 + kmem_cache_alloc_trace+0x22e/0x470 + dvb_register_device+0x12f/0x980 + dvb_dmxdev_init+0x1f3/0x230 +... +Freed by task 7666: + kasan_save_stack+0x23/0x50 + kasan_set_track+0x20/0x30 + kasan_set_free_info+0x24/0x40 + __kasan_slab_free+0xf2/0x130 + kfree+0xd1/0x5c0 + dvb_register_device.cold+0x1ac/0x1fa + dvb_dmxdev_init+0x1f3/0x230 +... + +When dvb_register_device() in dvb_dmxdev_init() fails, dvb_dmxdev_init() +does not return a failure, and the memory pointed to by dvbdev or +dvr_dvbdev is invalid at this point. If they are used subsequently, it +will result in UFA or null-ptr-deref. + +If dvb_register_device() in dvb_dmxdev_init() fails, fix the bug by making +dvb_dmxdev_init() return an error as well. + +Link: https://lore.kernel.org/linux-media/20211015085741.1203283-1-wanghai38@huawei.com + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dmxdev.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index f14a872d12687..e58cb8434dafe 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -1413,7 +1413,7 @@ static const struct dvb_device dvbdev_dvr = { + }; + int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) + { +- int i; ++ int i, ret; + + if (dmxdev->demux->open(dmxdev->demux) < 0) + return -EUSERS; +@@ -1432,14 +1432,26 @@ int dvb_dmxdev_init(struct dmxdev *dmxdev, struct dvb_adapter *dvb_adapter) + DMXDEV_STATE_FREE); + } + +- dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, ++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvbdev, &dvbdev_demux, dmxdev, + DVB_DEVICE_DEMUX, dmxdev->filternum); +- dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, ++ if (ret < 0) ++ goto err_register_dvbdev; ++ ++ ret = dvb_register_device(dvb_adapter, &dmxdev->dvr_dvbdev, &dvbdev_dvr, + dmxdev, DVB_DEVICE_DVR, dmxdev->filternum); ++ if (ret < 0) ++ goto err_register_dvr_dvbdev; + + dvb_ringbuffer_init(&dmxdev->dvr_buffer, NULL, 8192); + + return 0; ++ ++err_register_dvr_dvbdev: ++ dvb_unregister_device(dmxdev->dvbdev); ++err_register_dvbdev: ++ vfree(dmxdev->filter); ++ dmxdev->filter = NULL; ++ return ret; + } + + EXPORT_SYMBOL(dvb_dmxdev_init); +-- +2.34.1 + diff --git a/queue-5.4/media-dw2102-fix-use-after-free.patch b/queue-5.4/media-dw2102-fix-use-after-free.patch new file mode 100644 index 00000000000..6fa1254eb35 --- /dev/null +++ b/queue-5.4/media-dw2102-fix-use-after-free.patch @@ -0,0 +1,407 @@ +From d2f6be9ad9c0144fc9b1ce9b8b7a3da9f069127b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 12:41:47 +0200 +Subject: media: dw2102: Fix use after free + +From: Anton Vasilyev + +[ Upstream commit 589a9f0eb799f77de2c09583bf5bad221fa5d685 ] + +dvb_usb_device_init stores parts of properties at d->props +and d->desc and uses it on dvb_usb_device_exit. +Free of properties on module probe leads to use after free. +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204597 + +The patch makes properties static instead of allocated on heap to prevent +memleak and use after free. +Also fixes s421_properties.devices initialization to have 2 element +instead of 6 copied from p7500_properties. + +[mchehab: fix function call alignments] +Link: https://lore.kernel.org/linux-media/20190822104147.4420-1-vasilyev@ispras.ru +Signed-off-by: Anton Vasilyev +Fixes: 299c7007e936 ("media: dw2102: Fix memleak on sequence of probes") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/dw2102.c | 338 ++++++++++++++++++----------- + 1 file changed, 215 insertions(+), 123 deletions(-) + +diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c +index b960abd00d483..8493ebb377c4d 100644 +--- a/drivers/media/usb/dvb-usb/dw2102.c ++++ b/drivers/media/usb/dvb-usb/dw2102.c +@@ -2098,46 +2098,153 @@ static struct dvb_usb_device_properties s6x0_properties = { + } + }; + +-static const struct dvb_usb_device_description d1100 = { +- "Prof 1100 USB ", +- {&dw2102_table[PROF_1100], NULL}, +- {NULL}, +-}; ++static struct dvb_usb_device_properties p1100_properties = { ++ .caps = DVB_USB_IS_AN_I2C_ADAPTER, ++ .usb_ctrl = DEVICE_SPECIFIC, ++ .size_of_priv = sizeof(struct dw2102_state), ++ .firmware = P1100_FIRMWARE, ++ .no_reconnect = 1, + +-static const struct dvb_usb_device_description d660 = { +- "TeVii S660 USB", +- {&dw2102_table[TEVII_S660], NULL}, +- {NULL}, +-}; ++ .i2c_algo = &s6x0_i2c_algo, ++ .rc.core = { ++ .rc_interval = 150, ++ .rc_codes = RC_MAP_TBS_NEC, ++ .module_name = "dw2102", ++ .allowed_protos = RC_PROTO_BIT_NEC, ++ .rc_query = prof_rc_query, ++ }, + +-static const struct dvb_usb_device_description d480_1 = { +- "TeVii S480.1 USB", +- {&dw2102_table[TEVII_S480_1], NULL}, +- {NULL}, ++ .generic_bulk_ctrl_endpoint = 0x81, ++ .num_adapters = 1, ++ .download_firmware = dw2102_load_firmware, ++ .read_mac_address = s6x0_read_mac_address, ++ .adapter = { ++ { ++ .num_frontends = 1, ++ .fe = {{ ++ .frontend_attach = stv0288_frontend_attach, ++ .stream = { ++ .type = USB_BULK, ++ .count = 8, ++ .endpoint = 0x82, ++ .u = { ++ .bulk = { ++ .buffersize = 4096, ++ } ++ } ++ }, ++ } }, ++ } ++ }, ++ .num_device_descs = 1, ++ .devices = { ++ {"Prof 1100 USB ", ++ {&dw2102_table[PROF_1100], NULL}, ++ {NULL}, ++ }, ++ } + }; + +-static const struct dvb_usb_device_description d480_2 = { +- "TeVii S480.2 USB", +- {&dw2102_table[TEVII_S480_2], NULL}, +- {NULL}, +-}; ++static struct dvb_usb_device_properties s660_properties = { ++ .caps = DVB_USB_IS_AN_I2C_ADAPTER, ++ .usb_ctrl = DEVICE_SPECIFIC, ++ .size_of_priv = sizeof(struct dw2102_state), ++ .firmware = S660_FIRMWARE, ++ .no_reconnect = 1, + +-static const struct dvb_usb_device_description d7500 = { +- "Prof 7500 USB DVB-S2", +- {&dw2102_table[PROF_7500], NULL}, +- {NULL}, +-}; ++ .i2c_algo = &s6x0_i2c_algo, ++ .rc.core = { ++ .rc_interval = 150, ++ .rc_codes = RC_MAP_TEVII_NEC, ++ .module_name = "dw2102", ++ .allowed_protos = RC_PROTO_BIT_NEC, ++ .rc_query = dw2102_rc_query, ++ }, + +-static const struct dvb_usb_device_description d421 = { +- "TeVii S421 PCI", +- {&dw2102_table[TEVII_S421], NULL}, +- {NULL}, ++ .generic_bulk_ctrl_endpoint = 0x81, ++ .num_adapters = 1, ++ .download_firmware = dw2102_load_firmware, ++ .read_mac_address = s6x0_read_mac_address, ++ .adapter = { ++ { ++ .num_frontends = 1, ++ .fe = {{ ++ .frontend_attach = ds3000_frontend_attach, ++ .stream = { ++ .type = USB_BULK, ++ .count = 8, ++ .endpoint = 0x82, ++ .u = { ++ .bulk = { ++ .buffersize = 4096, ++ } ++ } ++ }, ++ } }, ++ } ++ }, ++ .num_device_descs = 3, ++ .devices = { ++ {"TeVii S660 USB", ++ {&dw2102_table[TEVII_S660], NULL}, ++ {NULL}, ++ }, ++ {"TeVii S480.1 USB", ++ {&dw2102_table[TEVII_S480_1], NULL}, ++ {NULL}, ++ }, ++ {"TeVii S480.2 USB", ++ {&dw2102_table[TEVII_S480_2], NULL}, ++ {NULL}, ++ }, ++ } + }; + +-static const struct dvb_usb_device_description d632 = { +- "TeVii S632 USB", +- {&dw2102_table[TEVII_S632], NULL}, +- {NULL}, ++static struct dvb_usb_device_properties p7500_properties = { ++ .caps = DVB_USB_IS_AN_I2C_ADAPTER, ++ .usb_ctrl = DEVICE_SPECIFIC, ++ .size_of_priv = sizeof(struct dw2102_state), ++ .firmware = P7500_FIRMWARE, ++ .no_reconnect = 1, ++ ++ .i2c_algo = &s6x0_i2c_algo, ++ .rc.core = { ++ .rc_interval = 150, ++ .rc_codes = RC_MAP_TBS_NEC, ++ .module_name = "dw2102", ++ .allowed_protos = RC_PROTO_BIT_NEC, ++ .rc_query = prof_rc_query, ++ }, ++ ++ .generic_bulk_ctrl_endpoint = 0x81, ++ .num_adapters = 1, ++ .download_firmware = dw2102_load_firmware, ++ .read_mac_address = s6x0_read_mac_address, ++ .adapter = { ++ { ++ .num_frontends = 1, ++ .fe = {{ ++ .frontend_attach = prof_7500_frontend_attach, ++ .stream = { ++ .type = USB_BULK, ++ .count = 8, ++ .endpoint = 0x82, ++ .u = { ++ .bulk = { ++ .buffersize = 4096, ++ } ++ } ++ }, ++ } }, ++ } ++ }, ++ .num_device_descs = 1, ++ .devices = { ++ {"Prof 7500 USB DVB-S2", ++ {&dw2102_table[PROF_7500], NULL}, ++ {NULL}, ++ }, ++ } + }; + + static struct dvb_usb_device_properties su3000_properties = { +@@ -2209,6 +2316,59 @@ static struct dvb_usb_device_properties su3000_properties = { + } + }; + ++static struct dvb_usb_device_properties s421_properties = { ++ .caps = DVB_USB_IS_AN_I2C_ADAPTER, ++ .usb_ctrl = DEVICE_SPECIFIC, ++ .size_of_priv = sizeof(struct dw2102_state), ++ .power_ctrl = su3000_power_ctrl, ++ .num_adapters = 1, ++ .identify_state = su3000_identify_state, ++ .i2c_algo = &su3000_i2c_algo, ++ ++ .rc.core = { ++ .rc_interval = 150, ++ .rc_codes = RC_MAP_SU3000, ++ .module_name = "dw2102", ++ .allowed_protos = RC_PROTO_BIT_RC5, ++ .rc_query = su3000_rc_query, ++ }, ++ ++ .read_mac_address = su3000_read_mac_address, ++ ++ .generic_bulk_ctrl_endpoint = 0x01, ++ ++ .adapter = { ++ { ++ .num_frontends = 1, ++ .fe = {{ ++ .streaming_ctrl = su3000_streaming_ctrl, ++ .frontend_attach = m88rs2000_frontend_attach, ++ .stream = { ++ .type = USB_BULK, ++ .count = 8, ++ .endpoint = 0x82, ++ .u = { ++ .bulk = { ++ .buffersize = 4096, ++ } ++ } ++ } ++ } }, ++ } ++ }, ++ .num_device_descs = 2, ++ .devices = { ++ { "TeVii S421 PCI", ++ { &dw2102_table[TEVII_S421], NULL }, ++ { NULL }, ++ }, ++ { "TeVii S632 USB", ++ { &dw2102_table[TEVII_S632], NULL }, ++ { NULL }, ++ }, ++ } ++}; ++ + static struct dvb_usb_device_properties t220_properties = { + .caps = DVB_USB_IS_AN_I2C_ADAPTER, + .usb_ctrl = DEVICE_SPECIFIC, +@@ -2326,101 +2486,33 @@ static struct dvb_usb_device_properties tt_s2_4600_properties = { + static int dw2102_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { +- int retval = -ENOMEM; +- struct dvb_usb_device_properties *p1100; +- struct dvb_usb_device_properties *s660; +- struct dvb_usb_device_properties *p7500; +- struct dvb_usb_device_properties *s421; +- +- p1100 = kmemdup(&s6x0_properties, +- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); +- if (!p1100) +- goto err0; +- +- /* copy default structure */ +- /* fill only different fields */ +- p1100->firmware = P1100_FIRMWARE; +- p1100->devices[0] = d1100; +- p1100->rc.core.rc_query = prof_rc_query; +- p1100->rc.core.rc_codes = RC_MAP_TBS_NEC; +- p1100->adapter->fe[0].frontend_attach = stv0288_frontend_attach; +- +- s660 = kmemdup(&s6x0_properties, +- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); +- if (!s660) +- goto err1; +- +- s660->firmware = S660_FIRMWARE; +- s660->num_device_descs = 3; +- s660->devices[0] = d660; +- s660->devices[1] = d480_1; +- s660->devices[2] = d480_2; +- s660->adapter->fe[0].frontend_attach = ds3000_frontend_attach; +- +- p7500 = kmemdup(&s6x0_properties, +- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); +- if (!p7500) +- goto err2; +- +- p7500->firmware = P7500_FIRMWARE; +- p7500->devices[0] = d7500; +- p7500->rc.core.rc_query = prof_rc_query; +- p7500->rc.core.rc_codes = RC_MAP_TBS_NEC; +- p7500->adapter->fe[0].frontend_attach = prof_7500_frontend_attach; +- +- +- s421 = kmemdup(&su3000_properties, +- sizeof(struct dvb_usb_device_properties), GFP_KERNEL); +- if (!s421) +- goto err3; +- +- s421->num_device_descs = 2; +- s421->devices[0] = d421; +- s421->devices[1] = d632; +- s421->adapter->fe[0].frontend_attach = m88rs2000_frontend_attach; +- +- if (0 == dvb_usb_device_init(intf, &dw2102_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &dw2104_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &dw3101_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &s6x0_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, p1100, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, s660, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, p7500, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, s421, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &su3000_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &t220_properties, +- THIS_MODULE, NULL, adapter_nr) || +- 0 == dvb_usb_device_init(intf, &tt_s2_4600_properties, +- THIS_MODULE, NULL, adapter_nr)) { +- +- /* clean up copied properties */ +- kfree(s421); +- kfree(p7500); +- kfree(s660); +- kfree(p1100); ++ if (!(dvb_usb_device_init(intf, &dw2102_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &dw2104_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &dw3101_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &s6x0_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &p1100_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &s660_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &p7500_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &s421_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &su3000_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &t220_properties, ++ THIS_MODULE, NULL, adapter_nr) && ++ dvb_usb_device_init(intf, &tt_s2_4600_properties, ++ THIS_MODULE, NULL, adapter_nr))) { + + return 0; + } + +- retval = -ENODEV; +- kfree(s421); +-err3: +- kfree(p7500); +-err2: +- kfree(s660); +-err1: +- kfree(p1100); +-err0: +- return retval; ++ return -ENODEV; + } + + static void dw2102_disconnect(struct usb_interface *intf) +-- +2.34.1 + diff --git a/queue-5.4/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch b/queue-5.4/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch new file mode 100644 index 00000000000..3ec8d9b6368 --- /dev/null +++ b/queue-5.4/media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch @@ -0,0 +1,81 @@ +From 26fad640fb49748fff93c1c53ff3a0ab9a335cc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 09:55:39 +0000 +Subject: media: em28xx: fix memory leak in em28xx_init_dev + +From: Dongliang Mu + +[ Upstream commit 22be5a10d0b24eec9e45decd15d7e6112b25f080 ] + +In the em28xx_init_rev, if em28xx_audio_setup fails, this function fails +to deallocate the media_dev allocated in the em28xx_media_device_init. + +Fix this by adding em28xx_unregister_media_device to free media_dev. + +BTW, this patch is tested in my local syzkaller instance, and it can +prevent the memory leak from occurring again. + +CC: Pavel Skripkin +Fixes: 37ecc7b1278f ("[media] em28xx: add media controller support") +Signed-off-by: Dongliang Mu +Reported-by: syzkaller +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-cards.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 3e96b4b711d75..bfca9d0a1fe15 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3515,8 +3515,10 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, + + if (dev->is_audio_only) { + retval = em28xx_audio_setup(dev); +- if (retval) +- return -ENODEV; ++ if (retval) { ++ retval = -ENODEV; ++ goto err_deinit_media; ++ } + em28xx_init_extension(dev); + + return 0; +@@ -3535,7 +3537,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, + dev_err(&dev->intf->dev, + "%s: em28xx_i2c_register bus 0 - error [%d]!\n", + __func__, retval); +- return retval; ++ goto err_deinit_media; + } + + /* register i2c bus 1 */ +@@ -3551,9 +3553,7 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, + "%s: em28xx_i2c_register bus 1 - error [%d]!\n", + __func__, retval); + +- em28xx_i2c_unregister(dev, 0); +- +- return retval; ++ goto err_unreg_i2c; + } + } + +@@ -3561,6 +3561,12 @@ static int em28xx_init_dev(struct em28xx *dev, struct usb_device *udev, + em28xx_card_setup(dev); + + return 0; ++ ++err_unreg_i2c: ++ em28xx_i2c_unregister(dev, 0); ++err_deinit_media: ++ em28xx_unregister_media_device(dev); ++ return retval; + } + + static int em28xx_duplicate_dev(struct em28xx *dev) +-- +2.34.1 + diff --git a/queue-5.4/media-hantro-fix-probe-func-error-path.patch b/queue-5.4/media-hantro-fix-probe-func-error-path.patch new file mode 100644 index 00000000000..906815d032a --- /dev/null +++ b/queue-5.4/media-hantro-fix-probe-func-error-path.patch @@ -0,0 +1,51 @@ +From 72b30d1f56de418f98f8a22cade16f737828ecf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 19:26:25 +0100 +Subject: media: hantro: Fix probe func error path + +From: Jernej Skrabec + +[ Upstream commit 37af43b250fda6162005d47bf7c959c70d52b107 ] + +If clocks for some reason couldn't be enabled, probe function returns +immediately, without disabling PM. This obviously leaves PM ref counters +unbalanced. + +Fix that by jumping to appropriate error path, so effects of PM functions +are reversed. + +Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver") +Signed-off-by: Jernej Skrabec +Acked-by: Andrzej Pietrasiewicz +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/hantro/hantro_drv.c b/drivers/staging/media/hantro/hantro_drv.c +index 32e5966ba5c5f..58cf44045b396 100644 +--- a/drivers/staging/media/hantro/hantro_drv.c ++++ b/drivers/staging/media/hantro/hantro_drv.c +@@ -823,7 +823,7 @@ static int hantro_probe(struct platform_device *pdev) + ret = clk_bulk_prepare(vpu->variant->num_clocks, vpu->clocks); + if (ret) { + dev_err(&pdev->dev, "Failed to prepare clocks\n"); +- return ret; ++ goto err_pm_disable; + } + + ret = v4l2_device_register(&pdev->dev, &vpu->v4l2_dev); +@@ -879,6 +879,7 @@ err_v4l2_unreg: + v4l2_device_unregister(&vpu->v4l2_dev); + err_clk_unprepare: + clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks); ++err_pm_disable: + pm_runtime_dont_use_autosuspend(vpu->dev); + pm_runtime_disable(vpu->dev); + return ret; +-- +2.34.1 + diff --git a/queue-5.4/media-igorplugusb-receiver-overflow-should-be-report.patch b/queue-5.4/media-igorplugusb-receiver-overflow-should-be-report.patch new file mode 100644 index 00000000000..5a5ebde8de0 --- /dev/null +++ b/queue-5.4/media-igorplugusb-receiver-overflow-should-be-report.patch @@ -0,0 +1,39 @@ +From ab08ab8ab2006895d3945fb59cbeded0ff5821ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 23:58:19 +0100 +Subject: media: igorplugusb: receiver overflow should be reported + +From: Sean Young + +[ Upstream commit 8fede658e7ddb605bbd68ed38067ddb0af033db4 ] + +Without this, some IR will be missing mid-stream and we might decode +something which never really occurred. + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/igorplugusb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c +index b981f7290c1b2..1e8276040ea5b 100644 +--- a/drivers/media/rc/igorplugusb.c ++++ b/drivers/media/rc/igorplugusb.c +@@ -64,9 +64,11 @@ static void igorplugusb_irdata(struct igorplugusb *ir, unsigned len) + if (start >= len) { + dev_err(ir->dev, "receive overflow invalid: %u", overflow); + } else { +- if (overflow > 0) ++ if (overflow > 0) { + dev_warn(ir->dev, "receive overflow, at least %u lost", + overflow); ++ ir_raw_event_reset(ir->rc); ++ } + + do { + rawir.duration = ir->buf_in[i] * 85333; +-- +2.34.1 + diff --git a/queue-5.4/media-imx-pxp-initialize-the-spinlock-prior-to-using.patch b/queue-5.4/media-imx-pxp-initialize-the-spinlock-prior-to-using.patch new file mode 100644 index 00000000000..b3bd696ea00 --- /dev/null +++ b/queue-5.4/media-imx-pxp-initialize-the-spinlock-prior-to-using.patch @@ -0,0 +1,51 @@ +From aeaf55f7f7a242f9850462fddff9976577c871e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Oct 2021 15:10:14 +0200 +Subject: media: imx-pxp: Initialize the spinlock prior to using it + +From: Fabio Estevam + +[ Upstream commit ed2f97ad4b21072f849cf4ae6645d1f2b1d3f550 ] + +After devm_request_threaded_irq() is called there is a chance that an +interrupt may occur before the spinlock is initialized, which will trigger +a kernel oops. + +To prevent that, move the initialization of the spinlock prior to +requesting the interrupts. + +Fixes: 51abcf7fdb70 ("media: imx-pxp: add i.MX Pixel Pipeline driver") +Signed-off-by: Fabio Estevam +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/imx-pxp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/imx-pxp.c b/drivers/media/platform/imx-pxp.c +index 38d9423223025..3c36cefddec7c 100644 +--- a/drivers/media/platform/imx-pxp.c ++++ b/drivers/media/platform/imx-pxp.c +@@ -1664,6 +1664,8 @@ static int pxp_probe(struct platform_device *pdev) + if (irq < 0) + return irq; + ++ spin_lock_init(&dev->irqlock); ++ + ret = devm_request_threaded_irq(&pdev->dev, irq, NULL, pxp_irq_handler, + IRQF_ONESHOT, dev_name(&pdev->dev), dev); + if (ret < 0) { +@@ -1681,8 +1683,6 @@ static int pxp_probe(struct platform_device *pdev) + goto err_clk; + } + +- spin_lock_init(&dev->irqlock); +- + ret = v4l2_device_register(&pdev->dev, &dev->v4l2_dev); + if (ret) + goto err_clk; +-- +2.34.1 + diff --git a/queue-5.4/media-m920x-don-t-use-stack-on-usb-reads.patch b/queue-5.4/media-m920x-don-t-use-stack-on-usb-reads.patch new file mode 100644 index 00000000000..0d1ee364f68 --- /dev/null +++ b/queue-5.4/media-m920x-don-t-use-stack-on-usb-reads.patch @@ -0,0 +1,59 @@ +From 9f53d1e918eb36a742f03d90c2a766076c94b84a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Dec 2021 15:34:19 +0100 +Subject: media: m920x: don't use stack on USB reads + +From: Mauro Carvalho Chehab + +[ Upstream commit a2ab06d7c4d6bfd0b545a768247a70463e977e27 ] + +Using stack-allocated pointers for USB message data don't work. +This driver is almost OK with that, except for the I2C read +logic. + +Fix it by using a temporary read buffer, just like on all other +calls to m920x_read(). + +Link: https://lore.kernel.org/all/ccc99e48-de4f-045e-0fe4-61e3118e3f74@mida.se/ +Reported-by: rkardell@mida.se +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/m920x.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c +index d866a1990a7d2..7282f60226558 100644 +--- a/drivers/media/usb/dvb-usb/m920x.c ++++ b/drivers/media/usb/dvb-usb/m920x.c +@@ -274,6 +274,13 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + /* Should check for ack here, if we knew how. */ + } + if (msg[i].flags & I2C_M_RD) { ++ char *read = kmalloc(1, GFP_KERNEL); ++ if (!read) { ++ ret = -ENOMEM; ++ kfree(read); ++ goto unlock; ++ } ++ + for (j = 0; j < msg[i].len; j++) { + /* Last byte of transaction? + * Send STOP, otherwise send ACK. */ +@@ -281,9 +288,12 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu + + if ((ret = m920x_read(d->udev, M9206_I2C, 0x0, + 0x20 | stop, +- &msg[i].buf[j], 1)) != 0) ++ read, 1)) != 0) + goto unlock; ++ msg[i].buf[j] = read[0]; + } ++ ++ kfree(read); + } else { + for (j = 0; j < msg[i].len; j++) { + /* Last byte of transaction? Then send STOP. */ +-- +2.34.1 + diff --git a/queue-5.4/media-msi001-fix-possible-null-ptr-deref-in-msi001_p.patch b/queue-5.4/media-msi001-fix-possible-null-ptr-deref-in-msi001_p.patch new file mode 100644 index 00000000000..bc479bec00d --- /dev/null +++ b/queue-5.4/media-msi001-fix-possible-null-ptr-deref-in-msi001_p.patch @@ -0,0 +1,58 @@ +From 9ac1125e64c46ab448973afc70775e8b743443d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Oct 2021 13:23:48 +0200 +Subject: media: msi001: fix possible null-ptr-deref in msi001_probe() + +From: Wang Hai + +[ Upstream commit 3d5831a40d3464eea158180eb12cbd81c5edfb6a ] + +I got a null-ptr-deref report: + +BUG: kernel NULL pointer dereference, address: 0000000000000060 +... +RIP: 0010:v4l2_ctrl_auto_cluster+0x57/0x270 +... +Call Trace: + msi001_probe+0x13b/0x24b [msi001] + spi_probe+0xeb/0x130 +... + do_syscall_64+0x35/0xb0 + +In msi001_probe(), if the creation of control for bandwidth_auto +fails, there will be a null-ptr-deref issue when it is used in +v4l2_ctrl_auto_cluster(). + +Check dev->hdl.error before v4l2_ctrl_auto_cluster() to fix this bug. + +Link: https://lore.kernel.org/linux-media/20211026112348.2878040-1-wanghai38@huawei.com +Fixes: 93203dd6c7c4 ("[media] msi001: Mirics MSi001 silicon tuner driver") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/msi001.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/tuners/msi001.c b/drivers/media/tuners/msi001.c +index 78e6fd600d8ef..44247049a3190 100644 +--- a/drivers/media/tuners/msi001.c ++++ b/drivers/media/tuners/msi001.c +@@ -442,6 +442,13 @@ static int msi001_probe(struct spi_device *spi) + V4L2_CID_RF_TUNER_BANDWIDTH_AUTO, 0, 1, 1, 1); + dev->bandwidth = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, + V4L2_CID_RF_TUNER_BANDWIDTH, 200000, 8000000, 1, 200000); ++ if (dev->hdl.error) { ++ ret = dev->hdl.error; ++ dev_err(&spi->dev, "Could not initialize controls\n"); ++ /* control init failed, free handler */ ++ goto err_ctrl_handler_free; ++ } ++ + v4l2_ctrl_auto_cluster(2, &dev->bandwidth_auto, 0, false); + dev->lna_gain = v4l2_ctrl_new_std(&dev->hdl, &msi001_ctrl_ops, + V4L2_CID_RF_TUNER_LNA_GAIN, 0, 1, 1, 1); +-- +2.34.1 + diff --git a/queue-5.4/media-mtk-vcodec-call-v4l2_m2m_ctx_release-first-whe.patch b/queue-5.4/media-mtk-vcodec-call-v4l2_m2m_ctx_release-first-whe.patch new file mode 100644 index 00000000000..bfdc8ab1db8 --- /dev/null +++ b/queue-5.4/media-mtk-vcodec-call-v4l2_m2m_ctx_release-first-whe.patch @@ -0,0 +1,86 @@ +From e73c591adf53cb43f24747944dbadd4e770ab433 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 14:06:30 +0100 +Subject: media: mtk-vcodec: call v4l2_m2m_ctx_release first when file is + released + +From: Dafna Hirschfeld + +[ Upstream commit 9f89c881bffbdffe4060ffaef3489a2830a6dd9c ] + +The func v4l2_m2m_ctx_release waits for currently running jobs +to finish and then stop streaming both queues and frees the buffers. +All this should be done before the call to mtk_vcodec_enc_release +which frees the encoder handler. This fixes null-pointer dereference bug: + +[ 638.028076] Mem abort info: +[ 638.030932] ESR = 0x96000004 +[ 638.033978] EC = 0x25: DABT (current EL), IL = 32 bits +[ 638.039293] SET = 0, FnV = 0 +[ 638.042338] EA = 0, S1PTW = 0 +[ 638.045474] FSC = 0x04: level 0 translation fault +[ 638.050349] Data abort info: +[ 638.053224] ISV = 0, ISS = 0x00000004 +[ 638.057055] CM = 0, WnR = 0 +[ 638.060018] user pgtable: 4k pages, 48-bit VAs, pgdp=000000012b6db000 +[ 638.066485] [00000000000001a0] pgd=0000000000000000, p4d=0000000000000000 +[ 638.073277] Internal error: Oops: 96000004 [#1] SMP +[ 638.078145] Modules linked in: rfkill mtk_vcodec_dec mtk_vcodec_enc uvcvideo mtk_mdp mtk_vcodec_common videobuf2_dma_contig v4l2_h264 cdc_ether v4l2_mem2mem videobuf2_vmalloc usbnet videobuf2_memops videobuf2_v4l2 r8152 videobuf2_common videodev cros_ec_sensors cros_ec_sensors_core industrialio_triggered_buffer kfifo_buf elan_i2c elants_i2c sbs_battery mc cros_usbpd_charger cros_ec_chardev cros_usbpd_logger crct10dif_ce mtk_vpu fuse ip_tables x_tables ipv6 +[ 638.118583] CPU: 0 PID: 212 Comm: kworker/u8:5 Not tainted 5.15.0-06427-g58a1d4dcfc74-dirty #109 +[ 638.127357] Hardware name: Google Elm (DT) +[ 638.131444] Workqueue: mtk-vcodec-enc mtk_venc_worker [mtk_vcodec_enc] +[ 638.137974] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 638.144925] pc : vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] +[ 638.150493] lr : venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] +[ 638.156060] sp : ffff8000124d3c40 +[ 638.159364] x29: ffff8000124d3c40 x28: 0000000000000000 x27: 0000000000000000 +[ 638.166493] x26: 0000000000000000 x25: ffff0000e7f252d0 x24: ffff8000124d3d58 +[ 638.173621] x23: ffff8000124d3d58 x22: ffff8000124d3d60 x21: 0000000000000001 +[ 638.180750] x20: ffff80001137e000 x19: 0000000000000000 x18: 0000000000000001 +[ 638.187878] x17: 000000040044ffff x16: 00400032b5503510 x15: 0000000000000000 +[ 638.195006] x14: ffff8000118536c0 x13: ffff8000ee1da000 x12: 0000000030d4d91d +[ 638.202134] x11: 0000000000000000 x10: 0000000000000980 x9 : ffff8000124d3b20 +[ 638.209262] x8 : ffff0000c18d4ea0 x7 : ffff0000c18d44c0 x6 : ffff0000c18d44c0 +[ 638.216391] x5 : ffff80000904a3b0 x4 : ffff8000124d3d58 x3 : ffff8000124d3d60 +[ 638.223519] x2 : ffff8000124d3d78 x1 : 0000000000000001 x0 : ffff80001137efb8 +[ 638.230648] Call trace: +[ 638.233084] vp8_enc_encode+0x34/0x2b0 [mtk_vcodec_enc] +[ 638.238304] venc_if_encode+0xac/0x1b0 [mtk_vcodec_enc] +[ 638.243525] mtk_venc_worker+0x110/0x250 [mtk_vcodec_enc] +[ 638.248918] process_one_work+0x1f8/0x498 +[ 638.252923] worker_thread+0x140/0x538 +[ 638.256664] kthread+0x148/0x158 +[ 638.259884] ret_from_fork+0x10/0x20 +[ 638.263455] Code: f90023f9 2a0103f5 aa0303f6 aa0403f8 (f940d277) +[ 638.269538] ---[ end trace e374fc10f8e181f5 ]--- + +[gst-master] root@debian:~/gst-build# [ 638.019193] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a0 +Fixes: 4e855a6efa547 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver") +Signed-off-by: Dafna Hirschfeld +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c +index 1d82aa2b6017c..dea0ee2cb7245 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_drv.c +@@ -209,11 +209,11 @@ static int fops_vcodec_release(struct file *file) + mtk_v4l2_debug(1, "[%d] encoder", ctx->id); + mutex_lock(&dev->dev_mutex); + ++ v4l2_m2m_ctx_release(ctx->m2m_ctx); + mtk_vcodec_enc_release(ctx); + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); + v4l2_ctrl_handler_free(&ctx->ctrl_hdl); +- v4l2_m2m_ctx_release(ctx->m2m_ctx); + + list_del_init(&ctx->list); + kfree(ctx); +-- +2.34.1 + diff --git a/queue-5.4/media-rcar-csi2-correct-the-selection-of-hsfreqrange.patch b/queue-5.4/media-rcar-csi2-correct-the-selection-of-hsfreqrange.patch new file mode 100644 index 00000000000..ffe8b8e006b --- /dev/null +++ b/queue-5.4/media-rcar-csi2-correct-the-selection-of-hsfreqrange.patch @@ -0,0 +1,83 @@ +From 0d33e45d788f72b1f195143b9b9bb60583cea693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 17:07:54 +0200 +Subject: media: rcar-csi2: Correct the selection of hsfreqrange +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Suresh Udipi + +[ Upstream commit cee44d4fbacbbdfe62697ec94e76c6e4f726c5df ] + +hsfreqrange should be chosen based on the calculated mbps which +is closer to the default bit rate and within the range as per +table[1]. But current calculation always selects first value which +is greater than or equal to the calculated mbps which may lead +to chosing a wrong range in some cases. + +For example for 360 mbps for H3/M3N +Existing logic selects +Calculated value 360Mbps : Default 400Mbps Range [368.125 -433.125 mbps] + +This hsfreqrange is out of range. + +The logic is changed to get the default value which is closest to the +calculated value [1] + +Calculated value 360Mbps : Default 350Mbps Range [320.625 -380.625 mpbs] + +[1] specs r19uh0105ej0200-r-car-3rd-generation.pdf [Table 25.9] + +Please note that According to Renesas in Table 25.9 the range for +220 default value is corrected as below + + |Range (Mbps) | Default Bit rate (Mbps) | + ----------------------------------------------- + | 197.125-244.125 | 220 | + ----------------------------------------------- + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Suresh Udipi +Signed-off-by: Kazuyoshi Akiyama +Signed-off-by: Michael Rodin +Reviewed-by: Niklas Söderlund +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar-vin/rcar-csi2.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c +index e01f22bf826d4..99b28611eb12c 100644 +--- a/drivers/media/platform/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c +@@ -430,16 +430,23 @@ static int rcsi2_wait_phy_start(struct rcar_csi2 *priv) + static int rcsi2_set_phypll(struct rcar_csi2 *priv, unsigned int mbps) + { + const struct rcsi2_mbps_reg *hsfreq; ++ const struct rcsi2_mbps_reg *hsfreq_prev = NULL; + +- for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) ++ for (hsfreq = priv->info->hsfreqrange; hsfreq->mbps != 0; hsfreq++) { + if (hsfreq->mbps >= mbps) + break; ++ hsfreq_prev = hsfreq; ++ } + + if (!hsfreq->mbps) { + dev_err(priv->dev, "Unsupported PHY speed (%u Mbps)", mbps); + return -ERANGE; + } + ++ if (hsfreq_prev && ++ ((mbps - hsfreq_prev->mbps) <= (hsfreq->mbps - mbps))) ++ hsfreq = hsfreq_prev; ++ + rcsi2_write(priv, PHYPLL_REG, PHYPLL_HSFREQRANGE(hsfreq->reg)); + + return 0; +-- +2.34.1 + diff --git a/queue-5.4/media-saa7146-hexium_gemini-fix-a-null-pointer-deref.patch b/queue-5.4/media-saa7146-hexium_gemini-fix-a-null-pointer-deref.patch new file mode 100644 index 00000000000..96006392eb8 --- /dev/null +++ b/queue-5.4/media-saa7146-hexium_gemini-fix-a-null-pointer-deref.patch @@ -0,0 +1,74 @@ +From ccb19e0a360c0047cad41d09d9ce7c2f466adb2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 16:40:30 +0100 +Subject: media: saa7146: hexium_gemini: Fix a NULL pointer dereference in + hexium_attach() + +From: Zhou Qingyang + +[ Upstream commit 3af86b046933ba513d08399dba0d4d8b50d607d0 ] + +In hexium_attach(dev, info), saa7146_vv_init() is called to allocate +a new memory for dev->vv_data. saa7146_vv_release() will be called on +failure of saa7146_register_device(). There is a dereference of +dev->vv_data in saa7146_vv_release(), which could lead to a NULL +pointer dereference on failure of saa7146_vv_init(). + +Fix this bug by adding a check of saa7146_vv_init(). + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_VIDEO_HEXIUM_GEMINI=m show no new warnings, +and our static analyzer no longer warns about this code. + +Link: https://lore.kernel.org/linux-media/20211203154030.111210-1-zhou1615@umn.edu +Signed-off-by: Zhou Qingyang +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/saa7146/saa7146_fops.c | 2 +- + drivers/media/pci/saa7146/hexium_gemini.c | 7 ++++++- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/common/saa7146/saa7146_fops.c b/drivers/media/common/saa7146/saa7146_fops.c +index aabb830e74689..4b332ea986168 100644 +--- a/drivers/media/common/saa7146/saa7146_fops.c ++++ b/drivers/media/common/saa7146/saa7146_fops.c +@@ -525,7 +525,7 @@ int saa7146_vv_init(struct saa7146_dev* dev, struct saa7146_ext_vv *ext_vv) + ERR("out of memory. aborting.\n"); + kfree(vv); + v4l2_ctrl_handler_free(hdl); +- return -1; ++ return -ENOMEM; + } + + saa7146_video_uops.init(dev,vv); +diff --git a/drivers/media/pci/saa7146/hexium_gemini.c b/drivers/media/pci/saa7146/hexium_gemini.c +index f962269306707..86d4e2abed82a 100644 +--- a/drivers/media/pci/saa7146/hexium_gemini.c ++++ b/drivers/media/pci/saa7146/hexium_gemini.c +@@ -284,7 +284,12 @@ static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_d + hexium_set_input(hexium, 0); + hexium->cur_input = 0; + +- saa7146_vv_init(dev, &vv_data); ++ ret = saa7146_vv_init(dev, &vv_data); ++ if (ret) { ++ i2c_del_adapter(&hexium->i2c_adapter); ++ kfree(hexium); ++ return ret; ++ } + + vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input; + vv_data.vid_ops.vidioc_g_input = vidioc_g_input; +-- +2.34.1 + diff --git a/queue-5.4/media-saa7146-hexium_orion-fix-a-null-pointer-derefe.patch b/queue-5.4/media-saa7146-hexium_orion-fix-a-null-pointer-derefe.patch new file mode 100644 index 00000000000..211f86bcd36 --- /dev/null +++ b/queue-5.4/media-saa7146-hexium_orion-fix-a-null-pointer-derefe.patch @@ -0,0 +1,74 @@ +From 1cc3f141e6ba53909fa8a5028762b4b968126106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 17:25:49 +0100 +Subject: media: saa7146: hexium_orion: Fix a NULL pointer dereference in + hexium_attach() + +From: Zhou Qingyang + +[ Upstream commit 348df8035301dd212e3cc2860efe4c86cb0d3303 ] + +In hexium_attach(dev, info), saa7146_vv_init() is called to allocate +a new memory for dev->vv_data. In hexium_detach(), saa7146_vv_release() +will be called and there is a dereference of dev->vv_data in +saa7146_vv_release(), which could lead to a NULL pointer dereference +on failure of saa7146_vv_init() according to the following logic. + +Both hexium_attach() and hexium_detach() are callback functions of +the variable 'extension', so there exists a possible call chain directly +from hexium_attach() to hexium_detach(): + +hexium_attach(dev, info) -- fail to alloc memory to dev->vv_data + | in saa7146_vv_init(). + | + | +hexium_detach() -- a dereference of dev->vv_data in saa7146_vv_release() + +Fix this bug by adding a check of saa7146_vv_init(). + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_VIDEO_HEXIUM_ORION=m show no new warnings, +and our static analyzer no longer warns about this code. + +Signed-off-by: Zhou Qingyang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/hexium_orion.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7146/hexium_orion.c b/drivers/media/pci/saa7146/hexium_orion.c +index bf5e55348f159..31388597386aa 100644 +--- a/drivers/media/pci/saa7146/hexium_orion.c ++++ b/drivers/media/pci/saa7146/hexium_orion.c +@@ -355,10 +355,16 @@ static struct saa7146_ext_vv vv_data; + static int hexium_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) + { + struct hexium *hexium = (struct hexium *) dev->ext_priv; ++ int ret; + + DEB_EE("\n"); + +- saa7146_vv_init(dev, &vv_data); ++ ret = saa7146_vv_init(dev, &vv_data); ++ if (ret) { ++ pr_err("Error in saa7146_vv_init()\n"); ++ return ret; ++ } ++ + vv_data.vid_ops.vidioc_enum_input = vidioc_enum_input; + vv_data.vid_ops.vidioc_g_input = vidioc_g_input; + vv_data.vid_ops.vidioc_s_input = vidioc_s_input; +-- +2.34.1 + diff --git a/queue-5.4/media-saa7146-mxb-fix-a-null-pointer-dereference-in-.patch b/queue-5.4/media-saa7146-mxb-fix-a-null-pointer-dereference-in-.patch new file mode 100644 index 00000000000..095ec4abc57 --- /dev/null +++ b/queue-5.4/media-saa7146-mxb-fix-a-null-pointer-dereference-in-.patch @@ -0,0 +1,64 @@ +From 51115eab00a1153f186d2015d16b3579074e3c1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 17:34:44 +0100 +Subject: media: saa7146: mxb: Fix a NULL pointer dereference in mxb_attach() + +From: Zhou Qingyang + +[ Upstream commit 0407c49ebe330333478440157c640fffd986f41b ] + +In mxb_attach(dev, info), saa7146_vv_init() is called to allocate a +new memory for dev->vv_data. saa7146_vv_release() will be called on +failure of mxb_probe(dev). There is a dereference of dev->vv_data +in saa7146_vv_release(), which could lead to a NULL pointer dereference +on failure of saa7146_vv_init(). + +Fix this bug by adding a check of saa7146_vv_init(). + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_VIDEO_MXB=m show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 03b1930efd3c ("V4L/DVB: saa7146: fix regression of the av7110/budget-av driver") +Signed-off-by: Zhou Qingyang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/mxb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c +index 952ea250feda0..58fe4c1619eeb 100644 +--- a/drivers/media/pci/saa7146/mxb.c ++++ b/drivers/media/pci/saa7146/mxb.c +@@ -683,10 +683,16 @@ static struct saa7146_ext_vv vv_data; + static int mxb_attach(struct saa7146_dev *dev, struct saa7146_pci_extension_data *info) + { + struct mxb *mxb; ++ int ret; + + DEB_EE("dev:%p\n", dev); + +- saa7146_vv_init(dev, &vv_data); ++ ret = saa7146_vv_init(dev, &vv_data); ++ if (ret) { ++ ERR("Error in saa7146_vv_init()"); ++ return ret; ++ } ++ + if (mxb_probe(dev)) { + saa7146_vv_release(dev); + return -1; +-- +2.34.1 + diff --git a/queue-5.4/media-si2157-fix-warm-tuner-state-detection.patch b/queue-5.4/media-si2157-fix-warm-tuner-state-detection.patch new file mode 100644 index 00000000000..2089c6d1ab7 --- /dev/null +++ b/queue-5.4/media-si2157-fix-warm-tuner-state-detection.patch @@ -0,0 +1,61 @@ +From bd0f459324434c76d32f90399f72e9d0423e018d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 22:08:43 +0100 +Subject: media: si2157: Fix "warm" tuner state detection + +From: Robert Schlabbach + +[ Upstream commit a6441ea29cb2c9314654e093a1cd8020b9b851c8 ] + +Commit e955f959ac52 ("media: si2157: Better check for running tuner in +init") completely broke the "warm" tuner detection of the si2157 driver +due to a simple endian error: The Si2157 CRYSTAL_TRIM property code is +0x0402 and needs to be transmitted LSB first. However, it was inserted +MSB first, causing the warm detection to always fail and spam the kernel +log with tuner initialization messages each time the DVB frontend +device was closed and reopened: + +[ 312.215682] si2157 16-0060: found a 'Silicon Labs Si2157-A30' +[ 312.264334] si2157 16-0060: firmware version: 3.0.5 +[ 342.248593] si2157 16-0060: found a 'Silicon Labs Si2157-A30' +[ 342.295743] si2157 16-0060: firmware version: 3.0.5 +[ 372.328574] si2157 16-0060: found a 'Silicon Labs Si2157-A30' +[ 372.385035] si2157 16-0060: firmware version: 3.0.5 + +Also, the reinitializations were observed disturb _other_ tuners on +multi-tuner cards such as the Hauppauge WinTV-QuadHD, leading to missed +or errored packets when one of the other DVB frontend devices on that +card was opened. + +Fix the order of the property code bytes to make the warm detection work +again, also reducing the tuner initialization message in the kernel log +to once per power-on, as well as fixing the interference with other +tuners. + +Link: https://lore.kernel.org/linux-media/trinity-2a86eb9d-6264-4387-95e1-ba7b79a4050f-1638392923493@3c-app-gmx-bap03 + +Fixes: e955f959ac52 ("media: si2157: Better check for running tuner in init") +Reported-by: Robert Schlabbach +Signed-off-by: Robert Schlabbach +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/si2157.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/tuners/si2157.c b/drivers/media/tuners/si2157.c +index a39e1966816bf..8db9f0eb98b52 100644 +--- a/drivers/media/tuners/si2157.c ++++ b/drivers/media/tuners/si2157.c +@@ -80,7 +80,7 @@ static int si2157_init(struct dvb_frontend *fe) + dev_dbg(&client->dev, "\n"); + + /* Try to get Xtal trim property, to verify tuner still running */ +- memcpy(cmd.args, "\x15\x00\x04\x02", 4); ++ memcpy(cmd.args, "\x15\x00\x02\x04", 4); + cmd.wlen = 4; + cmd.rlen = 4; + ret = si2157_cmd_execute(client, &cmd); +-- +2.34.1 + diff --git a/queue-5.4/media-si470x-i2c-fix-possible-memory-leak-in-si470x_.patch b/queue-5.4/media-si470x-i2c-fix-possible-memory-leak-in-si470x_.patch new file mode 100644 index 00000000000..12f441e30f4 --- /dev/null +++ b/queue-5.4/media-si470x-i2c-fix-possible-memory-leak-in-si470x_.patch @@ -0,0 +1,62 @@ +From 578b63ccd7bd4f04b2953b7a02351d36a8fec00e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 11:58:55 +0200 +Subject: media: si470x-i2c: fix possible memory leak in si470x_i2c_probe() + +From: Yang Yingliang + +[ Upstream commit ef054e345ed8c79ce1121a3599b5a2dfd78e57a0 ] + +n the 'radio->hdl.error' error handling, ctrl handler allocated by +v4l2_ctrl_new_std() does not released, and caused memory leak as +follows: + +unreferenced object 0xffff888033d54200 (size 256): + comm "i2c-si470x-19", pid 909, jiffies 4294914203 (age 8.072s) + hex dump (first 32 bytes): + e8 69 11 03 80 88 ff ff 00 46 d5 33 80 88 ff ff .i.......F.3.... + 10 42 d5 33 80 88 ff ff 10 42 d5 33 80 88 ff ff .B.3.....B.3.... + backtrace: + [<00000000086bd4ed>] __kmalloc_node+0x1eb/0x360 + [<00000000bdb68871>] kvmalloc_node+0x66/0x120 + [<00000000fac74e4c>] v4l2_ctrl_new+0x7b9/0x1c60 [videodev] + [<00000000693bf940>] v4l2_ctrl_new_std+0x19b/0x270 [videodev] + [<00000000c0cb91bc>] si470x_i2c_probe+0x2d3/0x9a0 [radio_si470x_i2c] + [<0000000056a6f01f>] i2c_device_probe+0x4d8/0xbe0 + +Fix the error handling path to avoid memory leak. + +Reported-by: Hulk Robot +Fixes: 8c081b6f9a9b ("media: radio: Critical v4l2 registration...") +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index a972c0705ac79..76d39e2e87706 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -368,7 +368,7 @@ static int si470x_i2c_probe(struct i2c_client *client) + if (radio->hdl.error) { + retval = radio->hdl.error; + dev_err(&client->dev, "couldn't register control\n"); +- goto err_dev; ++ goto err_all; + } + + /* video device initialization */ +@@ -463,7 +463,6 @@ static int si470x_i2c_probe(struct i2c_client *client) + return 0; + err_all: + v4l2_ctrl_handler_free(&radio->hdl); +-err_dev: + v4l2_device_unregister(&radio->v4l2_dev); + err_initial: + return retval; +-- +2.34.1 + diff --git a/queue-5.4/media-uvcvideo-increase-uvc_ctrl_control_timeout-to-.patch b/queue-5.4/media-uvcvideo-increase-uvc_ctrl_control_timeout-to-.patch new file mode 100644 index 00000000000..765a5c81d45 --- /dev/null +++ b/queue-5.4/media-uvcvideo-increase-uvc_ctrl_control_timeout-to-.patch @@ -0,0 +1,45 @@ +From 4d51d9573084fbd64565693496983a6048cb2ef2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 09:52:36 +0100 +Subject: media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds. + +From: James Hilliard + +[ Upstream commit c8ed7d2f614cd8b315981d116c7a2fb01829500d ] + +Some uvc devices appear to require the maximum allowed USB timeout +for GET_CUR/SET_CUR requests. + +So lets just bump the UVC control timeout to 5 seconds which is the +same as the usb ctrl get/set defaults: +USB_CTRL_GET_TIMEOUT 5000 +USB_CTRL_SET_TIMEOUT 5000 + +It fixes the following runtime warnings: + Failed to query (GET_CUR) UVC control 11 on unit 2: -110 (exp. 1). + Failed to query (SET_CUR) UVC control 3 on unit 2: -110 (exp. 2). + +Signed-off-by: James Hilliard +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvcvideo.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h +index 24e3d8c647e77..5f137400bebd6 100644 +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -179,7 +179,7 @@ + /* Maximum status buffer size in bytes of interrupt URB. */ + #define UVC_MAX_STATUS_SIZE 16 + +-#define UVC_CTRL_CONTROL_TIMEOUT 500 ++#define UVC_CTRL_CONTROL_TIMEOUT 5000 + #define UVC_CTRL_STREAMING_TIMEOUT 5000 + + /* Maximum allowed number of control mappings per device */ +-- +2.34.1 + diff --git a/queue-5.4/media-venus-core-fix-a-resource-leak-in-the-error-ha.patch b/queue-5.4/media-venus-core-fix-a-resource-leak-in-the-error-ha.patch new file mode 100644 index 00000000000..b27319c4f85 --- /dev/null +++ b/queue-5.4/media-venus-core-fix-a-resource-leak-in-the-error-ha.patch @@ -0,0 +1,61 @@ +From bed67fb809d1e15ad255600e9f49fe76c8a35c45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 22:05:28 +0200 +Subject: media: venus: core: Fix a resource leak in the error handling path of + 'venus_probe()' + +From: Christophe JAILLET + +[ Upstream commit 8cc7a1b2aca067397a016cdb971a5e6ad9b640c7 ] + +A successful 'of_platform_populate()' call should be balanced by a +corresponding 'of_platform_depopulate()' call in the error handling path +of the probe, as already done in the remove function. + +A successful 'venus_firmware_init()' call should be balanced by a +corresponding 'venus_firmware_deinit()' call in the error handling path +of the probe, as already done in the remove function. + +Update the error handling path accordingly. + +Fixes: f9799fcce4bb ("media: venus: firmware: register separate platform_device for firmware loader") +Signed-off-by: Christophe JAILLET +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index bbc430a003443..7b52d3e5d3f89 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -289,11 +289,11 @@ static int venus_probe(struct platform_device *pdev) + + ret = venus_firmware_init(core); + if (ret) +- goto err_runtime_disable; ++ goto err_of_depopulate; + + ret = venus_boot(core); + if (ret) +- goto err_runtime_disable; ++ goto err_firmware_deinit; + + ret = hfi_core_resume(core, true); + if (ret) +@@ -329,6 +329,10 @@ err_core_deinit: + hfi_core_deinit(core, false); + err_venus_shutdown: + venus_shutdown(core); ++err_firmware_deinit: ++ venus_firmware_deinit(core); ++err_of_depopulate: ++ of_platform_depopulate(dev); + err_runtime_disable: + pm_runtime_put_noidle(dev); + pm_runtime_set_suspended(dev); +-- +2.34.1 + diff --git a/queue-5.4/media-videobuf2-fix-the-size-printk-format.patch b/queue-5.4/media-videobuf2-fix-the-size-printk-format.patch new file mode 100644 index 00000000000..368c7621675 --- /dev/null +++ b/queue-5.4/media-videobuf2-fix-the-size-printk-format.patch @@ -0,0 +1,50 @@ +From 53670f6acb20f032bb80c5699c4c6ba3c61adfef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Oct 2021 09:43:19 +0100 +Subject: media: videobuf2: Fix the size printk format + +From: Dillon Min + +[ Upstream commit c9ee220d76775e42f35d634479c978d9350077d3 ] + +Since the type of parameter size is unsigned long, +it should printk by %lu, instead of %ld, fix it. + +Fixes: 7952be9b6ece ("media: drivers/media/common/videobuf2: rename from videobuf") +Signed-off-by: Dillon Min +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/videobuf2/videobuf2-dma-contig.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c +index 44cd0e530bbd3..093ebe6f279f7 100644 +--- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c ++++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c +@@ -154,7 +154,7 @@ static void *vb2_dc_alloc(struct device *dev, unsigned long attrs, + buf->cookie = dma_alloc_attrs(dev, size, &buf->dma_addr, + GFP_KERNEL | gfp_flags, buf->attrs); + if (!buf->cookie) { +- dev_err(dev, "dma_alloc_coherent of size %ld failed\n", size); ++ dev_err(dev, "dma_alloc_coherent of size %lu failed\n", size); + kfree(buf); + return ERR_PTR(-ENOMEM); + } +@@ -200,9 +200,9 @@ static int vb2_dc_mmap(void *buf_priv, struct vm_area_struct *vma) + + vma->vm_ops->open(vma); + +- pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %ld\n", +- __func__, (unsigned long)buf->dma_addr, vma->vm_start, +- buf->size); ++ pr_debug("%s: mapped dma addr 0x%08lx at 0x%08lx, size %lu\n", ++ __func__, (unsigned long)buf->dma_addr, vma->vm_start, ++ buf->size); + + return 0; + } +-- +2.34.1 + diff --git a/queue-5.4/mips-bcm63xx-add-support-for-clk_set_parent.patch b/queue-5.4/mips-bcm63xx-add-support-for-clk_set_parent.patch new file mode 100644 index 00000000000..78ca0d8a0a3 --- /dev/null +++ b/queue-5.4/mips-bcm63xx-add-support-for-clk_set_parent.patch @@ -0,0 +1,48 @@ +From e6b94a14d48b4682626124a7d395064420cddd27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 16:05:53 -0800 +Subject: mips: bcm63xx: add support for clk_set_parent() + +From: Randy Dunlap + +[ Upstream commit 6f03055d508ff4feb8db02ba3df9303a1db8d381 ] + +The MIPS BMC63XX subarch does not provide/support clk_set_parent(). +This causes build errors in a few drivers, so add a simple implementation +of that function so that callers of it will build without errors. + +Fixes these build errors: + +ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] undefined! +ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] undefined! + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs." ) +Signed-off-by: Randy Dunlap +Reviewed-by: Jonathan Cameron +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index aba6e2d6a736c..dcfa0ea912fe1 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -387,6 +387,12 @@ struct clk *clk_get_parent(struct clk *clk) + } + EXPORT_SYMBOL(clk_get_parent); + ++int clk_set_parent(struct clk *clk, struct clk *parent) ++{ ++ return 0; ++} ++EXPORT_SYMBOL(clk_set_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + if (!clk) +-- +2.34.1 + diff --git a/queue-5.4/mips-lantiq-add-support-for-clk_set_parent.patch b/queue-5.4/mips-lantiq-add-support-for-clk_set_parent.patch new file mode 100644 index 00000000000..7b08cbd5c48 --- /dev/null +++ b/queue-5.4/mips-lantiq-add-support-for-clk_set_parent.patch @@ -0,0 +1,48 @@ +From f0376f2627b1c3352d126d09b1cd260a31a561dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 16:03:45 -0800 +Subject: mips: lantiq: add support for clk_set_parent() + +From: Randy Dunlap + +[ Upstream commit 76f66dfd60dc5d2f9dec22d99091fea1035c5d03 ] + +Provide a simple implementation of clk_set_parent() in the lantiq +subarch so that callers of it will build without errors. + +Fixes these build errors: + +ERROR: modpost: "clk_set_parent" [sound/soc/jz4740/snd-soc-jz4740-i2s.ko] undefined! +ERROR: modpost: "clk_set_parent" [sound/soc/atmel/snd-soc-atmel-i2s.ko] undefined! + +Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +--to=linux-mips@vger.kernel.org --cc="John Crispin " --cc="Jonathan Cameron " --cc="Russell King " --cc="Andy Shevchenko " --cc=alsa-devel@alsa-project.org --to="Thomas Bogendoerfer " +Reviewed-by: Jonathan Cameron +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index 4916cccf378fd..7a623684d9b5e 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -164,6 +164,12 @@ struct clk *clk_get_parent(struct clk *clk) + } + EXPORT_SYMBOL(clk_get_parent); + ++int clk_set_parent(struct clk *clk, struct clk *parent) ++{ ++ return 0; ++} ++EXPORT_SYMBOL(clk_set_parent); ++ + static inline u32 get_counter_resolution(void) + { + u32 res; +-- +2.34.1 + diff --git a/queue-5.4/mips-octeon-add-put_device-after-of_find_device_by_n.patch b/queue-5.4/mips-octeon-add-put_device-after-of_find_device_by_n.patch new file mode 100644 index 00000000000..1b51ac68c65 --- /dev/null +++ b/queue-5.4/mips-octeon-add-put_device-after-of_find_device_by_n.patch @@ -0,0 +1,67 @@ +From 53acf866e68af04116b5b39041d1d276d1db0b79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 08:10:51 +0000 +Subject: MIPS: OCTEON: add put_device() after of_find_device_by_node() + +From: Ye Guojin + +[ Upstream commit 858779df1c0787d3fec827fb705708df9ebdb15b ] + +This was found by coccicheck: +./arch/mips/cavium-octeon/octeon-platform.c, 332, 1-7, ERROR missing +put_device; call of_find_device_by_node on line 324, but without a +corresponding object release within this function. +./arch/mips/cavium-octeon/octeon-platform.c, 395, 1-7, ERROR missing +put_device; call of_find_device_by_node on line 387, but without a +corresponding object release within this function. +./arch/mips/cavium-octeon/octeon-usb.c, 512, 3-9, ERROR missing +put_device; call of_find_device_by_node on line 515, but without a +corresponding object release within this function. +./arch/mips/cavium-octeon/octeon-usb.c, 543, 1-7, ERROR missing +put_device; call of_find_device_by_node on line 515, but without a +corresponding object release within this function. + +Reported-by: Zeal Robot +Signed-off-by: Ye Guojin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 2 ++ + arch/mips/cavium-octeon/octeon-usb.c | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 51685f893eab0..c214fe4e678bb 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -328,6 +328,7 @@ static int __init octeon_ehci_device_init(void) + + pd->dev.platform_data = &octeon_ehci_pdata; + octeon_ehci_hw_start(&pd->dev); ++ put_device(&pd->dev); + + return ret; + } +@@ -391,6 +392,7 @@ static int __init octeon_ohci_device_init(void) + + pd->dev.platform_data = &octeon_ohci_pdata; + octeon_ohci_hw_start(&pd->dev); ++ put_device(&pd->dev); + + return ret; + } +diff --git a/arch/mips/cavium-octeon/octeon-usb.c b/arch/mips/cavium-octeon/octeon-usb.c +index 4017398519cf9..e092d86e63581 100644 +--- a/arch/mips/cavium-octeon/octeon-usb.c ++++ b/arch/mips/cavium-octeon/octeon-usb.c +@@ -544,6 +544,7 @@ static int __init dwc3_octeon_device_init(void) + devm_iounmap(&pdev->dev, base); + devm_release_mem_region(&pdev->dev, res->start, + resource_size(res)); ++ put_device(&pdev->dev); + } + } while (node != NULL); + +-- +2.34.1 + diff --git a/queue-5.4/mips-octeon-fix-build-errors-using-clang.patch b/queue-5.4/mips-octeon-fix-build-errors-using-clang.patch new file mode 100644 index 00000000000..d53b4bb262d --- /dev/null +++ b/queue-5.4/mips-octeon-fix-build-errors-using-clang.patch @@ -0,0 +1,62 @@ +From 04d3af39d7b7a2c9b91fb2df37ba2793891ae245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Dec 2021 17:50:14 +0800 +Subject: MIPS: Octeon: Fix build errors using clang +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tianjia Zhang + +[ Upstream commit 95339b70677dc6f9a2d669c4716058e71b8dc1c7 ] + +A large number of the following errors is reported when compiling +with clang: + + cvmx-bootinfo.h:326:3: error: adding 'int' to a string does not append to the string [-Werror,-Wstring-plus-int] + ENUM_BRD_TYPE_CASE(CVMX_BOARD_TYPE_NULL) + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' + case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ + ~~~^~~~ + cvmx-bootinfo.h:326:3: note: use array indexing to silence this warning + cvmx-bootinfo.h:321:20: note: expanded from macro 'ENUM_BRD_TYPE_CASE' + case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ + ^ + +Follow the prompts to use the address operator '&' to fix this error. + +Signed-off-by: Tianjia Zhang +Reviewed-by: Nathan Chancellor +Reviewed-by: Philippe Mathieu-Daudé +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/octeon/cvmx-bootinfo.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/include/asm/octeon/cvmx-bootinfo.h b/arch/mips/include/asm/octeon/cvmx-bootinfo.h +index 62787765575ef..ce6e5fddce0bf 100644 +--- a/arch/mips/include/asm/octeon/cvmx-bootinfo.h ++++ b/arch/mips/include/asm/octeon/cvmx-bootinfo.h +@@ -315,7 +315,7 @@ enum cvmx_chip_types_enum { + + /* Functions to return string based on type */ + #define ENUM_BRD_TYPE_CASE(x) \ +- case x: return(#x + 16); /* Skip CVMX_BOARD_TYPE_ */ ++ case x: return (&#x[16]); /* Skip CVMX_BOARD_TYPE_ */ + static inline const char *cvmx_board_type_to_string(enum + cvmx_board_types_enum type) + { +@@ -404,7 +404,7 @@ static inline const char *cvmx_board_type_to_string(enum + } + + #define ENUM_CHIP_TYPE_CASE(x) \ +- case x: return(#x + 15); /* Skip CVMX_CHIP_TYPE */ ++ case x: return (&#x[15]); /* Skip CVMX_CHIP_TYPE */ + static inline const char *cvmx_chip_type_to_string(enum + cvmx_chip_types_enum type) + { +-- +2.34.1 + diff --git a/queue-5.4/misc-lattice-ecp3-config-fix-task-hung-when-firmware.patch b/queue-5.4/misc-lattice-ecp3-config-fix-task-hung-when-firmware.patch new file mode 100644 index 00000000000..24429d73adb --- /dev/null +++ b/queue-5.4/misc-lattice-ecp3-config-fix-task-hung-when-firmware.patch @@ -0,0 +1,95 @@ +From d7f78f3d069798128b2d79cb2394d42164a52ff3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Dec 2021 12:55:22 +0000 +Subject: misc: lattice-ecp3-config: Fix task hung when firmware load failed + +From: Wei Yongjun + +[ Upstream commit fcee5ce50bdb21116711e38635e3865594af907e ] + +When firmware load failed, kernel report task hung as follows: + +INFO: task xrun:5191 blocked for more than 147 seconds. + Tainted: G W 5.16.0-rc5-next-20211220+ #11 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +task:xrun state:D stack: 0 pid: 5191 ppid: 270 flags:0x00000004 +Call Trace: + __schedule+0xc12/0x4b50 kernel/sched/core.c:4986 + schedule+0xd7/0x260 kernel/sched/core.c:6369 (discriminator 1) + schedule_timeout+0x7aa/0xa80 kernel/time/timer.c:1857 + wait_for_completion+0x181/0x290 kernel/sched/completion.c:85 + lattice_ecp3_remove+0x32/0x40 drivers/misc/lattice-ecp3-config.c:221 + spi_remove+0x72/0xb0 drivers/spi/spi.c:409 + +lattice_ecp3_remove() wait for signals from firmware loading, but when +load failed, firmware_load() does not send this signal. This cause +device remove hung. Fix it by sending signal even if load failed. + +Fixes: 781551df57c7 ("misc: Add Lattice ECP3 FPGA configuration via SPI") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20211228125522.3122284-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/lattice-ecp3-config.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/lattice-ecp3-config.c b/drivers/misc/lattice-ecp3-config.c +index 884485c3f7232..3a0d2b052ed29 100644 +--- a/drivers/misc/lattice-ecp3-config.c ++++ b/drivers/misc/lattice-ecp3-config.c +@@ -77,12 +77,12 @@ static void firmware_load(const struct firmware *fw, void *context) + + if (fw == NULL) { + dev_err(&spi->dev, "Cannot load firmware, aborting\n"); +- return; ++ goto out; + } + + if (fw->size == 0) { + dev_err(&spi->dev, "Error: Firmware size is 0!\n"); +- return; ++ goto out; + } + + /* Fill dummy data (24 stuffing bits for commands) */ +@@ -104,7 +104,7 @@ static void firmware_load(const struct firmware *fw, void *context) + dev_err(&spi->dev, + "Error: No supported FPGA detected (JEDEC_ID=%08x)!\n", + jedec_id); +- return; ++ goto out; + } + + dev_info(&spi->dev, "FPGA %s detected\n", ecp3_dev[i].name); +@@ -117,7 +117,7 @@ static void firmware_load(const struct firmware *fw, void *context) + buffer = kzalloc(fw->size + 8, GFP_KERNEL); + if (!buffer) { + dev_err(&spi->dev, "Error: Can't allocate memory!\n"); +- return; ++ goto out; + } + + /* +@@ -156,7 +156,7 @@ static void firmware_load(const struct firmware *fw, void *context) + "Error: Timeout waiting for FPGA to clear (status=%08x)!\n", + status); + kfree(buffer); +- return; ++ goto out; + } + + dev_info(&spi->dev, "Configuring the FPGA...\n"); +@@ -182,7 +182,7 @@ static void firmware_load(const struct firmware *fw, void *context) + release_firmware(fw); + + kfree(buffer); +- ++out: + complete(&data->fw_loaded); + } + +-- +2.34.1 + diff --git a/queue-5.4/mlxsw-pci-add-shutdown-method-in-pci-driver.patch b/queue-5.4/mlxsw-pci-add-shutdown-method-in-pci-driver.patch new file mode 100644 index 00000000000..c5a37d2bbbb --- /dev/null +++ b/queue-5.4/mlxsw-pci-add-shutdown-method-in-pci-driver.patch @@ -0,0 +1,96 @@ +From 45cefab4ee0091539721f967e0fb61ae08f2a290 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 09:54:47 +0200 +Subject: mlxsw: pci: Add shutdown method in PCI driver + +From: Danielle Ratson + +[ Upstream commit c1020d3cf4752f61a6a413f632ea2ce2370e150d ] + +On an arm64 platform with the Spectrum ASIC, after loading and executing +a new kernel via kexec, the following trace [1] is observed. This seems +to be caused by the fact that the device is not properly shutdown before +executing the new kernel. + +Fix this by implementing a shutdown method which mirrors the remove +method, as recommended by the kexec maintainer [2][3]. + +[1] +BUG: Bad page state in process devlink pfn:22f73d +page:fffffe00089dcf40 refcount:-1 mapcount:0 mapping:0000000000000000 index:0x0 +flags: 0x2ffff00000000000() +raw: 2ffff00000000000 0000000000000000 ffffffff089d0201 0000000000000000 +raw: 0000000000000000 0000000000000000 ffffffffffffffff 0000000000000000 +page dumped because: nonzero _refcount +Modules linked in: +CPU: 1 PID: 16346 Comm: devlink Tainted: G B 5.8.0-rc6-custom-273020-gac6b365b1bf5 #44 +Hardware name: Marvell Armada 7040 TX4810M (DT) +Call trace: + dump_backtrace+0x0/0x1d0 + show_stack+0x1c/0x28 + dump_stack+0xbc/0x118 + bad_page+0xcc/0xf8 + check_free_page_bad+0x80/0x88 + __free_pages_ok+0x3f8/0x418 + __free_pages+0x38/0x60 + kmem_freepages+0x200/0x2a8 + slab_destroy+0x28/0x68 + slabs_destroy+0x60/0x90 + ___cache_free+0x1b4/0x358 + kfree+0xc0/0x1d0 + skb_free_head+0x2c/0x38 + skb_release_data+0x110/0x1a0 + skb_release_all+0x2c/0x38 + consume_skb+0x38/0x130 + __dev_kfree_skb_any+0x44/0x50 + mlxsw_pci_rdq_fini+0x8c/0xb0 + mlxsw_pci_queue_fini.isra.0+0x28/0x58 + mlxsw_pci_queue_group_fini+0x58/0x88 + mlxsw_pci_aqs_fini+0x2c/0x60 + mlxsw_pci_fini+0x34/0x50 + mlxsw_core_bus_device_unregister+0x104/0x1d0 + mlxsw_devlink_core_bus_device_reload_down+0x2c/0x48 + devlink_reload+0x44/0x158 + devlink_nl_cmd_reload+0x270/0x290 + genl_rcv_msg+0x188/0x2f0 + netlink_rcv_skb+0x5c/0x118 + genl_rcv+0x3c/0x50 + netlink_unicast+0x1bc/0x278 + netlink_sendmsg+0x194/0x390 + __sys_sendto+0xe0/0x158 + __arm64_sys_sendto+0x2c/0x38 + el0_svc_common.constprop.0+0x70/0x168 + do_el0_svc+0x28/0x88 + el0_sync_handler+0x88/0x190 + el0_sync+0x140/0x180 + +[2] +https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg1195432.html + +[3] +https://patchwork.kernel.org/project/linux-scsi/patch/20170212214920.28866-1-anton@ozlabs.org/#20116693 + +Cc: Eric Biederman +Signed-off-by: Danielle Ratson +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index aa4fef7890841..ff331251a019a 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1876,6 +1876,7 @@ int mlxsw_pci_driver_register(struct pci_driver *pci_driver) + { + pci_driver->probe = mlxsw_pci_probe; + pci_driver->remove = mlxsw_pci_remove; ++ pci_driver->shutdown = mlxsw_pci_remove; + return pci_register_driver(pci_driver); + } + EXPORT_SYMBOL(mlxsw_pci_driver_register); +-- +2.34.1 + diff --git a/queue-5.4/mmc-core-fixup-storing-of-ocr-for-mmc_quirk_nonstd_s.patch b/queue-5.4/mmc-core-fixup-storing-of-ocr-for-mmc_quirk_nonstd_s.patch new file mode 100644 index 00000000000..ea91162c156 --- /dev/null +++ b/queue-5.4/mmc-core-fixup-storing-of-ocr-for-mmc_quirk_nonstd_s.patch @@ -0,0 +1,57 @@ +From 1318d479d85c56bf7604ab661d52d790b4b3732f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 18:17:09 +0100 +Subject: mmc: core: Fixup storing of OCR for MMC_QUIRK_NONSTD_SDIO + +From: Ulf Hansson + +[ Upstream commit 8c3e5b74b9e2146f564905e50ca716591c76d4f1 ] + +The mmc core takes a specific path to support initializing of a +non-standard SDIO card. This is triggered by looking for the card-quirk, +MMC_QUIRK_NONSTD_SDIO. + +In mmc_sdio_init_card() this gets rather messy, as it causes the code to +bail out earlier, compared to the usual path. This leads to that the OCR +doesn't get saved properly in card->ocr. Fortunately, only omap_hsmmc has +been using the MMC_QUIRK_NONSTD_SDIO and is dealing with the issue, by +assigning a hardcoded value (0x80) to card->ocr from an ->init_card() ops. + +To make the behaviour consistent, let's instead rely on the core to save +the OCR in card->ocr during initialization. + +Reported-by: H. Nikolaus Schaller +Signed-off-by: Ulf Hansson +Signed-off-by: H. Nikolaus Schaller +Link: https://lore.kernel.org/r/e7936cff7fc24d187ef2680d3b4edb0ade58f293.1636564631.git.hns@goldelico.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sdio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c +index 0bf33786fc5c5..9e0791332ef38 100644 +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -626,6 +626,8 @@ try_again: + if (host->ops->init_card) + host->ops->init_card(host, card); + ++ card->ocr = ocr_card; ++ + /* + * If the host and card support UHS-I mode request the card + * to switch to 1.8V signaling level. No 1.8v signalling if +@@ -738,7 +740,7 @@ try_again: + goto mismatch; + } + } +- card->ocr = ocr_card; ++ + mmc_fixup_device(card, sdio_fixup_methods); + + if (card->type == MMC_TYPE_SD_COMBO) { +-- +2.34.1 + diff --git a/queue-5.4/mmc-meson-mx-sdio-add-irq-check.patch b/queue-5.4/mmc-meson-mx-sdio-add-irq-check.patch new file mode 100644 index 00000000000..e5d2638f0da --- /dev/null +++ b/queue-5.4/mmc-meson-mx-sdio-add-irq-check.patch @@ -0,0 +1,44 @@ +From e81d5b5c8c408cdeacebf59392855a0219b3a304 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 23:27:17 +0300 +Subject: mmc: meson-mx-sdio: add IRQ check + +From: Sergey Shtylyov + +[ Upstream commit 8fc9a77bc64e1f23d07953439817d8402ac9706f ] + +The driver neglects to check the result of platform_get_irq()'s call and +blithely passes the negative error codes to devm_request_threaded_irq() +(which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding +an original error code. Stop calling devm_request_threaded_irq() with the +invalid IRQ #s. + +Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meson8 and Meson8b SoC") +Signed-off-by: Sergey Shtylyov +Reviewed-by: Martin Blumenstingl +Link: https://lore.kernel.org/r/20211217202717.10041-3-s.shtylyov@omp.ru +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/meson-mx-sdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c +index 360d523132bd5..780552a86ec08 100644 +--- a/drivers/mmc/host/meson-mx-sdio.c ++++ b/drivers/mmc/host/meson-mx-sdio.c +@@ -665,6 +665,11 @@ static int meson_mx_mmc_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { ++ ret = irq; ++ goto error_free_mmc; ++ } ++ + ret = devm_request_threaded_irq(host->controller_dev, irq, + meson_mx_mmc_irq, + meson_mx_mmc_irq_thread, IRQF_ONESHOT, +-- +2.34.1 + diff --git a/queue-5.4/mwifiex-fix-possible-abba-deadlock.patch b/queue-5.4/mwifiex-fix-possible-abba-deadlock.patch new file mode 100644 index 00000000000..782238bc244 --- /dev/null +++ b/queue-5.4/mwifiex-fix-possible-abba-deadlock.patch @@ -0,0 +1,82 @@ +From 03531e27350ebc6472975aa9699a1313f8c3b15a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 16:47:34 -0800 +Subject: mwifiex: Fix possible ABBA deadlock + +From: Brian Norris + +[ Upstream commit 1b8bb8919ef81bfc8873d223b9361f1685f2106d ] + +Quoting Jia-Ju Bai : + + mwifiex_dequeue_tx_packet() + spin_lock_bh(&priv->wmm.ra_list_spinlock); --> Line 1432 (Lock A) + mwifiex_send_addba() + spin_lock_bh(&priv->sta_list_spinlock); --> Line 608 (Lock B) + + mwifiex_process_sta_tx_pause() + spin_lock_bh(&priv->sta_list_spinlock); --> Line 398 (Lock B) + mwifiex_update_ralist_tx_pause() + spin_lock_bh(&priv->wmm.ra_list_spinlock); --> Line 941 (Lock A) + +Similar report for mwifiex_process_uap_tx_pause(). + +While the locking expectations in this driver are a bit unclear, the +Fixed commit only intended to protect the sta_ptr, so we can drop the +lock as soon as we're done with it. + +IIUC, this deadlock cannot actually happen, because command event +processing (which calls mwifiex_process_sta_tx_pause()) is +sequentialized with TX packet processing (e.g., +mwifiex_dequeue_tx_packet()) via the main loop (mwifiex_main_process()). +But it's good not to leave this potential issue lurking. + +Fixes: f0f7c2275fb9 ("mwifiex: minor cleanups w/ sta_list_spinlock in cfg80211.c") +Cc: Douglas Anderson +Reported-by: TOTE Robot +Link: https://lore.kernel.org/linux-wireless/0e495b14-efbb-e0da-37bd-af6bd677ee2c@gmail.com/ +Signed-off-by: Brian Norris +Reviewed-by: Douglas Anderson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YaV0pllJ5p/EuUat@google.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sta_event.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c +index 5fdffb114913d..fd12093863801 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c ++++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c +@@ -364,10 +364,12 @@ static void mwifiex_process_uap_tx_pause(struct mwifiex_private *priv, + sta_ptr = mwifiex_get_sta_entry(priv, tp->peermac); + if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { + sta_ptr->tx_pause = tp->tx_pause; ++ spin_unlock_bh(&priv->sta_list_spinlock); + mwifiex_update_ralist_tx_pause(priv, tp->peermac, + tp->tx_pause); ++ } else { ++ spin_unlock_bh(&priv->sta_list_spinlock); + } +- spin_unlock_bh(&priv->sta_list_spinlock); + } + } + +@@ -399,11 +401,13 @@ static void mwifiex_process_sta_tx_pause(struct mwifiex_private *priv, + sta_ptr = mwifiex_get_sta_entry(priv, tp->peermac); + if (sta_ptr && sta_ptr->tx_pause != tp->tx_pause) { + sta_ptr->tx_pause = tp->tx_pause; ++ spin_unlock_bh(&priv->sta_list_spinlock); + mwifiex_update_ralist_tx_pause(priv, + tp->peermac, + tp->tx_pause); ++ } else { ++ spin_unlock_bh(&priv->sta_list_spinlock); + } +- spin_unlock_bh(&priv->sta_list_spinlock); + } + } + } +-- +2.34.1 + diff --git a/queue-5.4/mwifiex-fix-skb_over_panic-in-mwifiex_usb_recv.patch b/queue-5.4/mwifiex-fix-skb_over_panic-in-mwifiex_usb_recv.patch new file mode 100644 index 00000000000..73cfc08408d --- /dev/null +++ b/queue-5.4/mwifiex-fix-skb_over_panic-in-mwifiex_usb_recv.patch @@ -0,0 +1,68 @@ +From 8194061e0fae19a523ff2826742e78dd06944d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Oct 2021 22:42:50 -0400 +Subject: mwifiex: Fix skb_over_panic in mwifiex_usb_recv() + +From: Zekun Shen + +[ Upstream commit 04d80663f67ccef893061b49ec8a42ff7045ae84 ] + +Currently, with an unknown recv_type, mwifiex_usb_recv +just return -1 without restoring the skb. Next time +mwifiex_usb_rx_complete is invoked with the same skb, +calling skb_put causes skb_over_panic. + +The bug is triggerable with a compromised/malfunctioning +usb device. After applying the patch, skb_over_panic +no longer shows up with the same input. + +Attached is the panic report from fuzzing. +skbuff: skb_over_panic: text:000000003bf1b5fa + len:2048 put:4 head:00000000dd6a115b data:000000000a9445d8 + tail:0x844 end:0x840 dev: +kernel BUG at net/core/skbuff.c:109! +invalid opcode: 0000 [#1] SMP KASAN NOPTI +CPU: 0 PID: 198 Comm: in:imklog Not tainted 5.6.0 #60 +RIP: 0010:skb_panic+0x15f/0x161 +Call Trace: + + ? mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] + skb_put.cold+0x24/0x24 + mwifiex_usb_rx_complete+0x26b/0xfcd [mwifiex_usb] + __usb_hcd_giveback_urb+0x1e4/0x380 + usb_giveback_urb_bh+0x241/0x4f0 + ? __hrtimer_run_queues+0x316/0x740 + ? __usb_hcd_giveback_urb+0x380/0x380 + tasklet_action_common.isra.0+0x135/0x330 + __do_softirq+0x18c/0x634 + irq_exit+0x114/0x140 + smp_apic_timer_interrupt+0xde/0x380 + apic_timer_interrupt+0xf/0x20 + + +Reported-by: Brendan Dolan-Gavitt +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YX4CqjfRcTa6bVL+@Zekuns-MBP-16.fios-router.home +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c +index cb8a9ad40cfe9..39cf713d5054c 100644 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -130,7 +130,8 @@ static int mwifiex_usb_recv(struct mwifiex_adapter *adapter, + default: + mwifiex_dbg(adapter, ERROR, + "unknown recv_type %#x\n", recv_type); +- return -1; ++ ret = -1; ++ goto exit_restore_skb; + } + break; + case MWIFIEX_USB_EP_DATA: +-- +2.34.1 + diff --git a/queue-5.4/net-bonding-debug-avoid-printing-debug-logs-when-bon.patch b/queue-5.4/net-bonding-debug-avoid-printing-debug-logs-when-bon.patch new file mode 100644 index 00000000000..78390675728 --- /dev/null +++ b/queue-5.4/net-bonding-debug-avoid-printing-debug-logs-when-bon.patch @@ -0,0 +1,71 @@ +From 73c1a2dea4b209e6dbe081dbae0e947ee92a6430 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Dec 2021 11:17:09 +0530 +Subject: net: bonding: debug: avoid printing debug logs when bond is not + notifying peers + +From: Suresh Kumar + +[ Upstream commit fee32de284ac277ba434a2d59f8ce46528ff3946 ] + +Currently "bond_should_notify_peers: slave ..." messages are printed whenever +"bond_should_notify_peers" function is called. + ++++ +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Received LACPDU on port 1 +Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): Rx Machine: Port=1, Last State=6, Curr State=6 +Dec 12 12:33:26 node1 kernel: bond0: (slave enp0s25): partner sync=1 +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:26 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +... +Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Received LACPDU on port 2 +Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): Rx Machine: Port=2, Last State=6, Curr State=6 +Dec 12 12:33:30 node1 kernel: bond0: (slave enp4s3): partner sync=1 +Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 +Dec 12 12:33:30 node1 kernel: bond0: bond_should_notify_peers: slave enp0s25 ++++ + +This is confusing and can also clutter up debug logs. +Print logs only when the peer notification happens. + +Signed-off-by: Suresh Kumar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index a7eaf80f500c0..ff50ccc7dceb1 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -792,9 +792,6 @@ static bool bond_should_notify_peers(struct bonding *bond) + slave = rcu_dereference(bond->curr_active_slave); + rcu_read_unlock(); + +- netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", +- slave ? slave->dev->name : "NULL"); +- + if (!slave || !bond->send_peer_notif || + bond->send_peer_notif % + max(1, bond->params.peer_notif_delay) != 0 || +@@ -802,6 +799,9 @@ static bool bond_should_notify_peers(struct bonding *bond) + test_bit(__LINK_STATE_LINKWATCH_PENDING, &slave->dev->state)) + return false; + ++ netdev_dbg(bond->dev, "bond_should_notify_peers: slave %s\n", ++ slave ? slave->dev->name : "NULL"); ++ + return true; + } + +-- +2.34.1 + diff --git a/queue-5.4/net-gemini-allow-any-rgmii-interface-mode.patch b/queue-5.4/net-gemini-allow-any-rgmii-interface-mode.patch new file mode 100644 index 00000000000..e2552b8db16 --- /dev/null +++ b/queue-5.4/net-gemini-allow-any-rgmii-interface-mode.patch @@ -0,0 +1,71 @@ +From 79aa42342498631058d9055e5b8f5088b9d7abf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 16:38:31 +0000 +Subject: net: gemini: allow any RGMII interface mode + +From: Russell King (Oracle) + +[ Upstream commit 4e4f325a0a55907b14f579e6b1a38c53755e3de2 ] + +The four RGMII interface modes take care of the required RGMII delay +configuration at the PHY and should not be limited by the network MAC +driver. Sadly, gemini was only permitting RGMII mode with no delays, +which would require the required delay to be inserted via PCB tracking +or by the MAC. + +However, there are designs that require the PHY to add the delay, which +is impossible without Gemini permitting the other three PHY interface +modes. Fix the driver to allow these. + +Signed-off-by: Russell King (Oracle) +Reviewed-by: Linus Walleij +Tested-by: Corentin Labbe +Link: https://lore.kernel.org/r/E1n4mpT-002PLd-Ha@rmk-PC.armlinux.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index c9fb1ec625d8b..a8a8b77c1611e 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -304,21 +304,21 @@ static void gmac_speed_set(struct net_device *netdev) + switch (phydev->speed) { + case 1000: + status.bits.speed = GMAC_SPEED_1000; +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) ++ if (phy_interface_mode_is_rgmii(phydev->interface)) + status.bits.mii_rmii = GMAC_PHY_RGMII_1000; + netdev_dbg(netdev, "connect %s to RGMII @ 1Gbit\n", + phydev_name(phydev)); + break; + case 100: + status.bits.speed = GMAC_SPEED_100; +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) ++ if (phy_interface_mode_is_rgmii(phydev->interface)) + status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; + netdev_dbg(netdev, "connect %s to RGMII @ 100 Mbit\n", + phydev_name(phydev)); + break; + case 10: + status.bits.speed = GMAC_SPEED_10; +- if (phydev->interface == PHY_INTERFACE_MODE_RGMII) ++ if (phy_interface_mode_is_rgmii(phydev->interface)) + status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; + netdev_dbg(netdev, "connect %s to RGMII @ 10 Mbit\n", + phydev_name(phydev)); +@@ -388,6 +388,9 @@ static int gmac_setup_phy(struct net_device *netdev) + status.bits.mii_rmii = GMAC_PHY_GMII; + break; + case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: + netdev_dbg(netdev, + "RGMII: set GMAC0 and GMAC1 to MII/RGMII mode\n"); + status.bits.mii_rmii = GMAC_PHY_RGMII_100_10; +-- +2.34.1 + diff --git a/queue-5.4/net-mcs7830-handle-usb-read-errors-properly.patch b/queue-5.4/net-mcs7830-handle-usb-read-errors-properly.patch new file mode 100644 index 00000000000..c5f8870b4e8 --- /dev/null +++ b/queue-5.4/net-mcs7830-handle-usb-read-errors-properly.patch @@ -0,0 +1,56 @@ +From 5b019d735a9794fc0238cf607cab0bb2d95a07c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 01:57:16 +0300 +Subject: net: mcs7830: handle usb read errors properly + +From: Pavel Skripkin + +[ Upstream commit d668769eb9c52b150753f1653f7f5a0aeb8239d2 ] + +Syzbot reported uninit value in mcs7830_bind(). The problem was in +missing validation check for bytes read via usbnet_read_cmd(). + +usbnet_read_cmd() internally calls usb_control_msg(), that returns +number of bytes read. Code should validate that requested number of bytes +was actually read. + +So, this patch adds missing size validation check inside +mcs7830_get_reg() to prevent uninit value bugs + +Reported-and-tested-by: syzbot+003c0a286b9af5412510@syzkaller.appspotmail.com +Fixes: 2a36d7083438 ("USB: driver for mcs7830 (aka DeLOCK) USB ethernet adapter") +Signed-off-by: Pavel Skripkin +Reviewed-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20220106225716.7425-1-paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/mcs7830.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c +index 09bfa6a4dfbc1..7e40e2e2f3723 100644 +--- a/drivers/net/usb/mcs7830.c ++++ b/drivers/net/usb/mcs7830.c +@@ -108,8 +108,16 @@ static const char driver_name[] = "MOSCHIP usb-ethernet driver"; + + static int mcs7830_get_reg(struct usbnet *dev, u16 index, u16 size, void *data) + { +- return usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, +- 0x0000, index, data, size); ++ int ret; ++ ++ ret = usbnet_read_cmd(dev, MCS7830_RD_BREQ, MCS7830_RD_BMREQ, ++ 0x0000, index, data, size); ++ if (ret < 0) ++ return ret; ++ else if (ret < size) ++ return -ENODATA; ++ ++ return ret; + } + + static int mcs7830_set_reg(struct usbnet *dev, u16 index, u16 size, const void *data) +-- +2.34.1 + diff --git a/queue-5.4/net-mdio-demote-probed-message-to-debug-print.patch b/queue-5.4/net-mdio-demote-probed-message-to-debug-print.patch new file mode 100644 index 00000000000..dcc73a87e67 --- /dev/null +++ b/queue-5.4/net-mdio-demote-probed-message-to-debug-print.patch @@ -0,0 +1,40 @@ +From 160b4ec474375949e893d342968f3102df0934d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jan 2022 11:40:24 -0800 +Subject: net: mdio: Demote probed message to debug print + +From: Florian Fainelli + +[ Upstream commit 7590fc6f80ac2cbf23e6b42b668bbeded070850b ] + +On systems with large numbers of MDIO bus/muxes the message indicating +that a given MDIO bus has been successfully probed is repeated for as +many buses we have, which can eat up substantial boot time for no +reason, demote to a debug print. + +Reported-by: Maxime Bizon +Signed-off-by: Florian Fainelli +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20220103194024.2620-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index bec73f0640d03..b0a439248ff69 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -433,7 +433,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) + mdiobus_setup_mdiodev_from_board_info(bus, mdiobus_create_device); + + bus->state = MDIOBUS_REGISTERED; +- pr_info("%s: probed\n", bus->name); ++ dev_dbg(&bus->dev, "probed\n"); + return 0; + + error: +-- +2.34.1 + diff --git a/queue-5.4/net-mlx5-set-command-entry-semaphore-up-once-got-ind.patch b/queue-5.4/net-mlx5-set-command-entry-semaphore-up-once-got-ind.patch new file mode 100644 index 00000000000..e79cea15c52 --- /dev/null +++ b/queue-5.4/net-mlx5-set-command-entry-semaphore-up-once-got-ind.patch @@ -0,0 +1,72 @@ +From aa459953efc497bc24f398bf09472dddf182da41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Dec 2021 12:07:49 +0200 +Subject: net/mlx5: Set command entry semaphore up once got index free + +From: Moshe Shemesh + +[ Upstream commit 8e715cd613a1e872b9d918e912d90b399785761a ] + +Avoid a race where command work handler may fail to allocate command +entry index, by holding the command semaphore down till command entry +index is being freed. + +Fixes: 410bd754cd73 ("net/mlx5: Add retry mechanism to the command entry index allocation") +Signed-off-by: Moshe Shemesh +Reviewed-by: Eran Ben Elisha +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index bf091a6c0cd2d..cedb102ce8d2f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -147,8 +147,12 @@ static void cmd_ent_put(struct mlx5_cmd_work_ent *ent) + if (!refcount_dec_and_test(&ent->refcnt)) + return; + +- if (ent->idx >= 0) +- cmd_free_index(ent->cmd, ent->idx); ++ if (ent->idx >= 0) { ++ struct mlx5_cmd *cmd = ent->cmd; ++ ++ cmd_free_index(cmd, ent->idx); ++ up(ent->page_queue ? &cmd->pages_sem : &cmd->sem); ++ } + + cmd_free_ent(ent); + } +@@ -1577,8 +1581,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force + vector = vec & 0xffffffff; + for (i = 0; i < (1 << cmd->log_sz); i++) { + if (test_bit(i, &vector)) { +- struct semaphore *sem; +- + ent = cmd->ent_arr[i]; + + /* if we already completed the command, ignore it */ +@@ -1601,10 +1603,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force + dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) + cmd_ent_put(ent); + +- if (ent->page_queue) +- sem = &cmd->pages_sem; +- else +- sem = &cmd->sem; + ent->ts2 = ktime_get_ns(); + memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out)); + dump_command(dev, ent, 0); +@@ -1658,7 +1656,6 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force + */ + complete(&ent->done); + } +- up(sem); + } + } + } +-- +2.34.1 + diff --git a/queue-5.4/net-mlx5e-don-t-block-routes-with-nexthop-objects-in.patch b/queue-5.4/net-mlx5e-don-t-block-routes-with-nexthop-objects-in.patch new file mode 100644 index 00000000000..9b7f4b96499 --- /dev/null +++ b/queue-5.4/net-mlx5e-don-t-block-routes-with-nexthop-objects-in.patch @@ -0,0 +1,48 @@ +From ef2da6ff4ecc83570c4cece502182e330ad1cd7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 11:20:10 +0200 +Subject: net/mlx5e: Don't block routes with nexthop objects in SW + +From: Maor Dickman + +[ Upstream commit 9e72a55a3c9d54b38a704bb7292d984574a81d9d ] + +Routes with nexthop objects is currently not supported by multipath offload +and any attempts to use it is blocked, however this also block adding SW +routes with nexthop. + +Resolve this by returning NOTIFY_DONE instead of an error which will allow such +a route to be created in SW but not offloaded. + +This fix also solve an issue which block adding such routes on different devices +due to missing check if the route FIB device is one of multipath devices. + +Fixes: 6a87afc072c3 ("mlx5: Fail attempts to use routes with nexthop objects") +Signed-off-by: Maor Dickman +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +index bdc7f915d80e3..101667c6b5843 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lag_mp.c +@@ -265,10 +265,8 @@ static int mlx5_lag_fib_event(struct notifier_block *nb, + fen_info = container_of(info, struct fib_entry_notifier_info, + info); + fi = fen_info->fi; +- if (fi->nh) { +- NL_SET_ERR_MSG_MOD(info->extack, "IPv4 route with nexthop objects is not supported"); +- return notifier_from_errno(-EINVAL); +- } ++ if (fi->nh) ++ return NOTIFY_DONE; + fib_dev = fib_info_nh(fen_info->fi, 0)->fib_nh_dev; + if (fib_dev != ldev->pf[0].netdev && + fib_dev != ldev->pf[1].netdev) { +-- +2.34.1 + diff --git a/queue-5.4/net-phy-marvell-configure-rgmii-delays-for-88e1118.patch b/queue-5.4/net-phy-marvell-configure-rgmii-delays-for-88e1118.patch new file mode 100644 index 00000000000..03a669aee4e --- /dev/null +++ b/queue-5.4/net-phy-marvell-configure-rgmii-delays-for-88e1118.patch @@ -0,0 +1,55 @@ +From 88c8485dd46ba80f752af3339dc1111433452245 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 16:38:19 +0000 +Subject: net: phy: marvell: configure RGMII delays for 88E1118 + +From: Russell King (Oracle) + +[ Upstream commit f22725c95ececb703c3f741e8f946d23705630b7 ] + +Corentin Labbe reports that the SSI 1328 does not work when allowing +the PHY to operate at gigabit speeds, but does work with the generic +PHY driver. + +This appears to be because m88e1118_config_init() writes a fixed value +to the MSCR register, claiming that this is to enable 1G speeds. +However, this always sets bits 4 and 5, enabling RGMII transmit and +receive delays. The suspicion is that the original board this was +added for required the delays to make 1G speeds work. + +Add the necessary configuration for RGMII delays for the 88E1118 to +bring this into line with the requirements for RGMII support, and thus +make the SSI 1328 work. + +Corentin Labbe has tested this on gemini-ssi1328 and gemini-ns2502. + +Reported-by: Corentin Labbe +Tested-by: Corentin Labbe +Signed-off-by: Russell King (Oracle) +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 9dbe625ad4477..a69317e944229 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -917,6 +917,12 @@ static int m88e1118_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ if (phy_interface_is_rgmii(phydev)) { ++ err = m88e1121_config_aneg_rgmii_delays(phydev); ++ if (err < 0) ++ return err; ++ } ++ + /* Adjust LED Control */ + if (phydev->dev_flags & MARVELL_PHY_M1118_DNS323_LEDS) + err = phy_write(phydev, 0x10, 0x1100); +-- +2.34.1 + diff --git a/queue-5.4/net-phy-prefer-1000baset-over-1000basekx.patch b/queue-5.4/net-phy-prefer-1000baset-over-1000basekx.patch new file mode 100644 index 00000000000..3db42a312d5 --- /dev/null +++ b/queue-5.4/net-phy-prefer-1000baset-over-1000basekx.patch @@ -0,0 +1,58 @@ +From 8f3810a3b5447ebeb0aad0b6aa108a14781a0de2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 11:36:30 +0000 +Subject: net: phy: prefer 1000baseT over 1000baseKX + +From: Russell King (Oracle) + +[ Upstream commit f20f94f7f52c4685c81754f489ffcc72186e8bdb ] + +The PHY settings table is supposed to be sorted by descending match +priority - in other words, earlier entries are preferred over later +entries. + +The order of 1000baseKX/Full and 1000baseT/Full is such that we +prefer 1000baseKX/Full over 1000baseT/Full, but 1000baseKX/Full is +a lot rarer than 1000baseT/Full, and thus is much less likely to +be preferred. + +This causes phylink problems - it means a fixed link specifying a +speed of 1G and full duplex gets an ethtool linkmode of 1000baseKX/Full +rather than 1000baseT/Full as would be expected - and since we offer +userspace a software emulation of a conventional copper PHY, we want +to offer copper modes in preference to anything else. However, we do +still want to allow the rarer modes as well. + +Hence, let's reorder these two modes to prefer copper. + +Tested-by: Tom Lendacky +Signed-off-by: Russell King (Oracle) +Reviewed-by: Andrew Lunn +Reported-by: Florian Fainelli +Link: https://lore.kernel.org/r/E1muvFO-00F6jY-1K@rmk-PC.armlinux.org.uk +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/phy-core.c b/drivers/net/phy/phy-core.c +index 9412669b579c7..84064120918f0 100644 +--- a/drivers/net/phy/phy-core.c ++++ b/drivers/net/phy/phy-core.c +@@ -128,11 +128,11 @@ static const struct phy_setting settings[] = { + PHY_SETTING( 2500, FULL, 2500baseT_Full ), + PHY_SETTING( 2500, FULL, 2500baseX_Full ), + /* 1G */ +- PHY_SETTING( 1000, FULL, 1000baseKX_Full ), + PHY_SETTING( 1000, FULL, 1000baseT_Full ), + PHY_SETTING( 1000, HALF, 1000baseT_Half ), + PHY_SETTING( 1000, FULL, 1000baseT1_Full ), + PHY_SETTING( 1000, FULL, 1000baseX_Full ), ++ PHY_SETTING( 1000, FULL, 1000baseKX_Full ), + /* 100M */ + PHY_SETTING( 100, FULL, 100baseT_Full ), + PHY_SETTING( 100, FULL, 100baseT1_Full ), +-- +2.34.1 + diff --git a/queue-5.4/net-sysfs-update-the-queue-counts-in-the-unregistrat.patch b/queue-5.4/net-sysfs-update-the-queue-counts-in-the-unregistrat.patch new file mode 100644 index 00000000000..645956cad3f --- /dev/null +++ b/queue-5.4/net-sysfs-update-the-queue-counts-in-the-unregistrat.patch @@ -0,0 +1,38 @@ +From 501d9f071a2f275bbde251c1b0d0726504439ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 15:57:24 +0100 +Subject: net-sysfs: update the queue counts in the unregistration path + +From: Antoine Tenart + +[ Upstream commit d7dac083414eb5bb99a6d2ed53dc2c1b405224e5 ] + +When updating Rx and Tx queue kobjects, the queue count should always be +updated to match the queue kobjects count. This was not done in the net +device unregistration path, fix it. Tracking all queue count updates +will allow in a following up patch to detect illegal updates. + +Signed-off-by: Antoine Tenart +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/net-sysfs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 05b0c60bfba2b..bcad7028bbf45 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1661,6 +1661,9 @@ static void remove_queue_kobjects(struct net_device *dev) + + net_rx_queue_update_kobjects(dev, real_rx, 0); + netdev_queue_update_kobjects(dev, real_tx, 0); ++ ++ dev->real_num_rx_queues = 0; ++ dev->real_num_tx_queues = 0; + #ifdef CONFIG_SYSFS + kset_unregister(dev->queues_kset); + #endif +-- +2.34.1 + diff --git a/queue-5.4/netfilter-bridge-add-support-for-pppoe-filtering.patch b/queue-5.4/netfilter-bridge-add-support-for-pppoe-filtering.patch new file mode 100644 index 00000000000..0981b45e658 --- /dev/null +++ b/queue-5.4/netfilter-bridge-add-support-for-pppoe-filtering.patch @@ -0,0 +1,77 @@ +From 025dd159d2ebf40fbda287d2fdac3ebc7771f1af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Nov 2021 12:50:31 +0100 +Subject: netfilter: bridge: add support for pppoe filtering + +From: Florian Westphal + +[ Upstream commit 28b78ecffea8078d81466b2e01bb5a154509f1ba ] + +This makes 'bridge-nf-filter-pppoe-tagged' sysctl work for +bridged traffic. + +Looking at the original commit it doesn't appear this ever worked: + + static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb, +[..] + if (skb->protocol == htons(ETH_P_8021Q)) { + skb_pull(skb, VLAN_HLEN); + skb->network_header += VLAN_HLEN; ++ } else if (skb->protocol == htons(ETH_P_PPP_SES)) { ++ skb_pull(skb, PPPOE_SES_HLEN); ++ skb->network_header += PPPOE_SES_HLEN; + } + [..] + NF_HOOK(... POST_ROUTING, ...) + +... but the adjusted offsets are never restored. + +The alternative would be to rip this code out for good, +but otoh we'd have to keep this anyway for the vlan handling +(which works because vlan tag info is in the skb, not the packet + payload). + +Reported-and-tested-by: Amish Chana +Fixes: 516299d2f5b6f97 ("[NETFILTER]: bridge-nf: filter bridged IPv4/IPv6 encapsulated in pppoe traffic") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/br_netfilter_hooks.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 2371b833b2bcd..480e4111b24c1 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -743,6 +743,9 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff + if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) + mtu = nf_bridge->frag_max_size; + ++ nf_bridge_update_protocol(skb); ++ nf_bridge_push_encap_header(skb); ++ + if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) { + nf_bridge_info_free(skb); + return br_dev_queue_push_xmit(net, sk, skb); +@@ -760,8 +763,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff + + IPCB(skb)->frag_max_size = nf_bridge->frag_max_size; + +- nf_bridge_update_protocol(skb); +- + data = this_cpu_ptr(&brnf_frag_data_storage); + + if (skb_vlan_tag_present(skb)) { +@@ -789,8 +790,6 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff + + IP6CB(skb)->frag_max_size = nf_bridge->frag_max_size; + +- nf_bridge_update_protocol(skb); +- + data = this_cpu_ptr(&brnf_frag_data_storage); + data->encap_size = nf_bridge_encap_header_len(skb); + data->size = ETH_HLEN + data->encap_size; +-- +2.34.1 + diff --git a/queue-5.4/netfilter-ipt_clusterip-fix-refcount-leak-in-cluster.patch b/queue-5.4/netfilter-ipt_clusterip-fix-refcount-leak-in-cluster.patch new file mode 100644 index 00000000000..c2718b36d34 --- /dev/null +++ b/queue-5.4/netfilter-ipt_clusterip-fix-refcount-leak-in-cluster.patch @@ -0,0 +1,48 @@ +From 7e080a411de5ecacbe4903053d552eb6cc51634f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Dec 2021 10:48:12 +0800 +Subject: netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() + +From: Xin Xiong + +[ Upstream commit d94a69cb2cfa77294921aae9afcfb866e723a2da ] + +The issue takes place in one error path of clusterip_tg_check(). When +memcmp() returns nonzero, the function simply returns the error code, +forgetting to decrease the reference count of a clusterip_config +object, which is bumped earlier by clusterip_config_find_get(). This +may incur reference count leak. + +Fix this issue by decrementing the refcount of the object in specific +error path. + +Fixes: 06aa151ad1fc74 ("netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set") +Signed-off-by: Xin Xiong +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c +index 6bdb1ab8af617..63ebb87d85331 100644 +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -505,8 +505,11 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) + if (IS_ERR(config)) + return PTR_ERR(config); + } +- } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) ++ } else if (memcmp(&config->clustermac, &cipinfo->clustermac, ETH_ALEN)) { ++ clusterip_config_entry_put(config); ++ clusterip_config_put(config); + return -EINVAL; ++ } + + ret = nf_ct_netns_get(par->net, par->family); + if (ret < 0) { +-- +2.34.1 + diff --git a/queue-5.4/of-base-fix-phandle-argument-length-mismatch-error-m.patch b/queue-5.4/of-base-fix-phandle-argument-length-mismatch-error-m.patch new file mode 100644 index 00000000000..f64db8a904e --- /dev/null +++ b/queue-5.4/of-base-fix-phandle-argument-length-mismatch-error-m.patch @@ -0,0 +1,42 @@ +From 7e102cd3474348a8e1a55208d179530bff593d6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 18:31:52 +0200 +Subject: of: base: Fix phandle argument length mismatch error message + +From: Baruch Siach + +[ Upstream commit 94a4950a4acff39b5847cc1fee4f65e160813493 ] + +The cell_count field of of_phandle_iterator is the number of cells we +expect in the phandle arguments list when cells_name is missing. The +error message should show the number of cells we actually see. + +Fixes: af3be70a3211 ("of: Improve of_phandle_iterator_next() error message") +Cc: Florian Fainelli +Signed-off-by: Baruch Siach +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/96519ac55be90a63fa44afe01480c30d08535465.1640881913.git.baruch@tkos.co.il +Signed-off-by: Sasha Levin +--- + drivers/of/base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/of/base.c b/drivers/of/base.c +index 1d667eb730e19..a240211653789 100644 +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -1366,9 +1366,9 @@ int of_phandle_iterator_next(struct of_phandle_iterator *it) + * property data length + */ + if (it->cur + count > it->list_end) { +- pr_err("%pOF: %s = %d found %d\n", ++ pr_err("%pOF: %s = %d found %td\n", + it->parent, it->cells_name, +- count, it->cell_count); ++ count, it->list_end - it->cur); + goto err; + } + } +-- +2.34.1 + diff --git a/queue-5.4/parisc-avoid-calling-faulthandler_disabled-twice.patch b/queue-5.4/parisc-avoid-calling-faulthandler_disabled-twice.patch new file mode 100644 index 00000000000..b51d616654b --- /dev/null +++ b/queue-5.4/parisc-avoid-calling-faulthandler_disabled-twice.patch @@ -0,0 +1,53 @@ +From 8fd673500677b6e6a2dc472e06c75e14a7384897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 16:52:26 +0000 +Subject: parisc: Avoid calling faulthandler_disabled() twice + +From: John David Anglin + +[ Upstream commit 9e9d4b460f23bab61672eae397417d03917d116c ] + +In handle_interruption(), we call faulthandler_disabled() to check whether the +fault handler is not disabled. If the fault handler is disabled, we immediately +call do_page_fault(). It then calls faulthandler_disabled(). If disabled, +do_page_fault() attempts to fixup the exception by jumping to no_context: + +no_context: + + if (!user_mode(regs) && fixup_exception(regs)) { + return; + } + + parisc_terminate("Bad Address (null pointer deref?)", regs, code, address); + +Apart from the error messages, the two blocks of code perform the same +function. + +We can avoid two calls to faulthandler_disabled() by a simple revision +to the code in handle_interruption(). + +Note: I didn't try to fix the formatting of this code block. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/traps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index 82fc011894889..2a1060d747a5d 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -783,7 +783,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + * unless pagefault_disable() was called before. + */ + +- if (fault_space == 0 && !faulthandler_disabled()) ++ if (faulthandler_disabled() || fault_space == 0) + { + /* Clean up and return if in exception table. */ + if (fixup_exception(regs)) +-- +2.34.1 + diff --git a/queue-5.4/pci-msi-fix-pci_irq_vector-pci_irq_get_affinity.patch b/queue-5.4/pci-msi-fix-pci_irq_vector-pci_irq_get_affinity.patch new file mode 100644 index 00000000000..548b5e855c8 --- /dev/null +++ b/queue-5.4/pci-msi-fix-pci_irq_vector-pci_irq_get_affinity.patch @@ -0,0 +1,97 @@ +From e2f0377264eae14aa94674e673b354ce140ff310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Dec 2021 23:27:26 +0100 +Subject: PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity() + +From: Thomas Gleixner + +[ Upstream commit 29bbc35e29d9b6347780dcacde2deb4b39344167 ] + +pci_irq_vector() and pci_irq_get_affinity() use the list position to find the +MSI-X descriptor at a given index. That's correct for the normal case where +the entry number is the same as the list position. + +But it's wrong for cases where MSI-X was allocated with an entries array +describing sparse entry numbers into the hardware message descriptor +table. That's inconsistent at best. + +Make it always check the entry number because that's what the zero base +index really means. This change won't break existing users which use a +sparse entries array for allocation because these users retrieve the Linux +interrupt number from the entries array after allocation and none of them +uses pci_irq_vector() or pci_irq_get_affinity(). + +Fixes: aff171641d18 ("PCI: Provide sensible IRQ vector alloc/free routines") +Signed-off-by: Thomas Gleixner +Tested-by: Juergen Gross +Reviewed-by: Jason Gunthorpe +Acked-by: Bjorn Helgaas +Link: https://lore.kernel.org/r/20211206210223.929792157@linutronix.de +Signed-off-by: Sasha Levin +--- + drivers/pci/msi.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c +index 7dc10c2b4785d..715c85d4e688d 100644 +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -1294,19 +1294,24 @@ EXPORT_SYMBOL(pci_free_irq_vectors); + + /** + * pci_irq_vector - return Linux IRQ number of a device vector +- * @dev: PCI device to operate on +- * @nr: device-relative interrupt vector index (0-based). ++ * @dev: PCI device to operate on ++ * @nr: Interrupt vector index (0-based) ++ * ++ * @nr has the following meanings depending on the interrupt mode: ++ * MSI-X: The index in the MSI-X vector table ++ * MSI: The index of the enabled MSI vectors ++ * INTx: Must be 0 ++ * ++ * Return: The Linux interrupt number or -EINVAl if @nr is out of range. + */ + int pci_irq_vector(struct pci_dev *dev, unsigned int nr) + { + if (dev->msix_enabled) { + struct msi_desc *entry; +- int i = 0; + + for_each_pci_msi_entry(entry, dev) { +- if (i == nr) ++ if (entry->msi_attrib.entry_nr == nr) + return entry->irq; +- i++; + } + WARN_ON_ONCE(1); + return -EINVAL; +@@ -1330,17 +1335,22 @@ EXPORT_SYMBOL(pci_irq_vector); + * pci_irq_get_affinity - return the affinity of a particular MSI vector + * @dev: PCI device to operate on + * @nr: device-relative interrupt vector index (0-based). ++ * ++ * @nr has the following meanings depending on the interrupt mode: ++ * MSI-X: The index in the MSI-X vector table ++ * MSI: The index of the enabled MSI vectors ++ * INTx: Must be 0 ++ * ++ * Return: A cpumask pointer or NULL if @nr is out of range + */ + const struct cpumask *pci_irq_get_affinity(struct pci_dev *dev, int nr) + { + if (dev->msix_enabled) { + struct msi_desc *entry; +- int i = 0; + + for_each_pci_msi_entry(entry, dev) { +- if (i == nr) ++ if (entry->msi_attrib.entry_nr == nr) + return &entry->affinity->mask; +- i++; + } + WARN_ON_ONCE(1); + return NULL; +-- +2.34.1 + diff --git a/queue-5.4/pcmcia-fix-setting-of-kthread-task-states.patch b/queue-5.4/pcmcia-fix-setting-of-kthread-task-states.patch new file mode 100644 index 00000000000..5b703a38d8e --- /dev/null +++ b/queue-5.4/pcmcia-fix-setting-of-kthread-task-states.patch @@ -0,0 +1,55 @@ +From a378dbd10ac88531ef77dedd9942969816ece373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 10:02:51 +0100 +Subject: pcmcia: fix setting of kthread task states + +From: Dominik Brodowski + +[ Upstream commit fbb3485f1f931102d8ba606f1c28123f5b48afa3 ] + +We need to set TASK_INTERRUPTIBLE before calling kthread_should_stop(). +Otherwise, kthread_stop() might see that the pccardd thread is still +in TASK_RUNNING state and fail to wake it up. + +Additionally, we only need to set the state back to TASK_RUNNING if +kthread_should_stop() breaks the loop. + +Cc: Greg Kroah-Hartman +Reported-by: Al Viro +Reviewed-by: Matthew Wilcox (Oracle) +Fixes: d3046ba809ce ("pcmcia: fix a boot time warning in pcmcia cs code") +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/cs.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c +index e211e2619680c..f70197154a362 100644 +--- a/drivers/pcmcia/cs.c ++++ b/drivers/pcmcia/cs.c +@@ -666,18 +666,16 @@ static int pccardd(void *__skt) + if (events || sysfs_events) + continue; + ++ set_current_state(TASK_INTERRUPTIBLE); + if (kthread_should_stop()) + break; + +- set_current_state(TASK_INTERRUPTIBLE); +- + schedule(); + +- /* make sure we are running */ +- __set_current_state(TASK_RUNNING); +- + try_to_freeze(); + } ++ /* make sure we are running before we exit */ ++ __set_current_state(TASK_RUNNING); + + /* shut down socket, if a device is still present */ + if (skt->state & SOCKET_PRESENT) { +-- +2.34.1 + diff --git a/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch b/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..42df21a8ad4 --- /dev/null +++ b/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch @@ -0,0 +1,56 @@ +From c23021d3d1d33b19ae87c7a666f5e7787e81eb44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 00:59:23 +0800 +Subject: pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in + __nonstatic_find_io_region() + +From: Zhou Qingyang + +[ Upstream commit ca0fe0d7c35c97528bdf621fdca75f13157c27af ] + +In __nonstatic_find_io_region(), pcmcia_make_resource() is assigned to +res and used in pci_bus_alloc_resource(). There is a dereference of res +in pci_bus_alloc_resource(), which could lead to a NULL pointer +dereference on failure of pcmcia_make_resource(). + +Fix this bug by adding a check of res. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_PCCARD_NONSTATIC=y show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into one module") +Signed-off-by: Zhou Qingyang +[linux@dominikbrodowski.net: Fix typo in commit message] +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 9e6922c08ef62..03ae998675e87 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -690,6 +690,9 @@ static struct resource *__nonstatic_find_io_region(struct pcmcia_socket *s, + unsigned long min = base; + int ret; + ++ if (!res) ++ return NULL; ++ + data.mask = align - 1; + data.offset = base & data.mask; + data.map = &s_data->io_db; +-- +2.34.1 + diff --git a/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch-19174 b/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch-19174 new file mode 100644 index 00000000000..02d5f51bc67 --- /dev/null +++ b/queue-5.4/pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch-19174 @@ -0,0 +1,55 @@ +From 385a19dbcc2ad00c758a84aa9038857d93073730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 02:11:40 +0800 +Subject: pcmcia: rsrc_nonstatic: Fix a NULL pointer dereference in + nonstatic_find_mem_region() + +From: Zhou Qingyang + +[ Upstream commit 977d2e7c63c3d04d07ba340b39987742e3241554 ] + +In nonstatic_find_mem_region(), pcmcia_make_resource() is assigned to +res and used in pci_bus_alloc_resource(). There a dereference of res +in pci_bus_alloc_resource(), which could lead to a NULL pointer +dereference on failure of pcmcia_make_resource(). + +Fix this bug by adding a check of res. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_PCCARD_NONSTATIC=y show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into one module") +Signed-off-by: Zhou Qingyang +Signed-off-by: Dominik Brodowski +Signed-off-by: Sasha Levin +--- + drivers/pcmcia/rsrc_nonstatic.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c +index 03ae998675e87..3a512513cb32f 100644 +--- a/drivers/pcmcia/rsrc_nonstatic.c ++++ b/drivers/pcmcia/rsrc_nonstatic.c +@@ -812,6 +812,9 @@ static struct resource *nonstatic_find_mem_region(u_long base, u_long num, + unsigned long min, max; + int ret, i, j; + ++ if (!res) ++ return NULL; ++ + low = low || !(s->features & SS_CAP_PAGE_REGS); + + data.mask = align - 1; +-- +2.34.1 + diff --git a/queue-5.4/phy-uniphier-usb3ss-fix-unintended-writing-zeros-to-.patch b/queue-5.4/phy-uniphier-usb3ss-fix-unintended-writing-zeros-to-.patch new file mode 100644 index 00000000000..ef22a9c4033 --- /dev/null +++ b/queue-5.4/phy-uniphier-usb3ss-fix-unintended-writing-zeros-to-.patch @@ -0,0 +1,61 @@ +From 5f6b7ae3fb2f3c97092eca45cbcb1961ccdc48b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 14:19:29 +0900 +Subject: phy: uniphier-usb3ss: fix unintended writing zeros to PHY register + +From: Ryuta NAKANISHI + +[ Upstream commit 898c7a9ec81620125f2463714a0f4dea18ad6e54 ] + +Similar to commit 4a90bbb478db ("phy: uniphier-pcie: Fix updating phy +parameters"), in function uniphier_u3ssphy_set_param(), unintentionally +write zeros to other fields when writing PHY registers. + +Fixes: 5ab43d0f8697 ("phy: socionext: add USB3 PHY driver for UniPhier SoC") +Signed-off-by: Ryuta NAKANISHI +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/1640150369-4134-1-git-send-email-hayashi.kunihiko@socionext.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/socionext/phy-uniphier-usb3ss.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/phy/socionext/phy-uniphier-usb3ss.c b/drivers/phy/socionext/phy-uniphier-usb3ss.c +index a7577e316baf5..e63648b5c7547 100644 +--- a/drivers/phy/socionext/phy-uniphier-usb3ss.c ++++ b/drivers/phy/socionext/phy-uniphier-usb3ss.c +@@ -22,11 +22,13 @@ + #include + + #define SSPHY_TESTI 0x0 +-#define SSPHY_TESTO 0x4 + #define TESTI_DAT_MASK GENMASK(13, 6) + #define TESTI_ADR_MASK GENMASK(5, 1) + #define TESTI_WR_EN BIT(0) + ++#define SSPHY_TESTO 0x4 ++#define TESTO_DAT_MASK GENMASK(7, 0) ++ + #define PHY_F(regno, msb, lsb) { (regno), (msb), (lsb) } + + #define CDR_CPD_TRIM PHY_F(7, 3, 0) /* RxPLL charge pump current */ +@@ -84,12 +86,12 @@ static void uniphier_u3ssphy_set_param(struct uniphier_u3ssphy_priv *priv, + val = FIELD_PREP(TESTI_DAT_MASK, 1); + val |= FIELD_PREP(TESTI_ADR_MASK, p->field.reg_no); + uniphier_u3ssphy_testio_write(priv, val); +- val = readl(priv->base + SSPHY_TESTO); ++ val = readl(priv->base + SSPHY_TESTO) & TESTO_DAT_MASK; + + /* update value */ +- val &= ~FIELD_PREP(TESTI_DAT_MASK, field_mask); ++ val &= ~field_mask; + data = field_mask & (p->value << p->field.lsb); +- val = FIELD_PREP(TESTI_DAT_MASK, data); ++ val = FIELD_PREP(TESTI_DAT_MASK, data | val); + val |= FIELD_PREP(TESTI_ADR_MASK, p->field.reg_no); + uniphier_u3ssphy_testio_write(priv, val); + uniphier_u3ssphy_testio_write(priv, val | TESTI_WR_EN); +-- +2.34.1 + diff --git a/queue-5.4/power-bq25890-enable-continuous-conversion-for-adc-a.patch b/queue-5.4/power-bq25890-enable-continuous-conversion-for-adc-a.patch new file mode 100644 index 00000000000..a43f9cd1b99 --- /dev/null +++ b/queue-5.4/power-bq25890-enable-continuous-conversion-for-adc-a.patch @@ -0,0 +1,43 @@ +From 1d7a7a497586425954948fbbdf40683938ba8e6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 23:20:01 +0300 +Subject: power: bq25890: Enable continuous conversion for ADC at charging + +From: Yauhen Kharuzhy + +[ Upstream commit 80211be1b9dec04cc2805d3d81e2091ecac289a1 ] + +Instead of one shot run of ADC at beginning of charging, run continuous +conversion to ensure that all charging-related values are monitored +properly (input voltage, input current, themperature etc.). + +Signed-off-by: Yauhen Kharuzhy +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq25890_charger.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c +index 9d1ec8d677de6..5afe55119fe65 100644 +--- a/drivers/power/supply/bq25890_charger.c ++++ b/drivers/power/supply/bq25890_charger.c +@@ -531,12 +531,12 @@ static void bq25890_handle_state_change(struct bq25890_device *bq, + + if (!new_state->online) { /* power removed */ + /* disable ADC */ +- ret = bq25890_field_write(bq, F_CONV_START, 0); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 0); + if (ret < 0) + goto error; + } else if (!old_state.online) { /* power inserted */ + /* enable ADC, to have control of charge current/voltage */ +- ret = bq25890_field_write(bq, F_CONV_START, 1); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 1); + if (ret < 0) + goto error; + } +-- +2.34.1 + diff --git a/queue-5.4/powerpc-6xx-add-missing-of_node_put.patch b/queue-5.4/powerpc-6xx-add-missing-of_node_put.patch new file mode 100644 index 00000000000..2af1e8dcb82 --- /dev/null +++ b/queue-5.4/powerpc-6xx-add-missing-of_node_put.patch @@ -0,0 +1,64 @@ +From 88fdaf954abad70de28c0ab74ef1462797e67fc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2015 20:33:19 +0000 +Subject: powerpc/6xx: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit f6e82647ff71d427d4148964b71f239fba9d7937 ] + +for_each_compatible_node performs an of_node_get on each iteration, so +a break out of the loop requires an of_node_put. + +A simplified version of the semantic patch that fixes this problem is as +follows (http://coccinelle.lip6.fr): + +// +@@ +expression e; +local idexpression n; +@@ + +@@ +local idexpression n; +expression e; +@@ + + for_each_compatible_node(n,...) { + ... +( + of_node_put(n); +| + e = n +| ++ of_node_put(n); +? break; +) + ... + } +... when != n +// + +Signed-off-by: Julia Lawall +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1448051604-25256-2-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index a1b7f79a8a152..de10c13de15c6 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -215,6 +215,7 @@ void hlwd_pic_probe(void) + irq_set_chained_handler(cascade_virq, + hlwd_pic_irq_cascade); + hlwd_irq_host = host; ++ of_node_put(np); + break; + } + } +-- +2.34.1 + diff --git a/queue-5.4/powerpc-btext-add-missing-of_node_put.patch b/queue-5.4/powerpc-btext-add-missing-of_node_put.patch new file mode 100644 index 00000000000..63586db3c9a --- /dev/null +++ b/queue-5.4/powerpc-btext-add-missing-of_node_put.patch @@ -0,0 +1,63 @@ +From a77693f00832b8dfa82a79ad46f601eb65138732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2015 20:33:23 +0000 +Subject: powerpc/btext: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit a1d2b210ffa52d60acabbf7b6af3ef7e1e69cda0 ] + +for_each_node_by_type performs an of_node_get on each iteration, so +a break out of the loop requires an of_node_put. + +A simplified version of the semantic patch that fixes this problem is as +follows (http://coccinelle.lip6.fr): + +// +@@ +local idexpression n; +expression e; +@@ + + for_each_node_by_type(n,...) { + ... +( + of_node_put(n); +| + e = n +| ++ of_node_put(n); +? break; +) + ... + } +... when != n +// + +Signed-off-by: Julia Lawall +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1448051604-25256-6-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/btext.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/btext.c b/arch/powerpc/kernel/btext.c +index 6dfceaa820e42..b0e0b3cd91eec 100644 +--- a/arch/powerpc/kernel/btext.c ++++ b/arch/powerpc/kernel/btext.c +@@ -250,8 +250,10 @@ int __init btext_find_display(int allow_nonstdout) + rc = btext_initialize(np); + printk("result: %d\n", rc); + } +- if (rc == 0) ++ if (rc == 0) { ++ of_node_put(np); + break; ++ } + } + return rc; + } +-- +2.34.1 + diff --git a/queue-5.4/powerpc-cell-add-missing-of_node_put.patch b/queue-5.4/powerpc-cell-add-missing-of_node_put.patch new file mode 100644 index 00000000000..55e08e9d3d2 --- /dev/null +++ b/queue-5.4/powerpc-cell-add-missing-of_node_put.patch @@ -0,0 +1,57 @@ +From b4448bc18bc296184cdc2867cf9fafa1781764a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2015 21:33:24 +0100 +Subject: powerpc/cell: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit a841fd009e51c8c0a8f07c942e9ab6bb48da8858 ] + +for_each_node_by_name performs an of_node_get on each iteration, so +a break out of the loop requires an of_node_put. + +A simplified version of the semantic patch that fixes this problem is as +follows (http://coccinelle.lip6.fr): + +// +@@ +expression e,e1; +local idexpression n; +@@ + + for_each_node_by_name(n, e1) { + ... when != of_node_put(n) + when != e = n +( + return n; +| ++ of_node_put(n); +? return ...; +) + ... + } +// + +Signed-off-by: Julia Lawall +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1448051604-25256-7-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/cell/iommu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/cell/iommu.c b/arch/powerpc/platforms/cell/iommu.c +index ca9ffc1c8685d..a6a60e2b8f453 100644 +--- a/arch/powerpc/platforms/cell/iommu.c ++++ b/arch/powerpc/platforms/cell/iommu.c +@@ -976,6 +976,7 @@ static int __init cell_iommu_fixed_mapping_init(void) + if (hbase < dbase || (hend > (dbase + dsize))) { + pr_debug("iommu: hash window doesn't fit in" + "real DMA window\n"); ++ of_node_put(np); + return -1; + } + } +-- +2.34.1 + diff --git a/queue-5.4/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch b/queue-5.4/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch new file mode 100644 index 00000000000..477cd1005ed --- /dev/null +++ b/queue-5.4/powerpc-handle-kdump-appropriately-with-crash_kexec_.patch @@ -0,0 +1,76 @@ +From f7992f67daef7d758aa24239dfc333499c53ec70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Dec 2021 16:07:18 +0530 +Subject: powerpc: handle kdump appropriately with crash_kexec_post_notifiers + option + +From: Hari Bathini + +[ Upstream commit 219572d2fc4135b5ce65c735d881787d48b10e71 ] + +Kdump can be triggered after panic_notifers since commit f06e5153f4ae2 +("kernel/panic.c: add "crash_kexec_post_notifiers" option for kdump +after panic_notifers") introduced crash_kexec_post_notifiers option. +But using this option would mean smp_send_stop(), that marks all other +CPUs as offline, gets called before kdump is triggered. As a result, +kdump routines fail to save other CPUs' registers. To fix this, kdump +friendly crash_smp_send_stop() function was introduced with kernel +commit 0ee59413c967 ("x86/panic: replace smp_send_stop() with kdump +friendly version in panic path"). Override this kdump friendly weak +function to handle crash_kexec_post_notifiers option appropriately +on powerpc. + +Reported-by: kernel test robot +Signed-off-by: Hari Bathini +[Fixed signature of crash_stop_this_cpu() - reported by lkp@intel.com] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211207103719.91117-1-hbathini@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/smp.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index 82dff003a7fd6..4de63ec2e1551 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -582,6 +582,36 @@ void crash_send_ipi(void (*crash_ipi_callback)(struct pt_regs *)) + } + #endif + ++#ifdef CONFIG_NMI_IPI ++static void crash_stop_this_cpu(struct pt_regs *regs) ++#else ++static void crash_stop_this_cpu(void *dummy) ++#endif ++{ ++ /* ++ * Just busy wait here and avoid marking CPU as offline to ensure ++ * register data is captured appropriately. ++ */ ++ while (1) ++ cpu_relax(); ++} ++ ++void crash_smp_send_stop(void) ++{ ++ static bool stopped = false; ++ ++ if (stopped) ++ return; ++ ++ stopped = true; ++ ++#ifdef CONFIG_NMI_IPI ++ smp_send_nmi_ipi(NMI_IPI_ALL_OTHERS, crash_stop_this_cpu, 1000000); ++#else ++ smp_call_function(crash_stop_this_cpu, NULL, 0); ++#endif /* CONFIG_NMI_IPI */ ++} ++ + #ifdef CONFIG_NMI_IPI + static void nmi_stop_this_cpu(struct pt_regs *regs) + { +-- +2.34.1 + diff --git a/queue-5.4/powerpc-powermac-add-additional-missing-lockdep_regi.patch b/queue-5.4/powerpc-powermac-add-additional-missing-lockdep_regi.patch new file mode 100644 index 00000000000..002cd950427 --- /dev/null +++ b/queue-5.4/powerpc-powermac-add-additional-missing-lockdep_regi.patch @@ -0,0 +1,53 @@ +From 8e00b34bd7293784362a8e960116e846ae4bf459 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 17:36:52 +0000 +Subject: powerpc/powermac: Add additional missing lockdep_register_key() + +From: Christophe Leroy + +[ Upstream commit b149d5d45ac9171ed699a256f026c8ebef901112 ] + +Commit df1f679d19ed ("powerpc/powermac: Add missing +lockdep_register_key()") fixed a problem that was causing a WARNING. + +There are two other places in the same file with the same problem +originating from commit 9e607f72748d ("i2c_powermac: shut up lockdep +warning"). + +Add missing lockdep_register_key() + +Fixes: 9e607f72748d ("i2c_powermac: shut up lockdep warning") +Reported-by: Erhard Furtner +Signed-off-by: Christophe Leroy +Depends-on: df1f679d19ed ("powerpc/powermac: Add missing lockdep_register_key()") +Signed-off-by: Michael Ellerman +Link: https://bugzilla.kernel.org/show_bug.cgi?id=200055 +Link: https://lore.kernel.org/r/2c7e421874e21b2fb87813d768cf662f630c2ad4.1638984999.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powermac/low_i2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c +index bf4be4b53b44d..a366233d8ac2d 100644 +--- a/arch/powerpc/platforms/powermac/low_i2c.c ++++ b/arch/powerpc/platforms/powermac/low_i2c.c +@@ -811,6 +811,7 @@ static void __init pmu_i2c_probe(void) + bus->hostdata = bus + 1; + bus->xfer = pmu_i2c_xfer; + mutex_init(&bus->mutex); ++ lockdep_register_key(&bus->lock_key); + lockdep_set_class(&bus->mutex, &bus->lock_key); + bus->flags = pmac_i2c_multibus; + list_add(&bus->link, &pmac_i2c_busses); +@@ -934,6 +935,7 @@ static void __init smu_i2c_probe(void) + bus->hostdata = bus + 1; + bus->xfer = smu_i2c_xfer; + mutex_init(&bus->mutex); ++ lockdep_register_key(&bus->lock_key); + lockdep_set_class(&bus->mutex, &bus->lock_key); + bus->flags = 0; + list_add(&bus->link, &pmac_i2c_busses); +-- +2.34.1 + diff --git a/queue-5.4/powerpc-powermac-add-missing-lockdep_register_key.patch b/queue-5.4/powerpc-powermac-add-missing-lockdep_register_key.patch new file mode 100644 index 00000000000..6270fb64c23 --- /dev/null +++ b/queue-5.4/powerpc-powermac-add-missing-lockdep_register_key.patch @@ -0,0 +1,61 @@ +From 4430721cd8e36600a7162043591c78e02d6f53d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 10:32:42 +0100 +Subject: powerpc/powermac: Add missing lockdep_register_key() + +From: Christophe Leroy + +[ Upstream commit df1f679d19edb9eeb67cc2f96b29375f21991945 ] + +KeyWest i2c @0xf8001003 irq 42 /uni-n@f8000000/i2c@f8001000 +BUG: key c2d00cbc has not been registered! +------------[ cut here ]------------ +DEBUG_LOCKS_WARN_ON(1) +WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:4801 lockdep_init_map_type+0x4c0/0xb4c +Modules linked in: +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.15.5-gentoo-PowerMacG4 #9 +NIP: c01a9428 LR: c01a9428 CTR: 00000000 +REGS: e1033cf0 TRAP: 0700 Not tainted (5.15.5-gentoo-PowerMacG4) +MSR: 00029032 CR: 24002002 XER: 00000000 + +GPR00: c01a9428 e1033db0 c2d1cf20 00000016 00000004 00000001 c01c0630 e1033a73 +GPR08: 00000000 00000000 00000000 e1033db0 24002004 00000000 f8729377 00000003 +GPR16: c1829a9c 00000000 18305357 c1416fc0 c1416f80 c006ac60 c2d00ca8 c1416f00 +GPR24: 00000000 c21586f0 c2160000 00000000 c2d00cbc c2170000 c216e1a0 c2160000 +NIP [c01a9428] lockdep_init_map_type+0x4c0/0xb4c +LR [c01a9428] lockdep_init_map_type+0x4c0/0xb4c +Call Trace: +[e1033db0] [c01a9428] lockdep_init_map_type+0x4c0/0xb4c (unreliable) +[e1033df0] [c1c177b8] kw_i2c_add+0x334/0x424 +[e1033e20] [c1c18294] pmac_i2c_init+0x9ec/0xa9c +[e1033e80] [c1c1a790] smp_core99_probe+0xbc/0x35c +[e1033eb0] [c1c03cb0] kernel_init_freeable+0x190/0x5a4 +[e1033f10] [c000946c] kernel_init+0x28/0x154 +[e1033f30] [c0035148] ret_from_kernel_thread+0x14/0x1c + +Add missing lockdep_register_key() + +Reported-by: Erhard Furtner +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/69e4f55565bb45ebb0843977801b245af0c666fe.1638264741.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powermac/low_i2c.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/powermac/low_i2c.c b/arch/powerpc/platforms/powermac/low_i2c.c +index a366233d8ac2d..210435a43bf95 100644 +--- a/arch/powerpc/platforms/powermac/low_i2c.c ++++ b/arch/powerpc/platforms/powermac/low_i2c.c +@@ -582,6 +582,7 @@ static void __init kw_i2c_add(struct pmac_i2c_host_kw *host, + bus->close = kw_i2c_close; + bus->xfer = kw_i2c_xfer; + mutex_init(&bus->mutex); ++ lockdep_register_key(&bus->lock_key); + lockdep_set_class(&bus->mutex, &bus->lock_key); + if (controller == busnode) + bus->flags = pmac_i2c_multibus; +-- +2.34.1 + diff --git a/queue-5.4/powerpc-powernv-add-missing-of_node_put.patch b/queue-5.4/powerpc-powernv-add-missing-of_node_put.patch new file mode 100644 index 00000000000..ab7a069127c --- /dev/null +++ b/queue-5.4/powerpc-powernv-add-missing-of_node_put.patch @@ -0,0 +1,59 @@ +From 3699c101c70092c320ea72cd66d0f6e3ed333254 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2015 20:33:21 +0000 +Subject: powerpc/powernv: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit 7d405a939ca960162eb30c1475759cb2fdf38f8c ] + +for_each_compatible_node performs an of_node_get on each iteration, so +a break out of the loop requires an of_node_put. + +A simplified version of the semantic patch that fixes this problem is as +follows (http://coccinelle.lip6.fr): + +// +@@ +local idexpression n; +expression e; +@@ + + for_each_compatible_node(n,...) { + ... +( + of_node_put(n); +| + e = n +| ++ of_node_put(n); +? break; +) + ... + } +... when != n +// + +Signed-off-by: Julia Lawall +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1448051604-25256-4-git-send-email-Julia.Lawall@lip6.fr +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-lpc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/powernv/opal-lpc.c b/arch/powerpc/platforms/powernv/opal-lpc.c +index 608569082ba0b..123a0e799b7bd 100644 +--- a/arch/powerpc/platforms/powernv/opal-lpc.c ++++ b/arch/powerpc/platforms/powernv/opal-lpc.c +@@ -396,6 +396,7 @@ void __init opal_lpc_init(void) + if (!of_get_property(np, "primary", NULL)) + continue; + opal_lpc_chip_id = of_get_ibm_chip_id(np); ++ of_node_put(np); + break; + } + if (opal_lpc_chip_id < 0) +-- +2.34.1 + diff --git a/queue-5.4/powerpc-prom_init-fix-improper-check-of-prom_getprop.patch b/queue-5.4/powerpc-prom_init-fix-improper-check-of-prom_getprop.patch new file mode 100644 index 00000000000..ec9742a3410 --- /dev/null +++ b/queue-5.4/powerpc-prom_init-fix-improper-check-of-prom_getprop.patch @@ -0,0 +1,37 @@ +From 4504f0abc53a83dd4b315c7516c680a3d2d7340e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Nov 2021 17:12:18 +0800 +Subject: powerpc/prom_init: Fix improper check of prom_getprop() + +From: Peiwei Hu + +[ Upstream commit 869fb7e5aecbc163003f93f36dcc26d0554319f6 ] + +prom_getprop() can return PROM_ERROR. Binary operator can not identify +it. + +Fixes: 94d2dde738a5 ("[POWERPC] Efika: prune fixups and make them more carefull") +Signed-off-by: Peiwei Hu +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/tencent_BA28CC6897B7C95A92EB8C580B5D18589105@qq.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index 1b65fb7c0bdaa..7f4e2c031a9ab 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -2919,7 +2919,7 @@ static void __init fixup_device_tree_efika_add_phy(void) + + /* Check if the phy-handle property exists - bail if it does */ + rv = prom_getprop(node, "phy-handle", prop, sizeof(prop)); +- if (!rv) ++ if (rv <= 0) + return; + + /* +-- +2.34.1 + diff --git a/queue-5.4/powerpc-smp-move-setup_profiling_timer-under-config_.patch b/queue-5.4/powerpc-smp-move-setup_profiling_timer-under-config_.patch new file mode 100644 index 00000000000..c64074d3bac --- /dev/null +++ b/queue-5.4/powerpc-smp-move-setup_profiling_timer-under-config_.patch @@ -0,0 +1,44 @@ +From 0cffe80e365660e2f542a371598d7c0e9ef40f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Nov 2021 20:32:53 +1100 +Subject: powerpc/smp: Move setup_profiling_timer() under CONFIG_PROFILING +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit a4ac0d249a5db80e79d573db9e4ad29354b643a8 ] + +setup_profiling_timer() is only needed when CONFIG_PROFILING is enabled. + +Fixes the following W=1 warning when CONFIG_PROFILING=n: + linux/arch/powerpc/kernel/smp.c:1638:5: error: no previous prototype for ‘setup_profiling_timer’ + +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211124093254.1054750-5-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/smp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index c06cac543f188..82dff003a7fd6 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -1296,10 +1296,12 @@ void start_secondary(void *unused) + BUG(); + } + ++#ifdef CONFIG_PROFILING + int setup_profiling_timer(unsigned int multiplier) + { + return 0; + } ++#endif + + #ifdef CONFIG_SCHED_SMT + /* cpumask of CPUs with asymetric SMT dependancy */ +-- +2.34.1 + diff --git a/queue-5.4/powerpc-watchdog-fix-missed-watchdog-reset-due-to-me.patch b/queue-5.4/powerpc-watchdog-fix-missed-watchdog-reset-due-to-me.patch new file mode 100644 index 00000000000..0dd0dba602b --- /dev/null +++ b/queue-5.4/powerpc-watchdog-fix-missed-watchdog-reset-due-to-me.patch @@ -0,0 +1,111 @@ +From 936ff7b3fe08ec59342b22371d7784ac1a42f953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 12:50:53 +1000 +Subject: powerpc/watchdog: Fix missed watchdog reset due to memory ordering + race + +From: Nicholas Piggin + +[ Upstream commit 5dad4ba68a2483fc80d70b9dc90bbe16e1f27263 ] + +It is possible for all CPUs to miss the pending cpumask becoming clear, +and then nobody resetting it, which will cause the lockup detector to +stop working. It will eventually expire, but watchdog_smp_panic will +avoid doing anything if the pending mask is clear and it will never be +reset. + +Order the cpumask clear vs the subsequent test to close this race. + +Add an extra check for an empty pending mask when the watchdog fires and +finds its bit still clear, to try to catch any other possible races or +bugs here and keep the watchdog working. The extra test in +arch_touch_nmi_watchdog is required to prevent the new warning from +firing off. + +Signed-off-by: Nicholas Piggin +Reviewed-by: Laurent Dufour +Debugged-by: Laurent Dufour +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211110025056.2084347-2-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/watchdog.c | 41 +++++++++++++++++++++++++++++++++- + 1 file changed, 40 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c +index af3c15a1d41eb..75b2a6c4db5a5 100644 +--- a/arch/powerpc/kernel/watchdog.c ++++ b/arch/powerpc/kernel/watchdog.c +@@ -132,6 +132,10 @@ static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb) + { + cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask); + cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask); ++ /* ++ * See wd_smp_clear_cpu_pending() ++ */ ++ smp_mb(); + if (cpumask_empty(&wd_smp_cpus_pending)) { + wd_smp_last_reset_tb = tb; + cpumask_andnot(&wd_smp_cpus_pending, +@@ -217,13 +221,44 @@ static void wd_smp_clear_cpu_pending(int cpu, u64 tb) + + cpumask_clear_cpu(cpu, &wd_smp_cpus_stuck); + wd_smp_unlock(&flags); ++ } else { ++ /* ++ * The last CPU to clear pending should have reset the ++ * watchdog so we generally should not find it empty ++ * here if our CPU was clear. However it could happen ++ * due to a rare race with another CPU taking the ++ * last CPU out of the mask concurrently. ++ * ++ * We can't add a warning for it. But just in case ++ * there is a problem with the watchdog that is causing ++ * the mask to not be reset, try to kick it along here. ++ */ ++ if (unlikely(cpumask_empty(&wd_smp_cpus_pending))) ++ goto none_pending; + } + return; + } ++ + cpumask_clear_cpu(cpu, &wd_smp_cpus_pending); ++ ++ /* ++ * Order the store to clear pending with the load(s) to check all ++ * words in the pending mask to check they are all empty. This orders ++ * with the same barrier on another CPU. This prevents two CPUs ++ * clearing the last 2 pending bits, but neither seeing the other's ++ * store when checking if the mask is empty, and missing an empty ++ * mask, which ends with a false positive. ++ */ ++ smp_mb(); + if (cpumask_empty(&wd_smp_cpus_pending)) { + unsigned long flags; + ++none_pending: ++ /* ++ * Double check under lock because more than one CPU could see ++ * a clear mask with the lockless check after clearing their ++ * pending bits. ++ */ + wd_smp_lock(&flags); + if (cpumask_empty(&wd_smp_cpus_pending)) { + wd_smp_last_reset_tb = tb; +@@ -314,8 +349,12 @@ void arch_touch_nmi_watchdog(void) + { + unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000; + int cpu = smp_processor_id(); +- u64 tb = get_tb(); ++ u64 tb; + ++ if (!cpumask_test_cpu(cpu, &watchdog_cpumask)) ++ return; ++ ++ tb = get_tb(); + if (tb - per_cpu(wd_timer_tb, cpu) >= ticks) { + per_cpu(wd_timer_tb, cpu) = tb; + wd_smp_clear_cpu_pending(cpu, tb); +-- +2.34.1 + diff --git a/queue-5.4/ppp-ensure-minimum-packet-size-in-ppp_write.patch b/queue-5.4/ppp-ensure-minimum-packet-size-in-ppp_write.patch new file mode 100644 index 00000000000..3f9ac77fcef --- /dev/null +++ b/queue-5.4/ppp-ensure-minimum-packet-size-in-ppp_write.patch @@ -0,0 +1,104 @@ +From 635472a03fa95533e4b0efa3fe83dbbc1fed9a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 03:48:42 -0800 +Subject: ppp: ensure minimum packet size in ppp_write() + +From: Eric Dumazet + +[ Upstream commit 44073187990d5629804ce0627525f6ea5cfef171 ] + +It seems pretty clear ppp layer assumed user space +would always be kind to provide enough data +in their write() to a ppp device. + +This patch makes sure user provides at least +2 bytes. + +It adds PPP_PROTO_LEN macro that could replace +in net-next many occurrences of hard-coded 2 value. + +I replaced only one occurrence to ease backports +to stable kernels. + +The bug manifests in the following report: + +BUG: KMSAN: uninit-value in ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 + ppp_send_frame+0x28d/0x27c0 drivers/net/ppp/ppp_generic.c:1740 + __ppp_xmit_process+0x23e/0x4b0 drivers/net/ppp/ppp_generic.c:1640 + ppp_xmit_process+0x1fe/0x480 drivers/net/ppp/ppp_generic.c:1661 + ppp_write+0x5cb/0x5e0 drivers/net/ppp/ppp_generic.c:513 + do_iter_write+0xb0c/0x1500 fs/read_write.c:853 + vfs_writev fs/read_write.c:924 [inline] + do_writev+0x645/0xe00 fs/read_write.c:967 + __do_sys_writev fs/read_write.c:1040 [inline] + __se_sys_writev fs/read_write.c:1037 [inline] + __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:524 [inline] + slab_alloc_node mm/slub.c:3251 [inline] + __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 + kmalloc_reserve net/core/skbuff.c:354 [inline] + __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 + alloc_skb include/linux/skbuff.h:1126 [inline] + ppp_write+0x11d/0x5e0 drivers/net/ppp/ppp_generic.c:501 + do_iter_write+0xb0c/0x1500 fs/read_write.c:853 + vfs_writev fs/read_write.c:924 [inline] + do_writev+0x645/0xe00 fs/read_write.c:967 + __do_sys_writev fs/read_write.c:1040 [inline] + __se_sys_writev fs/read_write.c:1037 [inline] + __x64_sys_writev+0xe5/0x120 fs/read_write.c:1037 + do_syscall_x64 arch/x86/entry/common.c:51 [inline] + do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Cc: Paul Mackerras +Cc: linux-ppp@vger.kernel.org +Reported-by: syzbot +Acked-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ppp/ppp_generic.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index c6c41a7836c93..a085213dc2eaa 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -69,6 +69,8 @@ + #define MPHDRLEN 6 /* multilink protocol header length */ + #define MPHDRLEN_SSN 4 /* ditto with short sequence numbers */ + ++#define PPP_PROTO_LEN 2 ++ + /* + * An instance of /dev/ppp can be associated with either a ppp + * interface unit or a ppp channel. In both cases, file->private_data +@@ -498,6 +500,9 @@ static ssize_t ppp_write(struct file *file, const char __user *buf, + + if (!pf) + return -ENXIO; ++ /* All PPP packets should start with the 2-byte protocol */ ++ if (count < PPP_PROTO_LEN) ++ return -EINVAL; + ret = -ENOMEM; + skb = alloc_skb(count + pf->hdrlen, GFP_KERNEL); + if (!skb) +@@ -1544,7 +1549,7 @@ ppp_send_frame(struct ppp *ppp, struct sk_buff *skb) + } + + ++ppp->stats64.tx_packets; +- ppp->stats64.tx_bytes += skb->len - 2; ++ ppp->stats64.tx_bytes += skb->len - PPP_PROTO_LEN; + + switch (proto) { + case PPP_IP: +-- +2.34.1 + diff --git a/queue-5.4/random-do-not-throw-away-excess-input-to-crng_fast_l.patch b/queue-5.4/random-do-not-throw-away-excess-input-to-crng_fast_l.patch new file mode 100644 index 00000000000..4dbc77c7466 --- /dev/null +++ b/queue-5.4/random-do-not-throw-away-excess-input-to-crng_fast_l.patch @@ -0,0 +1,95 @@ +From 77210798741da616ecf46f9ecb535aad56782929 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Dec 2021 22:10:05 +0100 +Subject: random: do not throw away excess input to crng_fast_load + +From: Jason A. Donenfeld + +[ Upstream commit 73c7733f122e8d0107f88655a12011f68f69e74b ] + +When crng_fast_load() is called by add_hwgenerator_randomness(), we +currently will advance to crng_init==1 once we've acquired 64 bytes, and +then throw away the rest of the buffer. Usually, that is not a problem: +When add_hwgenerator_randomness() gets called via EFI or DT during +setup_arch(), there won't be any IRQ randomness. Therefore, the 64 bytes +passed by EFI exactly matches what is needed to advance to crng_init==1. +Usually, DT seems to pass 64 bytes as well -- with one notable exception +being kexec, which hands over 128 bytes of entropy to the kexec'd kernel. +In that case, we'll advance to crng_init==1 once 64 of those bytes are +consumed by crng_fast_load(), but won't continue onward feeding in bytes +to progress to crng_init==2. This commit fixes the issue by feeding +any leftover bytes into the next phase in add_hwgenerator_randomness(). + +[linux@dominikbrodowski.net: rewrite commit message] +Signed-off-by: Dominik Brodowski +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Sasha Levin +--- + drivers/char/random.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 60b39af1279a4..19bfbaf135989 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -975,12 +975,14 @@ static struct crng_state *select_crng(void) + + /* + * crng_fast_load() can be called by code in the interrupt service +- * path. So we can't afford to dilly-dally. ++ * path. So we can't afford to dilly-dally. Returns the number of ++ * bytes processed from cp. + */ +-static int crng_fast_load(const char *cp, size_t len) ++static size_t crng_fast_load(const char *cp, size_t len) + { + unsigned long flags; + char *p; ++ size_t ret = 0; + + if (!spin_trylock_irqsave(&primary_crng.lock, flags)) + return 0; +@@ -991,7 +993,7 @@ static int crng_fast_load(const char *cp, size_t len) + p = (unsigned char *) &primary_crng.state[4]; + while (len > 0 && crng_init_cnt < CRNG_INIT_CNT_THRESH) { + p[crng_init_cnt % CHACHA_KEY_SIZE] ^= *cp; +- cp++; crng_init_cnt++; len--; ++ cp++; crng_init_cnt++; len--; ret++; + } + spin_unlock_irqrestore(&primary_crng.lock, flags); + if (crng_init_cnt >= CRNG_INIT_CNT_THRESH) { +@@ -1000,7 +1002,7 @@ static int crng_fast_load(const char *cp, size_t len) + wake_up_interruptible(&crng_init_wait); + pr_notice("random: fast init done\n"); + } +- return 1; ++ return ret; + } + + /* +@@ -1353,7 +1355,7 @@ void add_interrupt_randomness(int irq, int irq_flags) + if (unlikely(crng_init == 0)) { + if ((fast_pool->count >= 64) && + crng_fast_load((char *) fast_pool->pool, +- sizeof(fast_pool->pool))) { ++ sizeof(fast_pool->pool)) > 0) { + fast_pool->count = 0; + fast_pool->last = now; + } +@@ -2501,8 +2503,11 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, + struct entropy_store *poolp = &input_pool; + + if (unlikely(crng_init == 0)) { +- crng_fast_load(buffer, count); +- return; ++ size_t ret = crng_fast_load(buffer, count); ++ count -= ret; ++ buffer += ret; ++ if (!count || crng_init == 0) ++ return; + } + + /* Suspend writing if we're above the trickle threshold. +-- +2.34.1 + diff --git a/queue-5.4/rcu-exp-mark-current-cpu-as-exp-qs-in-ipi-loop-secon.patch b/queue-5.4/rcu-exp-mark-current-cpu-as-exp-qs-in-ipi-loop-secon.patch new file mode 100644 index 00000000000..a12d7b90781 --- /dev/null +++ b/queue-5.4/rcu-exp-mark-current-cpu-as-exp-qs-in-ipi-loop-secon.patch @@ -0,0 +1,61 @@ +From f617b2dda88b7f27a1d75fd89715740da4740265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Nov 2021 17:21:08 +0100 +Subject: rcu/exp: Mark current CPU as exp-QS in IPI loop second pass + +From: Frederic Weisbecker + +[ Upstream commit 81f6d49cce2d2fe507e3fddcc4a6db021d9c2e7b ] + +Expedited RCU grace periods invoke sync_rcu_exp_select_node_cpus(), which +takes two passes over the leaf rcu_node structure's CPUs. The first +pass gathers up the current CPU and CPUs that are in dynticks idle mode. +The workqueue will report a quiescent state on their behalf later. +The second pass sends IPIs to the rest of the CPUs, but excludes the +current CPU, incorrectly assuming it has been included in the first +pass's list of CPUs. + +Unfortunately the current CPU may have changed between the first and +second pass, due to the fact that the various rcu_node structures' +->lock fields have been dropped, thus momentarily enabling preemption. +This means that if the second pass's CPU was not on the first pass's +list, it will be ignored completely. There will be no IPI sent to +it, and there will be no reporting of quiescent states on its behalf. +Unfortunately, the expedited grace period will nevertheless be waiting +for that CPU to report a quiescent state, but with that CPU having no +reason to believe that such a report is needed. + +The result will be an expedited grace period stall. + +Fix this by no longer excluding the current CPU from consideration during +the second pass. + +Fixes: b9ad4d6ed18e ("rcu: Avoid self-IPI in sync_rcu_exp_select_node_cpus()") +Reviewed-by: Neeraj Upadhyay +Signed-off-by: Frederic Weisbecker +Cc: Uladzislau Rezki +Cc: Neeraj Upadhyay +Cc: Boqun Feng +Cc: Josh Triplett +Cc: Joel Fernandes +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_exp.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/rcu/tree_exp.h b/kernel/rcu/tree_exp.h +index 4c4d7683a4e5b..173e3ce607900 100644 +--- a/kernel/rcu/tree_exp.h ++++ b/kernel/rcu/tree_exp.h +@@ -382,6 +382,7 @@ retry_ipi: + continue; + } + if (get_cpu() == cpu) { ++ mask_ofl_test |= mask; + put_cpu(); + continue; + } +-- +2.34.1 + diff --git a/queue-5.4/rdma-cma-let-cma_resolve_ib_dev-continue-search-even.patch b/queue-5.4/rdma-cma-let-cma_resolve_ib_dev-continue-search-even.patch new file mode 100644 index 00000000000..130412e6024 --- /dev/null +++ b/queue-5.4/rdma-cma-let-cma_resolve_ib_dev-continue-search-even.patch @@ -0,0 +1,66 @@ +From 0ce2327354dc1a7df8e3fb6faa82b3e6ee336170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Dec 2021 15:16:07 +0200 +Subject: RDMA/cma: Let cma_resolve_ib_dev() continue search even after empty + entry + +From: Avihai Horon + +[ Upstream commit 20679094a0161c94faf77e373fa3f7428a8e14bd ] + +Currently, when cma_resolve_ib_dev() searches for a matching GID it will +stop searching after encountering the first empty GID table entry. This +behavior is wrong since neither IB nor RoCE spec enforce tightly packed +GID tables. + +For example, when the matching valid GID entry exists at index N, and if a +GID entry is empty at index N-1, cma_resolve_ib_dev() will fail to find +the matching valid entry. + +Fix it by making cma_resolve_ib_dev() continue searching even after +encountering missing entries. + +Fixes: f17df3b0dede ("RDMA/cma: Add support for AF_IB to rdma_resolve_addr()") +Link: https://lore.kernel.org/r/b7346307e3bb396c43d67d924348c6c496493991.1639055490.git.leonro@nvidia.com +Signed-off-by: Avihai Horon +Reviewed-by: Mark Zhang +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index ec9e9598894f6..5e2b688e36fca 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -820,6 +820,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + u16 pkey, index; + u8 p; + enum ib_port_state port_state; ++ int ret; + int i; + + cma_dev = NULL; +@@ -838,9 +839,14 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + + if (ib_get_cached_port_state(cur_dev->device, p, &port_state)) + continue; +- for (i = 0; !rdma_query_gid(cur_dev->device, +- p, i, &gid); +- i++) { ++ ++ for (i = 0; i < cur_dev->device->port_data[p].immutable.gid_tbl_len; ++ ++i) { ++ ret = rdma_query_gid(cur_dev->device, p, i, ++ &gid); ++ if (ret) ++ continue; ++ + if (!memcmp(&gid, dgid, sizeof(gid))) { + cma_dev = cur_dev; + sgid = gid; +-- +2.34.1 + diff --git a/queue-5.4/rdma-core-let-ib_find_gid-continue-search-even-after.patch b/queue-5.4/rdma-core-let-ib_find_gid-continue-search-even-after.patch new file mode 100644 index 00000000000..965e2c4a6f3 --- /dev/null +++ b/queue-5.4/rdma-core-let-ib_find_gid-continue-search-even-after.patch @@ -0,0 +1,47 @@ +From 836e1aa507f5bc1a522fd9e8d870a3f5ba5a379a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Dec 2021 15:16:06 +0200 +Subject: RDMA/core: Let ib_find_gid() continue search even after empty entry + +From: Avihai Horon + +[ Upstream commit 483d805191a23191f8294bbf9b4e94836f5d92e4 ] + +Currently, ib_find_gid() will stop searching after encountering the first +empty GID table entry. This behavior is wrong since neither IB nor RoCE +spec enforce tightly packed GID tables. + +For example, when a valid GID entry exists at index N, and if a GID entry +is empty at index N-1, ib_find_gid() will fail to find the valid entry. + +Fix it by making ib_find_gid() continue searching even after encountering +missing entries. + +Fixes: 5eb620c81ce3 ("IB/core: Add helpers for uncached GID and P_Key searches") +Link: https://lore.kernel.org/r/e55d331b96cecfc2cf19803d16e7109ea966882d.1639055490.git.leonro@nvidia.com +Signed-off-by: Avihai Horon +Reviewed-by: Mark Zhang +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 256d379bba676..de66d7da1bf6e 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -2438,7 +2438,8 @@ int ib_find_gid(struct ib_device *device, union ib_gid *gid, + ++i) { + ret = rdma_query_gid(device, port, i, &tmp_gid); + if (ret) +- return ret; ++ continue; ++ + if (!memcmp(&tmp_gid, gid, sizeof *gid)) { + *port_num = port; + if (index) +-- +2.34.1 + diff --git a/queue-5.4/rdma-cxgb4-set-queue-pair-state-when-being-queried.patch b/queue-5.4/rdma-cxgb4-set-queue-pair-state-when-being-queried.patch new file mode 100644 index 00000000000..91abf694463 --- /dev/null +++ b/queue-5.4/rdma-cxgb4-set-queue-pair-state-when-being-queried.patch @@ -0,0 +1,37 @@ +From 5955d5c418505a7379949dc79a67382f8a4511f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 17:25:30 +0200 +Subject: RDMA/cxgb4: Set queue pair state when being queried + +From: Kamal Heib + +[ Upstream commit e375b9c92985e409c4bb95dd43d34915ea7f5e28 ] + +The API for ib_query_qp requires the driver to set cur_qp_state on return, +add the missing set. + +Fixes: 67bbc05512d8 ("RDMA/cxgb4: Add query_qp support") +Link: https://lore.kernel.org/r/20211220152530.60399-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/qp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index 3ac08f47a8ce4..b3fbafbf66555 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -2469,6 +2469,7 @@ int c4iw_ib_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + memset(attr, 0, sizeof(*attr)); + memset(init_attr, 0, sizeof(*init_attr)); + attr->qp_state = to_ib_qp_state(qhp->attr.state); ++ attr->cur_qp_state = to_ib_qp_state(qhp->attr.state); + init_attr->cap.max_send_wr = qhp->attr.sq_num_entries; + init_attr->cap.max_recv_wr = qhp->attr.rq_num_entries; + init_attr->cap.max_send_sge = qhp->attr.sq_max_sges; +-- +2.34.1 + diff --git a/queue-5.4/rdma-hns-validate-the-pkey-index.patch b/queue-5.4/rdma-hns-validate-the-pkey-index.patch new file mode 100644 index 00000000000..0c48ef8abe8 --- /dev/null +++ b/queue-5.4/rdma-hns-validate-the-pkey-index.patch @@ -0,0 +1,37 @@ +From 50650d2f49bf64361bebaf32726235438b769326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Nov 2021 16:59:54 +0200 +Subject: RDMA/hns: Validate the pkey index + +From: Kamal Heib + +[ Upstream commit 2a67fcfa0db6b4075515bd23497750849b88850f ] + +Before query pkey, make sure that the queried index is valid. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/20211117145954.123893-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index f23a341400c06..a360e214deaa8 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -279,6 +279,9 @@ static enum rdma_link_layer hns_roce_get_link_layer(struct ib_device *device, + static int hns_roce_query_pkey(struct ib_device *ib_dev, u8 port, u16 index, + u16 *pkey) + { ++ if (index > 0) ++ return -EINVAL; ++ + *pkey = PKEY_ID; + + return 0; +-- +2.34.1 + diff --git a/queue-5.4/regulator-qcom_smd-align-probe-function-with-rpmh-re.patch b/queue-5.4/regulator-qcom_smd-align-probe-function-with-rpmh-re.patch new file mode 100644 index 00000000000..0b1336b2c72 --- /dev/null +++ b/queue-5.4/regulator-qcom_smd-align-probe-function-with-rpmh-re.patch @@ -0,0 +1,171 @@ +From ff240412906284b17d4674e75c4af7507a538fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Dec 2021 03:34:42 +0100 +Subject: regulator: qcom_smd: Align probe function with rpmh-regulator + +From: Konrad Dybcio + +[ Upstream commit 14e2976fbabdacb01335d7f91eeebbc89c67ddb1 ] + +The RPMh regulator driver is much newer and gets more attention, which in +consequence makes it do a few things better. Update qcom_smd-regulator's +probe function to mimic what rpmh-regulator does to address a couple of +issues: + +- Probe defer now works correctly, before it used to, well, + kinda just die.. This fixes reliable probing on (at least) PM8994, + because Linux apparently cannot deal with supply map dependencies yet.. + +- Regulator data is now matched more sanely: regulator data is matched + against each individual regulator node name and throwing an -EINVAL if + data is missing, instead of just assuming everything is fine and + iterating over all subsequent array members. + +- status = "disabled" will now work for disabling individual regulators in + DT. Previously it didn't seem to do much if anything at all. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20211230023442.1123424-1-konrad.dybcio@somainline.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/qcom_smd-regulator.c | 100 +++++++++++++++++-------- + 1 file changed, 70 insertions(+), 30 deletions(-) + +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index 3b0828c79e2b5..e6601c28ab431 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + + struct qcom_rpm_reg { +@@ -776,52 +777,91 @@ static const struct of_device_id rpm_of_match[] = { + }; + MODULE_DEVICE_TABLE(of, rpm_of_match); + +-static int rpm_reg_probe(struct platform_device *pdev) ++/** ++ * rpm_regulator_init_vreg() - initialize all attributes of a qcom_smd-regulator ++ * @vreg: Pointer to the individual qcom_smd-regulator resource ++ * @dev: Pointer to the top level qcom_smd-regulator PMIC device ++ * @node: Pointer to the individual qcom_smd-regulator resource ++ * device node ++ * @rpm: Pointer to the rpm bus node ++ * @pmic_rpm_data: Pointer to a null-terminated array of qcom_smd-regulator ++ * resources defined for the top level PMIC device ++ * ++ * Return: 0 on success, errno on failure ++ */ ++static int rpm_regulator_init_vreg(struct qcom_rpm_reg *vreg, struct device *dev, ++ struct device_node *node, struct qcom_smd_rpm *rpm, ++ const struct rpm_regulator_data *pmic_rpm_data) + { +- const struct rpm_regulator_data *reg; +- const struct of_device_id *match; +- struct regulator_config config = { }; ++ struct regulator_config config = {}; ++ const struct rpm_regulator_data *rpm_data; + struct regulator_dev *rdev; ++ int ret; ++ ++ for (rpm_data = pmic_rpm_data; rpm_data->name; rpm_data++) ++ if (of_node_name_eq(node, rpm_data->name)) ++ break; ++ ++ if (!rpm_data->name) { ++ dev_err(dev, "Unknown regulator %pOFn\n", node); ++ return -EINVAL; ++ } ++ ++ vreg->dev = dev; ++ vreg->rpm = rpm; ++ vreg->type = rpm_data->type; ++ vreg->id = rpm_data->id; ++ ++ memcpy(&vreg->desc, rpm_data->desc, sizeof(vreg->desc)); ++ vreg->desc.name = rpm_data->name; ++ vreg->desc.supply_name = rpm_data->supply; ++ vreg->desc.owner = THIS_MODULE; ++ vreg->desc.type = REGULATOR_VOLTAGE; ++ vreg->desc.of_match = rpm_data->name; ++ ++ config.dev = dev; ++ config.of_node = node; ++ config.driver_data = vreg; ++ ++ rdev = devm_regulator_register(dev, &vreg->desc, &config); ++ if (IS_ERR(rdev)) { ++ ret = PTR_ERR(rdev); ++ dev_err(dev, "%pOFn: devm_regulator_register() failed, ret=%d\n", node, ret); ++ return ret; ++ } ++ ++ return 0; ++} ++ ++static int rpm_reg_probe(struct platform_device *pdev) ++{ ++ struct device *dev = &pdev->dev; ++ const struct rpm_regulator_data *vreg_data; ++ struct device_node *node; + struct qcom_rpm_reg *vreg; + struct qcom_smd_rpm *rpm; ++ int ret; + + rpm = dev_get_drvdata(pdev->dev.parent); + if (!rpm) { +- dev_err(&pdev->dev, "unable to retrieve handle to rpm\n"); ++ dev_err(&pdev->dev, "Unable to retrieve handle to rpm\n"); + return -ENODEV; + } + +- match = of_match_device(rpm_of_match, &pdev->dev); +- if (!match) { +- dev_err(&pdev->dev, "failed to match device\n"); ++ vreg_data = of_device_get_match_data(dev); ++ if (!vreg_data) + return -ENODEV; +- } + +- for (reg = match->data; reg->name; reg++) { ++ for_each_available_child_of_node(dev->of_node, node) { + vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); + if (!vreg) + return -ENOMEM; + +- vreg->dev = &pdev->dev; +- vreg->type = reg->type; +- vreg->id = reg->id; +- vreg->rpm = rpm; +- +- memcpy(&vreg->desc, reg->desc, sizeof(vreg->desc)); +- +- vreg->desc.id = -1; +- vreg->desc.owner = THIS_MODULE; +- vreg->desc.type = REGULATOR_VOLTAGE; +- vreg->desc.name = reg->name; +- vreg->desc.supply_name = reg->supply; +- vreg->desc.of_match = reg->name; +- +- config.dev = &pdev->dev; +- config.driver_data = vreg; +- rdev = devm_regulator_register(&pdev->dev, &vreg->desc, &config); +- if (IS_ERR(rdev)) { +- dev_err(&pdev->dev, "failed to register %s\n", reg->name); +- return PTR_ERR(rdev); ++ ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); ++ ++ if (ret < 0) { ++ of_node_put(node); ++ return ret; + } + } + +-- +2.34.1 + diff --git a/queue-5.4/revert-net-mlx5e-block-offload-of-outer-header-csum-.patch b/queue-5.4/revert-net-mlx5e-block-offload-of-outer-header-csum-.patch new file mode 100644 index 00000000000..885f41cbadd --- /dev/null +++ b/queue-5.4/revert-net-mlx5e-block-offload-of-outer-header-csum-.patch @@ -0,0 +1,51 @@ +From dfc1a0dc7511db2b931aed5414c7c43f0207bc3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 11:47:41 +0300 +Subject: Revert "net/mlx5e: Block offload of outer header csum for UDP + tunnels" + +From: Aya Levin + +[ Upstream commit 64050cdad0983ad8060e33c3f4b5aee2366bcebd ] + +This reverts commit 6d6727dddc7f93fcc155cb8d0c49c29ae0e71122. + +Although the NIC doesn't support offload of outer header CSUM, using +gso_partial_features allows offloading the tunnel's segmentation. The +driver relies on the stack CSUM calculation of the outer header. For +this, NETIF_F_GSO_UDP_TUNNEL_CSUM must be a member of the device's +features. + +Fixes: 6d6727dddc7f ("net/mlx5e: Block offload of outer header csum for UDP tunnels") +Signed-off-by: Aya Levin +Reviewed-by: Gal Pressman +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index dea884c94568c..2465165cbea73 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -5053,9 +5053,13 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + } + + if (mlx5_vxlan_allowed(mdev->vxlan) || mlx5_geneve_tx_allowed(mdev)) { +- netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL; +- netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL; +- netdev->vlan_features |= NETIF_F_GSO_UDP_TUNNEL; ++ netdev->hw_features |= NETIF_F_GSO_UDP_TUNNEL | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM; ++ netdev->hw_enc_features |= NETIF_F_GSO_UDP_TUNNEL | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM; ++ netdev->gso_partial_features = NETIF_F_GSO_UDP_TUNNEL_CSUM; ++ netdev->vlan_features |= NETIF_F_GSO_UDP_TUNNEL | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM; + } + + if (mlx5e_tunnel_proto_supported(mdev, IPPROTO_GRE)) { +-- +2.34.1 + diff --git a/queue-5.4/rocker-fix-a-sleeping-in-atomic-bug.patch b/queue-5.4/rocker-fix-a-sleeping-in-atomic-bug.patch new file mode 100644 index 00000000000..45d99cdff28 --- /dev/null +++ b/queue-5.4/rocker-fix-a-sleeping-in-atomic-bug.patch @@ -0,0 +1,38 @@ +From 4567952c9a06a36e8377fafb7f0b8998b34657d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 14:57:54 +0300 +Subject: rocker: fix a sleeping in atomic bug + +From: Dan Carpenter + +[ Upstream commit 43d012123122cc69feacab55b71369f386c19566 ] + +This code is holding the &ofdpa->flow_tbl_lock spinlock so it is not +allowed to sleep. That means we have to pass the OFDPA_OP_FLAG_NOWAIT +flag to ofdpa_flow_tbl_del(). + +Fixes: 936bd486564a ("rocker: use FIB notifications instead of switchdev calls") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/rocker/rocker_ofdpa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c +index 7072b249c8bd6..8157666209798 100644 +--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c ++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c +@@ -2795,7 +2795,8 @@ static void ofdpa_fib4_abort(struct rocker *rocker) + if (!ofdpa_port) + continue; + nh->fib_nh_flags &= ~RTNH_F_OFFLOAD; +- ofdpa_flow_tbl_del(ofdpa_port, OFDPA_OP_FLAG_REMOVE, ++ ofdpa_flow_tbl_del(ofdpa_port, ++ OFDPA_OP_FLAG_REMOVE | OFDPA_OP_FLAG_NOWAIT, + flow_entry); + } + spin_unlock_irqrestore(&ofdpa->flow_tbl_lock, flags); +-- +2.34.1 + diff --git a/queue-5.4/rsi-fix-out-of-bounds-read-in-rsi_read_pkt.patch b/queue-5.4/rsi-fix-out-of-bounds-read-in-rsi_read_pkt.patch new file mode 100644 index 00000000000..4d4811f157a --- /dev/null +++ b/queue-5.4/rsi-fix-out-of-bounds-read-in-rsi_read_pkt.patch @@ -0,0 +1,108 @@ +From 5f1fff9545f3ac9792b2edf69ebeebf742f3fde5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 16:19:23 -0400 +Subject: rsi: Fix out-of-bounds read in rsi_read_pkt() + +From: Zekun Shen + +[ Upstream commit f1cb3476e48b60c450ec3a1d7da0805bffc6e43a ] + +rsi_get_* functions rely on an offset variable from usb +input. The size of usb input is RSI_MAX_RX_USB_PKT_SIZE(3000), +while 2-byte offset can be up to 0xFFFF. Thus a large offset +can cause out-of-bounds read. + +The patch adds a bound checking condition when rcv_pkt_len is 0, +indicating it's USB. It's unclear whether this is triggerable +from other type of bus. The following check might help in that case. +offset > rcv_pkt_len - FRAME_DESC_SZ + +The bug is trigerrable with conpromised/malfunctioning USB devices. +I tested the patch with the crashing input and got no more bug report. + +Attached is the KASAN report from fuzzing. + +BUG: KASAN: slab-out-of-bounds in rsi_read_pkt+0x42e/0x500 [rsi_91x] +Read of size 2 at addr ffff888019439fdb by task RX-Thread/227 + +CPU: 0 PID: 227 Comm: RX-Thread Not tainted 5.6.0 #66 +Call Trace: + dump_stack+0x76/0xa0 + print_address_description.constprop.0+0x16/0x200 + ? rsi_read_pkt+0x42e/0x500 [rsi_91x] + ? rsi_read_pkt+0x42e/0x500 [rsi_91x] + __kasan_report.cold+0x37/0x7c + ? rsi_read_pkt+0x42e/0x500 [rsi_91x] + kasan_report+0xe/0x20 + rsi_read_pkt+0x42e/0x500 [rsi_91x] + rsi_usb_rx_thread+0x1b1/0x2fc [rsi_usb] + ? rsi_probe+0x16a0/0x16a0 [rsi_usb] + ? _raw_spin_lock_irqsave+0x7b/0xd0 + ? _raw_spin_trylock_bh+0x120/0x120 + ? __wake_up_common+0x10b/0x520 + ? rsi_probe+0x16a0/0x16a0 [rsi_usb] + kthread+0x2b5/0x3b0 + ? kthread_create_on_node+0xd0/0xd0 + ret_from_fork+0x22/0x40 + +Reported-by: Brendan Dolan-Gavitt +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YXxXS4wgu2OsmlVv@10-18-43-117.dynapool.wireless.nyu.edu +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_main.c | 4 ++++ + drivers/net/wireless/rsi/rsi_91x_usb.c | 1 - + drivers/net/wireless/rsi/rsi_usb.h | 2 ++ + 3 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c +index 441fda71f6289..d92337169ee3a 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_main.c ++++ b/drivers/net/wireless/rsi/rsi_91x_main.c +@@ -23,6 +23,7 @@ + #include "rsi_common.h" + #include "rsi_coex.h" + #include "rsi_hal.h" ++#include "rsi_usb.h" + + u32 rsi_zone_enabled = /* INFO_ZONE | + INIT_ZONE | +@@ -167,6 +168,9 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len) + frame_desc = &rx_pkt[index]; + actual_length = *(u16 *)&frame_desc[0]; + offset = *(u16 *)&frame_desc[2]; ++ if (!rcv_pkt_len && offset > ++ RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ) ++ goto fail; + + queueno = rsi_get_queueno(frame_desc, offset); + length = rsi_get_length(frame_desc, offset); +diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c +index 730d7bf86c40c..94bf2a7ca635d 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -320,7 +320,6 @@ static int rsi_rx_urb_submit(struct rsi_hw *adapter, u8 ep_num, gfp_t mem_flags) + struct sk_buff *skb; + u8 dword_align_bytes = 0; + +-#define RSI_MAX_RX_USB_PKT_SIZE 3000 + skb = dev_alloc_skb(RSI_MAX_RX_USB_PKT_SIZE); + if (!skb) + return -ENOMEM; +diff --git a/drivers/net/wireless/rsi/rsi_usb.h b/drivers/net/wireless/rsi/rsi_usb.h +index 8702f434b5699..ad88f8c70a351 100644 +--- a/drivers/net/wireless/rsi/rsi_usb.h ++++ b/drivers/net/wireless/rsi/rsi_usb.h +@@ -44,6 +44,8 @@ + #define RSI_USB_BUF_SIZE 4096 + #define RSI_USB_CTRL_BUF_SIZE 0x04 + ++#define RSI_MAX_RX_USB_PKT_SIZE 3000 ++ + struct rx_usb_ctrl_block { + u8 *data; + struct urb *rx_urb; +-- +2.34.1 + diff --git a/queue-5.4/rsi-fix-use-after-free-in-rsi_rx_done_handler.patch b/queue-5.4/rsi-fix-use-after-free-in-rsi_rx_done_handler.patch new file mode 100644 index 00000000000..d5c6ce77bef --- /dev/null +++ b/queue-5.4/rsi-fix-use-after-free-in-rsi_rx_done_handler.patch @@ -0,0 +1,88 @@ +From 5cae287b289408839f1eb38aaadfdd384521f798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 15:49:03 -0400 +Subject: rsi: Fix use-after-free in rsi_rx_done_handler() + +From: Zekun Shen + +[ Upstream commit b07e3c6ebc0c20c772c0f54042e430acec2945c3 ] + +When freeing rx_cb->rx_skb, the pointer is not set to NULL, +a later rsi_rx_done_handler call will try to read the freed +address. +This bug will very likley lead to double free, although +detected early as use-after-free bug. + +The bug is triggerable with a compromised/malfunctional usb +device. After applying the patch, the same input no longer +triggers the use-after-free. + +Attached is the kasan report from fuzzing. + +BUG: KASAN: use-after-free in rsi_rx_done_handler+0x354/0x430 [rsi_usb] +Read of size 4 at addr ffff8880188e5930 by task modprobe/231 +Call Trace: + + dump_stack+0x76/0xa0 + print_address_description.constprop.0+0x16/0x200 + ? rsi_rx_done_handler+0x354/0x430 [rsi_usb] + ? rsi_rx_done_handler+0x354/0x430 [rsi_usb] + __kasan_report.cold+0x37/0x7c + ? dma_direct_unmap_page+0x90/0x110 + ? rsi_rx_done_handler+0x354/0x430 [rsi_usb] + kasan_report+0xe/0x20 + rsi_rx_done_handler+0x354/0x430 [rsi_usb] + __usb_hcd_giveback_urb+0x1e4/0x380 + usb_giveback_urb_bh+0x241/0x4f0 + ? __usb_hcd_giveback_urb+0x380/0x380 + ? apic_timer_interrupt+0xa/0x20 + tasklet_action_common.isra.0+0x135/0x330 + __do_softirq+0x18c/0x634 + ? handle_irq_event+0xcd/0x157 + ? handle_edge_irq+0x1eb/0x7b0 + irq_exit+0x114/0x140 + do_IRQ+0x91/0x1e0 + common_interrupt+0xf/0xf + + +Reported-by: Brendan Dolan-Gavitt +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/YXxQL/vIiYcZUu/j@10-18-43-117.dynapool.wireless.nyu.edu +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_usb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c +index 68ce3d2bc5357..730d7bf86c40c 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -261,8 +261,12 @@ static void rsi_rx_done_handler(struct urb *urb) + struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)rx_cb->data; + int status = -EINVAL; + ++ if (!rx_cb->rx_skb) ++ return; ++ + if (urb->status) { + dev_kfree_skb(rx_cb->rx_skb); ++ rx_cb->rx_skb = NULL; + return; + } + +@@ -286,8 +290,10 @@ out: + if (rsi_rx_urb_submit(dev->priv, rx_cb->ep_num, GFP_ATOMIC)) + rsi_dbg(ERR_ZONE, "%s: Failed in urb submission", __func__); + +- if (status) ++ if (status) { + dev_kfree_skb(rx_cb->rx_skb); ++ rx_cb->rx_skb = NULL; ++ } + } + + static void rsi_rx_urb_kill(struct rsi_hw *adapter, u8 ep_num) +-- +2.34.1 + diff --git a/queue-5.4/sched-rt-try-to-restart-rt-period-timer-when-rt-runt.patch b/queue-5.4/sched-rt-try-to-restart-rt-period-timer-when-rt-runt.patch new file mode 100644 index 00000000000..37ba5c58e10 --- /dev/null +++ b/queue-5.4/sched-rt-try-to-restart-rt-period-timer-when-rt-runt.patch @@ -0,0 +1,99 @@ +From 65e9734beebc78917560907844e167062a6ec273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 03:36:18 +0000 +Subject: sched/rt: Try to restart rt period timer when rt runtime exceeded + +From: Li Hua + +[ Upstream commit 9b58e976b3b391c0cf02e038d53dd0478ed3013c ] + +When rt_runtime is modified from -1 to a valid control value, it may +cause the task to be throttled all the time. Operations like the following +will trigger the bug. E.g: + + 1. echo -1 > /proc/sys/kernel/sched_rt_runtime_us + 2. Run a FIFO task named A that executes while(1) + 3. echo 950000 > /proc/sys/kernel/sched_rt_runtime_us + +When rt_runtime is -1, The rt period timer will not be activated when task +A enqueued. And then the task will be throttled after setting rt_runtime to +950,000. The task will always be throttled because the rt period timer is +not activated. + +Fixes: d0b27fa77854 ("sched: rt-group: synchonised bandwidth period") +Reported-by: Hulk Robot +Signed-off-by: Li Hua +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20211203033618.11895-1-hucool.lihua@huawei.com +Signed-off-by: Sasha Levin +--- + kernel/sched/rt.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 2dffb8762e16b..28c82dee13ea9 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -52,11 +52,8 @@ void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime) + rt_b->rt_period_timer.function = sched_rt_period_timer; + } + +-static void start_rt_bandwidth(struct rt_bandwidth *rt_b) ++static inline void do_start_rt_bandwidth(struct rt_bandwidth *rt_b) + { +- if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF) +- return; +- + raw_spin_lock(&rt_b->rt_runtime_lock); + if (!rt_b->rt_period_active) { + rt_b->rt_period_active = 1; +@@ -75,6 +72,14 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b) + raw_spin_unlock(&rt_b->rt_runtime_lock); + } + ++static void start_rt_bandwidth(struct rt_bandwidth *rt_b) ++{ ++ if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF) ++ return; ++ ++ do_start_rt_bandwidth(rt_b); ++} ++ + void init_rt_rq(struct rt_rq *rt_rq) + { + struct rt_prio_array *array; +@@ -983,13 +988,17 @@ static void update_curr_rt(struct rq *rq) + + for_each_sched_rt_entity(rt_se) { + struct rt_rq *rt_rq = rt_rq_of_se(rt_se); ++ int exceeded; + + if (sched_rt_runtime(rt_rq) != RUNTIME_INF) { + raw_spin_lock(&rt_rq->rt_runtime_lock); + rt_rq->rt_time += delta_exec; +- if (sched_rt_runtime_exceeded(rt_rq)) ++ exceeded = sched_rt_runtime_exceeded(rt_rq); ++ if (exceeded) + resched_curr(rq); + raw_spin_unlock(&rt_rq->rt_runtime_lock); ++ if (exceeded) ++ do_start_rt_bandwidth(sched_rt_bandwidth(rt_rq)); + } + } + } +@@ -2659,8 +2668,12 @@ static int sched_rt_global_validate(void) + + static void sched_rt_do_global(void) + { ++ unsigned long flags; ++ ++ raw_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags); + def_rt_bandwidth.rt_runtime = global_rt_runtime(); + def_rt_bandwidth.rt_period = ns_to_ktime(global_rt_period()); ++ raw_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags); + } + + int sched_rt_handler(struct ctl_table *table, int write, +-- +2.34.1 + diff --git a/queue-5.4/scsi-lpfc-trigger-sli4-firmware-dump-before-doing-dr.patch b/queue-5.4/scsi-lpfc-trigger-sli4-firmware-dump-before-doing-dr.patch new file mode 100644 index 00000000000..b186a689b9d --- /dev/null +++ b/queue-5.4/scsi-lpfc-trigger-sli4-firmware-dump-before-doing-dr.patch @@ -0,0 +1,188 @@ +From f077d909f082f40d5b23ae94a49fe28ae02479b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 16:26:40 -0800 +Subject: scsi: lpfc: Trigger SLI4 firmware dump before doing driver cleanup + +From: James Smart + +[ Upstream commit 7dd2e2a923173d637c272e483966be8e96a72b64 ] + +Extraneous teardown routines are present in the firmware dump path causing +altered states in firmware captures. + +When a firmware dump is requested via sysfs, trigger the dump immediately +without tearing down structures and changing adapter state. + +The driver shall rely on pre-existing firmware error state clean up +handlers to restore the adapter. + +Link: https://lore.kernel.org/r/20211204002644.116455-6-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc.h | 2 +- + drivers/scsi/lpfc/lpfc_attr.c | 62 ++++++++++++++++++++------------ + drivers/scsi/lpfc/lpfc_hbadisc.c | 8 ++++- + drivers/scsi/lpfc/lpfc_sli.c | 6 ---- + 4 files changed, 48 insertions(+), 30 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h +index 8943d42fc406e..0b69f4f713778 100644 +--- a/drivers/scsi/lpfc/lpfc.h ++++ b/drivers/scsi/lpfc/lpfc.h +@@ -735,7 +735,6 @@ struct lpfc_hba { + #define HBA_DEVLOSS_TMO 0x2000 /* HBA in devloss timeout */ + #define HBA_RRQ_ACTIVE 0x4000 /* process the rrq active list */ + #define HBA_IOQ_FLUSH 0x8000 /* FCP/NVME I/O queues being flushed */ +-#define HBA_FW_DUMP_OP 0x10000 /* Skips fn reset before FW dump */ + #define HBA_RECOVERABLE_UE 0x20000 /* Firmware supports recoverable UE */ + #define HBA_FORCED_LINK_SPEED 0x40000 /* + * Firmware supports Forced Link Speed +@@ -744,6 +743,7 @@ struct lpfc_hba { + #define HBA_FLOGI_ISSUED 0x100000 /* FLOGI was issued */ + #define HBA_DEFER_FLOGI 0x800000 /* Defer FLOGI till read_sparm cmpl */ + ++ struct completion *fw_dump_cmpl; /* cmpl event tracker for fw_dump */ + uint32_t fcp_ring_in_use; /* When polling test if intr-hndlr active*/ + struct lpfc_dmabuf slim2p; + +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index f0ecfe565660a..1c541a600149b 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -1537,25 +1537,25 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) + before_fc_flag = phba->pport->fc_flag; + sriov_nr_virtfn = phba->cfg_sriov_nr_virtfn; + +- /* Disable SR-IOV virtual functions if enabled */ +- if (phba->cfg_sriov_nr_virtfn) { +- pci_disable_sriov(pdev); +- phba->cfg_sriov_nr_virtfn = 0; +- } ++ if (opcode == LPFC_FW_DUMP) { ++ init_completion(&online_compl); ++ phba->fw_dump_cmpl = &online_compl; ++ } else { ++ /* Disable SR-IOV virtual functions if enabled */ ++ if (phba->cfg_sriov_nr_virtfn) { ++ pci_disable_sriov(pdev); ++ phba->cfg_sriov_nr_virtfn = 0; ++ } + +- if (opcode == LPFC_FW_DUMP) +- phba->hba_flag |= HBA_FW_DUMP_OP; ++ status = lpfc_do_offline(phba, LPFC_EVT_OFFLINE); + +- status = lpfc_do_offline(phba, LPFC_EVT_OFFLINE); ++ if (status != 0) ++ return status; + +- if (status != 0) { +- phba->hba_flag &= ~HBA_FW_DUMP_OP; +- return status; ++ /* wait for the device to be quiesced before firmware reset */ ++ msleep(100); + } + +- /* wait for the device to be quiesced before firmware reset */ +- msleep(100); +- + reg_val = readl(phba->sli4_hba.conf_regs_memmap_p + + LPFC_CTL_PDEV_CTL_OFFSET); + +@@ -1584,24 +1584,42 @@ lpfc_sli4_pdev_reg_request(struct lpfc_hba *phba, uint32_t opcode) + lpfc_printf_log(phba, KERN_ERR, LOG_SLI, + "3153 Fail to perform the requested " + "access: x%x\n", reg_val); ++ if (phba->fw_dump_cmpl) ++ phba->fw_dump_cmpl = NULL; + return rc; + } + + /* keep the original port state */ +- if (before_fc_flag & FC_OFFLINE_MODE) +- goto out; +- +- init_completion(&online_compl); +- job_posted = lpfc_workq_post_event(phba, &status, &online_compl, +- LPFC_EVT_ONLINE); +- if (!job_posted) ++ if (before_fc_flag & FC_OFFLINE_MODE) { ++ if (phba->fw_dump_cmpl) ++ phba->fw_dump_cmpl = NULL; + goto out; ++ } + +- wait_for_completion(&online_compl); ++ /* Firmware dump will trigger an HA_ERATT event, and ++ * lpfc_handle_eratt_s4 routine already handles bringing the port back ++ * online. ++ */ ++ if (opcode == LPFC_FW_DUMP) { ++ wait_for_completion(phba->fw_dump_cmpl); ++ } else { ++ init_completion(&online_compl); ++ job_posted = lpfc_workq_post_event(phba, &status, &online_compl, ++ LPFC_EVT_ONLINE); ++ if (!job_posted) ++ goto out; + ++ wait_for_completion(&online_compl); ++ } + out: + /* in any case, restore the virtual functions enabled as before */ + if (sriov_nr_virtfn) { ++ /* If fw_dump was performed, first disable to clean up */ ++ if (opcode == LPFC_FW_DUMP) { ++ pci_disable_sriov(pdev); ++ phba->cfg_sriov_nr_virtfn = 0; ++ } ++ + sriov_err = + lpfc_sli_probe_sriov_nr_virtfn(phba, sriov_nr_virtfn); + if (!sriov_err) +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index 0dc1d56ff4709..0abce779fbb13 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -628,10 +628,16 @@ lpfc_work_done(struct lpfc_hba *phba) + if (phba->pci_dev_grp == LPFC_PCI_DEV_OC) + lpfc_sli4_post_async_mbox(phba); + +- if (ha_copy & HA_ERATT) ++ if (ha_copy & HA_ERATT) { + /* Handle the error attention event */ + lpfc_handle_eratt(phba); + ++ if (phba->fw_dump_cmpl) { ++ complete(phba->fw_dump_cmpl); ++ phba->fw_dump_cmpl = NULL; ++ } ++ } ++ + if (ha_copy & HA_MBATT) + lpfc_sli_handle_mb_event(phba); + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 51bab0979527b..bd908dd273078 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -4498,12 +4498,6 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba) + phba->fcf.fcf_flag = 0; + spin_unlock_irq(&phba->hbalock); + +- /* SLI4 INTF 2: if FW dump is being taken skip INIT_PORT */ +- if (phba->hba_flag & HBA_FW_DUMP_OP) { +- phba->hba_flag &= ~HBA_FW_DUMP_OP; +- return rc; +- } +- + /* Now physically reset the device */ + lpfc_printf_log(phba, KERN_INFO, LOG_INIT, + "0389 Performing PCI function reset!\n"); +-- +2.34.1 + diff --git a/queue-5.4/scsi-sr-don-t-use-gfp_dma.patch b/queue-5.4/scsi-sr-don-t-use-gfp_dma.patch new file mode 100644 index 00000000000..874cd96b2ff --- /dev/null +++ b/queue-5.4/scsi-sr-don-t-use-gfp_dma.patch @@ -0,0 +1,61 @@ +From 425c06ef7e9c6d97fa9d6c8b10ec934401f504fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 10:08:42 +0100 +Subject: scsi: sr: Don't use GFP_DMA + +From: Christoph Hellwig + +[ Upstream commit d94d94969a4ba07a43d62429c60372320519c391 ] + +The allocated buffers are used as a command payload, for which the block +layer and/or DMA API do the proper bounce buffering if needed. + +Link: https://lore.kernel.org/r/20211222090842.920724-1-hch@lst.de +Reported-by: Baoquan He +Reviewed-by: Baoquan He +Signed-off-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sr.c | 2 +- + drivers/scsi/sr_vendor.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 279dea628620d..310da62cda263 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -887,7 +887,7 @@ static void get_capabilities(struct scsi_cd *cd) + + + /* allocate transfer buffer */ +- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); ++ buffer = kmalloc(512, GFP_KERNEL); + if (!buffer) { + sr_printk(KERN_ERR, cd, "out of memory.\n"); + return; +diff --git a/drivers/scsi/sr_vendor.c b/drivers/scsi/sr_vendor.c +index b9db2ec6d0361..996bccadd3866 100644 +--- a/drivers/scsi/sr_vendor.c ++++ b/drivers/scsi/sr_vendor.c +@@ -113,7 +113,7 @@ int sr_set_blocklength(Scsi_CD *cd, int blocklength) + if (cd->vendor == VENDOR_TOSHIBA) + density = (blocklength > 2048) ? 0x81 : 0x83; + +- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); ++ buffer = kmalloc(512, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -161,7 +161,7 @@ int sr_cd_check(struct cdrom_device_info *cdi) + if (cd->cdi.mask & CDC_MULTI_SESSION) + return 0; + +- buffer = kmalloc(512, GFP_KERNEL | GFP_DMA); ++ buffer = kmalloc(512, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +-- +2.34.1 + diff --git a/queue-5.4/scsi-ufs-fix-race-conditions-related-to-driver-data.patch b/queue-5.4/scsi-ufs-fix-race-conditions-related-to-driver-data.patch new file mode 100644 index 00000000000..0786e8d4afe --- /dev/null +++ b/queue-5.4/scsi-ufs-fix-race-conditions-related-to-driver-data.patch @@ -0,0 +1,73 @@ +From 66ca775fc8befb44f5049090a30cd8d77f2933c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Dec 2021 15:19:39 -0800 +Subject: scsi: ufs: Fix race conditions related to driver data + +From: Bart Van Assche + +[ Upstream commit 21ad0e49085deb22c094f91f9da57319a97188e4 ] + +The driver data pointer must be set before any callbacks are registered +that use that pointer. Hence move the initialization of that pointer from +after the ufshcd_init() call to inside ufshcd_init(). + +Link: https://lore.kernel.org/r/20211203231950.193369-7-bvanassche@acm.org +Fixes: 3b1d05807a9a ("[SCSI] ufs: Segregate PCI Specific Code") +Reported-by: Alexey Dobriyan +Tested-by: Bean Huo +Reviewed-by: Bean Huo +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - + drivers/scsi/ufs/ufshcd-pltfrm.c | 2 -- + drivers/scsi/ufs/ufshcd.c | 7 +++++++ + 3 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ufs/tc-dwc-g210-pci.c b/drivers/scsi/ufs/tc-dwc-g210-pci.c +index 67a6a61154b71..4e471484539d2 100644 +--- a/drivers/scsi/ufs/tc-dwc-g210-pci.c ++++ b/drivers/scsi/ufs/tc-dwc-g210-pci.c +@@ -135,7 +135,6 @@ tc_dwc_g210_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return err; + } + +- pci_set_drvdata(pdev, hba); + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_allow(&pdev->dev); + +diff --git a/drivers/scsi/ufs/ufshcd-pltfrm.c b/drivers/scsi/ufs/ufshcd-pltfrm.c +index 8d40dc918f4e1..10eec501f6b39 100644 +--- a/drivers/scsi/ufs/ufshcd-pltfrm.c ++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c +@@ -436,8 +436,6 @@ int ufshcd_pltfrm_init(struct platform_device *pdev, + goto dealloc_host; + } + +- platform_set_drvdata(pdev, hba); +- + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 29c7a76d2c658..ebf7ae1ef70d4 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -8328,6 +8328,13 @@ int ufshcd_init(struct ufs_hba *hba, void __iomem *mmio_base, unsigned int irq) + struct Scsi_Host *host = hba->host; + struct device *dev = hba->dev; + ++ /* ++ * dev_set_drvdata() must be called before any callbacks are registered ++ * that use dev_get_drvdata() (frequency scaling, clock scaling, hwmon, ++ * sysfs). ++ */ ++ dev_set_drvdata(dev, hba); ++ + if (!mmio_base) { + dev_err(hba->dev, + "Invalid memory reference for mmio_base is NULL\n"); +-- +2.34.1 + diff --git a/queue-5.4/selinux-fix-potential-memleak-in-selinux_add_opt.patch b/queue-5.4/selinux-fix-potential-memleak-in-selinux_add_opt.patch new file mode 100644 index 00000000000..3dff112e6f6 --- /dev/null +++ b/queue-5.4/selinux-fix-potential-memleak-in-selinux_add_opt.patch @@ -0,0 +1,63 @@ +From 348f77ee4b0a697fd9c58d355de0495fff44bed5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Dec 2021 04:03:58 -0800 +Subject: selinux: fix potential memleak in selinux_add_opt() + +From: Bernard Zhao + +[ Upstream commit 2e08df3c7c4e4e74e3dd5104c100f0bf6288aaa8 ] + +This patch try to fix potential memleak in error branch. + +Fixes: ba6418623385 ("selinux: new helper - selinux_add_opt()") +Signed-off-by: Bernard Zhao +[PM: tweak the subject line, add Fixes tag] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 91f2ba0b225b7..56418cf72069d 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -995,18 +995,22 @@ out: + static int selinux_add_opt(int token, const char *s, void **mnt_opts) + { + struct selinux_mnt_opts *opts = *mnt_opts; ++ bool is_alloc_opts = false; + + if (token == Opt_seclabel) /* eaten and completely ignored */ + return 0; + ++ if (!s) ++ return -ENOMEM; ++ + if (!opts) { + opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL); + if (!opts) + return -ENOMEM; + *mnt_opts = opts; ++ is_alloc_opts = true; + } +- if (!s) +- return -ENOMEM; ++ + switch (token) { + case Opt_context: + if (opts->context || opts->defcontext) +@@ -1031,6 +1035,10 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts) + } + return 0; + Einval: ++ if (is_alloc_opts) { ++ kfree(opts); ++ *mnt_opts = NULL; ++ } + pr_warn(SEL_MOUNT_FAIL_MSG); + return -EINVAL; + } +-- +2.34.1 + diff --git a/queue-5.4/serial-amba-pl011-do-not-request-memory-region-twice.patch b/queue-5.4/serial-amba-pl011-do-not-request-memory-region-twice.patch new file mode 100644 index 00000000000..756a8c76381 --- /dev/null +++ b/queue-5.4/serial-amba-pl011-do-not-request-memory-region-twice.patch @@ -0,0 +1,106 @@ +From ffc3639650c1dca24fb8db35d161219361b0c388 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 18:42:38 +0100 +Subject: serial: amba-pl011: do not request memory region twice +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lino Sanfilippo + +[ Upstream commit d1180405c7b5c7a1c6bde79d5fc24fe931430737 ] + +With commit 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") the +function devm_ioremap() called from pl011_setup_port() was replaced with +devm_ioremap_resource(). Since this function not only remaps but also +requests the ports io memory region it now collides with the .config_port() +callback which requests the same region at uart port registration. + +Since devm_ioremap_resource() already claims the memory successfully, the +request in .config_port() fails. + +Later at uart port deregistration the attempt to release the unclaimed +memory also fails. The failure results in a “Trying to free nonexistent +resource" warning. + +Fix these issues by removing the callbacks that implement the redundant +memory allocation/release. Also make sure that changing the drivers io +memory base address via TIOCSSERIAL is not allowed any more. + +Fixes: 3873e2d7f63a ("drivers: PL011: refactor pl011_probe()") +Signed-off-by: Lino Sanfilippo +Link: https://lore.kernel.org/r/20211129174238.8333-1-LinoSanfilippo@gmx.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/amba-pl011.c | 27 +++------------------------ + 1 file changed, 3 insertions(+), 24 deletions(-) + +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 6741d0f3daf94..0bd8c05d72d60 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -2094,32 +2094,13 @@ static const char *pl011_type(struct uart_port *port) + return uap->port.type == PORT_AMBA ? uap->type : NULL; + } + +-/* +- * Release the memory region(s) being used by 'port' +- */ +-static void pl011_release_port(struct uart_port *port) +-{ +- release_mem_region(port->mapbase, SZ_4K); +-} +- +-/* +- * Request the memory region(s) being used by 'port' +- */ +-static int pl011_request_port(struct uart_port *port) +-{ +- return request_mem_region(port->mapbase, SZ_4K, "uart-pl011") +- != NULL ? 0 : -EBUSY; +-} +- + /* + * Configure/autoconfigure the port. + */ + static void pl011_config_port(struct uart_port *port, int flags) + { +- if (flags & UART_CONFIG_TYPE) { ++ if (flags & UART_CONFIG_TYPE) + port->type = PORT_AMBA; +- pl011_request_port(port); +- } + } + + /* +@@ -2134,6 +2115,8 @@ static int pl011_verify_port(struct uart_port *port, struct serial_struct *ser) + ret = -EINVAL; + if (ser->baud_base < 9600) + ret = -EINVAL; ++ if (port->mapbase != (unsigned long) ser->iomem_base) ++ ret = -EINVAL; + return ret; + } + +@@ -2151,8 +2134,6 @@ static const struct uart_ops amba_pl011_pops = { + .flush_buffer = pl011_dma_flush_buffer, + .set_termios = pl011_set_termios, + .type = pl011_type, +- .release_port = pl011_release_port, +- .request_port = pl011_request_port, + .config_port = pl011_config_port, + .verify_port = pl011_verify_port, + #ifdef CONFIG_CONSOLE_POLL +@@ -2182,8 +2163,6 @@ static const struct uart_ops sbsa_uart_pops = { + .shutdown = sbsa_uart_shutdown, + .set_termios = sbsa_uart_set_termios, + .type = pl011_type, +- .release_port = pl011_release_port, +- .request_port = pl011_request_port, + .config_port = pl011_config_port, + .verify_port = pl011_verify_port, + #ifdef CONFIG_CONSOLE_POLL +-- +2.34.1 + diff --git a/queue-5.4/serial-core-keep-mctrl-register-state-and-cached-cop.patch b/queue-5.4/serial-core-keep-mctrl-register-state-and-cached-cop.patch new file mode 100644 index 00000000000..5930077c836 --- /dev/null +++ b/queue-5.4/serial-core-keep-mctrl-register-state-and-cached-cop.patch @@ -0,0 +1,53 @@ +From 5fd9a7be1d22c1add5791f492d78dc02df5600f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jan 2022 18:52:44 +0100 +Subject: serial: core: Keep mctrl register state and cached copy in sync + +From: Lukas Wunner + +[ Upstream commit 93a770b7e16772530196674ffc79bb13fa927dc6 ] + +struct uart_port contains a cached copy of the Modem Control signals. +It is used to skip register writes in uart_update_mctrl() if the new +signal state equals the old signal state. It also avoids a register +read to obtain the current state of output signals. + +When a uart_port is registered, uart_configure_port() changes signal +state but neglects to keep the cached copy in sync. That may cause +a subsequent register write to be incorrectly skipped. Fix it before +it trips somebody up. + +This behavior has been present ever since the serial core was introduced +in 2002: +https://git.kernel.org/history/history/c/33c0d1b0c3eb + +So far it was never an issue because the cached copy is initialized to 0 +by kzalloc() and when uart_configure_port() is executed, at most DTR has +been set by uart_set_options() or sunsu_console_setup(). Therefore, +a stable designation seems unnecessary. + +Signed-off-by: Lukas Wunner +Link: https://lore.kernel.org/r/bceeaba030b028ed810272d55d5fc6f3656ddddb.1641129752.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/serial_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index aad640b9e3f4b..c8a047ba76ebe 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -2395,7 +2395,8 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, + * We probably don't need a spinlock around this, but + */ + spin_lock_irqsave(&port->lock, flags); +- port->ops->set_mctrl(port, port->mctrl & TIOCM_DTR); ++ port->mctrl &= TIOCM_DTR; ++ port->ops->set_mctrl(port, port->mctrl); + spin_unlock_irqrestore(&port->lock, flags); + + /* +-- +2.34.1 + diff --git a/queue-5.4/serial-pl010-drop-cr-register-reset-on-set_termios.patch b/queue-5.4/serial-pl010-drop-cr-register-reset-on-set_termios.patch new file mode 100644 index 00000000000..f2f4666802e --- /dev/null +++ b/queue-5.4/serial-pl010-drop-cr-register-reset-on-set_termios.patch @@ -0,0 +1,58 @@ +From a133716e4389deb48e1db4b4598b9129a3eaba85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Jan 2022 18:42:44 +0100 +Subject: serial: pl010: Drop CR register reset on set_termios + +From: Lukas Wunner + +[ Upstream commit 08a0c6dff91c965e39905cf200d22db989203ccb ] + +pl010_set_termios() briefly resets the CR register to zero. + +Where does this register write come from? + +The PL010 driver's IRQ handler ambauart_int() originally modified the CR +register without holding the port spinlock. ambauart_set_termios() also +modified that register. To prevent concurrent read-modify-writes by the +IRQ handler and to prevent transmission while changing baudrate, +ambauart_set_termios() had to disable interrupts. That is achieved by +writing zero to the CR register. + +However in 2004 the PL010 driver was amended to acquire the port +spinlock in the IRQ handler, obviating the need to disable interrupts in +->set_termios(): +https://git.kernel.org/history/history/c/157c0342e591 + +That rendered the CR register write obsolete. Drop it. + +Cc: Russell King +Signed-off-by: Lukas Wunner +Link: https://lore.kernel.org/r/fcaff16e5b1abb4cc3da5a2879ac13f278b99ed0.1641128728.git.lukas@wunner.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/amba-pl010.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c +index 2c37d11726aba..13f882e5e7b76 100644 +--- a/drivers/tty/serial/amba-pl010.c ++++ b/drivers/tty/serial/amba-pl010.c +@@ -452,14 +452,11 @@ pl010_set_termios(struct uart_port *port, struct ktermios *termios, + if ((termios->c_cflag & CREAD) == 0) + uap->port.ignore_status_mask |= UART_DUMMY_RSR_RX; + +- /* first, disable everything */ + old_cr = readb(uap->port.membase + UART010_CR) & ~UART010_CR_MSIE; + + if (UART_ENABLE_MS(port, termios->c_cflag)) + old_cr |= UART010_CR_MSIE; + +- writel(0, uap->port.membase + UART010_CR); +- + /* Set baud rate */ + quot -= 1; + writel((quot & 0xf00) >> 8, uap->port.membase + UART010_LCRM); +-- +2.34.1 + diff --git a/queue-5.4/series b/queue-5.4/series index b51a63f8c4f..1c43ee85902 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -2,3 +2,214 @@ hid-uhid-fix-worker-destroying-device-without-any-protection.patch hid-wacom-reset-expected-and-received-contact-counts-at-the-same-time.patch hid-wacom-ignore-the-confidence-flag-when-a-touch-is-removed.patch hid-wacom-avoid-using-stale-array-indicies-to-read-contact-count.patch +drm-panel-kingdisplay-kd097d04-delete-panel-on-attac.patch +drm-panel-innolux-p079zca-delete-panel-on-attach-fai.patch +drm-rockchip-dsi-fix-unbalanced-clock-on-probe-error.patch +bluetooth-cmtp-fix-possible-panic-when-cmtp_init_soc.patch +clk-bcm-2835-pick-the-closest-clock-rate.patch +clk-bcm-2835-remove-rounding-up-the-dividers.patch +wcn36xx-indicate-beacon-not-connection-loss-on-misse.patch +wcn36xx-release-dma-channel-descriptor-allocations.patch +media-videobuf2-fix-the-size-printk-format.patch +media-aspeed-fix-mode-detect-always-time-out-at-2nd-.patch +media-em28xx-fix-memory-leak-in-em28xx_init_dev.patch +media-aspeed-update-signal-status-immediately-to-ens.patch +arm64-dts-meson-gxbb-wetek-fix-hdmi-in-early-boot.patch +arm64-dts-meson-gxbb-wetek-fix-missing-gpio-binding.patch +bluetooth-stop-proccessing-malicious-adv-data.patch +tee-fix-put-order-in-teedev_close_context.patch +media-dmxdev-fix-uaf-when-dvb_register_device-fails.patch +crypto-qce-fix-uaf-on-qce_ahash_register_one.patch +arm64-dts-ti-k3-j721e-correct-cache-sets-info.patch +tty-serial-atmel-check-return-code-of-dmaengine_subm.patch +tty-serial-atmel-call-dma_async_issue_pending.patch +media-rcar-csi2-correct-the-selection-of-hsfreqrange.patch +media-imx-pxp-initialize-the-spinlock-prior-to-using.patch +media-si470x-i2c-fix-possible-memory-leak-in-si470x_.patch +media-mtk-vcodec-call-v4l2_m2m_ctx_release-first-whe.patch +media-venus-core-fix-a-resource-leak-in-the-error-ha.patch +netfilter-bridge-add-support-for-pppoe-filtering.patch +arm64-dts-qcom-msm8916-fix-mmc-controller-aliases.patch +acpi-ec-rework-flushing-of-ec-work-while-suspended-t.patch +drm-amdgpu-fix-a-null-pointer-dereference-in-amdgpu_.patch +drm-radeon-radeon_kms-fix-a-null-pointer-dereference.patch +arm64-dts-ti-k3-j721e-fix-the-l2-cache-sets.patch +tty-serial-uartlite-allow-64-bit-address.patch +serial-amba-pl011-do-not-request-memory-region-twice.patch +floppy-fix-hang-in-watchdog-when-disk-is-ejected.patch +staging-rtl8192e-return-error-code-from-rtllib_softm.patch +staging-rtl8192e-rtllib_module-fix-error-handle-case.patch +bluetooth-btmtksdio-fix-resume-failure.patch +media-dib8000-fix-a-memleak-in-dib8000_init.patch +media-saa7146-mxb-fix-a-null-pointer-dereference-in-.patch +media-si2157-fix-warm-tuner-state-detection.patch +sched-rt-try-to-restart-rt-period-timer-when-rt-runt.patch +rcu-exp-mark-current-cpu-as-exp-qs-in-ipi-loop-secon.patch +mwifiex-fix-possible-abba-deadlock.patch +xfrm-fix-a-small-bug-in-xfrm_sa_len.patch +crypto-stm32-cryp-fix-xts-and-race-condition-in-cryp.patch +crypto-stm32-cryp-fix-double-pm-exit.patch +crypto-stm32-cryp-fix-lrw-chaining-mode.patch +arm-dts-gemini-nas4220-b-fis-index-block-with-128-ki.patch +media-dw2102-fix-use-after-free.patch +media-msi001-fix-possible-null-ptr-deref-in-msi001_p.patch +media-coda-imx-vdoa-handle-dma_set_coherent_mask-err.patch +drm-msm-dpu-fix-safe-status-debugfs-file.patch +drm-bridge-ti-sn65dsi86-set-max-register-for-regmap.patch +media-hantro-fix-probe-func-error-path.patch +xfrm-interface-with-if_id-0-should-return-error.patch +xfrm-state-and-policy-should-fail-if-xfrma_if_id-0.patch +arm-9159-1-decompressor-avoid-unpredictable-nop-enco.patch +usb-ftdi-elan-fix-memory-leak-on-device-disconnect.patch +arm-dts-armada-38x-add-generic-compatible-to-uart-no.patch +mmc-meson-mx-sdio-add-irq-check.patch +selinux-fix-potential-memleak-in-selinux_add_opt.patch +bpftool-enable-line-buffering-for-stdout.patch +x86-mce-inject-avoid-out-of-bounds-write-when-settin.patch +acpi-scan-create-platform-device-for-bcm4752-and-lnv.patch +pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch +pcmcia-rsrc_nonstatic-fix-a-null-pointer-dereference.patch-19174 +netfilter-ipt_clusterip-fix-refcount-leak-in-cluster.patch +bpf-fix-so_rcvbuf-so_sndbuf-handling-in-_bpf_setsock.patch +ppp-ensure-minimum-packet-size-in-ppp_write.patch +rocker-fix-a-sleeping-in-atomic-bug.patch +staging-greybus-audio-check-null-pointer.patch +fsl-fman-check-for-null-pointer-after-calling-devm_i.patch +bluetooth-hci_bcm-check-for-error-irq.patch +hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch +hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-10015 +hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-1092 +hid-hid-uclogic-params-invalid-parameter-check-in-uc.patch-28733 +debugfs-lockdown-allow-reading-debugfs-files-that-ar.patch +net-mlx5e-don-t-block-routes-with-nexthop-objects-in.patch +revert-net-mlx5e-block-offload-of-outer-header-csum-.patch +net-mlx5-set-command-entry-semaphore-up-once-got-ind.patch +spi-spi-meson-spifc-add-missing-pm_runtime_disable-i.patch +tpm-add-request_locality-before-write-tpm_int_enable.patch +can-softing-softing_startstop-fix-set-but-not-used-v.patch +can-xilinx_can-xcan_probe-check-for-error-irq.patch +pcmcia-fix-setting-of-kthread-task-states.patch +net-mcs7830-handle-usb-read-errors-properly.patch +ext4-avoid-trim-error-on-fs-with-small-groups.patch +alsa-jack-add-missing-rwsem-around-snd_ctl_remove-ca.patch +alsa-pcm-add-missing-rwsem-around-snd_ctl_remove-cal.patch +alsa-hda-add-missing-rwsem-around-snd_ctl_remove-cal.patch +rdma-hns-validate-the-pkey-index.patch +clk-imx8mn-fix-imx8mn_clko1_sels.patch +powerpc-prom_init-fix-improper-check-of-prom_getprop.patch +asoc-uniphier-drop-selecting-non-existing-snd_soc_un.patch +alsa-oss-fix-compile-error-when-oss_debug-is-enabled.patch +char-mwave-adjust-io-port-register-size.patch +binder-fix-handling-of-error-during-copy.patch +uio-uio_dmem_genirq-catch-the-exception.patch +iommu-io-pgtable-arm-fix-table-descriptor-paddr-form.patch +scsi-ufs-fix-race-conditions-related-to-driver-data.patch +pci-msi-fix-pci_irq_vector-pci_irq_get_affinity.patch +powerpc-powermac-add-additional-missing-lockdep_regi.patch +rdma-core-let-ib_find_gid-continue-search-even-after.patch +rdma-cma-let-cma_resolve_ib_dev-continue-search-even.patch +asoc-rt5663-handle-device_property_read_u32_array-er.patch +clk-stm32-fix-ltdc-s-clock-turn-off-by-clk_disable_u.patch +dmaengine-pxa-mmp-stop-referencing-config-slave_id.patch +iommu-iova-fix-race-between-fq-timeout-and-teardown.patch +phy-uniphier-usb3ss-fix-unintended-writing-zeros-to-.patch +asoc-mediatek-check-for-error-clk-pointer.patch +asoc-samsung-idma-check-of-ioremap-return-value.patch +misc-lattice-ecp3-config-fix-task-hung-when-firmware.patch +mips-lantiq-add-support-for-clk_set_parent.patch +mips-bcm63xx-add-support-for-clk_set_parent.patch +rdma-cxgb4-set-queue-pair-state-when-being-queried.patch +of-base-fix-phandle-argument-length-mismatch-error-m.patch +bluetooth-fix-debugfs-entry-leak-in-hci_register_dev.patch +fs-dlm-filter-user-dlm-messages-for-kernel-locks.patch +libbpf-validate-that-.btf-and-.btf.ext-sections-cont.patch +drm-lima-fix-warning-when-config_debug_sg-y-config_d.patch +ar5523-fix-null-ptr-deref-with-unexpected-wdcmsg_tar.patch +drm-nouveau-pmu-gm200-avoid-touching-pmu-outside-of-.patch +arm-shmobile-rcar-gen2-add-missing-of_node_put.patch +batman-adv-allow-netlink-usage-in-unprivileged-conta.patch +usb-gadget-f_fs-use-stream_open-for-endpoint-files.patch +drm-panel-orientation-quirks-add-quirk-for-the-lenov.patch +hid-apple-do-not-reset-quirks-when-the-fn-key-is-not.patch +media-b2c2-add-missing-check-in-flexcop_pci_isr.patch +edac-synopsys-use-the-quirk-for-version-instead-of-d.patch +arm-imx-rename-debug_imx21_imx27_uart-to-debug_imx27.patch +mlxsw-pci-add-shutdown-method-in-pci-driver.patch +drm-bridge-megachips-ensure-both-bridges-are-probed-.patch +gpiolib-acpi-do-not-set-the-irq-type-if-the-irq-is-a.patch +hsi-core-fix-return-freed-object-in-hsi_new_client.patch +mwifiex-fix-skb_over_panic-in-mwifiex_usb_recv.patch +rsi-fix-use-after-free-in-rsi_rx_done_handler.patch +rsi-fix-out-of-bounds-read-in-rsi_read_pkt.patch +usb-uhci-add-aspeed-ast2600-uhci-support.patch +floppy-add-max-size-check-for-user-space-request.patch +x86-mm-flush-global-tlb-when-switching-to-trampoline.patch +media-uvcvideo-increase-uvc_ctrl_control_timeout-to-.patch +media-saa7146-hexium_orion-fix-a-null-pointer-derefe.patch +media-m920x-don-t-use-stack-on-usb-reads.patch +iwlwifi-mvm-synchronize-with-fw-after-multicast-comm.patch +ath10k-fix-tx-hanging.patch +net-sysfs-update-the-queue-counts-in-the-unregistrat.patch +net-phy-prefer-1000baset-over-1000basekx.patch +gpio-aspeed-convert-aspeed_gpio.lock-to-raw_spinlock.patch +x86-mce-mark-mce_panic-noinstr.patch +x86-mce-mark-mce_end-noinstr.patch +x86-mce-mark-mce_read_aux-noinstr.patch +net-bonding-debug-avoid-printing-debug-logs-when-bon.patch +bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch +hid-quirks-allow-inverting-the-absolute-x-y-values.patch +media-igorplugusb-receiver-overflow-should-be-report.patch +media-saa7146-hexium_gemini-fix-a-null-pointer-deref.patch +mmc-core-fixup-storing-of-ocr-for-mmc_quirk_nonstd_s.patch +audit-ensure-userspace-is-penalized-the-same-as-the-.patch +arm64-dts-ls1028a-qds-move-rtc-node-to-the-correct-i.patch +arm64-tegra-adjust-length-of-ccplex-cluster-mmio-reg.patch +cpufreq-fix-initialization-of-min-and-max-frequency-.patch +usb-hub-add-delay-for-superspeed-hub-resume-to-let-l.patch +ath9k-fix-out-of-bound-memcpy-in-ath9k_hif_usb_rx_st.patch +iwlwifi-fix-leaks-bad-data-after-failed-firmware-loa.patch +iwlwifi-remove-module-loading-failure-message.patch +iwlwifi-mvm-fix-calculation-of-frame-length.patch +um-registers-rename-function-names-to-avoid-conflict.patch +jffs2-gc-deadlock-reading-a-page-that-is-used-in-jff.patch +acpica-actypes.h-expand-the-acpi_access_-definitions.patch +acpica-utilities-avoid-deleting-the-same-object-twic.patch +acpica-executer-fix-the-refclass_refof-case-in-acpi_.patch +acpica-fix-wrong-interpretation-of-pcc-address.patch +acpica-hardware-do-not-flush-cpu-cache-when-entering.patch +drm-amdgpu-fixup-bad-vram-size-on-gmc-v8.patch +acpi-battery-add-the-thinkpad-not-charging-quirk.patch +btrfs-remove-bug_on-in-find_parent_nodes.patch +btrfs-remove-bug_on-eie-in-find_parent_nodes.patch +net-mdio-demote-probed-message-to-debug-print.patch +mac80211-allow-non-standard-vht-mcs-10-11.patch +dm-btree-add-a-defensive-bounds-check-to-insert_at.patch +dm-space-map-common-add-bounds-check-to-sm_ll_lookup.patch +net-phy-marvell-configure-rgmii-delays-for-88e1118.patch +net-gemini-allow-any-rgmii-interface-mode.patch +regulator-qcom_smd-align-probe-function-with-rpmh-re.patch +serial-pl010-drop-cr-register-reset-on-set_termios.patch +serial-core-keep-mctrl-register-state-and-cached-cop.patch +random-do-not-throw-away-excess-input-to-crng_fast_l.patch +parisc-avoid-calling-faulthandler_disabled-twice.patch +powerpc-6xx-add-missing-of_node_put.patch +powerpc-powernv-add-missing-of_node_put.patch +powerpc-cell-add-missing-of_node_put.patch +powerpc-btext-add-missing-of_node_put.patch +powerpc-watchdog-fix-missed-watchdog-reset-due-to-me.patch +i2c-i801-don-t-silently-correct-invalid-transfer-siz.patch +powerpc-smp-move-setup_profiling_timer-under-config_.patch +i2c-mpc-correct-i2c-reset-procedure.patch +clk-meson-gxbb-fix-the-sdm_en-bit-for-mpll0-on-gxbb.patch +powerpc-powermac-add-missing-lockdep_register_key.patch +kvm-ppc-book3s-suppress-failed-alloc-warning-in-h_co.patch +w1-misuse-of-get_user-put_user-reported-by-sparse.patch +scsi-lpfc-trigger-sli4-firmware-dump-before-doing-dr.patch +alsa-seq-set-upper-limit-of-processed-events.patch +powerpc-handle-kdump-appropriately-with-crash_kexec_.patch +mips-octeon-add-put_device-after-of_find_device_by_n.patch +i2c-designware-pci-fix-to-change-data-types-of-hcnt-.patch +mips-octeon-fix-build-errors-using-clang.patch +scsi-sr-don-t-use-gfp_dma.patch +asoc-mediatek-mt8173-fix-device_node-leak.patch +power-bq25890-enable-continuous-conversion-for-adc-a.patch diff --git a/queue-5.4/spi-spi-meson-spifc-add-missing-pm_runtime_disable-i.patch b/queue-5.4/spi-spi-meson-spifc-add-missing-pm_runtime_disable-i.patch new file mode 100644 index 00000000000..367cd46ea59 --- /dev/null +++ b/queue-5.4/spi-spi-meson-spifc-add-missing-pm_runtime_disable-i.patch @@ -0,0 +1,38 @@ +From 7acde6888487162255c955ba49fda149ad50882a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 07:54:24 +0000 +Subject: spi: spi-meson-spifc: Add missing pm_runtime_disable() in + meson_spifc_probe + +From: Miaoqian Lin + +[ Upstream commit 69c1b87516e327a60b39f96b778fe683259408bf ] + +If the probe fails, we should use pm_runtime_disable() to balance +pm_runtime_enable(). +Add missing pm_runtime_disable() for meson_spifc_probe. + +Fixes: c3e4bc5434d2 ("spi: meson: Add support for Amlogic Meson SPIFC") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220107075424.7774-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-meson-spifc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-meson-spifc.c b/drivers/spi/spi-meson-spifc.c +index c7b0399802913..cae934464f3dd 100644 +--- a/drivers/spi/spi-meson-spifc.c ++++ b/drivers/spi/spi-meson-spifc.c +@@ -349,6 +349,7 @@ static int meson_spifc_probe(struct platform_device *pdev) + return 0; + out_clk: + clk_disable_unprepare(spifc->clk); ++ pm_runtime_disable(spifc->dev); + out_err: + spi_master_put(master); + return ret; +-- +2.34.1 + diff --git a/queue-5.4/staging-greybus-audio-check-null-pointer.patch b/queue-5.4/staging-greybus-audio-check-null-pointer.patch new file mode 100644 index 00000000000..4e6b5dc3dae --- /dev/null +++ b/queue-5.4/staging-greybus-audio-check-null-pointer.patch @@ -0,0 +1,91 @@ +From 08a24234be6166abe85d2c305683e6d95354ddd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jan 2022 23:06:28 +0800 +Subject: staging: greybus: audio: Check null pointer + +From: Jiasheng Jiang + +[ Upstream commit 2e81948177d769106754085c3e03534e6cc1f623 ] + +As the possible alloc failure of devm_kcalloc(), it could return null +pointer. +Therefore, 'strings' should be checked and return NULL if alloc fails to +prevent the dereference of the NULL pointer. +Also, the caller should also deal with the return value of the +gb_generate_enum_strings() and return -ENOMEM if returns NULL. +Moreover, because the memory allocated with devm_kzalloc() will be +freed automatically when the last reference to the device is dropped, +the 'gbe' in gbaudio_tplg_create_enum_kctl() and +gbaudio_tplg_create_enum_ctl() do not need to free manually. +But the 'control' in gbaudio_tplg_create_widget() and +gbaudio_tplg_process_kcontrols() has a specially error handle to +cleanup. +So it should be better to cleanup 'control' when fails. + +Fixes: e65579e335da ("greybus: audio: topology: Enable enumerated control support") +Reviewed-by: Alex Elder +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220104150628.1987906-1-jiasheng@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/audio_topology.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/staging/greybus/audio_topology.c b/drivers/staging/greybus/audio_topology.c +index a8cfea957868a..3e2fbcd20598a 100644 +--- a/drivers/staging/greybus/audio_topology.c ++++ b/drivers/staging/greybus/audio_topology.c +@@ -145,6 +145,9 @@ static const char **gb_generate_enum_strings(struct gbaudio_module_info *gb, + + items = le32_to_cpu(gbenum->items); + strings = devm_kcalloc(gb->dev, items, sizeof(char *), GFP_KERNEL); ++ if (!strings) ++ return NULL; ++ + data = gbenum->names; + + for (i = 0; i < items; i++) { +@@ -662,6 +665,8 @@ static int gbaudio_tplg_create_enum_kctl(struct gbaudio_module_info *gb, + /* since count=1, and reg is dummy */ + gbe->max = le32_to_cpu(gb_enum->items); + gbe->texts = gb_generate_enum_strings(gb, gb_enum); ++ if (!gbe->texts) ++ return -ENOMEM; + + /* debug enum info */ + dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, +@@ -871,6 +876,8 @@ static int gbaudio_tplg_create_enum_ctl(struct gbaudio_module_info *gb, + /* since count=1, and reg is dummy */ + gbe->max = le32_to_cpu(gb_enum->items); + gbe->texts = gb_generate_enum_strings(gb, gb_enum); ++ if (!gbe->texts) ++ return -ENOMEM; + + /* debug enum info */ + dev_dbg(gb->dev, "Max:%d, name_length:%d\n", gbe->max, +@@ -1081,6 +1088,10 @@ static int gbaudio_tplg_create_widget(struct gbaudio_module_info *module, + csize += le16_to_cpu(gbenum->names_length); + control->texts = (const char * const *) + gb_generate_enum_strings(module, gbenum); ++ if (!control->texts) { ++ ret = -ENOMEM; ++ goto error; ++ } + control->items = le32_to_cpu(gbenum->items); + } else { + csize = sizeof(struct gb_audio_control); +@@ -1190,6 +1201,10 @@ static int gbaudio_tplg_process_kcontrols(struct gbaudio_module_info *module, + csize += le16_to_cpu(gbenum->names_length); + control->texts = (const char * const *) + gb_generate_enum_strings(module, gbenum); ++ if (!control->texts) { ++ ret = -ENOMEM; ++ goto error; ++ } + control->items = le32_to_cpu(gbenum->items); + } else { + csize = sizeof(struct gb_audio_control); +-- +2.34.1 + diff --git a/queue-5.4/staging-rtl8192e-return-error-code-from-rtllib_softm.patch b/queue-5.4/staging-rtl8192e-return-error-code-from-rtllib_softm.patch new file mode 100644 index 00000000000..151f55be54e --- /dev/null +++ b/queue-5.4/staging-rtl8192e-return-error-code-from-rtllib_softm.patch @@ -0,0 +1,71 @@ +From 35df0acf9cb43bd5e07e766854df47c793af4984 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 11:07:02 +0800 +Subject: staging: rtl8192e: return error code from rtllib_softmac_init() + +From: Yang Yingliang + +[ Upstream commit 68bf78ff59a0891eb1239948e94ce10f73a9dd30 ] + +If it fails to allocate 'dot11d_info', rtllib_softmac_init() +should return error code. And remove unneccessary error message. + +Fixes: 94a799425eee ("From: wlanfae ") +Reviewed-by: Dan Carpenter +Reviewed-by: Pavel Skripkin +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211202030704.2425621-2-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtllib.h | 2 +- + drivers/staging/rtl8192e/rtllib_softmac.c | 6 ++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/rtl8192e/rtllib.h b/drivers/staging/rtl8192e/rtllib.h +index 2eeb9a43734e3..49bf3ad31f912 100644 +--- a/drivers/staging/rtl8192e/rtllib.h ++++ b/drivers/staging/rtl8192e/rtllib.h +@@ -1982,7 +1982,7 @@ void rtllib_softmac_xmit(struct rtllib_txb *txb, struct rtllib_device *ieee); + void rtllib_stop_send_beacons(struct rtllib_device *ieee); + void notify_wx_assoc_event(struct rtllib_device *ieee); + void rtllib_start_ibss(struct rtllib_device *ieee); +-void rtllib_softmac_init(struct rtllib_device *ieee); ++int rtllib_softmac_init(struct rtllib_device *ieee); + void rtllib_softmac_free(struct rtllib_device *ieee); + void rtllib_disassociate(struct rtllib_device *ieee); + void rtllib_stop_scan(struct rtllib_device *ieee); +diff --git a/drivers/staging/rtl8192e/rtllib_softmac.c b/drivers/staging/rtl8192e/rtllib_softmac.c +index f2f7529e7c80e..4ff8fd694c600 100644 +--- a/drivers/staging/rtl8192e/rtllib_softmac.c ++++ b/drivers/staging/rtl8192e/rtllib_softmac.c +@@ -2952,7 +2952,7 @@ void rtllib_start_protocol(struct rtllib_device *ieee) + } + } + +-void rtllib_softmac_init(struct rtllib_device *ieee) ++int rtllib_softmac_init(struct rtllib_device *ieee) + { + int i; + +@@ -2963,7 +2963,8 @@ void rtllib_softmac_init(struct rtllib_device *ieee) + ieee->seq_ctrl[i] = 0; + ieee->dot11d_info = kzalloc(sizeof(struct rt_dot11d_info), GFP_ATOMIC); + if (!ieee->dot11d_info) +- netdev_err(ieee->dev, "Can't alloc memory for DOT11D\n"); ++ return -ENOMEM; ++ + ieee->LinkDetectInfo.SlotIndex = 0; + ieee->LinkDetectInfo.SlotNum = 2; + ieee->LinkDetectInfo.NumRecvBcnInPeriod = 0; +@@ -3031,6 +3032,7 @@ void rtllib_softmac_init(struct rtllib_device *ieee) + (void(*)(unsigned long)) rtllib_sta_ps, + (unsigned long)ieee); + ++ return 0; + } + + void rtllib_softmac_free(struct rtllib_device *ieee) +-- +2.34.1 + diff --git a/queue-5.4/staging-rtl8192e-rtllib_module-fix-error-handle-case.patch b/queue-5.4/staging-rtl8192e-rtllib_module-fix-error-handle-case.patch new file mode 100644 index 00000000000..9ef615f2e8a --- /dev/null +++ b/queue-5.4/staging-rtl8192e-rtllib_module-fix-error-handle-case.patch @@ -0,0 +1,72 @@ +From af9bd0b76506d5067f45c9c9b93ce36f7f7fab08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 11:07:03 +0800 +Subject: staging: rtl8192e: rtllib_module: fix error handle case in + alloc_rtllib() + +From: Yang Yingliang + +[ Upstream commit e730cd57ac2dfe94bca0f14a3be8e1b21de41a9c ] + +Some variables are leaked in the error handling in alloc_rtllib(), free +the variables in the error path. + +Fixes: 94a799425eee ("From: wlanfae ") +Reviewed-by: Dan Carpenter +Reviewed-by: Pavel Skripkin +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211202030704.2425621-3-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/rtllib_module.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/rtl8192e/rtllib_module.c b/drivers/staging/rtl8192e/rtllib_module.c +index 64d9feee1f392..f00ac94b2639b 100644 +--- a/drivers/staging/rtl8192e/rtllib_module.c ++++ b/drivers/staging/rtl8192e/rtllib_module.c +@@ -88,7 +88,7 @@ struct net_device *alloc_rtllib(int sizeof_priv) + err = rtllib_networks_allocate(ieee); + if (err) { + pr_err("Unable to allocate beacon storage: %d\n", err); +- goto failed; ++ goto free_netdev; + } + rtllib_networks_initialize(ieee); + +@@ -121,11 +121,13 @@ struct net_device *alloc_rtllib(int sizeof_priv) + ieee->hwsec_active = 0; + + memset(ieee->swcamtable, 0, sizeof(struct sw_cam_table) * 32); +- rtllib_softmac_init(ieee); ++ err = rtllib_softmac_init(ieee); ++ if (err) ++ goto free_crypt_info; + + ieee->pHTInfo = kzalloc(sizeof(struct rt_hi_throughput), GFP_KERNEL); + if (!ieee->pHTInfo) +- return NULL; ++ goto free_softmac; + + HTUpdateDefaultSetting(ieee); + HTInitializeHTInfo(ieee); +@@ -141,8 +143,14 @@ struct net_device *alloc_rtllib(int sizeof_priv) + + return dev; + +- failed: ++free_softmac: ++ rtllib_softmac_free(ieee); ++free_crypt_info: ++ lib80211_crypt_info_free(&ieee->crypt_info); ++ rtllib_networks_free(ieee); ++free_netdev: + free_netdev(dev); ++ + return NULL; + } + EXPORT_SYMBOL(alloc_rtllib); +-- +2.34.1 + diff --git a/queue-5.4/tee-fix-put-order-in-teedev_close_context.patch b/queue-5.4/tee-fix-put-order-in-teedev_close_context.patch new file mode 100644 index 00000000000..70c1a422f3b --- /dev/null +++ b/queue-5.4/tee-fix-put-order-in-teedev_close_context.patch @@ -0,0 +1,41 @@ +From 472387df58e34485801fde1652564bfd84a500e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 22:23:50 +0200 +Subject: tee: fix put order in teedev_close_context() + +From: Jens Wiklander + +[ Upstream commit f18397ab3ae23e8e43bba9986e66af6d4497f2ad ] + +Prior to this patch was teedev_close_context() calling tee_device_put() +before teedev_ctx_put() leading to teedev_ctx_release() accessing +ctx->teedev just after the reference counter was decreased on the +teedev. Fix this by calling teedev_ctx_put() before tee_device_put(). + +Fixes: 217e0250cccb ("tee: use reference counting for tee_context") +Reviewed-by: Sumit Garg +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/tee_core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index 0f16d9ffd8d12..85e0cef9e917e 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -84,8 +84,10 @@ void teedev_ctx_put(struct tee_context *ctx) + + static void teedev_close_context(struct tee_context *ctx) + { +- tee_device_put(ctx->teedev); ++ struct tee_device *teedev = ctx->teedev; ++ + teedev_ctx_put(ctx); ++ tee_device_put(teedev); + } + + static int tee_open(struct inode *inode, struct file *filp) +-- +2.34.1 + diff --git a/queue-5.4/tpm-add-request_locality-before-write-tpm_int_enable.patch b/queue-5.4/tpm-add-request_locality-before-write-tpm_int_enable.patch new file mode 100644 index 00000000000..7b70b1d6280 --- /dev/null +++ b/queue-5.4/tpm-add-request_locality-before-write-tpm_int_enable.patch @@ -0,0 +1,44 @@ +From db81c404b2cb2d9bddc2742dd32b73ca4baefc7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Oct 2021 06:25:56 +0000 +Subject: tpm: add request_locality before write TPM_INT_ENABLE + +From: Chen Jun + +[ Upstream commit 0ef333f5ba7f24f5d8478425c163d3097f1c7afd ] + +Locality is not appropriately requested before writing the int mask. +Add the missing boilerplate. + +Fixes: e6aef069b6e9 ("tpm_tis: convert to using locality callbacks") +Signed-off-by: Chen Jun +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis_core.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 2fe26ec03552b..70f7859942287 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -877,7 +877,15 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + intmask |= TPM_INTF_CMD_READY_INT | TPM_INTF_LOCALITY_CHANGE_INT | + TPM_INTF_DATA_AVAIL_INT | TPM_INTF_STS_VALID_INT; + intmask &= ~TPM_GLOBAL_INT_ENABLE; ++ ++ rc = request_locality(chip, 0); ++ if (rc < 0) { ++ rc = -ENODEV; ++ goto out_err; ++ } ++ + tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); ++ release_locality(chip, 0); + + rc = tpm_chip_start(chip); + if (rc) +-- +2.34.1 + diff --git a/queue-5.4/tty-serial-atmel-call-dma_async_issue_pending.patch b/queue-5.4/tty-serial-atmel-call-dma_async_issue_pending.patch new file mode 100644 index 00000000000..45653d952ad --- /dev/null +++ b/queue-5.4/tty-serial-atmel-call-dma_async_issue_pending.patch @@ -0,0 +1,50 @@ +From 87a086bbbc194fc91ff8448ce775483fde340587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 11:00:18 +0200 +Subject: tty: serial: atmel: Call dma_async_issue_pending() + +From: Tudor Ambarus + +[ Upstream commit 4f4b9b5895614eb2e2b5f4cab7858f44bd113e1b ] + +The driver wrongly assummed that tx_submit() will start the transfer, +which is not the case, now that the at_xdmac driver is fixed. tx_submit +is supposed to push the current transaction descriptor to a pending queue, +waiting for issue_pending to be called. issue_pending must start the +transfer, not tx_submit. + +Fixes: 34df42f59a60 ("serial: at91: add rx dma support") +Fixes: 08f738be88bb ("serial: at91: add tx dma support") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20211125090028.786832-4-tudor.ambarus@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/atmel_serial.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index da076493b336a..3b2c25bd2e06b 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1007,6 +1007,8 @@ static void atmel_tx_dma(struct uart_port *port) + atmel_port->cookie_tx); + return; + } ++ ++ dma_async_issue_pending(chan); + } + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) +@@ -1273,6 +1275,8 @@ static int atmel_prepare_rx_dma(struct uart_port *port) + goto chan_err; + } + ++ dma_async_issue_pending(atmel_port->chan_rx); ++ + return 0; + + chan_err: +-- +2.34.1 + diff --git a/queue-5.4/tty-serial-atmel-check-return-code-of-dmaengine_subm.patch b/queue-5.4/tty-serial-atmel-check-return-code-of-dmaengine_subm.patch new file mode 100644 index 00000000000..a88ac186650 --- /dev/null +++ b/queue-5.4/tty-serial-atmel-check-return-code-of-dmaengine_subm.patch @@ -0,0 +1,59 @@ +From 711888a946ad443d778204449d163cb3fce5e523 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Nov 2021 11:00:17 +0200 +Subject: tty: serial: atmel: Check return code of dmaengine_submit() + +From: Tudor Ambarus + +[ Upstream commit 1e67bd2b8cb90b66e89562598e9c2046246832d3 ] + +The tx_submit() method of struct dma_async_tx_descriptor is entitled +to do sanity checks and return errors if encountered. It's not the +case for the DMA controller drivers that this client is using +(at_h/xdmac), because they currently don't do sanity checks and always +return a positive cookie at tx_submit() method. In case the controller +drivers will implement sanity checks and return errors, print a message +so that the client will be informed that something went wrong at +tx_submit() level. + +Fixes: 08f738be88bb ("serial: at91: add tx dma support") +Signed-off-by: Tudor Ambarus +Acked-by: Richard Genoud +Link: https://lore.kernel.org/r/20211125090028.786832-3-tudor.ambarus@microchip.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/atmel_serial.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 8a909d5561859..da076493b336a 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1002,6 +1002,11 @@ static void atmel_tx_dma(struct uart_port *port) + desc->callback = atmel_complete_tx_dma; + desc->callback_param = atmel_port; + atmel_port->cookie_tx = dmaengine_submit(desc); ++ if (dma_submit_error(atmel_port->cookie_tx)) { ++ dev_err(port->dev, "dma_submit_error %d\n", ++ atmel_port->cookie_tx); ++ return; ++ } + } + + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) +@@ -1262,6 +1267,11 @@ static int atmel_prepare_rx_dma(struct uart_port *port) + desc->callback_param = port; + atmel_port->desc_rx = desc; + atmel_port->cookie_rx = dmaengine_submit(desc); ++ if (dma_submit_error(atmel_port->cookie_rx)) { ++ dev_err(port->dev, "dma_submit_error %d\n", ++ atmel_port->cookie_rx); ++ goto chan_err; ++ } + + return 0; + +-- +2.34.1 + diff --git a/queue-5.4/tty-serial-uartlite-allow-64-bit-address.patch b/queue-5.4/tty-serial-uartlite-allow-64-bit-address.patch new file mode 100644 index 00000000000..82ac426594a --- /dev/null +++ b/queue-5.4/tty-serial-uartlite-allow-64-bit-address.patch @@ -0,0 +1,39 @@ +From 41e7d7969f28f9f001476e9c900e273e0474e013 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Nov 2021 12:23:02 -0800 +Subject: tty: serial: uartlite: allow 64 bit address + +From: Lizhi Hou + +[ Upstream commit 3672fb65155530b5eea6225685c75329b6debec3 ] + +The base address of uartlite registers could be 64 bit address which is from +device resource. When ulite_probe() calls ulite_assign(), this 64 bit +address is casted to 32-bit. The fix is to replace "u32" type with +"phys_addr_t" type for the base address in ulite_assign() argument list. + +Fixes: 8fa7b6100693 ("[POWERPC] Uartlite: Separate the bus binding from the driver proper") +Signed-off-by: Lizhi Hou +Link: https://lore.kernel.org/r/20211129202302.1319033-1-lizhi.hou@xilinx.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/uartlite.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c +index 56066d93a65b8..9a4049c894f7a 100644 +--- a/drivers/tty/serial/uartlite.c ++++ b/drivers/tty/serial/uartlite.c +@@ -618,7 +618,7 @@ static struct uart_driver ulite_uart_driver = { + * + * Returns: 0 on success, <0 otherwise + */ +-static int ulite_assign(struct device *dev, int id, u32 base, int irq, ++static int ulite_assign(struct device *dev, int id, phys_addr_t base, int irq, + struct uartlite_data *pdata) + { + struct uart_port *port; +-- +2.34.1 + diff --git a/queue-5.4/uio-uio_dmem_genirq-catch-the-exception.patch b/queue-5.4/uio-uio_dmem_genirq-catch-the-exception.patch new file mode 100644 index 00000000000..026cf774f4f --- /dev/null +++ b/queue-5.4/uio-uio_dmem_genirq-catch-the-exception.patch @@ -0,0 +1,41 @@ +From 43d13aead05569cec1414eb78b78d6c1a8fb83f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Dec 2021 08:03:26 +0800 +Subject: uio: uio_dmem_genirq: Catch the Exception + +From: Jiasheng Jiang + +[ Upstream commit eec91694f927d1026974444eb6a3adccd4f1cbc2 ] + +The return value of dma_set_coherent_mask() is not always 0. +To catch the exception in case that dma is not support the mask. + +Fixes: 0a0c3b5a24bd ("Add new uio device for dynamic memory allocation") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20211204000326.1592687-1-jiasheng@iscas.ac.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/uio/uio_dmem_genirq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c +index 44858f70f5f52..bdba9dc06f63b 100644 +--- a/drivers/uio/uio_dmem_genirq.c ++++ b/drivers/uio/uio_dmem_genirq.c +@@ -192,7 +192,11 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev) + goto bad0; + } + +- dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ ret = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32)); ++ if (ret) { ++ dev_err(&pdev->dev, "DMA enable failed\n"); ++ return ret; ++ } + + priv->uioinfo = uioinfo; + spin_lock_init(&priv->lock); +-- +2.34.1 + diff --git a/queue-5.4/um-registers-rename-function-names-to-avoid-conflict.patch b/queue-5.4/um-registers-rename-function-names-to-avoid-conflict.patch new file mode 100644 index 00000000000..6953bee76d1 --- /dev/null +++ b/queue-5.4/um-registers-rename-function-names-to-avoid-conflict.patch @@ -0,0 +1,104 @@ +From 2a22f675a04636215072aa70903e935ef2a0494b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Sep 2021 23:12:52 -0700 +Subject: um: registers: Rename function names to avoid conflicts and build + problems + +From: Randy Dunlap + +[ Upstream commit 077b7320942b64b0da182aefd83c374462a65535 ] + +The function names init_registers() and restore_registers() are used +in several net/ethernet/ and gpu/drm/ drivers for other purposes (not +calls to UML functions), so rename them. + +This fixes multiple build errors. + +Signed-off-by: Randy Dunlap +Cc: Jeff Dike +Cc: Richard Weinberger +Cc: Anton Ivanov +Cc: linux-um@lists.infradead.org +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/include/shared/registers.h | 4 ++-- + arch/um/os-Linux/registers.c | 4 ++-- + arch/um/os-Linux/start_up.c | 2 +- + arch/x86/um/syscalls_64.c | 3 ++- + 4 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/arch/um/include/shared/registers.h b/arch/um/include/shared/registers.h +index 0c50fa6e8a55b..fbb709a222839 100644 +--- a/arch/um/include/shared/registers.h ++++ b/arch/um/include/shared/registers.h +@@ -16,8 +16,8 @@ extern int restore_fp_registers(int pid, unsigned long *fp_regs); + extern int save_fpx_registers(int pid, unsigned long *fp_regs); + extern int restore_fpx_registers(int pid, unsigned long *fp_regs); + extern int save_registers(int pid, struct uml_pt_regs *regs); +-extern int restore_registers(int pid, struct uml_pt_regs *regs); +-extern int init_registers(int pid); ++extern int restore_pid_registers(int pid, struct uml_pt_regs *regs); ++extern int init_pid_registers(int pid); + extern void get_safe_registers(unsigned long *regs, unsigned long *fp_regs); + extern unsigned long get_thread_reg(int reg, jmp_buf *buf); + extern int get_fp_registers(int pid, unsigned long *regs); +diff --git a/arch/um/os-Linux/registers.c b/arch/um/os-Linux/registers.c +index 2d9270508e156..b123955be7acc 100644 +--- a/arch/um/os-Linux/registers.c ++++ b/arch/um/os-Linux/registers.c +@@ -21,7 +21,7 @@ int save_registers(int pid, struct uml_pt_regs *regs) + return 0; + } + +-int restore_registers(int pid, struct uml_pt_regs *regs) ++int restore_pid_registers(int pid, struct uml_pt_regs *regs) + { + int err; + +@@ -36,7 +36,7 @@ int restore_registers(int pid, struct uml_pt_regs *regs) + static unsigned long exec_regs[MAX_REG_NR]; + static unsigned long exec_fp_regs[FP_SIZE]; + +-int init_registers(int pid) ++int init_pid_registers(int pid) + { + int err; + +diff --git a/arch/um/os-Linux/start_up.c b/arch/um/os-Linux/start_up.c +index f79dc338279e6..b28373a2b8d2d 100644 +--- a/arch/um/os-Linux/start_up.c ++++ b/arch/um/os-Linux/start_up.c +@@ -336,7 +336,7 @@ void __init os_early_checks(void) + check_tmpexec(); + + pid = start_ptraced_child(); +- if (init_registers(pid)) ++ if (init_pid_registers(pid)) + fatal("Failed to initialize default registers"); + stop_ptraced_child(pid, 1, 1); + } +diff --git a/arch/x86/um/syscalls_64.c b/arch/x86/um/syscalls_64.c +index 58f51667e2e4b..8249685b40960 100644 +--- a/arch/x86/um/syscalls_64.c ++++ b/arch/x86/um/syscalls_64.c +@@ -11,6 +11,7 @@ + #include + #include /* XXX This should get the constants from libc */ + #include ++#include + + long arch_prctl(struct task_struct *task, int option, + unsigned long __user *arg2) +@@ -35,7 +36,7 @@ long arch_prctl(struct task_struct *task, int option, + switch (option) { + case ARCH_SET_FS: + case ARCH_SET_GS: +- ret = restore_registers(pid, ¤t->thread.regs.regs); ++ ret = restore_pid_registers(pid, ¤t->thread.regs.regs); + if (ret) + return ret; + break; +-- +2.34.1 + diff --git a/queue-5.4/usb-ftdi-elan-fix-memory-leak-on-device-disconnect.patch b/queue-5.4/usb-ftdi-elan-fix-memory-leak-on-device-disconnect.patch new file mode 100644 index 00000000000..387fe357ecf --- /dev/null +++ b/queue-5.4/usb-ftdi-elan-fix-memory-leak-on-device-disconnect.patch @@ -0,0 +1,52 @@ +From d914106dbbbbdc06d97869e91011653548589b6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 16:34:28 +0800 +Subject: usb: ftdi-elan: fix memory leak on device disconnect + +From: Wei Yongjun + +[ Upstream commit 1646566b5e0c556f779180a8514e521ac735de1e ] + +'ftdi' is alloced when probe device, but not free on device disconnect, +this cause a memory leak as follows: + +unreferenced object 0xffff88800d584000 (size 8400): + comm "kworker/0:2", pid 3809, jiffies 4295453055 (age 13.784s) + hex dump (first 32 bytes): + 00 40 58 0d 80 88 ff ff 00 40 58 0d 80 88 ff ff .@X......@X..... + 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de .............N.. + backtrace: + [<000000000d47f947>] kmalloc_order_trace+0x19/0x110 mm/slab_common.c:960 + [<000000008548ac68>] ftdi_elan_probe+0x8c/0x880 drivers/usb/misc/ftdi-elan.c:2647 + [<000000007f73e422>] usb_probe_interface+0x31b/0x800 drivers/usb/core/driver.c:396 + [<00000000fe8d07fc>] really_probe+0x299/0xc30 drivers/base/dd.c:517 + [<0000000005da7d32>] __driver_probe_device+0x357/0x500 drivers/base/dd.c:751 + [<000000003c2c9579>] driver_probe_device+0x4e/0x140 drivers/base/dd.c:781 + +Fix it by freeing 'ftdi' after nobody use it. + +Fixes: a5c66e4b2418 ("USB: ftdi-elan: client driver for ELAN Uxxx adapters") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20211217083428.2441-1-weiyongjun1@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/ftdi-elan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/misc/ftdi-elan.c b/drivers/usb/misc/ftdi-elan.c +index cdee3af33ad7b..684800c66bb4d 100644 +--- a/drivers/usb/misc/ftdi-elan.c ++++ b/drivers/usb/misc/ftdi-elan.c +@@ -202,6 +202,7 @@ static void ftdi_elan_delete(struct kref *kref) + mutex_unlock(&ftdi_module_lock); + kfree(ftdi->bulk_in_buffer); + ftdi->bulk_in_buffer = NULL; ++ kfree(ftdi); + } + + static void ftdi_elan_put_kref(struct usb_ftdi *ftdi) +-- +2.34.1 + diff --git a/queue-5.4/usb-gadget-f_fs-use-stream_open-for-endpoint-files.patch b/queue-5.4/usb-gadget-f_fs-use-stream_open-for-endpoint-files.patch new file mode 100644 index 00000000000..a7aa0fb6196 --- /dev/null +++ b/queue-5.4/usb-gadget-f_fs-use-stream_open-for-endpoint-files.patch @@ -0,0 +1,65 @@ +From 26e333ad6056e6d5eedcae6ad19ee9f100c2a047 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 15:54:40 +0530 +Subject: usb: gadget: f_fs: Use stream_open() for endpoint files + +From: Pavankumar Kondeti + +[ Upstream commit c76ef96fc00eb398c8fc836b0eb2f82bcc619dc7 ] + +Function fs endpoint file operations are synchronized via an interruptible +mutex wait. However we see threads that do ep file operations concurrently +are getting blocked for the mutex lock in __fdget_pos(). This is an +uninterruptible wait and we see hung task warnings and kernel panic +if hung_task_panic systcl is enabled if host does not send/receive +the data for long time. + +The reason for threads getting blocked in __fdget_pos() is due to +the file position protection introduced by the commit 9c225f2655e3 +("vfs: atomic f_pos accesses as per POSIX"). Since function fs +endpoint files does not have the notion of the file position, switch +to the stream mode. This will bypass the file position mutex and +threads will be blocked in interruptible state for the function fs +mutex. + +It should not affects user space as we are only changing the task state +changes the task state from UNINTERRUPTIBLE to INTERRUPTIBLE while waiting +for the USB transfers to be finished. However there is a slight change to +the O_NONBLOCK behavior. Earlier threads that are using O_NONBLOCK are also +getting blocked inside fdget_pos(). Now they reach to function fs and error +code is returned. The non blocking behavior is actually honoured now. + +Reviewed-by: John Keeping +Signed-off-by: Pavankumar Kondeti +Link: https://lore.kernel.org/r/1636712682-1226-1-git-send-email-quic_pkondeti@quicinc.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_fs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 3f5c21f7f9905..2bea33b41553b 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -614,7 +614,7 @@ static int ffs_ep0_open(struct inode *inode, struct file *file) + file->private_data = ffs; + ffs_data_opened(ffs); + +- return 0; ++ return stream_open(inode, file); + } + + static int ffs_ep0_release(struct inode *inode, struct file *file) +@@ -1156,7 +1156,7 @@ ffs_epfile_open(struct inode *inode, struct file *file) + file->private_data = epfile; + ffs_data_opened(epfile->ffs); + +- return 0; ++ return stream_open(inode, file); + } + + static int ffs_aio_cancel(struct kiocb *kiocb) +-- +2.34.1 + diff --git a/queue-5.4/usb-hub-add-delay-for-superspeed-hub-resume-to-let-l.patch b/queue-5.4/usb-hub-add-delay-for-superspeed-hub-resume-to-let-l.patch new file mode 100644 index 00000000000..3bd7772622d --- /dev/null +++ b/queue-5.4/usb-hub-add-delay-for-superspeed-hub-resume-to-let-l.patch @@ -0,0 +1,97 @@ +From ad46e556ab71c05906121a41627b87f6a421ccee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 20:01:06 +0800 +Subject: usb: hub: Add delay for SuperSpeed hub resume to let links transit to + U0 + +From: Kai-Heng Feng + +[ Upstream commit 00558586382891540c59c9febc671062425a6e47 ] + +When a new USB device gets plugged to nested hubs, the affected hub, +which connects to usb 2-1.4-port2, doesn't report there's any change, +hence the nested hubs go back to runtime suspend like nothing happened: +[ 281.032951] usb usb2: usb wakeup-resume +[ 281.032959] usb usb2: usb auto-resume +[ 281.032974] hub 2-0:1.0: hub_resume +[ 281.033011] usb usb2-port1: status 0263 change 0000 +[ 281.033077] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 +[ 281.049797] usb 2-1: usb wakeup-resume +[ 281.069800] usb 2-1: Waited 0ms for CONNECT +[ 281.069810] usb 2-1: finish resume +[ 281.070026] hub 2-1:1.0: hub_resume +[ 281.070250] usb 2-1-port4: status 0203 change 0000 +[ 281.070272] usb usb2-port1: resume, status 0 +[ 281.070282] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 +[ 281.089813] usb 2-1.4: usb wakeup-resume +[ 281.109792] usb 2-1.4: Waited 0ms for CONNECT +[ 281.109801] usb 2-1.4: finish resume +[ 281.109991] hub 2-1.4:1.0: hub_resume +[ 281.110147] usb 2-1.4-port2: status 0263 change 0000 +[ 281.110234] usb 2-1-port4: resume, status 0 +[ 281.110239] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s +[ 281.110266] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 +[ 281.110426] hub 2-1.4:1.0: hub_suspend +[ 281.110565] usb 2-1.4: usb auto-suspend, wakeup 1 +[ 281.130998] hub 2-1:1.0: hub_suspend +[ 281.137788] usb 2-1: usb auto-suspend, wakeup 1 +[ 281.142935] hub 2-0:1.0: state 7 ports 4 chg 0000 evt 0000 +[ 281.177828] usb 2-1: usb wakeup-resume +[ 281.197839] usb 2-1: Waited 0ms for CONNECT +[ 281.197850] usb 2-1: finish resume +[ 281.197984] hub 2-1:1.0: hub_resume +[ 281.198203] usb 2-1-port4: status 0203 change 0000 +[ 281.198228] usb usb2-port1: resume, status 0 +[ 281.198237] hub 2-1:1.0: state 7 ports 4 chg 0010 evt 0000 +[ 281.217835] usb 2-1.4: usb wakeup-resume +[ 281.237834] usb 2-1.4: Waited 0ms for CONNECT +[ 281.237845] usb 2-1.4: finish resume +[ 281.237990] hub 2-1.4:1.0: hub_resume +[ 281.238067] usb 2-1.4-port2: status 0263 change 0000 +[ 281.238148] usb 2-1-port4: resume, status 0 +[ 281.238152] usb 2-1-port4: status 0203, change 0000, 10.0 Gb/s +[ 281.238166] hub 2-1.4:1.0: state 7 ports 4 chg 0000 evt 0000 +[ 281.238385] hub 2-1.4:1.0: hub_suspend +[ 281.238523] usb 2-1.4: usb auto-suspend, wakeup 1 +[ 281.258076] hub 2-1:1.0: hub_suspend +[ 281.265744] usb 2-1: usb auto-suspend, wakeup 1 +[ 281.285976] hub 2-0:1.0: hub_suspend +[ 281.285988] usb usb2: bus auto-suspend, wakeup 1 + +USB 3.2 spec, 9.2.5.4 "Changing Function Suspend State" says that "If +the link is in a non-U0 state, then the device must transition the link +to U0 prior to sending the remote wake message", but the hub only +transits the link to U0 after signaling remote wakeup. + +So be more forgiving and use a 20ms delay to let the link transit to U0 +for remote wakeup. + +Suggested-by: Alan Stern +Acked-by: Alan Stern +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20211215120108.336597-1-kai.heng.feng@canonical.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/hub.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 69dd48f9507e5..4cf0dc7f330dd 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1108,7 +1108,10 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + } else { + hub_power_on(hub, true); + } +- } ++ /* Give some time on remote wakeup to let links to transit to U0 */ ++ } else if (hub_is_superspeed(hub->hdev)) ++ msleep(20); ++ + init2: + + /* +-- +2.34.1 + diff --git a/queue-5.4/usb-uhci-add-aspeed-ast2600-uhci-support.patch b/queue-5.4/usb-uhci-add-aspeed-ast2600-uhci-support.patch new file mode 100644 index 00000000000..a7b2c10a1c7 --- /dev/null +++ b/queue-5.4/usb-uhci-add-aspeed-ast2600-uhci-support.patch @@ -0,0 +1,36 @@ +From ec699a6e169f65432d3bb2bf4bd97effd776931d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 18:00:21 +0800 +Subject: usb: uhci: add aspeed ast2600 uhci support + +From: Neal Liu + +[ Upstream commit 554abfe2eadec97d12c71d4a69da1518478f69eb ] + +Enable ast2600 uhci quirks. + +Signed-off-by: Neal Liu +Link: https://lore.kernel.org/r/20211126100021.2331024-1-neal_liu@aspeedtech.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/uhci-platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/uhci-platform.c b/drivers/usb/host/uhci-platform.c +index 70dbd95c3f063..be9e9db7cad10 100644 +--- a/drivers/usb/host/uhci-platform.c ++++ b/drivers/usb/host/uhci-platform.c +@@ -113,7 +113,8 @@ static int uhci_hcd_platform_probe(struct platform_device *pdev) + num_ports); + } + if (of_device_is_compatible(np, "aspeed,ast2400-uhci") || +- of_device_is_compatible(np, "aspeed,ast2500-uhci")) { ++ of_device_is_compatible(np, "aspeed,ast2500-uhci") || ++ of_device_is_compatible(np, "aspeed,ast2600-uhci")) { + uhci->is_aspeed = 1; + dev_info(&pdev->dev, + "Enabled Aspeed implementation workarounds\n"); +-- +2.34.1 + diff --git a/queue-5.4/w1-misuse-of-get_user-put_user-reported-by-sparse.patch b/queue-5.4/w1-misuse-of-get_user-put_user-reported-by-sparse.patch new file mode 100644 index 00000000000..510ca599378 --- /dev/null +++ b/queue-5.4/w1-misuse-of-get_user-put_user-reported-by-sparse.patch @@ -0,0 +1,86 @@ +From 02cafe8f5c1a36ecfbafa496884dc52831d50808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Nov 2021 18:06:46 +0100 +Subject: w1: Misuse of get_user()/put_user() reported by sparse + +From: Christophe Leroy + +[ Upstream commit 33dc3e3e99e626ce51f462d883b05856c6c30b1d ] + +sparse warnings: (new ones prefixed by >>) +>> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ + drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr + drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf +>> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ + drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr + drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf + +The buffer buf is a failsafe buffer in kernel space, it's not user +memory hence doesn't deserve the use of get_user() or put_user(). + +Access 'buf' content directly. + +Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ +Reported-by: kernel test robot +Signed-off-by: Christophe Leroy +Link: https://lore.kernel.org/r/d14ed8d71ad4372e6839ae427f91441d3ba0e94d.1637946316.git.christophe.leroy@csgroup.eu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_ds28e04.c | 26 ++++++-------------------- + 1 file changed, 6 insertions(+), 20 deletions(-) + +diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c +index 8a640f1590784..06a9966f8c933 100644 +--- a/drivers/w1/slaves/w1_ds28e04.c ++++ b/drivers/w1/slaves/w1_ds28e04.c +@@ -32,7 +32,7 @@ static int w1_strong_pullup = 1; + module_param_named(strong_pullup, w1_strong_pullup, int, 0); + + /* enable/disable CRC checking on DS28E04-100 memory accesses */ +-static char w1_enable_crccheck = 1; ++static bool w1_enable_crccheck = true; + + #define W1_EEPROM_SIZE 512 + #define W1_PAGE_COUNT 16 +@@ -339,32 +339,18 @@ static BIN_ATTR_RW(pio, 1); + static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- if (put_user(w1_enable_crccheck + 0x30, buf)) +- return -EFAULT; +- +- return sizeof(w1_enable_crccheck); ++ return sysfs_emit(buf, "%d\n", w1_enable_crccheck); + } + + static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { +- char val; +- +- if (count != 1 || !buf) +- return -EINVAL; ++ int err = kstrtobool(buf, &w1_enable_crccheck); + +- if (get_user(val, buf)) +- return -EFAULT; ++ if (err) ++ return err; + +- /* convert to decimal */ +- val = val - 0x30; +- if (val != 0 && val != 1) +- return -EINVAL; +- +- /* set the new value */ +- w1_enable_crccheck = val; +- +- return sizeof(w1_enable_crccheck); ++ return count; + } + + static DEVICE_ATTR_RW(crccheck); +-- +2.34.1 + diff --git a/queue-5.4/wcn36xx-indicate-beacon-not-connection-loss-on-misse.patch b/queue-5.4/wcn36xx-indicate-beacon-not-connection-loss-on-misse.patch new file mode 100644 index 00000000000..82ad46c53aa --- /dev/null +++ b/queue-5.4/wcn36xx-indicate-beacon-not-connection-loss-on-misse.patch @@ -0,0 +1,51 @@ +From 6d6ebc0260dc7991976db486b4438b8062e31e4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 00:25:29 +0100 +Subject: wcn36xx: Indicate beacon not connection loss on MISSED_BEACON_IND + +From: Bryan O'Donoghue + +[ Upstream commit 588b45c88ae130fe373a8c50edaf54735c3f4fe3 ] + +Firmware can trigger a missed beacon indication, this is not the same as a +lost signal. + +Flag to Linux the missed beacon and let the WiFi stack decide for itself if +the link is up or down by sending its own probe to determine this. + +We should only be signalling the link is lost when the firmware indicates + +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211027232529.657764-1-bryan.odonoghue@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wcn36xx/smd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c +index a7532028bf9db..74cf173c186ff 100644 +--- a/drivers/net/wireless/ath/wcn36xx/smd.c ++++ b/drivers/net/wireless/ath/wcn36xx/smd.c +@@ -2311,7 +2311,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn, + wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", + tmp->bss_index); + vif = wcn36xx_priv_to_vif(tmp); +- ieee80211_connection_loss(vif); ++ ieee80211_beacon_loss(vif); + } + return 0; + } +@@ -2326,7 +2326,7 @@ static int wcn36xx_smd_missed_beacon_ind(struct wcn36xx *wcn, + wcn36xx_dbg(WCN36XX_DBG_HAL, "beacon missed bss_index %d\n", + rsp->bss_index); + vif = wcn36xx_priv_to_vif(tmp); +- ieee80211_connection_loss(vif); ++ ieee80211_beacon_loss(vif); + return 0; + } + } +-- +2.34.1 + diff --git a/queue-5.4/wcn36xx-release-dma-channel-descriptor-allocations.patch b/queue-5.4/wcn36xx-release-dma-channel-descriptor-allocations.patch new file mode 100644 index 00000000000..be7625e28aa --- /dev/null +++ b/queue-5.4/wcn36xx-release-dma-channel-descriptor-allocations.patch @@ -0,0 +1,38 @@ +From fb1490182a437f1a8029e7824f5a8ba483f5dfab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 12:21:51 +0000 +Subject: wcn36xx: Release DMA channel descriptor allocations + +From: Bryan O'Donoghue + +[ Upstream commit 3652096e5263ad67604b0323f71d133485f410e5 ] + +When unloading the driver we are not releasing the DMA descriptors which we +previously allocated. + +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 hardware") +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211105122152.1580542-3-bryan.odonoghue@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wcn36xx/dxe.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/ath/wcn36xx/dxe.c b/drivers/net/wireless/ath/wcn36xx/dxe.c +index 4da25e84793b7..c400261352bc8 100644 +--- a/drivers/net/wireless/ath/wcn36xx/dxe.c ++++ b/drivers/net/wireless/ath/wcn36xx/dxe.c +@@ -952,4 +952,9 @@ void wcn36xx_dxe_deinit(struct wcn36xx *wcn) + + wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_l_ch); + wcn36xx_dxe_ch_free_skbs(wcn, &wcn->dxe_rx_h_ch); ++ ++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_l_ch); ++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_tx_h_ch); ++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_l_ch); ++ wcn36xx_dxe_deinit_descs(wcn->dev, &wcn->dxe_rx_h_ch); + } +-- +2.34.1 + diff --git a/queue-5.4/x86-mce-inject-avoid-out-of-bounds-write-when-settin.patch b/queue-5.4/x86-mce-inject-avoid-out-of-bounds-write-when-settin.patch new file mode 100644 index 00000000000..6355faf5cc7 --- /dev/null +++ b/queue-5.4/x86-mce-inject-avoid-out-of-bounds-write-when-settin.patch @@ -0,0 +1,55 @@ +From 199ad046c5c0b0c442e97c1de85c1d3de5182343 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 22:02:49 +0100 +Subject: x86/mce/inject: Avoid out-of-bounds write when setting flags + +From: Zhang Zixun + +[ Upstream commit de768416b203ac84e02a757b782a32efb388476f ] + +A contrived zero-length write, for example, by using write(2): + + ... + ret = write(fd, str, 0); + ... + +to the "flags" file causes: + + BUG: KASAN: stack-out-of-bounds in flags_write + Write of size 1 at addr ffff888019be7ddf by task writefile/3787 + + CPU: 4 PID: 3787 Comm: writefile Not tainted 5.16.0-rc7+ #12 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + +due to accessing buf one char before its start. + +Prevent such out-of-bounds access. + + [ bp: Productize into a proper patch. Link below is the next best + thing because the original mail didn't get archived on lore. ] + +Fixes: 0451d14d0561 ("EDAC, mce_amd_inj: Modify flags attribute to use string arguments") +Signed-off-by: Zhang Zixun +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/linux-edac/YcnePfF1OOqoQwrX@zn.tnic/ +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/inject.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/mce/inject.c b/arch/x86/kernel/cpu/mce/inject.c +index eb2d41c1816d6..e1fda5b19b6f6 100644 +--- a/arch/x86/kernel/cpu/mce/inject.c ++++ b/arch/x86/kernel/cpu/mce/inject.c +@@ -347,7 +347,7 @@ static ssize_t flags_write(struct file *filp, const char __user *ubuf, + char buf[MAX_FLAG_OPT_SIZE], *__buf; + int err; + +- if (cnt > MAX_FLAG_OPT_SIZE) ++ if (!cnt || cnt > MAX_FLAG_OPT_SIZE) + return -EINVAL; + + if (copy_from_user(&buf, ubuf, cnt)) +-- +2.34.1 + diff --git a/queue-5.4/x86-mce-mark-mce_end-noinstr.patch b/queue-5.4/x86-mce-mark-mce_end-noinstr.patch new file mode 100644 index 00000000000..de335eadbfb --- /dev/null +++ b/queue-5.4/x86-mce-mark-mce_end-noinstr.patch @@ -0,0 +1,66 @@ +From 6c9661229a3a9960e3b0f947d5ef8ecd770d0281 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 16:43:33 +0100 +Subject: x86/mce: Mark mce_end() noinstr + +From: Borislav Petkov + +[ Upstream commit b4813539d37fa31fed62cdfab7bd2dd8929c5b2e ] + +It is called by the #MC handler which is noinstr. + +Fixes + + vmlinux.o: warning: objtool: do_machine_check()+0xbd6: call to memset() leaves .noinstr.text section + +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/r/20211208111343.8130-9-bp@alien8.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/core.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 290d64e04ab20..a0f6c574c3783 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -1080,10 +1080,13 @@ static int mce_start(int *no_way_out) + * Synchronize between CPUs after main scanning loop. + * This invokes the bulk of the Monarch processing. + */ +-static int mce_end(int order) ++static noinstr int mce_end(int order) + { +- int ret = -1; + u64 timeout = (u64)mca_cfg.monarch_timeout * NSEC_PER_USEC; ++ int ret = -1; ++ ++ /* Allow instrumentation around external facilities. */ ++ instrumentation_begin(); + + if (!timeout) + goto reset; +@@ -1127,7 +1130,8 @@ static int mce_end(int order) + /* + * Don't reset anything. That's done by the Monarch. + */ +- return 0; ++ ret = 0; ++ goto out; + } + + /* +@@ -1142,6 +1146,10 @@ reset: + * Let others run again. + */ + atomic_set(&mce_executing, 0); ++ ++out: ++ instrumentation_end(); ++ + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.4/x86-mce-mark-mce_panic-noinstr.patch b/queue-5.4/x86-mce-mark-mce_panic-noinstr.patch new file mode 100644 index 00000000000..7ca4f3ffbc3 --- /dev/null +++ b/queue-5.4/x86-mce-mark-mce_panic-noinstr.patch @@ -0,0 +1,69 @@ +From 5f8d6722b44f0ed08e06c4f38fc133dd7587a375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 13:39:35 +0100 +Subject: x86/mce: Mark mce_panic() noinstr + +From: Borislav Petkov + +[ Upstream commit 3c7ce80a818fa7950be123cac80cd078e5ac1013 ] + +And allow instrumentation inside it because it does calls to other +facilities which will not be tagged noinstr. + +Fixes + + vmlinux.o: warning: objtool: do_machine_check()+0xc73: call to mce_panic() leaves .noinstr.text section + +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/r/20211208111343.8130-8-bp@alien8.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/core.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index c2a9762d278dd..290d64e04ab20 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -310,11 +310,17 @@ static void wait_for_panic(void) + panic("Panicing machine check CPU died"); + } + +-static void mce_panic(const char *msg, struct mce *final, char *exp) ++static noinstr void mce_panic(const char *msg, struct mce *final, char *exp) + { +- int apei_err = 0; + struct llist_node *pending; + struct mce_evt_llist *l; ++ int apei_err = 0; ++ ++ /* ++ * Allow instrumentation around external facilities usage. Not that it ++ * matters a whole lot since the machine is going to panic anyway. ++ */ ++ instrumentation_begin(); + + if (!fake_panic) { + /* +@@ -329,7 +335,7 @@ static void mce_panic(const char *msg, struct mce *final, char *exp) + } else { + /* Don't log too much for fake panic */ + if (atomic_inc_return(&mce_fake_panicked) > 1) +- return; ++ goto out; + } + pending = mce_gen_pool_prepare_records(); + /* First print corrected ones that are still unlogged */ +@@ -367,6 +373,9 @@ static void mce_panic(const char *msg, struct mce *final, char *exp) + panic(msg); + } else + pr_emerg(HW_ERR "Fake kernel panic: %s\n", msg); ++ ++out: ++ instrumentation_end(); + } + + /* Support code for software error injection */ +-- +2.34.1 + diff --git a/queue-5.4/x86-mce-mark-mce_read_aux-noinstr.patch b/queue-5.4/x86-mce-mark-mce_read_aux-noinstr.patch new file mode 100644 index 00000000000..c76f89389b8 --- /dev/null +++ b/queue-5.4/x86-mce-mark-mce_read_aux-noinstr.patch @@ -0,0 +1,36 @@ +From 1718962230edd39bb4d799509df20d33e824262c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Nov 2021 11:14:48 +0100 +Subject: x86/mce: Mark mce_read_aux() noinstr + +From: Borislav Petkov + +[ Upstream commit db6c996d6ce45dfb44891f0824a65ecec216f47a ] + +Fixes + + vmlinux.o: warning: objtool: do_machine_check()+0x681: call to mce_read_aux() leaves .noinstr.text section + +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/r/20211208111343.8130-10-bp@alien8.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index a0f6c574c3783..8a2b8e7913149 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -700,7 +700,7 @@ static struct notifier_block mce_default_nb = { + /* + * Read ADDR and MISC registers. + */ +-static void mce_read_aux(struct mce *m, int i) ++static noinstr void mce_read_aux(struct mce *m, int i) + { + if (m->status & MCI_STATUS_MISCV) + m->misc = mce_rdmsrl(msr_ops.misc(i)); +-- +2.34.1 + diff --git a/queue-5.4/x86-mm-flush-global-tlb-when-switching-to-trampoline.patch b/queue-5.4/x86-mm-flush-global-tlb-when-switching-to-trampoline.patch new file mode 100644 index 00000000000..955202f0e01 --- /dev/null +++ b/queue-5.4/x86-mm-flush-global-tlb-when-switching-to-trampoline.patch @@ -0,0 +1,103 @@ +From 01ef5d1290526e19dc5a30267ce756c43c5eabdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Dec 2021 16:32:25 +0100 +Subject: x86/mm: Flush global TLB when switching to trampoline page-table + +From: Joerg Roedel + +[ Upstream commit 71d5049b053876afbde6c3273250b76935494ab2 ] + +Move the switching code into a function so that it can be re-used and +add a global TLB flush. This makes sure that usage of memory which is +not mapped in the trampoline page-table is reliably caught. + +Also move the clearing of CR4.PCIDE before the CR3 switch because the +cr4_clear_bits() function will access data not mapped into the +trampoline page-table. + +Signed-off-by: Joerg Roedel +Signed-off-by: Borislav Petkov +Link: https://lore.kernel.org/r/20211202153226.22946-4-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/realmode.h | 1 + + arch/x86/kernel/reboot.c | 12 ++---------- + arch/x86/realmode/init.c | 26 ++++++++++++++++++++++++++ + 3 files changed, 29 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/include/asm/realmode.h b/arch/x86/include/asm/realmode.h +index 09ecc32f65248..52d7512ea91ab 100644 +--- a/arch/x86/include/asm/realmode.h ++++ b/arch/x86/include/asm/realmode.h +@@ -82,6 +82,7 @@ static inline void set_real_mode_mem(phys_addr_t mem) + } + + void reserve_real_mode(void); ++void load_trampoline_pgtable(void); + + #endif /* __ASSEMBLY__ */ + +diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c +index d65d1afb27161..fdef27a84d713 100644 +--- a/arch/x86/kernel/reboot.c ++++ b/arch/x86/kernel/reboot.c +@@ -113,17 +113,9 @@ void __noreturn machine_real_restart(unsigned int type) + spin_unlock(&rtc_lock); + + /* +- * Switch back to the initial page table. ++ * Switch to the trampoline page table. + */ +-#ifdef CONFIG_X86_32 +- load_cr3(initial_page_table); +-#else +- write_cr3(real_mode_header->trampoline_pgd); +- +- /* Exiting long mode will fail if CR4.PCIDE is set. */ +- if (boot_cpu_has(X86_FEATURE_PCID)) +- cr4_clear_bits(X86_CR4_PCIDE); +-#endif ++ load_trampoline_pgtable(); + + /* Jump to the identity-mapped low memory code */ + #ifdef CONFIG_X86_32 +diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c +index de371e52cfa85..fac50ebb122b5 100644 +--- a/arch/x86/realmode/init.c ++++ b/arch/x86/realmode/init.c +@@ -16,6 +16,32 @@ u32 *trampoline_cr4_features; + /* Hold the pgd entry used on booting additional CPUs */ + pgd_t trampoline_pgd_entry; + ++void load_trampoline_pgtable(void) ++{ ++#ifdef CONFIG_X86_32 ++ load_cr3(initial_page_table); ++#else ++ /* ++ * This function is called before exiting to real-mode and that will ++ * fail with CR4.PCIDE still set. ++ */ ++ if (boot_cpu_has(X86_FEATURE_PCID)) ++ cr4_clear_bits(X86_CR4_PCIDE); ++ ++ write_cr3(real_mode_header->trampoline_pgd); ++#endif ++ ++ /* ++ * The CR3 write above will not flush global TLB entries. ++ * Stale, global entries from previous page tables may still be ++ * present. Flush those stale entries. ++ * ++ * This ensures that memory accessed while running with ++ * trampoline_pgd is *actually* mapped into trampoline_pgd. ++ */ ++ __flush_tlb_all(); ++} ++ + void __init reserve_real_mode(void) + { + phys_addr_t mem; +-- +2.34.1 + diff --git a/queue-5.4/xfrm-fix-a-small-bug-in-xfrm_sa_len.patch b/queue-5.4/xfrm-fix-a-small-bug-in-xfrm_sa_len.patch new file mode 100644 index 00000000000..0a783ff9b98 --- /dev/null +++ b/queue-5.4/xfrm-fix-a-small-bug-in-xfrm_sa_len.patch @@ -0,0 +1,38 @@ +From 20cfb522379883727ccd39a889935aca3fa4c42e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 12:20:19 -0800 +Subject: xfrm: fix a small bug in xfrm_sa_len() + +From: Eric Dumazet + +[ Upstream commit 7770a39d7c63faec6c4f33666d49a8cb664d0482 ] + +copy_user_offload() will actually push a struct struct xfrm_user_offload, +which is different than (struct xfrm_state *)->xso +(struct xfrm_state_offload) + +Fixes: d77e38e612a01 ("xfrm: Add an IPsec hardware offloading API") +Signed-off-by: Eric Dumazet +Cc: Steffen Klassert +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 0cee2d3c6e452..ddcf569d852f7 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2816,7 +2816,7 @@ static inline unsigned int xfrm_sa_len(struct xfrm_state *x) + if (x->props.extra_flags) + l += nla_total_size(sizeof(x->props.extra_flags)); + if (x->xso.dev) +- l += nla_total_size(sizeof(x->xso)); ++ l += nla_total_size(sizeof(struct xfrm_user_offload)); + if (x->props.smark.v | x->props.smark.m) { + l += nla_total_size(sizeof(x->props.smark.v)); + l += nla_total_size(sizeof(x->props.smark.m)); +-- +2.34.1 + diff --git a/queue-5.4/xfrm-interface-with-if_id-0-should-return-error.patch b/queue-5.4/xfrm-interface-with-if_id-0-should-return-error.patch new file mode 100644 index 00000000000..2187ca382ea --- /dev/null +++ b/queue-5.4/xfrm-interface-with-if_id-0-should-return-error.patch @@ -0,0 +1,69 @@ +From 3694c4d4e6883d027119c46bde2aea94c44b4c87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Dec 2021 11:34:30 +0100 +Subject: xfrm: interface with if_id 0 should return error + +From: Antony Antony + +[ Upstream commit 8dce43919566f06e865f7e8949f5c10d8c2493f5 ] + +xfrm interface if_id = 0 would cause xfrm policy lookup errors since +Commit 9f8550e4bd9d. + +Now explicitly fail to create an xfrm interface when if_id = 0 + +With this commit: + ip link add ipsec0 type xfrm dev lo if_id 0 + Error: if_id must be non zero. + +v1->v2 change: + - add Fixes: tag + +Fixes: 9f8550e4bd9d ("xfrm: fix disable_xfrm sysctl when used on xfrm interfaces") +Signed-off-by: Antony Antony +Reviewed-by: Eyal Birger +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_interface.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 74e90d78c3b46..08343201513a9 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -659,11 +659,16 @@ static int xfrmi_newlink(struct net *src_net, struct net_device *dev, + struct netlink_ext_ack *extack) + { + struct net *net = dev_net(dev); +- struct xfrm_if_parms p; ++ struct xfrm_if_parms p = {}; + struct xfrm_if *xi; + int err; + + xfrmi_netlink_parms(data, &p); ++ if (!p.if_id) { ++ NL_SET_ERR_MSG(extack, "if_id must be non zero"); ++ return -EINVAL; ++ } ++ + xi = xfrmi_locate(net, &p); + if (xi) + return -EEXIST; +@@ -688,7 +693,12 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], + { + struct xfrm_if *xi = netdev_priv(dev); + struct net *net = xi->net; +- struct xfrm_if_parms p; ++ struct xfrm_if_parms p = {}; ++ ++ if (!p.if_id) { ++ NL_SET_ERR_MSG(extack, "if_id must be non zero"); ++ return -EINVAL; ++ } + + xfrmi_netlink_parms(data, &p); + xi = xfrmi_locate(net, &p); +-- +2.34.1 + diff --git a/queue-5.4/xfrm-state-and-policy-should-fail-if-xfrma_if_id-0.patch b/queue-5.4/xfrm-state-and-policy-should-fail-if-xfrma_if_id-0.patch new file mode 100644 index 00000000000..9b4365033fe --- /dev/null +++ b/queue-5.4/xfrm-state-and-policy-should-fail-if-xfrma_if_id-0.patch @@ -0,0 +1,84 @@ +From e68d1d1b56c144e4a939e2bd5edaf625f40b535c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Dec 2021 11:35:00 +0100 +Subject: xfrm: state and policy should fail if XFRMA_IF_ID 0 + +From: Antony Antony + +[ Upstream commit 68ac0f3810e76a853b5f7b90601a05c3048b8b54 ] + +xfrm ineterface does not allow xfrm if_id = 0 +fail to create or update xfrm state and policy. + +With this commit: + ip xfrm policy add src 192.0.2.1 dst 192.0.2.2 dir out if_id 0 + RTNETLINK answers: Invalid argument + + ip xfrm state add src 192.0.2.1 dst 192.0.2.2 proto esp spi 1 \ + reqid 1 mode tunnel aead 'rfc4106(gcm(aes))' \ + 0x1111111111111111111111111111111111111111 96 if_id 0 + RTNETLINK answers: Invalid argument + +v1->v2 change: + - add Fixes: tag + +Fixes: 9f8550e4bd9d ("xfrm: fix disable_xfrm sysctl when used on xfrm interfaces") +Signed-off-by: Antony Antony +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index ddcf569d852f7..42ff32700d68b 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -621,8 +621,13 @@ static struct xfrm_state *xfrm_state_construct(struct net *net, + + xfrm_smark_init(attrs, &x->props.smark); + +- if (attrs[XFRMA_IF_ID]) ++ if (attrs[XFRMA_IF_ID]) { + x->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); ++ if (!x->if_id) { ++ err = -EINVAL; ++ goto error; ++ } ++ } + + err = __xfrm_init_state(x, false, attrs[XFRMA_OFFLOAD_DEV]); + if (err) +@@ -1328,8 +1333,13 @@ static int xfrm_alloc_userspi(struct sk_buff *skb, struct nlmsghdr *nlh, + + mark = xfrm_mark_get(attrs, &m); + +- if (attrs[XFRMA_IF_ID]) ++ if (attrs[XFRMA_IF_ID]) { + if_id = nla_get_u32(attrs[XFRMA_IF_ID]); ++ if (!if_id) { ++ err = -EINVAL; ++ goto out_noput; ++ } ++ } + + if (p->info.seq) { + x = xfrm_find_acq_byseq(net, mark, p->info.seq); +@@ -1631,8 +1641,13 @@ static struct xfrm_policy *xfrm_policy_construct(struct net *net, struct xfrm_us + + xfrm_mark_get(attrs, &xp->mark); + +- if (attrs[XFRMA_IF_ID]) ++ if (attrs[XFRMA_IF_ID]) { + xp->if_id = nla_get_u32(attrs[XFRMA_IF_ID]); ++ if (!xp->if_id) { ++ err = -EINVAL; ++ goto error; ++ } ++ } + + return xp; + error: +-- +2.34.1 +