From: Greg Kroah-Hartman Date: Mon, 25 Jan 2021 14:58:59 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.171~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=73a3a9852e94c0683a27219df2287f990503d491;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch cachefiles-drop-superfluous-readpages-aops-null-check.patch cls_flower-call-nla_ok-before-nla_next.patch drm-i915-hdcp-update-cp-property-in-update_pipe.patch lightnvm-fix-memory-leak-when-submit-fails.patch locking-lockdep-cure-noinstr-fail.patch net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch nvme-pci-fix-error-unwind-in-nvme_map_data.patch nvme-pci-refactor-nvme_unmap_data.patch octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch selftests-powerpc-fix-exit-status-of-pkey-tests.patch sh-dma-fix-kconfig-dependency-for-g2_dma.patch sh-remove-unused-have_copy_thread_tls-macro.patch sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch tools-gpio-fix-llu-warning-in-gpio-watch.c.patch x86-cpu-amd-set-__max_die_per_package-on-amd.patch x86-entry-fix-noinstr-fail.patch --- diff --git a/queue-5.10/asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch b/queue-5.10/asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch new file mode 100644 index 00000000000..d51dfd97d1e --- /dev/null +++ b/queue-5.10/asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch @@ -0,0 +1,92 @@ +From 9c25af250214e45f6d1c21ff6239a1ffeeedf20e Mon Sep 17 00:00:00 2001 +From: Kai Vehmanen +Date: Wed, 13 Jan 2021 17:07:15 +0200 +Subject: ASoC: SOF: Intel: fix page fault at probe if i915 init fails + +From: Kai Vehmanen + +commit 9c25af250214e45f6d1c21ff6239a1ffeeedf20e upstream. + +The earlier commit to fix runtime PM in case i915 init fails, +introduces a possibility to hit a page fault. + +snd_hdac_ext_bus_device_exit() is designed to be called from +dev.release(). Calling it outside device reference counting, is +not safe and may lead to calling the device_exit() function +twice. Additionally, as part of ext_bus_device_init(), the device +is also registered with snd_hdac_device_register(). Thus before +calling device_exit(), the device must be removed from device +hierarchy first. + +Fix the issue by rolling back init actions by calling +hdac_device_unregister() and then releasing device with put_device(). +This matches with existing code in hdac-ext module. + +To complete the fix, add handling for the case where +hda_codec_load_module() returns -ENODEV, and clean up the hdac_ext +resources also in this case. + +In future work, hdac-ext interface should be extended to allow clients +more flexibility to handle the life-cycle of individual devices, beyond +just the current snd_hdac_ext_bus_device_remove(), which removes all +devices. + +BugLink: https://github.com/thesofproject/linux/issues/2646 +Reported-by: Jaroslav Kysela +Fixes: 6c63c954e1c5 ("ASoC: SOF: fix a runtime pm issue in SOF when HDMI codec doesn't work") +Signed-off-by: Kai Vehmanen +Reviewed-by: Rander Wang +Reviewed-by: Libin Yang +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210113150715.3992635-1-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/sof/intel/hda-codec.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/sound/soc/sof/intel/hda-codec.c ++++ b/sound/soc/sof/intel/hda-codec.c +@@ -156,7 +156,8 @@ static int hda_codec_probe(struct snd_so + if (!hdev->bus->audio_component) { + dev_dbg(sdev->dev, + "iDisp hw present but no driver\n"); +- goto error; ++ ret = -ENOENT; ++ goto out; + } + hda_priv->need_display_power = true; + } +@@ -173,24 +174,23 @@ static int hda_codec_probe(struct snd_so + * other return codes without modification + */ + if (ret == 0) +- goto error; ++ ret = -ENOENT; + } + +- return ret; +- +-error: +- snd_hdac_ext_bus_device_exit(hdev); +- return -ENOENT; +- ++out: ++ if (ret < 0) { ++ snd_hdac_device_unregister(hdev); ++ put_device(&hdev->dev); ++ } + #else + hdev = devm_kzalloc(sdev->dev, sizeof(*hdev), GFP_KERNEL); + if (!hdev) + return -ENOMEM; + + ret = snd_hdac_ext_bus_device_init(&hbus->core, address, hdev, HDA_DEV_ASOC); ++#endif + + return ret; +-#endif + } + + /* Codec initialization */ diff --git a/queue-5.10/cachefiles-drop-superfluous-readpages-aops-null-check.patch b/queue-5.10/cachefiles-drop-superfluous-readpages-aops-null-check.patch new file mode 100644 index 00000000000..b07b18a7365 --- /dev/null +++ b/queue-5.10/cachefiles-drop-superfluous-readpages-aops-null-check.patch @@ -0,0 +1,49 @@ +From db58465f1121086b524be80be39d1fedbe5387f3 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 20 Jan 2021 16:11:12 +0000 +Subject: cachefiles: Drop superfluous readpages aops NULL check + +From: Takashi Iwai + +commit db58465f1121086b524be80be39d1fedbe5387f3 upstream. + +After the recent actions to convert readpages aops to readahead, the +NULL checks of readpages aops in cachefiles_read_or_alloc_page() may +hit falsely. More badly, it's an ASSERT() call, and this panics. + +Drop the superfluous NULL checks for fixing this regression. + +[DH: Note that cachefiles never actually used readpages, so this check was + never actually necessary] + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=208883 +BugLink: https://bugzilla.opensuse.org/show_bug.cgi?id=1175245 +Fixes: 9ae326a69004 ("CacheFiles: A cache that backs onto a mounted filesystem") +Signed-off-by: Takashi Iwai +Signed-off-by: David Howells +Acked-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cachefiles/rdwr.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/cachefiles/rdwr.c ++++ b/fs/cachefiles/rdwr.c +@@ -413,7 +413,6 @@ int cachefiles_read_or_alloc_page(struct + + inode = d_backing_inode(object->backer); + ASSERT(S_ISREG(inode->i_mode)); +- ASSERT(inode->i_mapping->a_ops->readpages); + + /* calculate the shift required to use bmap */ + shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits; +@@ -713,7 +712,6 @@ int cachefiles_read_or_alloc_pages(struc + + inode = d_backing_inode(object->backer); + ASSERT(S_ISREG(inode->i_mode)); +- ASSERT(inode->i_mapping->a_ops->readpages); + + /* calculate the shift required to use bmap */ + shift = PAGE_SHIFT - inode->i_sb->s_blocksize_bits; diff --git a/queue-5.10/cls_flower-call-nla_ok-before-nla_next.patch b/queue-5.10/cls_flower-call-nla_ok-before-nla_next.patch new file mode 100644 index 00000000000..522e54a7272 --- /dev/null +++ b/queue-5.10/cls_flower-call-nla_ok-before-nla_next.patch @@ -0,0 +1,90 @@ +From c96adff95619178e2118925578343ad54857c80c Mon Sep 17 00:00:00 2001 +From: Cong Wang +Date: Fri, 15 Jan 2021 10:50:24 -0800 +Subject: cls_flower: call nla_ok() before nla_next() + +From: Cong Wang + +commit c96adff95619178e2118925578343ad54857c80c upstream. + +fl_set_enc_opt() simply checks if there are still bytes left to parse, +but this is not sufficent as syzbot seems to be able to generate +malformatted netlink messages. nla_ok() is more strict so should be +used to validate the next nlattr here. + +And nla_validate_nested_deprecated() has less strict check too, it is +probably too late to switch to the strict version, but we can just +call nla_ok() too after it. + +Reported-and-tested-by: syzbot+2624e3778b18fc497c92@syzkaller.appspotmail.com +Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options") +Fixes: 79b1011cb33d ("net: sched: allow flower to match erspan options") +Cc: Jamal Hadi Salim +Cc: Xin Long +Cc: Jiri Pirko +Signed-off-by: Cong Wang +Link: https://lore.kernel.org/r/20210115185024.72298-1-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/cls_flower.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -1272,6 +1272,10 @@ static int fl_set_enc_opt(struct nlattr + + nla_opt_msk = nla_data(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); + msk_depth = nla_len(tb[TCA_FLOWER_KEY_ENC_OPTS_MASK]); ++ if (!nla_ok(nla_opt_msk, msk_depth)) { ++ NL_SET_ERR_MSG(extack, "Invalid nested attribute for masks"); ++ return -EINVAL; ++ } + } + + nla_for_each_attr(nla_opt_key, nla_enc_key, +@@ -1307,9 +1311,6 @@ static int fl_set_enc_opt(struct nlattr + NL_SET_ERR_MSG(extack, "Key and mask miss aligned"); + return -EINVAL; + } +- +- if (msk_depth) +- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth); + break; + case TCA_FLOWER_KEY_ENC_OPTS_VXLAN: + if (key->enc_opts.dst_opt_type) { +@@ -1340,9 +1341,6 @@ static int fl_set_enc_opt(struct nlattr + NL_SET_ERR_MSG(extack, "Key and mask miss aligned"); + return -EINVAL; + } +- +- if (msk_depth) +- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth); + break; + case TCA_FLOWER_KEY_ENC_OPTS_ERSPAN: + if (key->enc_opts.dst_opt_type) { +@@ -1373,14 +1371,20 @@ static int fl_set_enc_opt(struct nlattr + NL_SET_ERR_MSG(extack, "Key and mask miss aligned"); + return -EINVAL; + } +- +- if (msk_depth) +- nla_opt_msk = nla_next(nla_opt_msk, &msk_depth); + break; + default: + NL_SET_ERR_MSG(extack, "Unknown tunnel option type"); + return -EINVAL; + } ++ ++ if (!msk_depth) ++ continue; ++ ++ if (!nla_ok(nla_opt_msk, msk_depth)) { ++ NL_SET_ERR_MSG(extack, "A mask attribute is invalid"); ++ return -EINVAL; ++ } ++ nla_opt_msk = nla_next(nla_opt_msk, &msk_depth); + } + + return 0; diff --git a/queue-5.10/drm-i915-hdcp-update-cp-property-in-update_pipe.patch b/queue-5.10/drm-i915-hdcp-update-cp-property-in-update_pipe.patch new file mode 100644 index 00000000000..35f009f2116 --- /dev/null +++ b/queue-5.10/drm-i915-hdcp-update-cp-property-in-update_pipe.patch @@ -0,0 +1,66 @@ +From b3c95d0bdb0855b1f28370629e9eebec6bceac17 Mon Sep 17 00:00:00 2001 +From: Anshuman Gupta +Date: Mon, 11 Jan 2021 13:41:02 +0530 +Subject: drm/i915/hdcp: Update CP property in update_pipe + +From: Anshuman Gupta + +commit b3c95d0bdb0855b1f28370629e9eebec6bceac17 upstream. + +When crtc state need_modeset is true it is not necessary +it is going to be a real modeset, it can turns to be a +fastset instead of modeset. +This turns content protection property to be DESIRED and hdcp +update_pipe left with property to be in DESIRED state but +actual hdcp->value was ENABLED. + +This issue is caught with DP MST setup, where we have multiple +connector in same DP_MST topology. When disabling HDCP on one of +DP MST connector leads to set the crtc state need_modeset to true +for all other crtc driving the other DP-MST topology connectors. +This turns up other DP MST connectors CP property to be DESIRED +despite the actual hdcp->value is ENABLED. +Above scenario fails the DP MST HDCP IGT test, disabling HDCP on +one MST stream should not cause to disable HDCP on another MST +stream on same DP MST topology. + +v2: +- Fixed connector->base.registration_state == DRM_CONNECTOR_REGISTERED + WARN_ON. + +v3: +- Commit log improvement. [Uma] +- Added a comment before scheduling prop_work. [Uma] + +Fixes: 33f9a623bfc6 ("drm/i915/hdcp: Update CP as per the kernel internal state") +Cc: Ramalingam C +Reviewed-by: Uma Shankar +Reviewed-by: Ramalingam C +Tested-by: Karthik B S +Signed-off-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20210111081120.28417-2-anshuman.gupta@intel.com +(cherry picked from commit d276e16702e2d634094f75f69df3b493f359fe31) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/display/intel_hdcp.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_hdcp.c ++++ b/drivers/gpu/drm/i915/display/intel_hdcp.c +@@ -2198,6 +2198,14 @@ void intel_hdcp_update_pipe(struct intel + desired_and_not_enabled = + hdcp->value != DRM_MODE_CONTENT_PROTECTION_ENABLED; + mutex_unlock(&hdcp->mutex); ++ /* ++ * If HDCP already ENABLED and CP property is DESIRED, schedule ++ * prop_work to update correct CP property to user space. ++ */ ++ if (!desired_and_not_enabled && !content_protection_type_changed) { ++ drm_connector_get(&connector->base); ++ schedule_work(&hdcp->prop_work); ++ } + } + + if (desired_and_not_enabled || content_protection_type_changed) diff --git a/queue-5.10/lightnvm-fix-memory-leak-when-submit-fails.patch b/queue-5.10/lightnvm-fix-memory-leak-when-submit-fails.patch new file mode 100644 index 00000000000..21da5608de4 --- /dev/null +++ b/queue-5.10/lightnvm-fix-memory-leak-when-submit-fails.patch @@ -0,0 +1,37 @@ +From 97784481757fba7570121a70dd37ca74a29f50a8 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Wed, 20 Jan 2021 23:22:02 -0800 +Subject: lightnvm: fix memory leak when submit fails + +From: Pan Bian + +commit 97784481757fba7570121a70dd37ca74a29f50a8 upstream. + +The allocated page is not released if error occurs in +nvm_submit_io_sync_raw(). __free_page() is moved ealier to avoid +possible memory leak issue. + +Fixes: aff3fb18f957 ("lightnvm: move bad block and chunk state logic to core") +Signed-off-by: Pan Bian +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/lightnvm/core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/lightnvm/core.c ++++ b/drivers/lightnvm/core.c +@@ -844,11 +844,10 @@ static int nvm_bb_chunk_sense(struct nvm + rqd.ppa_addr = generic_to_dev_addr(dev, ppa); + + ret = nvm_submit_io_sync_raw(dev, &rqd); ++ __free_page(page); + if (ret) + return ret; + +- __free_page(page); +- + return rqd.error; + } + diff --git a/queue-5.10/locking-lockdep-cure-noinstr-fail.patch b/queue-5.10/locking-lockdep-cure-noinstr-fail.patch new file mode 100644 index 00000000000..09d94178caa --- /dev/null +++ b/queue-5.10/locking-lockdep-cure-noinstr-fail.patch @@ -0,0 +1,36 @@ +From 0afda3a888dccf12557b41ef42eee942327d122b Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 6 Jan 2021 15:36:22 +0100 +Subject: locking/lockdep: Cure noinstr fail + +From: Peter Zijlstra + +commit 0afda3a888dccf12557b41ef42eee942327d122b upstream. + +When the compiler doesn't feel like inlining, it causes a noinstr +fail: + + vmlinux.o: warning: objtool: lock_is_held_type()+0xb: call to lockdep_enabled() leaves .noinstr.text section + +Fixes: 4d004099a668 ("lockdep: Fix lockdep recursion") +Reported-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210106144017.592595176@infradead.org +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/locking/lockdep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -79,7 +79,7 @@ module_param(lock_stat, int, 0644); + DEFINE_PER_CPU(unsigned int, lockdep_recursion); + EXPORT_PER_CPU_SYMBOL_GPL(lockdep_recursion); + +-static inline bool lockdep_enabled(void) ++static __always_inline bool lockdep_enabled(void) + { + if (!debug_locks) + return false; diff --git a/queue-5.10/net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch b/queue-5.10/net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch new file mode 100644 index 00000000000..814043b73fc --- /dev/null +++ b/queue-5.10/net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch @@ -0,0 +1,48 @@ +From 87fe04367d842c4d97a77303242d4dd4ac351e46 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Sat, 16 Jan 2021 03:39:35 +0100 +Subject: net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext + +From: Rasmus Villemoes + +commit 87fe04367d842c4d97a77303242d4dd4ac351e46 upstream. + +mv88e6xxx_port_vlan_join checks whether the VTU already contains an +entry for the given vid (via mv88e6xxx_vtu_getnext), and if so, merely +changes the relevant .member[] element and loads the updated entry +into the VTU. + +However, at least for the mv88e6250, the on-stack struct +mv88e6xxx_vtu_entry vlan never has its .state[] array explicitly +initialized, neither in mv88e6xxx_port_vlan_join() nor inside the +getnext implementation. So the new entry has random garbage for the +STU bits, breaking VLAN filtering. + +When the VTU entry is initially created, those bits are all zero, and +we should make sure to keep them that way when the entry is updated. + +Fixes: 92307069a96c (net: dsa: mv88e6xxx: Avoid VTU corruption on 6097) +Signed-off-by: Rasmus Villemoes +Reviewed-by: Florian Fainelli +Reviewed-by: Tobias Waldekranz +Tested-by: Tobias Waldekranz +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/dsa/mv88e6xxx/global1_vtu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/dsa/mv88e6xxx/global1_vtu.c ++++ b/drivers/net/dsa/mv88e6xxx/global1_vtu.c +@@ -351,6 +351,10 @@ int mv88e6250_g1_vtu_getnext(struct mv88 + if (err) + return err; + ++ err = mv88e6185_g1_stu_data_read(chip, entry); ++ if (err) ++ return err; ++ + /* VTU DBNum[3:0] are located in VTU Operation 3:0 + * VTU DBNum[5:4] are located in VTU Operation 9:8 + */ diff --git a/queue-5.10/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch b/queue-5.10/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch new file mode 100644 index 00000000000..cb7e1371136 --- /dev/null +++ b/queue-5.10/netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch @@ -0,0 +1,78 @@ +From 2e5a6266fbb11ae93c468dfecab169aca9c27b43 Mon Sep 17 00:00:00 2001 +From: Guillaume Nault +Date: Sat, 16 Jan 2021 11:44:26 +0100 +Subject: netfilter: rpfilter: mask ecn bits before fib lookup + +From: Guillaume Nault + +commit 2e5a6266fbb11ae93c468dfecab169aca9c27b43 upstream. + +RT_TOS() only masks one of the two ECN bits. Therefore rpfilter_mt() +treats Not-ECT or ECT(1) packets in a different way than those with +ECT(0) or CE. + +Reproducer: + + Create two netns, connected with a veth: + $ ip netns add ns0 + $ ip netns add ns1 + $ ip link add name veth01 netns ns0 type veth peer name veth10 netns ns1 + $ ip -netns ns0 link set dev veth01 up + $ ip -netns ns1 link set dev veth10 up + $ ip -netns ns0 address add 192.0.2.10/32 dev veth01 + $ ip -netns ns1 address add 192.0.2.11/32 dev veth10 + + Add a route to ns1 in ns0: + $ ip -netns ns0 route add 192.0.2.11/32 dev veth01 + + In ns1, only packets with TOS 4 can be routed to ns0: + $ ip -netns ns1 route add 192.0.2.10/32 tos 4 dev veth10 + + Ping from ns0 to ns1 works regardless of the ECN bits, as long as TOS + is 4: + $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1) + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0) + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE + ... 0% packet loss ... + + Now use iptable's rpfilter module in ns1: + $ ip netns exec ns1 iptables-legacy -t raw -A PREROUTING -m rpfilter --invert -j DROP + + Not-ECT and ECT(1) packets still pass: + $ ip netns exec ns0 ping -Q 4 192.0.2.11 # TOS 4, Not-ECT + ... 0% packet loss ... + $ ip netns exec ns0 ping -Q 5 192.0.2.11 # TOS 4, ECT(1) + ... 0% packet loss ... + + But ECT(0) and ECN packets are dropped: + $ ip netns exec ns0 ping -Q 6 192.0.2.11 # TOS 4, ECT(0) + ... 100% packet loss ... + $ ip netns exec ns0 ping -Q 7 192.0.2.11 # TOS 4, CE + ... 100% packet loss ... + +After this patch, rpfilter doesn't drop ECT(0) and CE packets anymore. + +Fixes: 8f97339d3feb ("netfilter: add ipv4 reverse path filter match") +Signed-off-by: Guillaume Nault +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/netfilter/ipt_rpfilter.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/netfilter/ipt_rpfilter.c ++++ b/net/ipv4/netfilter/ipt_rpfilter.c +@@ -76,7 +76,7 @@ static bool rpfilter_mt(const struct sk_ + flow.daddr = iph->saddr; + flow.saddr = rpfilter_get_saddr(iph->daddr); + flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; +- flow.flowi4_tos = RT_TOS(iph->tos); ++ flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; + flow.flowi4_scope = RT_SCOPE_UNIVERSE; + flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); + diff --git a/queue-5.10/nvme-pci-fix-error-unwind-in-nvme_map_data.patch b/queue-5.10/nvme-pci-fix-error-unwind-in-nvme_map_data.patch new file mode 100644 index 00000000000..77e8927a823 --- /dev/null +++ b/queue-5.10/nvme-pci-fix-error-unwind-in-nvme_map_data.patch @@ -0,0 +1,106 @@ +From fa0732168fa1369dd089e5b06d6158a68229f7b7 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 20 Jan 2021 09:35:01 +0100 +Subject: nvme-pci: fix error unwind in nvme_map_data + +From: Christoph Hellwig + +commit fa0732168fa1369dd089e5b06d6158a68229f7b7 upstream. + +Properly unwind step by step using refactored helpers from nvme_unmap_data +to avoid a potential double dma_unmap on a mapping failure. + +Fixes: 7fe07d14f71f ("nvme-pci: merge nvme_free_iod into nvme_unmap_data") +Reported-by: Marc Orr +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Marc Orr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/pci.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -682,7 +682,7 @@ static blk_status_t nvme_pci_setup_prps( + __le64 *old_prp_list = prp_list; + prp_list = dma_pool_alloc(pool, GFP_ATOMIC, &prp_dma); + if (!prp_list) +- return BLK_STS_RESOURCE; ++ goto free_prps; + list[iod->npages++] = prp_list; + prp_list[0] = old_prp_list[i - 1]; + old_prp_list[i - 1] = cpu_to_le64(prp_dma); +@@ -702,14 +702,14 @@ static blk_status_t nvme_pci_setup_prps( + dma_addr = sg_dma_address(sg); + dma_len = sg_dma_len(sg); + } +- + done: + cmnd->dptr.prp1 = cpu_to_le64(sg_dma_address(iod->sg)); + cmnd->dptr.prp2 = cpu_to_le64(iod->first_dma); +- + return BLK_STS_OK; +- +- bad_sgl: ++free_prps: ++ nvme_free_prps(dev, req); ++ return BLK_STS_RESOURCE; ++bad_sgl: + WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents), + "Invalid SGL for payload:%d nents:%d\n", + blk_rq_payload_bytes(req), iod->nents); +@@ -781,7 +781,7 @@ static blk_status_t nvme_pci_setup_sgls( + + sg_list = dma_pool_alloc(pool, GFP_ATOMIC, &sgl_dma); + if (!sg_list) +- return BLK_STS_RESOURCE; ++ goto free_sgls; + + i = 0; + nvme_pci_iod_list(req)[iod->npages++] = sg_list; +@@ -794,6 +794,9 @@ static blk_status_t nvme_pci_setup_sgls( + } while (--entries > 0); + + return BLK_STS_OK; ++free_sgls: ++ nvme_free_sgls(dev, req); ++ return BLK_STS_RESOURCE; + } + + static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev, +@@ -862,7 +865,7 @@ static blk_status_t nvme_map_data(struct + sg_init_table(iod->sg, blk_rq_nr_phys_segments(req)); + iod->nents = blk_rq_map_sg(req->q, req, iod->sg); + if (!iod->nents) +- goto out; ++ goto out_free_sg; + + if (is_pci_p2pdma_page(sg_page(iod->sg))) + nr_mapped = pci_p2pdma_map_sg_attrs(dev->dev, iod->sg, +@@ -871,16 +874,21 @@ static blk_status_t nvme_map_data(struct + nr_mapped = dma_map_sg_attrs(dev->dev, iod->sg, iod->nents, + rq_dma_dir(req), DMA_ATTR_NO_WARN); + if (!nr_mapped) +- goto out; ++ goto out_free_sg; + + iod->use_sgl = nvme_pci_use_sgls(dev, req); + if (iod->use_sgl) + ret = nvme_pci_setup_sgls(dev, req, &cmnd->rw, nr_mapped); + else + ret = nvme_pci_setup_prps(dev, req, &cmnd->rw); +-out: + if (ret != BLK_STS_OK) +- nvme_unmap_data(dev, req); ++ goto out_unmap_sg; ++ return BLK_STS_OK; ++ ++out_unmap_sg: ++ nvme_unmap_sg(dev, req); ++out_free_sg: ++ mempool_free(iod->sg, dev->iod_mempool); + return ret; + } + diff --git a/queue-5.10/nvme-pci-refactor-nvme_unmap_data.patch b/queue-5.10/nvme-pci-refactor-nvme_unmap_data.patch new file mode 100644 index 00000000000..5de9c45295b --- /dev/null +++ b/queue-5.10/nvme-pci-refactor-nvme_unmap_data.patch @@ -0,0 +1,123 @@ +From 9275c206f88e5c49cb3e71932c81c8561083db9e Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 20 Jan 2021 09:33:52 +0100 +Subject: nvme-pci: refactor nvme_unmap_data + +From: Christoph Hellwig + +commit 9275c206f88e5c49cb3e71932c81c8561083db9e upstream. + +Split out three helpers from nvme_unmap_data that will allow finer grained +unwinding from nvme_map_data. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Marc Orr +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/pci.c | 77 ++++++++++++++++++++++++++++++------------------ + 1 file changed, 49 insertions(+), 28 deletions(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -542,50 +542,71 @@ static inline bool nvme_pci_use_sgls(str + return true; + } + +-static void nvme_unmap_data(struct nvme_dev *dev, struct request *req) ++static void nvme_free_prps(struct nvme_dev *dev, struct request *req) + { +- struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + const int last_prp = NVME_CTRL_PAGE_SIZE / sizeof(__le64) - 1; +- dma_addr_t dma_addr = iod->first_dma, next_dma_addr; ++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req); ++ dma_addr_t dma_addr = iod->first_dma; + int i; + +- if (iod->dma_len) { +- dma_unmap_page(dev->dev, dma_addr, iod->dma_len, +- rq_dma_dir(req)); +- return; ++ for (i = 0; i < iod->npages; i++) { ++ __le64 *prp_list = nvme_pci_iod_list(req)[i]; ++ dma_addr_t next_dma_addr = le64_to_cpu(prp_list[last_prp]); ++ ++ dma_pool_free(dev->prp_page_pool, prp_list, dma_addr); ++ dma_addr = next_dma_addr; + } + +- WARN_ON_ONCE(!iod->nents); ++} + +- if (is_pci_p2pdma_page(sg_page(iod->sg))) +- pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents, +- rq_dma_dir(req)); +- else +- dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req)); ++static void nvme_free_sgls(struct nvme_dev *dev, struct request *req) ++{ ++ const int last_sg = SGES_PER_PAGE - 1; ++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req); ++ dma_addr_t dma_addr = iod->first_dma; ++ int i; + ++ for (i = 0; i < iod->npages; i++) { ++ struct nvme_sgl_desc *sg_list = nvme_pci_iod_list(req)[i]; ++ dma_addr_t next_dma_addr = le64_to_cpu((sg_list[last_sg]).addr); + +- if (iod->npages == 0) +- dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0], +- dma_addr); ++ dma_pool_free(dev->prp_page_pool, sg_list, dma_addr); ++ dma_addr = next_dma_addr; ++ } + +- for (i = 0; i < iod->npages; i++) { +- void *addr = nvme_pci_iod_list(req)[i]; ++} + +- if (iod->use_sgl) { +- struct nvme_sgl_desc *sg_list = addr; ++static void nvme_unmap_sg(struct nvme_dev *dev, struct request *req) ++{ ++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + +- next_dma_addr = +- le64_to_cpu((sg_list[SGES_PER_PAGE - 1]).addr); +- } else { +- __le64 *prp_list = addr; ++ if (is_pci_p2pdma_page(sg_page(iod->sg))) ++ pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents, ++ rq_dma_dir(req)); ++ else ++ dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req)); ++} + +- next_dma_addr = le64_to_cpu(prp_list[last_prp]); +- } ++static void nvme_unmap_data(struct nvme_dev *dev, struct request *req) ++{ ++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + +- dma_pool_free(dev->prp_page_pool, addr, dma_addr); +- dma_addr = next_dma_addr; ++ if (iod->dma_len) { ++ dma_unmap_page(dev->dev, iod->first_dma, iod->dma_len, ++ rq_dma_dir(req)); ++ return; + } + ++ WARN_ON_ONCE(!iod->nents); ++ ++ nvme_unmap_sg(dev, req); ++ if (iod->npages == 0) ++ dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0], ++ iod->first_dma); ++ else if (iod->use_sgl) ++ nvme_free_sgls(dev, req); ++ else ++ nvme_free_prps(dev, req); + mempool_free(iod->sg, dev->iod_mempool); + } + diff --git a/queue-5.10/octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch b/queue-5.10/octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch new file mode 100644 index 00000000000..659e835592c --- /dev/null +++ b/queue-5.10/octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch @@ -0,0 +1,48 @@ +From b7ba6cfabc42fc846eb96e33f1edcd3ea6290a27 Mon Sep 17 00:00:00 2001 +From: Yingjie Wang +Date: Fri, 15 Jan 2021 06:10:04 -0800 +Subject: octeontx2-af: Fix missing check bugs in rvu_cgx.c + +From: Yingjie Wang + +commit b7ba6cfabc42fc846eb96e33f1edcd3ea6290a27 upstream. + +In rvu_mbox_handler_cgx_mac_addr_get() +and rvu_mbox_handler_cgx_mac_addr_set(), +the msg is expected only from PFs that are mapped to CGX LMACs. +It should be checked before mapping, +so we add the is_cgx_config_permitted() in the functions. + +Fixes: 96be2e0da85e ("octeontx2-af: Support for MAC address filters in CGX") +Signed-off-by: Yingjie Wang +Reviewed-by: Geetha sowjanya +Link: https://lore.kernel.org/r/1610719804-35230-1-git-send-email-wangyingjie55@126.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +@@ -454,6 +454,9 @@ int rvu_mbox_handler_cgx_mac_addr_set(st + int pf = rvu_get_pf(req->hdr.pcifunc); + u8 cgx_id, lmac_id; + ++ if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc)) ++ return -EPERM; ++ + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); + + cgx_lmac_addr_set(cgx_id, lmac_id, req->mac_addr); +@@ -470,6 +473,9 @@ int rvu_mbox_handler_cgx_mac_addr_get(st + int rc = 0, i; + u64 cfg; + ++ if (!is_cgx_config_permitted(rvu, req->hdr.pcifunc)) ++ return -EPERM; ++ + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id); + + rsp->hdr.rc = rc; diff --git a/queue-5.10/printk-fix-buffer-overflow-potential-for-print_text.patch b/queue-5.10/printk-fix-buffer-overflow-potential-for-print_text.patch deleted file mode 100644 index 495eafb7f82..00000000000 --- a/queue-5.10/printk-fix-buffer-overflow-potential-for-print_text.patch +++ /dev/null @@ -1,116 +0,0 @@ -From f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 Mon Sep 17 00:00:00 2001 -From: John Ogness -Date: Thu, 14 Jan 2021 18:10:12 +0106 -Subject: printk: fix buffer overflow potential for print_text() - -From: John Ogness - -commit f0e386ee0c0b71ea6f7238506a4d0965a2dbef11 upstream. - -Before the commit 896fbe20b4e2333fb55 ("printk: use the lockless -ringbuffer"), msg_print_text() would only write up to size-1 bytes -into the provided buffer. Some callers expect this behavior and -append a terminator to returned string. In particular: - -arch/powerpc/xmon/xmon.c:dump_log_buf() -arch/um/kernel/kmsg_dump.c:kmsg_dumper_stdout() - -msg_print_text() has been replaced by record_print_text(), which -currently fills the full size of the buffer. This causes a -buffer overflow for the above callers. - -Change record_print_text() so that it will only use size-1 bytes -for text data. Also, for paranoia sakes, add a terminator after -the text data. - -And finally, document this behavior so that it is clear that only -size-1 bytes are used and a terminator is added. - -Fixes: 896fbe20b4e2333fb55 ("printk: use the lockless ringbuffer") -Cc: stable@vger.kernel.org # 5.10+ -Signed-off-by: John Ogness -Reviewed-by: Petr Mladek -Acked-by: Sergey Senozhatsky -Signed-off-by: Petr Mladek -Link: https://lore.kernel.org/r/20210114170412.4819-1-john.ogness@linutronix.de -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/printk/printk.c | 36 +++++++++++++++++++++++++++--------- - 1 file changed, 27 insertions(+), 9 deletions(-) - ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -1338,11 +1338,16 @@ static size_t info_print_prefix(const st - * done: - * - * - Add prefix for each line. -+ * - Drop truncated lines that no longer fit into the buffer. - * - Add the trailing newline that has been removed in vprintk_store(). -- * - Drop truncated lines that do not longer fit into the buffer. -+ * - Add a string terminator. -+ * -+ * Since the produced string is always terminated, the maximum possible -+ * return value is @r->text_buf_size - 1; - * - * Return: The length of the updated/prepared text, including the added -- * prefixes and the newline. The dropped line(s) are not counted. -+ * prefixes and the newline. The terminator is not counted. The dropped -+ * line(s) are not counted. - */ - static size_t record_print_text(struct printk_record *r, bool syslog, - bool time) -@@ -1385,26 +1390,31 @@ static size_t record_print_text(struct p - - /* - * Truncate the text if there is not enough space to add the -- * prefix and a trailing newline. -+ * prefix and a trailing newline and a terminator. - */ -- if (len + prefix_len + text_len + 1 > buf_size) { -+ if (len + prefix_len + text_len + 1 + 1 > buf_size) { - /* Drop even the current line if no space. */ -- if (len + prefix_len + line_len + 1 > buf_size) -+ if (len + prefix_len + line_len + 1 + 1 > buf_size) - break; - -- text_len = buf_size - len - prefix_len - 1; -+ text_len = buf_size - len - prefix_len - 1 - 1; - truncated = true; - } - - memmove(text + prefix_len, text, text_len); - memcpy(text, prefix, prefix_len); - -+ /* -+ * Increment the prepared length to include the text and -+ * prefix that were just moved+copied. Also increment for the -+ * newline at the end of this line. If this is the last line, -+ * there is no newline, but it will be added immediately below. -+ */ - len += prefix_len + line_len + 1; -- - if (text_len == line_len) { - /* -- * Add the trailing newline removed in -- * vprintk_store(). -+ * This is the last line. Add the trailing newline -+ * removed in vprintk_store(). - */ - text[prefix_len + line_len] = '\n'; - break; -@@ -1429,6 +1439,14 @@ static size_t record_print_text(struct p - text_len -= line_len + 1; - } - -+ /* -+ * If a buffer was provided, it will be terminated. Space for the -+ * string terminator is guaranteed to be available. The terminator is -+ * not counted in the return value. -+ */ -+ if (buf_size > 0) -+ text[len] = 0; -+ - return len; - } - diff --git a/queue-5.10/printk-fix-kmsg_dump_get_buffer-length-calulations.patch b/queue-5.10/printk-fix-kmsg_dump_get_buffer-length-calulations.patch index 8582ab6a158..737691b7955 100644 --- a/queue-5.10/printk-fix-kmsg_dump_get_buffer-length-calulations.patch +++ b/queue-5.10/printk-fix-kmsg_dump_get_buffer-length-calulations.patch @@ -23,14 +23,12 @@ Signed-off-by: Petr Mladek Link: https://lore.kernel.org/r/20210113164413.1599-1-john.ogness@linutronix.de Signed-off-by: Sasha Levin --- - kernel/printk/printk.c | 4 ++-- + kernel/printk/printk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index 1246b3b330fd1..807810216492a 100644 --- a/kernel/printk/printk.c +++ b/kernel/printk/printk.c -@@ -3394,7 +3394,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog, +@@ -3376,7 +3376,7 @@ bool kmsg_dump_get_buffer(struct kmsg_du while (prb_read_valid_info(prb, seq, &info, &line_count)) { if (r.info->seq >= dumper->next_seq) break; @@ -39,7 +37,7 @@ index 1246b3b330fd1..807810216492a 100644 seq = r.info->seq + 1; } -@@ -3404,7 +3404,7 @@ bool kmsg_dump_get_buffer(struct kmsg_dumper *dumper, bool syslog, +@@ -3386,7 +3386,7 @@ bool kmsg_dump_get_buffer(struct kmsg_du &info, &line_count)) { if (r.info->seq >= dumper->next_seq) break; @@ -48,6 +46,3 @@ index 1246b3b330fd1..807810216492a 100644 seq = r.info->seq + 1; } --- -2.27.0 - diff --git a/queue-5.10/selftests-powerpc-fix-exit-status-of-pkey-tests.patch b/queue-5.10/selftests-powerpc-fix-exit-status-of-pkey-tests.patch new file mode 100644 index 00000000000..88eace818db --- /dev/null +++ b/queue-5.10/selftests-powerpc-fix-exit-status-of-pkey-tests.patch @@ -0,0 +1,46 @@ +From 92a5e1fdb286851d5bd0eb966b8d075be27cf5ee Mon Sep 17 00:00:00 2001 +From: Sandipan Das +Date: Mon, 18 Jan 2021 15:01:45 +0530 +Subject: selftests/powerpc: Fix exit status of pkey tests + +From: Sandipan Das + +commit 92a5e1fdb286851d5bd0eb966b8d075be27cf5ee upstream. + +Since main() does not return a value explicitly, the +return values from FAIL_IF() conditions are ignored +and the tests can still pass irrespective of failures. +This makes sure that we always explicitly return the +correct test exit status. + +Fixes: 1addb6444791 ("selftests/powerpc: Add test for execute-disabled pkeys") +Fixes: c27f2fd1705a ("selftests/powerpc: Add test for pkey siginfo verification") +Reported-by: Eirik Fuller +Signed-off-by: Sandipan Das +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210118093145.10134-1-sandipan@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/powerpc/mm/pkey_exec_prot.c | 2 +- + tools/testing/selftests/powerpc/mm/pkey_siginfo.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/powerpc/mm/pkey_exec_prot.c ++++ b/tools/testing/selftests/powerpc/mm/pkey_exec_prot.c +@@ -290,5 +290,5 @@ static int test(void) + + int main(void) + { +- test_harness(test, "pkey_exec_prot"); ++ return test_harness(test, "pkey_exec_prot"); + } +--- a/tools/testing/selftests/powerpc/mm/pkey_siginfo.c ++++ b/tools/testing/selftests/powerpc/mm/pkey_siginfo.c +@@ -329,5 +329,5 @@ static int test(void) + + int main(void) + { +- test_harness(test, "pkey_siginfo"); ++ return test_harness(test, "pkey_siginfo"); + } diff --git a/queue-5.10/series b/queue-5.10/series index 4e301542690..77b520fe05d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -11,7 +11,6 @@ alsa-hda-via-add-minimum-mute-flag.patch crypto-xor-fix-divide-error-in-do_xor_speed.patch dm-crypt-fix-copy-and-paste-bug-in-crypt_alloc_req_aead.patch acpi-scan-make-acpi_bus_get_device-clear-return-pointer-on-error.patch -printk-fix-buffer-overflow-potential-for-print_text.patch btrfs-don-t-get-an-eintr-during-drop_snapshot-for-reloc.patch btrfs-do-not-double-free-backref-nodes-on-error.patch btrfs-fix-lockdep-splat-in-btrfs_recover_relocation.patch @@ -145,3 +144,23 @@ driver-core-fix-device-link-device-name-collision.patch driver-core-extend-device_is_dependent.patch drm-i915-s-intel_dp_sink_dpms-intel_dp_set_power.patch drm-i915-only-enable-dfp-4-4-4-4-2-0-conversion-when-outputting-ycbcr-4-4-4.patch +x86-entry-fix-noinstr-fail.patch +x86-cpu-amd-set-__max_die_per_package-on-amd.patch +cls_flower-call-nla_ok-before-nla_next.patch +netfilter-rpfilter-mask-ecn-bits-before-fib-lookup.patch +tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch +tools-gpio-fix-llu-warning-in-gpio-watch.c.patch +drm-i915-hdcp-update-cp-property-in-update_pipe.patch +sh-dma-fix-kconfig-dependency-for-g2_dma.patch +sh-remove-unused-have_copy_thread_tls-macro.patch +locking-lockdep-cure-noinstr-fail.patch +asoc-sof-intel-fix-page-fault-at-probe-if-i915-init-fails.patch +octeontx2-af-fix-missing-check-bugs-in-rvu_cgx.c.patch +net-dsa-mv88e6xxx-also-read-stu-state-in-mv88e6250_g1_vtu_getnext.patch +selftests-powerpc-fix-exit-status-of-pkey-tests.patch +sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch +nvme-pci-refactor-nvme_unmap_data.patch +nvme-pci-fix-error-unwind-in-nvme_map_data.patch +cachefiles-drop-superfluous-readpages-aops-null-check.patch +lightnvm-fix-memory-leak-when-submit-fails.patch +skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch diff --git a/queue-5.10/sh-dma-fix-kconfig-dependency-for-g2_dma.patch b/queue-5.10/sh-dma-fix-kconfig-dependency-for-g2_dma.patch new file mode 100644 index 00000000000..32ff1530567 --- /dev/null +++ b/queue-5.10/sh-dma-fix-kconfig-dependency-for-g2_dma.patch @@ -0,0 +1,50 @@ +From f477a538c14d07f8c45e554c8c5208d588514e98 Mon Sep 17 00:00:00 2001 +From: Necip Fazil Yildiran +Date: Thu, 17 Sep 2020 18:45:48 +0300 +Subject: sh: dma: fix kconfig dependency for G2_DMA + +From: Necip Fazil Yildiran + +commit f477a538c14d07f8c45e554c8c5208d588514e98 upstream. + +When G2_DMA is enabled and SH_DMA is disabled, it results in the following +Kbuild warning: + +WARNING: unmet direct dependencies detected for SH_DMA_API + Depends on [n]: SH_DMA [=n] + Selected by [y]: + - G2_DMA [=y] && SH_DREAMCAST [=y] + +The reason is that G2_DMA selects SH_DMA_API without depending on or +selecting SH_DMA while SH_DMA_API depends on SH_DMA. + +When G2_DMA was first introduced with commit 40f49e7ed77f +("sh: dma: Make G2 DMA configurable."), this wasn't an issue since +SH_DMA_API didn't have such dependency, and this way was the only way to +enable it since SH_DMA_API was non-visible. However, later SH_DMA_API was +made visible and dependent on SH_DMA with commit d8902adcc1a9 +("dmaengine: sh: Add Support SuperH DMA Engine driver"). + +Let G2_DMA depend on SH_DMA_API instead to avoid Kbuild issues. + +Fixes: d8902adcc1a9 ("dmaengine: sh: Add Support SuperH DMA Engine driver") +Signed-off-by: Necip Fazil Yildiran +Signed-off-by: Rich Felker +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/drivers/dma/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/sh/drivers/dma/Kconfig ++++ b/arch/sh/drivers/dma/Kconfig +@@ -63,8 +63,7 @@ config PVR2_DMA + + config G2_DMA + tristate "G2 Bus DMA support" +- depends on SH_DREAMCAST +- select SH_DMA_API ++ depends on SH_DREAMCAST && SH_DMA_API + help + This enables support for the DMA controller for the Dreamcast's + G2 bus. Drivers that want this will generally enable this on diff --git a/queue-5.10/sh-remove-unused-have_copy_thread_tls-macro.patch b/queue-5.10/sh-remove-unused-have_copy_thread_tls-macro.patch new file mode 100644 index 00000000000..24e1b13c799 --- /dev/null +++ b/queue-5.10/sh-remove-unused-have_copy_thread_tls-macro.patch @@ -0,0 +1,28 @@ +From 19170492735be935747b0545b7eed8bb40cc1209 Mon Sep 17 00:00:00 2001 +From: Jinyang He +Date: Mon, 12 Oct 2020 11:50:24 +0800 +Subject: sh: Remove unused HAVE_COPY_THREAD_TLS macro + +From: Jinyang He + +commit 19170492735be935747b0545b7eed8bb40cc1209 upstream. + +Fixes: e1cc9d8d596e ("sh: switch to copy_thread_tls()") +Signed-off-by: Jinyang He +Signed-off-by: Rich Felker +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sh/Kconfig | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/sh/Kconfig ++++ b/arch/sh/Kconfig +@@ -30,7 +30,6 @@ config SUPERH + select HAVE_ARCH_KGDB + select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_TRACEHOOK +- select HAVE_COPY_THREAD_TLS + select HAVE_DEBUG_BUGVERBOSE + select HAVE_DEBUG_KMEMLEAK + select HAVE_DYNAMIC_FTRACE diff --git a/queue-5.10/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch b/queue-5.10/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch new file mode 100644 index 00000000000..9b4c10f4002 --- /dev/null +++ b/queue-5.10/sh_eth-fix-power-down-vs.-is_opened-flag-ordering.patch @@ -0,0 +1,46 @@ +From f6a2e94b3f9d89cb40771ff746b16b5687650cbb Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 18 Jan 2021 16:08:12 +0100 +Subject: sh_eth: Fix power down vs. is_opened flag ordering +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +commit f6a2e94b3f9d89cb40771ff746b16b5687650cbb upstream. + +sh_eth_close() does a synchronous power down of the device before +marking it closed. Revert the order, to make sure the device is never +marked opened while suspended. + +While at it, use pm_runtime_put() instead of pm_runtime_put_sync(), as +there is no reason to do a synchronous power down. + +Fixes: 7fa2955ff70ce453 ("sh_eth: Fix sleeping function called from invalid context") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Sergei Shtylyov +Reviewed-by: Niklas Söderlund +Link: https://lore.kernel.org/r/20210118150812.796791-1-geert+renesas@glider.be +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/renesas/sh_eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -2606,10 +2606,10 @@ static int sh_eth_close(struct net_devic + /* Free all the skbuffs in the Rx queue and the DMA buffer. */ + sh_eth_ring_free(ndev); + +- pm_runtime_put_sync(&mdp->pdev->dev); +- + mdp->is_opened = 0; + ++ pm_runtime_put(&mdp->pdev->dev); ++ + return 0; + } + diff --git a/queue-5.10/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch b/queue-5.10/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch new file mode 100644 index 00000000000..ad6e42be1fd --- /dev/null +++ b/queue-5.10/skbuff-back-tiny-skbs-with-kmalloc-in-__netdev_alloc_skb-too.patch @@ -0,0 +1,51 @@ +From 66c556025d687dbdd0f748c5e1df89c977b6c02a Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin +Date: Fri, 15 Jan 2021 15:04:40 +0000 +Subject: skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too + +From: Alexander Lobakin + +commit 66c556025d687dbdd0f748c5e1df89c977b6c02a upstream. + +Commit 3226b158e67c ("net: avoid 32 x truesize under-estimation for +tiny skbs") ensured that skbs with data size lower than 1025 bytes +will be kmalloc'ed to avoid excessive page cache fragmentation and +memory consumption. +However, the fix adressed only __napi_alloc_skb() (primarily for +virtio_net and napi_get_frags()), but the issue can still be achieved +through __netdev_alloc_skb(), which is still used by several drivers. +Drivers often allocate a tiny skb for headers and place the rest of +the frame to frags (so-called copybreak). +Mirror the condition to __netdev_alloc_skb() to handle this case too. + +Since v1 [0]: + - fix "Fixes:" tag; + - refine commit message (mention copybreak usecase). + +[0] https://lore.kernel.org/netdev/20210114235423.232737-1-alobakin@pm.me + +Fixes: a1c7fff7e18f ("net: netdev_alloc_skb() use build_skb()") +Signed-off-by: Alexander Lobakin +Link: https://lore.kernel.org/r/20210115150354.85967-1-alobakin@pm.me +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skbuff.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -432,7 +432,11 @@ struct sk_buff *__netdev_alloc_skb(struc + + len += NET_SKB_PAD; + +- if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) || ++ /* If requested length is either too small or too big, ++ * we use kmalloc() for skb->head allocation. ++ */ ++ if (len <= SKB_WITH_OVERHEAD(1024) || ++ len > SKB_WITH_OVERHEAD(PAGE_SIZE) || + (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) { + skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE); + if (!skb) diff --git a/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch b/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch new file mode 100644 index 00000000000..16150bdd93a --- /dev/null +++ b/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-event-mon.c.patch @@ -0,0 +1,50 @@ +From 2fe7c2f99440d52613e1cf845c96e8e463c28111 Mon Sep 17 00:00:00 2001 +From: Kent Gibson +Date: Thu, 7 Jan 2021 12:00:19 +0800 +Subject: tools: gpio: fix %llu warning in gpio-event-mon.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kent Gibson + +commit 2fe7c2f99440d52613e1cf845c96e8e463c28111 upstream. + +Some platforms, such as mips64, don't map __u64 to long long unsigned +int so using %llu produces a warning: + +gpio-event-mon.c:110:37: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 3 has type ‘__u64’ {aka ‘long unsigned int’} [-Wformat=] + 110 | fprintf(stdout, "GPIO EVENT at %llu on line %d (%d|%d) ", + | ~~~^ + | | + | long long unsigned int + | %lu + 111 | event.timestamp_ns, event.offset, event.line_seqno, + | ~~~~~~~~~~~~~~~~~~ + | | + | __u64 {aka long unsigned int} + +Replace the %llu with PRIu64 and cast the argument to uint64_t. + +Fixes: 03fd11b03362 ("tools/gpio/gpio-event-mon: fix warning") +Signed-off-by: Kent Gibson +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + tools/gpio/gpio-event-mon.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/gpio/gpio-event-mon.c ++++ b/tools/gpio/gpio-event-mon.c +@@ -107,8 +107,8 @@ int monitor_device(const char *device_na + ret = -EIO; + break; + } +- fprintf(stdout, "GPIO EVENT at %llu on line %d (%d|%d) ", +- event.timestamp_ns, event.offset, event.line_seqno, ++ fprintf(stdout, "GPIO EVENT at %" PRIu64 " on line %d (%d|%d) ", ++ (uint64_t)event.timestamp_ns, event.offset, event.line_seqno, + event.seqno); + switch (event.id) { + case GPIO_V2_LINE_EVENT_RISING_EDGE: diff --git a/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-watch.c.patch b/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-watch.c.patch new file mode 100644 index 00000000000..2cf2ffd32a6 --- /dev/null +++ b/queue-5.10/tools-gpio-fix-llu-warning-in-gpio-watch.c.patch @@ -0,0 +1,59 @@ +From 1fc7c1ef37f86f207b4db40aba57084bb2f6a69a Mon Sep 17 00:00:00 2001 +From: Kent Gibson +Date: Thu, 7 Jan 2021 12:00:20 +0800 +Subject: tools: gpio: fix %llu warning in gpio-watch.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kent Gibson + +commit 1fc7c1ef37f86f207b4db40aba57084bb2f6a69a upstream. + +Some platforms, such as mips64, don't map __u64 to long long unsigned +int so using %llu produces a warning: + +gpio-watch.c: In function ‘main’: +gpio-watch.c:89:30: warning: format ‘%llu’ expects argument of type ‘long long unsigned int’, but argument 4 has type ‘__u64’ {aka ‘long unsigned int’} [-Wformat=] + 89 | printf("line %u: %s at %llu\n", + | ~~~^ + | | + | long long unsigned int + | %lu + 90 | chg.info.offset, event, chg.timestamp_ns); + | ~~~~~~~~~~~~~~~~ + | | + | __u64 {aka long unsigned int} + +Replace the %llu with PRIu64 and cast the argument to uint64_t. + +Fixes: 33f0c47b8fb4 ("tools: gpio: implement gpio-watch") +Signed-off-by: Kent Gibson +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + tools/gpio/gpio-watch.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/tools/gpio/gpio-watch.c ++++ b/tools/gpio/gpio-watch.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -86,8 +87,8 @@ int main(int argc, char **argv) + return EXIT_FAILURE; + } + +- printf("line %u: %s at %llu\n", +- chg.info.offset, event, chg.timestamp_ns); ++ printf("line %u: %s at %" PRIu64 "\n", ++ chg.info.offset, event, (uint64_t)chg.timestamp_ns); + } + } + diff --git a/queue-5.10/x86-cpu-amd-set-__max_die_per_package-on-amd.patch b/queue-5.10/x86-cpu-amd-set-__max_die_per_package-on-amd.patch new file mode 100644 index 00000000000..d708e61e99e --- /dev/null +++ b/queue-5.10/x86-cpu-amd-set-__max_die_per_package-on-amd.patch @@ -0,0 +1,49 @@ +From 76e2fc63ca40977af893b724b00cc2f8e9ce47a4 Mon Sep 17 00:00:00 2001 +From: Yazen Ghannam +Date: Mon, 11 Jan 2021 11:04:29 +0100 +Subject: x86/cpu/amd: Set __max_die_per_package on AMD + +From: Yazen Ghannam + +commit 76e2fc63ca40977af893b724b00cc2f8e9ce47a4 upstream. + +Set the maximum DIE per package variable on AMD using the +NodesPerProcessor topology value. This will be used by RAPL, among +others, to determine the maximum number of DIEs on the system in order +to do per-DIE manipulations. + + [ bp: Productize into a proper patch. ] + +Fixes: 028c221ed190 ("x86/CPU/AMD: Save AMD NodeId as cpu_die_id") +Reported-by: Johnathan Smithinovic +Reported-by: Rafael Kitover +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Tested-by: Johnathan Smithinovic +Tested-by: Rafael Kitover +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210939 +Link: https://lkml.kernel.org/r/20210106112106.GE5729@zn.tnic +Link: https://lkml.kernel.org/r/20210111101455.1194-1-bp@alien8.de +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/amd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -569,12 +569,12 @@ static void bsp_init_amd(struct cpuinfo_ + u32 ecx; + + ecx = cpuid_ecx(0x8000001e); +- nodes_per_socket = ((ecx >> 8) & 7) + 1; ++ __max_die_per_package = nodes_per_socket = ((ecx >> 8) & 7) + 1; + } else if (boot_cpu_has(X86_FEATURE_NODEID_MSR)) { + u64 value; + + rdmsrl(MSR_FAM10H_NODE_ID, value); +- nodes_per_socket = ((value >> 3) & 7) + 1; ++ __max_die_per_package = nodes_per_socket = ((value >> 3) & 7) + 1; + } + + if (!boot_cpu_has(X86_FEATURE_AMD_SSBD) && diff --git a/queue-5.10/x86-entry-fix-noinstr-fail.patch b/queue-5.10/x86-entry-fix-noinstr-fail.patch new file mode 100644 index 00000000000..f5f0366078f --- /dev/null +++ b/queue-5.10/x86-entry-fix-noinstr-fail.patch @@ -0,0 +1,70 @@ +From 9caa7ff509add50959a793b811cc7c9339e281cd Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Wed, 6 Jan 2021 15:36:20 +0100 +Subject: x86/entry: Fix noinstr fail + +From: Peter Zijlstra + +commit 9caa7ff509add50959a793b811cc7c9339e281cd upstream. + + vmlinux.o: warning: objtool: __do_fast_syscall_32()+0x47: call to syscall_enter_from_user_mode_work() leaves .noinstr.text section + +Fixes: 4facb95b7ada ("x86/entry: Unbreak 32bit fast syscall") +Reported-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20210106144017.472696632@infradead.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/entry/common.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/x86/entry/common.c ++++ b/arch/x86/entry/common.c +@@ -73,10 +73,8 @@ static __always_inline void do_syscall_3 + unsigned int nr) + { + if (likely(nr < IA32_NR_syscalls)) { +- instrumentation_begin(); + nr = array_index_nospec(nr, IA32_NR_syscalls); + regs->ax = ia32_sys_call_table[nr](regs); +- instrumentation_end(); + } + } + +@@ -91,8 +89,11 @@ __visible noinstr void do_int80_syscall_ + * or may not be necessary, but it matches the old asm behavior. + */ + nr = (unsigned int)syscall_enter_from_user_mode(regs, nr); ++ instrumentation_begin(); + + do_syscall_32_irqs_on(regs, nr); ++ ++ instrumentation_end(); + syscall_exit_to_user_mode(regs); + } + +@@ -121,11 +122,12 @@ static noinstr bool __do_fast_syscall_32 + res = get_user(*(u32 *)®s->bp, + (u32 __user __force *)(unsigned long)(u32)regs->sp); + } +- instrumentation_end(); + + if (res) { + /* User code screwed up. */ + regs->ax = -EFAULT; ++ ++ instrumentation_end(); + syscall_exit_to_user_mode(regs); + return false; + } +@@ -135,6 +137,8 @@ static noinstr bool __do_fast_syscall_32 + + /* Now this is just like a normal syscall. */ + do_syscall_32_irqs_on(regs, nr); ++ ++ instrumentation_end(); + syscall_exit_to_user_mode(regs); + return true; + }