From: Sasha Levin Date: Thu, 25 Mar 2021 20:14:41 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.11.11~76 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7cef19254b9c532db7cade1bc605749c451df33b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-hda-ignore-invalid-nhlt-table.patch b/queue-5.10/alsa-hda-ignore-invalid-nhlt-table.patch new file mode 100644 index 00000000000..b92c40ad71b --- /dev/null +++ b/queue-5.10/alsa-hda-ignore-invalid-nhlt-table.patch @@ -0,0 +1,50 @@ +From 08abe42305c708c2a16853b1fc78e6499f5af82a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 09:10:03 -0500 +Subject: ALSA: hda: ignore invalid NHLT table + +From: Mark Pearson + +[ Upstream commit a14a6219996ee6f6e858d83b11affc7907633687 ] + +On some Lenovo systems if the microphone is disabled in the BIOS +only the NHLT table header is created, with no data. This means +the endpoints field is not correctly set to zero - leading to an +unintialised variable and hence invalid descriptors are parsed +leading to page faults. + +The Lenovo firmware team is addressing this, but adding a check +preventing invalid tables being parsed is worthwhile. + +Tested on a Lenovo T14. + +Tested-by: Philipp Leskovitz +Reported-by: Philipp Leskovitz +Signed-off-by: Mark Pearson +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210302141003.7342-1-markpearson@lenovo.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/intel-nhlt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/hda/intel-nhlt.c b/sound/hda/intel-nhlt.c +index d053beccfaec..e2237239d922 100644 +--- a/sound/hda/intel-nhlt.c ++++ b/sound/hda/intel-nhlt.c +@@ -39,6 +39,11 @@ int intel_nhlt_get_dmic_geo(struct device *dev, struct nhlt_acpi_table *nhlt) + if (!nhlt) + return 0; + ++ if (nhlt->header.length <= sizeof(struct acpi_table_header)) { ++ dev_warn(dev, "Invalid DMIC description table\n"); ++ return 0; ++ } ++ + for (j = 0, epnt = nhlt->desc; j < nhlt->endpoint_count; j++, + epnt = (struct nhlt_endpoint *)((u8 *)epnt + epnt->length)) { + +-- +2.30.1 + diff --git a/queue-5.10/atm-eni-dont-release-is-never-initialized.patch b/queue-5.10/atm-eni-dont-release-is-never-initialized.patch new file mode 100644 index 00000000000..12510c27829 --- /dev/null +++ b/queue-5.10/atm-eni-dont-release-is-never-initialized.patch @@ -0,0 +1,106 @@ +From 102f961daa2bda8be28e3342c3dc25741c9e098f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Feb 2021 16:15:06 -0500 +Subject: atm: eni: dont release is never initialized + +From: Tong Zhang + +[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ] + +label err_eni_release is reachable when eni_start() fail. +In eni_start() it calls dev->phy->start() in the last step, if start() +fail we don't need to call phy->stop(), if start() is never called, we +neither need to call phy->stop(), otherwise null-ptr-deref will happen. + +In order to fix this issue, don't call phy->stop() in label err_eni_release + +[ 4.875714] ================================================================== +[ 4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni] +[ 4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95 +[ 4.876778] +[ 4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2 +[ 4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94 +[ 4.877876] Call Trace: +[ 4.878009] dump_stack+0x7d/0xa3 +[ 4.878191] kasan_report.cold+0x10c/0x10e +[ 4.878410] ? __slab_free+0x2f0/0x340 +[ 4.878612] ? suni_stop+0x47/0x100 [suni] +[ 4.878832] suni_stop+0x47/0x100 [suni] +[ 4.879043] eni_do_release+0x3b/0x70 [eni] +[ 4.879269] eni_init_one.cold+0x1152/0x1747 [eni] +[ 4.879528] ? _raw_spin_lock_irqsave+0x7b/0xd0 +[ 4.879768] ? eni_ioctl+0x270/0x270 [eni] +[ 4.879990] ? __mutex_lock_slowpath+0x10/0x10 +[ 4.880226] ? eni_ioctl+0x270/0x270 [eni] +[ 4.880448] local_pci_probe+0x6f/0xb0 +[ 4.880650] pci_device_probe+0x171/0x240 +[ 4.880864] ? pci_device_remove+0xe0/0xe0 +[ 4.881086] ? kernfs_create_link+0xb6/0x110 +[ 4.881315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 +[ 4.881594] really_probe+0x161/0x420 +[ 4.881791] driver_probe_device+0x6d/0xd0 +[ 4.882010] device_driver_attach+0x82/0x90 +[ 4.882233] ? device_driver_attach+0x90/0x90 +[ 4.882465] __driver_attach+0x60/0x100 +[ 4.882671] ? device_driver_attach+0x90/0x90 +[ 4.882903] bus_for_each_dev+0xe1/0x140 +[ 4.883114] ? subsys_dev_iter_exit+0x10/0x10 +[ 4.883346] ? klist_node_init+0x61/0x80 +[ 4.883557] bus_add_driver+0x254/0x2a0 +[ 4.883764] driver_register+0xd3/0x150 +[ 4.883971] ? 0xffffffffc0038000 +[ 4.884149] do_one_initcall+0x84/0x250 +[ 4.884355] ? trace_event_raw_event_initcall_finish+0x150/0x150 +[ 4.884674] ? unpoison_range+0xf/0x30 +[ 4.884875] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 4.885150] ? unpoison_range+0xf/0x30 +[ 4.885352] ? unpoison_range+0xf/0x30 +[ 4.885557] do_init_module+0xf8/0x350 +[ 4.885760] load_module+0x3fe6/0x4340 +[ 4.885960] ? vm_unmap_ram+0x1d0/0x1d0 +[ 4.886166] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 4.886441] ? module_frob_arch_sections+0x20/0x20 +[ 4.886697] ? __do_sys_finit_module+0x108/0x170 +[ 4.886941] __do_sys_finit_module+0x108/0x170 +[ 4.887178] ? __ia32_sys_init_module+0x40/0x40 +[ 4.887419] ? file_open_root+0x200/0x200 +[ 4.887634] ? do_sys_open+0x85/0xe0 +[ 4.887826] ? filp_open+0x50/0x50 +[ 4.888009] ? fpregs_assert_state_consistent+0x4d/0x60 +[ 4.888287] ? exit_to_user_mode_prepare+0x2f/0x130 +[ 4.888547] do_syscall_64+0x33/0x40 +[ 4.888739] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 4.889010] RIP: 0033:0x7ff62fcf1cf7 +[ 4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71 +[ 4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7 +[ 4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003 +[ 4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 +[ 4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0 +[ 4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001 +[ 4.892439] ================================================================== + +Signed-off-by: Tong Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/eni.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c +index 316a9947541f..b574cce98dc3 100644 +--- a/drivers/atm/eni.c ++++ b/drivers/atm/eni.c +@@ -2260,7 +2260,8 @@ static int eni_init_one(struct pci_dev *pci_dev, + return rc; + + err_eni_release: +- eni_do_release(dev); ++ dev->phy = NULL; ++ iounmap(ENI_DEV(dev)->ioaddr); + err_unregister: + atm_dev_deregister(dev); + err_free_consistent: +-- +2.30.1 + diff --git a/queue-5.10/atm-idt77252-fix-null-ptr-dereference.patch b/queue-5.10/atm-idt77252-fix-null-ptr-dereference.patch new file mode 100644 index 00000000000..048d07a9afa --- /dev/null +++ b/queue-5.10/atm-idt77252-fix-null-ptr-dereference.patch @@ -0,0 +1,48 @@ +From 83d044ccbc1a46708e2fca9bca21b3da096cc192 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 22:25:30 -0500 +Subject: atm: idt77252: fix null-ptr-dereference + +From: Tong Zhang + +[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ] + +this one is similar to the phy_data allocation fix in uPD98402, the +driver allocate the idt77105_priv and store to dev_data but later +dereference using dev->dev_data, which will cause null-ptr-dereference. + +fix this issue by changing dev_data to phy_data so that PRIV(dev) can +work correctly. + +Signed-off-by: Tong Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/idt77105.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c +index 3c081b6171a8..bfca7b8a6f31 100644 +--- a/drivers/atm/idt77105.c ++++ b/drivers/atm/idt77105.c +@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev) + { + unsigned long flags; + +- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) ++ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL))) + return -ENOMEM; + PRIV(dev)->dev = dev; + spin_lock_irqsave(&idt77105_priv_lock, flags); +@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev) + else + idt77105_all = walk->next; + dev->phy = NULL; +- dev->dev_data = NULL; ++ dev->phy_data = NULL; + kfree(walk); + break; + } +-- +2.30.1 + diff --git a/queue-5.10/atm-lanai-dont-run-lanai_dev_close-if-not-open.patch b/queue-5.10/atm-lanai-dont-run-lanai_dev_close-if-not-open.patch new file mode 100644 index 00000000000..41620d7ab15 --- /dev/null +++ b/queue-5.10/atm-lanai-dont-run-lanai_dev_close-if-not-open.patch @@ -0,0 +1,147 @@ +From 6058078b0ce38dcc64401b2ca32d579148a5af0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Feb 2021 22:55:50 -0500 +Subject: atm: lanai: dont run lanai_dev_close if not open + +From: Tong Zhang + +[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ] + +lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the +pci device is disabled. The caller, lanai_init_one(), then tries to run +atm_dev_deregister(). This will subsequently call lanai_dev_close() and +use the already released MMIO area. + +To fix this issue, set the lanai->base to NULL if open fail, +and test the flag in lanai_dev_close(). + +[ 8.324153] lanai: lanai_start() failed, err=19 +[ 8.324819] lanai(itf 0): shutting down interface +[ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024 +[ 8.325781] #PF: supervisor write access in kernel mode +[ 8.326215] #PF: error_code(0x0002) - not-present page +[ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0 +[ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI +[ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12 +[ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 +[ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] +[ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 +[ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 +[ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a +[ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 +[ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa +[ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 +[ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 +[ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 +[ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 +[ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 8.334932] Call Trace: +[ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm] +[ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai] +[ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai] +[ 8.335831] local_pci_probe+0x6f/0xb0 +[ 8.336039] pci_device_probe+0x171/0x240 +[ 8.336255] ? pci_device_remove+0xe0/0xe0 +[ 8.336475] ? kernfs_create_link+0xb6/0x110 +[ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 +[ 8.336983] really_probe+0x161/0x420 +[ 8.337181] driver_probe_device+0x6d/0xd0 +[ 8.337401] device_driver_attach+0x82/0x90 +[ 8.337626] ? device_driver_attach+0x90/0x90 +[ 8.337859] __driver_attach+0x60/0x100 +[ 8.338065] ? device_driver_attach+0x90/0x90 +[ 8.338298] bus_for_each_dev+0xe1/0x140 +[ 8.338511] ? subsys_dev_iter_exit+0x10/0x10 +[ 8.338745] ? klist_node_init+0x61/0x80 +[ 8.338956] bus_add_driver+0x254/0x2a0 +[ 8.339164] driver_register+0xd3/0x150 +[ 8.339370] ? 0xffffffffc0028000 +[ 8.339550] do_one_initcall+0x84/0x250 +[ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150 +[ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0 +[ 8.340329] ? unpoison_range+0xf/0x30 +[ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 8.340806] ? unpoison_range+0xf/0x30 +[ 8.341014] ? unpoison_range+0xf/0x30 +[ 8.341217] do_init_module+0xf8/0x350 +[ 8.341419] load_module+0x3fe6/0x4340 +[ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0 +[ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 +[ 8.342101] ? module_frob_arch_sections+0x20/0x20 +[ 8.342358] ? __do_sys_finit_module+0x108/0x170 +[ 8.342604] __do_sys_finit_module+0x108/0x170 +[ 8.342841] ? __ia32_sys_init_module+0x40/0x40 +[ 8.343083] ? file_open_root+0x200/0x200 +[ 8.343298] ? do_sys_open+0x85/0xe0 +[ 8.343491] ? filp_open+0x50/0x50 +[ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130 +[ 8.343935] do_syscall_64+0x33/0x40 +[ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 8.344401] RIP: 0033:0x7f08eb887cf7 +[ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 +[ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +[ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7 +[ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003 +[ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 +[ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0 +[ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001 +[ 8.347836] Modules linked in: lanai(+) atm +[ 8.348065] CR2: ffffc90000180024 +[ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]--- +[ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] +[ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 +[ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 +[ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a +[ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 +[ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa +[ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 +[ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 +[ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 +[ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 +[ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left + +Signed-off-by: Tong Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/lanai.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/atm/lanai.c b/drivers/atm/lanai.c +index ac811cfa6843..92edd100a394 100644 +--- a/drivers/atm/lanai.c ++++ b/drivers/atm/lanai.c +@@ -2234,6 +2234,7 @@ static int lanai_dev_open(struct atm_dev *atmdev) + conf1_write(lanai); + #endif + iounmap(lanai->base); ++ lanai->base = NULL; + error_pci: + pci_disable_device(lanai->pci); + error: +@@ -2246,6 +2247,8 @@ static int lanai_dev_open(struct atm_dev *atmdev) + static void lanai_dev_close(struct atm_dev *atmdev) + { + struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; ++ if (lanai->base==NULL) ++ return; + printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", + lanai->number); + lanai_timed_poll_stop(lanai); +@@ -2553,7 +2556,7 @@ static int lanai_init_one(struct pci_dev *pci, + struct atm_dev *atmdev; + int result; + +- lanai = kmalloc(sizeof(*lanai), GFP_KERNEL); ++ lanai = kzalloc(sizeof(*lanai), GFP_KERNEL); + if (lanai == NULL) { + printk(KERN_ERR DEV_LABEL + ": couldn't allocate dev_data structure!\n"); +-- +2.30.1 + diff --git a/queue-5.10/atm-upd98402-fix-incorrect-allocation.patch b/queue-5.10/atm-upd98402-fix-incorrect-allocation.patch new file mode 100644 index 00000000000..3555b8b2703 --- /dev/null +++ b/queue-5.10/atm-upd98402-fix-incorrect-allocation.patch @@ -0,0 +1,39 @@ +From f79dc3706b56cc9e615730f3cc5cde4f3f288ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 22:25:29 -0500 +Subject: atm: uPD98402: fix incorrect allocation + +From: Tong Zhang + +[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ] + +dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this +dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock +(i.e dev->phy_data->lock) will result in a null-ptr-dereference. + +I believe this is a typo and what it actually want to do is to allocate +phy_data instead of dev_data. + +Signed-off-by: Tong Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/uPD98402.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c +index 7850758b5bb8..239852d85558 100644 +--- a/drivers/atm/uPD98402.c ++++ b/drivers/atm/uPD98402.c +@@ -211,7 +211,7 @@ static void uPD98402_int(struct atm_dev *dev) + static int uPD98402_start(struct atm_dev *dev) + { + DPRINTK("phy_start\n"); +- if (!(dev->dev_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) ++ if (!(dev->phy_data = kmalloc(sizeof(struct uPD98402_priv),GFP_KERNEL))) + return -ENOMEM; + spin_lock_init(&PRIV(dev)->lock); + memset(&PRIV(dev)->sonet_stats,0,sizeof(struct k_sonet_stats)); +-- +2.30.1 + diff --git a/queue-5.10/blk-cgroup-fix-the-recursive-blkg-rwstat.patch b/queue-5.10/blk-cgroup-fix-the-recursive-blkg-rwstat.patch new file mode 100644 index 00000000000..e2a52d79622 --- /dev/null +++ b/queue-5.10/blk-cgroup-fix-the-recursive-blkg-rwstat.patch @@ -0,0 +1,60 @@ +From a463261f7d445ad5b7eecc1b069416d02f429b6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Mar 2021 16:13:27 +0800 +Subject: blk-cgroup: Fix the recursive blkg rwstat + +From: Xunlei Pang + +[ Upstream commit 4f44657d74873735e93a50eb25014721a66aac19 ] + +The current blkio.throttle.io_service_bytes_recursive doesn't +work correctly. + +As an example, for the following blkcg hierarchy: + (Made 1GB READ in test1, 512MB READ in test2) + test + / \ + test1 test2 + +$ head -n 1 test/test1/blkio.throttle.io_service_bytes_recursive +8:0 Read 1073684480 +$ head -n 1 test/test2/blkio.throttle.io_service_bytes_recursive +8:0 Read 537448448 +$ head -n 1 test/blkio.throttle.io_service_bytes_recursive +8:0 Read 537448448 + +Clearly, above data of "test" reflects "test2" not "test1"+"test2". + +Do the correct summary in blkg_rwstat_recursive_sum(). + +Signed-off-by: Xunlei Pang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup-rwstat.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-cgroup-rwstat.c b/block/blk-cgroup-rwstat.c +index 85d5790ac49b..3304e841df7c 100644 +--- a/block/blk-cgroup-rwstat.c ++++ b/block/blk-cgroup-rwstat.c +@@ -109,6 +109,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, + + lockdep_assert_held(&blkg->q->queue_lock); + ++ memset(sum, 0, sizeof(*sum)); + rcu_read_lock(); + blkg_for_each_descendant_pre(pos_blkg, pos_css, blkg) { + struct blkg_rwstat *rwstat; +@@ -122,7 +123,7 @@ void blkg_rwstat_recursive_sum(struct blkcg_gq *blkg, struct blkcg_policy *pol, + rwstat = (void *)pos_blkg + off; + + for (i = 0; i < BLKG_RWSTAT_NR; i++) +- sum->cnt[i] = blkg_rwstat_read_counter(rwstat, i); ++ sum->cnt[i] += blkg_rwstat_read_counter(rwstat, i); + } + rcu_read_unlock(); + } +-- +2.30.1 + diff --git a/queue-5.10/block-fix-req_op_zone_reset_all-handling.patch b/queue-5.10/block-fix-req_op_zone_reset_all-handling.patch new file mode 100644 index 00000000000..08dcd555d12 --- /dev/null +++ b/queue-5.10/block-fix-req_op_zone_reset_all-handling.patch @@ -0,0 +1,35 @@ +From e7315d51938ececfb401b04b31e561df892eb829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 18:09:19 +0900 +Subject: block: Fix REQ_OP_ZONE_RESET_ALL handling + +From: Damien Le Moal + +[ Upstream commit faa44c69daf9ccbd5b8a1aee13e0e0d037c0be17 ] + +Similarly to a single zone reset operation (REQ_OP_ZONE_RESET), execute +REQ_OP_ZONE_RESET_ALL operations with REQ_SYNC set. + +Signed-off-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-zoned.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index 4676c6f00489..ab7d7ebcf6dd 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -240,7 +240,7 @@ int blkdev_zone_mgmt(struct block_device *bdev, enum req_opf op, + */ + if (op == REQ_OP_ZONE_RESET && + blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) { +- bio->bi_opf = REQ_OP_ZONE_RESET_ALL; ++ bio->bi_opf = REQ_OP_ZONE_RESET_ALL | REQ_SYNC; + break; + } + +-- +2.30.1 + diff --git a/queue-5.10/block-suppress-uevent-for-hidden-device-when-removed.patch b/queue-5.10/block-suppress-uevent-for-hidden-device-when-removed.patch new file mode 100644 index 00000000000..2b196ee464e --- /dev/null +++ b/queue-5.10/block-suppress-uevent-for-hidden-device-when-removed.patch @@ -0,0 +1,50 @@ +From 34e080167c2ba7402ec6e200502b4a7515403294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 16:19:17 +0100 +Subject: block: Suppress uevent for hidden device when removed + +From: Daniel Wagner + +[ Upstream commit 9ec491447b90ad6a4056a9656b13f0b3a1e83043 ] + +register_disk() suppress uevents for devices with the GENHD_FL_HIDDEN +but enables uevents at the end again in order to announce disk after +possible partitions are created. + +When the device is removed the uevents are still on and user land sees +'remove' messages for devices which were never 'add'ed to the system. + + KERNEL[95481.571887] remove /devices/virtual/nvme-fabrics/ctl/nvme5/nvme0c5n1 (block) + +Let's suppress the uevents for GENHD_FL_HIDDEN by not enabling the +uevents at all. + +Signed-off-by: Daniel Wagner +Reviewed-by: Christoph Hellwig +Reviewed-by: Martin Wilck +Link: https://lore.kernel.org/r/20210311151917.136091-1-dwagner@suse.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/genhd.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/block/genhd.c b/block/genhd.c +index ec6264e2ed67..796baf761202 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -732,10 +732,8 @@ static void register_disk(struct device *parent, struct gendisk *disk, + disk->part0.holder_dir = kobject_create_and_add("holders", &ddev->kobj); + disk->slave_dir = kobject_create_and_add("slaves", &ddev->kobj); + +- if (disk->flags & GENHD_FL_HIDDEN) { +- dev_set_uevent_suppress(ddev, 0); ++ if (disk->flags & GENHD_FL_HIDDEN) + return; +- } + + disk_scan_partitions(disk); + +-- +2.30.1 + diff --git a/queue-5.10/cifs-ask-for-more-credit-on-async-read-write-code-pa.patch b/queue-5.10/cifs-ask-for-more-credit-on-async-read-write-code-pa.patch new file mode 100644 index 00000000000..1ef28fde137 --- /dev/null +++ b/queue-5.10/cifs-ask-for-more-credit-on-async-read-write-code-pa.patch @@ -0,0 +1,54 @@ +From aae4b1101c647d1e3f4d8f415b370cc47efad26a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 17:51:48 +0000 +Subject: cifs: ask for more credit on async read/write code paths + +From: Aurelien Aptel + +[ Upstream commit 88fd98a2306755b965e4f4567f84e73db3b6738c ] + +When doing a large read or write workload we only +very gradually increase the number of credits +which can cause problems with parallelizing large i/o +(I/O ramps up more slowly than it should for large +read/write workloads) especially with multichannel +when the number of credits on the secondary channels +starts out low (e.g. less than about 130) or when +recovering after server throttled back the number +of credit. + +Signed-off-by: Aurelien Aptel +Reviewed-by: Shyam Prasad N +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c6f8bc6729aa..d1d550647cd6 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -4032,8 +4032,7 @@ smb2_async_readv(struct cifs_readdata *rdata) + if (rdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(rdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = +- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); ++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + + rc = adjust_credits(server, &rdata->credits, rdata->bytes); + if (rc) +@@ -4339,8 +4338,7 @@ smb2_async_writev(struct cifs_writedata *wdata, + if (wdata->credits.value > 0) { + shdr->CreditCharge = cpu_to_le16(DIV_ROUND_UP(wdata->bytes, + SMB2_MAX_BUFFER_SIZE)); +- shdr->CreditRequest = +- cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 1); ++ shdr->CreditRequest = cpu_to_le16(le16_to_cpu(shdr->CreditCharge) + 8); + + rc = adjust_credits(server, &wdata->credits, wdata->bytes); + if (rc) +-- +2.30.1 + diff --git a/queue-5.10/cifs-change-noisy-error-message-to-fyi.patch b/queue-5.10/cifs-change-noisy-error-message-to-fyi.patch new file mode 100644 index 00000000000..61c003bd37a --- /dev/null +++ b/queue-5.10/cifs-change-noisy-error-message-to-fyi.patch @@ -0,0 +1,47 @@ +From e10172d740bd1685c29e6a630c1ccebe9d5a841f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 12:00:48 -0300 +Subject: cifs: change noisy error message to FYI + +From: Paulo Alcantara + +[ Upstream commit e3d100eae44b42f309c1366efb8397368f1cf8ed ] + +A customer has reported that their dmesg were being flooded by + + CIFS: VFS: \\server Cancelling wait for mid xxx cmd: a + CIFS: VFS: \\server Cancelling wait for mid yyy cmd: b + CIFS: VFS: \\server Cancelling wait for mid zzz cmd: c + +because some processes that were performing statfs(2) on the share had +been interrupted due to their automount setup when certain users +logged in and out. + +Change it to FYI as they should be mostly informative rather than +error messages. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Aurelien Aptel +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/transport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 7b45b3b79df5..503a0056b60f 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -1170,7 +1170,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, + } + if (rc != 0) { + for (; i < num_rqst; i++) { +- cifs_server_dbg(VFS, "Cancelling wait for mid %llu cmd: %d\n", ++ cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", + midQ[i]->mid, le16_to_cpu(midQ[i]->command)); + send_cancel(server, &rqst[i], midQ[i]); + spin_lock(&GlobalMid_Lock); +-- +2.30.1 + diff --git a/queue-5.10/cpufreq-blacklist-arm-vexpress-platforms-in-cpufreq-.patch b/queue-5.10/cpufreq-blacklist-arm-vexpress-platforms-in-cpufreq-.patch new file mode 100644 index 00000000000..9170d8c867b --- /dev/null +++ b/queue-5.10/cpufreq-blacklist-arm-vexpress-platforms-in-cpufreq-.patch @@ -0,0 +1,36 @@ +From d11e9f09321da5dc292b14a0e60896e4109f3059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 22:23:26 +0000 +Subject: cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev + +From: Sudeep Holla + +[ Upstream commit fbb31cb805fd3574d3be7defc06a7fd2fd9af7d2 ] + +Add "arm,vexpress" to cpufreq-dt-platdev blacklist since the actual +scaling is handled by the firmware cpufreq drivers(scpi, scmi and +vexpress-spc). + +Signed-off-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq-dt-platdev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c +index 3776d960f405..1c192a42f11e 100644 +--- a/drivers/cpufreq/cpufreq-dt-platdev.c ++++ b/drivers/cpufreq/cpufreq-dt-platdev.c +@@ -103,6 +103,8 @@ static const struct of_device_id whitelist[] __initconst = { + static const struct of_device_id blacklist[] __initconst = { + { .compatible = "allwinner,sun50i-h6", }, + ++ { .compatible = "arm,vexpress", }, ++ + { .compatible = "calxeda,highbank", }, + { .compatible = "calxeda,ecx-2000", }, + +-- +2.30.1 + diff --git a/queue-5.10/drm-amd-display-revert-dram_clock_change_latency-for.patch b/queue-5.10/drm-amd-display-revert-dram_clock_change_latency-for.patch new file mode 100644 index 00000000000..637d7317777 --- /dev/null +++ b/queue-5.10/drm-amd-display-revert-dram_clock_change_latency-for.patch @@ -0,0 +1,39 @@ +From 1d0d746192a7b2c6914c3bf5a4e1b8b95c2aa188 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 13:20:43 -0500 +Subject: drm/amd/display: Revert dram_clock_change_latency for DCN2.1 + +From: Sung Lee + +[ Upstream commit b0075d114c33580f5c9fa9cee8e13d06db41471b ] + +[WHY & HOW] +Using values provided by DF for latency may cause hangs in +multi display configurations. Revert change to previous value. + +Tested-by: Daniel Wheeler +Signed-off-by: Sung Lee +Reviewed-by: Haonan Wang +Acked-by: Eryk Brol +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index b5fe2a008bd4..7ed4d7c8734f 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -295,7 +295,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn2_1_soc = { + .num_banks = 8, + .num_chans = 4, + .vmm_page_size_bytes = 4096, +- .dram_clock_change_latency_us = 11.72, ++ .dram_clock_change_latency_us = 23.84, + .return_bus_width_bytes = 64, + .dispclk_dppclk_vco_speed_mhz = 3600, + .xfc_bus_transport_time_us = 4, +-- +2.30.1 + diff --git a/queue-5.10/drm-amdgpu-fb-bo-should-be-ttm_bo_type_device.patch b/queue-5.10/drm-amdgpu-fb-bo-should-be-ttm_bo_type_device.patch new file mode 100644 index 00000000000..d144da6d5ce --- /dev/null +++ b/queue-5.10/drm-amdgpu-fb-bo-should-be-ttm_bo_type_device.patch @@ -0,0 +1,39 @@ +From c4e3e8ab0102bb0271e5bd5b5703c516afede884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 15:22:22 +0100 +Subject: drm/amdgpu: fb BO should be ttm_bo_type_device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nirmoy Das + +[ Upstream commit 521f04f9e3ffc73ef96c776035f8a0a31b4cdd81 ] + +FB BO should not be ttm_bo_type_kernel type and +amdgpufb_create_pinned_object() pins the FB BO anyway. + +Signed-off-by: Nirmoy Das +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +index e2c2eb45a793..1ea8af48ae2f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +@@ -146,7 +146,7 @@ static int amdgpufb_create_pinned_object(struct amdgpu_fbdev *rfbdev, + size = mode_cmd->pitches[0] * height; + aligned_size = ALIGN(size, PAGE_SIZE); + ret = amdgpu_gem_object_create(adev, aligned_size, 0, domain, flags, +- ttm_bo_type_kernel, NULL, &gobj); ++ ttm_bo_type_device, NULL, &gobj); + if (ret) { + pr_err("failed to allocate framebuffer (%d)\n", aligned_size); + return -ENOMEM; +-- +2.30.1 + diff --git a/queue-5.10/drm-radeon-fix-agp-dependency.patch b/queue-5.10/drm-radeon-fix-agp-dependency.patch new file mode 100644 index 00000000000..e881c197c67 --- /dev/null +++ b/queue-5.10/drm-radeon-fix-agp-dependency.patch @@ -0,0 +1,38 @@ +From afd19f8f749297e240d9fc311a5f6baeb7e840c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 19:22:13 +0100 +Subject: drm/radeon: fix AGP dependency +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christian König + +[ Upstream commit cba2afb65cb05c3d197d17323fee4e3c9edef9cd ] + +When AGP is compiled as module radeon must be compiled as module as +well. + +Signed-off-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig +index 16f73c102394..ca868271f4c4 100644 +--- a/drivers/gpu/drm/Kconfig ++++ b/drivers/gpu/drm/Kconfig +@@ -239,6 +239,7 @@ source "drivers/gpu/drm/arm/Kconfig" + config DRM_RADEON + tristate "ATI Radeon" + depends on DRM && PCI && MMU ++ depends on AGP || !AGP + select FW_LOADER + select DRM_KMS_HELPER + select DRM_TTM +-- +2.30.1 + diff --git a/queue-5.10/gfs2-fix-use-after-free-in-trans_drain.patch b/queue-5.10/gfs2-fix-use-after-free-in-trans_drain.patch new file mode 100644 index 00000000000..20028591fc8 --- /dev/null +++ b/queue-5.10/gfs2-fix-use-after-free-in-trans_drain.patch @@ -0,0 +1,62 @@ +From 5f6da8db1d408df2344a3c71764316a18fc17aa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 11:11:09 -0500 +Subject: gfs2: fix use-after-free in trans_drain + +From: Bob Peterson + +[ Upstream commit 1a5a2cfd34c17db73c53ef127272c8c1ae220485 ] + +This patch adds code to function trans_drain to remove drained +bd elements from the ail lists, if queued, before freeing the bd. +If we don't remove the bd from the ail, function ail_drain will +try to reference the bd after it has been freed by trans_drain. + +Thanks to Andy Price for his analysis of the problem. + +Reported-by: Andy Price +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/log.c | 4 ++++ + fs/gfs2/trans.c | 2 ++ + 2 files changed, 6 insertions(+) + +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 2e9314091c81..1955dea999f7 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -935,12 +935,16 @@ static void trans_drain(struct gfs2_trans *tr) + while (!list_empty(head)) { + bd = list_first_entry(head, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); ++ if (!list_empty(&bd->bd_ail_st_list)) ++ gfs2_remove_from_ail(bd); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + head = &tr->tr_databuf; + while (!list_empty(head)) { + bd = list_first_entry(head, struct gfs2_bufdata, bd_list); + list_del_init(&bd->bd_list); ++ if (!list_empty(&bd->bd_ail_st_list)) ++ gfs2_remove_from_ail(bd); + kmem_cache_free(gfs2_bufdata_cachep, bd); + } + } +diff --git a/fs/gfs2/trans.c b/fs/gfs2/trans.c +index 6d4bf7ea7b3b..7f850ff6a05d 100644 +--- a/fs/gfs2/trans.c ++++ b/fs/gfs2/trans.c +@@ -134,6 +134,8 @@ static struct gfs2_bufdata *gfs2_alloc_bufdata(struct gfs2_glock *gl, + bd->bd_bh = bh; + bd->bd_gl = gl; + INIT_LIST_HEAD(&bd->bd_list); ++ INIT_LIST_HEAD(&bd->bd_ail_st_list); ++ INIT_LIST_HEAD(&bd->bd_ail_gl_list); + bh->b_private = bd; + return bd; + } +-- +2.30.1 + diff --git a/queue-5.10/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch b/queue-5.10/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch new file mode 100644 index 00000000000..8da845f6cf6 --- /dev/null +++ b/queue-5.10/gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch @@ -0,0 +1,101 @@ +From 6b3a35e4f923876f3e4df4acb8f7c893401d47c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 20:52:52 +0100 +Subject: gianfar: fix jumbo packets+napi+rx overrun crash + +From: Michael Braun + +[ Upstream commit d8861bab48b6c1fc3cdbcab8ff9d1eaea43afe7f ] + +When using jumbo packets and overrunning rx queue with napi enabled, +the following sequence is observed in gfar_add_rx_frag: + + | lstatus | | skb | +t | lstatus, size, flags | first | len, data_len, *ptr | +---+--------------------------------------+-------+-----------------------+ +13 | 18002348, 9032, INTERRUPT LAST | 0 | 9600, 8000, f554c12e | +12 | 10000640, 1600, INTERRUPT | 0 | 8000, 6400, f554c12e | +11 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, f554c12e | +10 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, f554c12e | +09 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, f554c12e | +08 | 14000640, 1600, INTERRUPT FIRST | 0 | 1600, 0, f554c12e | +07 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, f554c12e | +06 | 1c000080, 128, INTERRUPT LAST FIRST | 1 | 0, 0, abf3bd6e | +05 | 18002348, 9032, INTERRUPT LAST | 0 | 8000, 6400, c5a57780 | +04 | 10000640, 1600, INTERRUPT | 0 | 6400, 4800, c5a57780 | +03 | 10000640, 1600, INTERRUPT | 0 | 4800, 3200, c5a57780 | +02 | 10000640, 1600, INTERRUPT | 0 | 3200, 1600, c5a57780 | +01 | 10000640, 1600, INTERRUPT | 0 | 1600, 0, c5a57780 | +00 | 14000640, 1600, INTERRUPT FIRST | 1 | 0, 0, c5a57780 | + +So at t=7 a new packets is started but not finished, probably due to rx +overrun - but rx overrun is not indicated in the flags. Instead a new +packets starts at t=8. This results in skb->len to exceed size for the LAST +fragment at t=13 and thus a negative fragment size added to the skb. + +This then crashes: + +kernel BUG at include/linux/skbuff.h:2277! +Oops: Exception in kernel mode, sig: 5 [#1] +... +NIP [c04689f4] skb_pull+0x2c/0x48 +LR [c03f62ac] gfar_clean_rx_ring+0x2e4/0x844 +Call Trace: +[ec4bfd38] [c06a84c4] _raw_spin_unlock_irqrestore+0x60/0x7c (unreliable) +[ec4bfda8] [c03f6a44] gfar_poll_rx_sq+0x48/0xe4 +[ec4bfdc8] [c048d504] __napi_poll+0x54/0x26c +[ec4bfdf8] [c048d908] net_rx_action+0x138/0x2c0 +[ec4bfe68] [c06a8f34] __do_softirq+0x3a4/0x4fc +[ec4bfed8] [c0040150] run_ksoftirqd+0x58/0x70 +[ec4bfee8] [c0066ecc] smpboot_thread_fn+0x184/0x1cc +[ec4bff08] [c0062718] kthread+0x140/0x144 +[ec4bff38] [c0012350] ret_from_kernel_thread+0x14/0x1c + +This patch fixes this by checking for computed LAST fragment size, so a +negative sized fragment is never added. +In order to prevent the newer rx frame from getting corrupted, the FIRST +flag is checked to discard the incomplete older frame. + +Signed-off-by: Michael Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index d391a45cebb6..4fab2ee5bbf5 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2391,6 +2391,10 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + if (lstatus & BD_LFLAG(RXBD_LAST)) + size -= skb->len; + ++ WARN(size < 0, "gianfar: rx fragment size underflow"); ++ if (size < 0) ++ return false; ++ + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, + rxb->page_offset + RXBUF_ALIGNMENT, + size, GFAR_RXB_TRUESIZE); +@@ -2553,6 +2557,17 @@ static int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, + if (lstatus & BD_LFLAG(RXBD_EMPTY)) + break; + ++ /* lost RXBD_LAST descriptor due to overrun */ ++ if (skb && ++ (lstatus & BD_LFLAG(RXBD_FIRST))) { ++ /* discard faulty buffer */ ++ dev_kfree_skb(skb); ++ skb = NULL; ++ rx_queue->stats.rx_dropped++; ++ ++ /* can continue normally */ ++ } ++ + /* order rx buffer descriptor reads */ + rmb(); + +-- +2.30.1 + diff --git a/queue-5.10/gpiolib-acpi-add-missing-irqf_oneshot.patch b/queue-5.10/gpiolib-acpi-add-missing-irqf_oneshot.patch new file mode 100644 index 00000000000..fb308ba8044 --- /dev/null +++ b/queue-5.10/gpiolib-acpi-add-missing-irqf_oneshot.patch @@ -0,0 +1,41 @@ +From 1356ce368648e5ede6f8d9a081fa05a091f7973d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 16:35:58 +0800 +Subject: gpiolib: acpi: Add missing IRQF_ONESHOT + +From: Yang Li + +[ Upstream commit 6e5d5791730b55a1f987e1db84b078b91eb49e99 ] + +fixed the following coccicheck: +./drivers/gpio/gpiolib-acpi.c:176:7-27: ERROR: Threaded IRQ with no +primary handler requested without IRQF_ONESHOT + +Make sure threaded IRQs without a primary handler are always request +with IRQF_ONESHOT + +Reported-by: Abaci Robot +Signed-off-by: Yang Li +Acked-by: Andy Shevchenko +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-acpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c +index 49a1f8ce4baa..863f059bc498 100644 +--- a/drivers/gpio/gpiolib-acpi.c ++++ b/drivers/gpio/gpiolib-acpi.c +@@ -174,7 +174,7 @@ static void acpi_gpiochip_request_irq(struct acpi_gpio_chip *acpi_gpio, + int ret, value; + + ret = request_threaded_irq(event->irq, NULL, event->handler, +- event->irqflags, "ACPI:Event", event); ++ event->irqflags | IRQF_ONESHOT, "ACPI:Event", event); + if (ret) { + dev_err(acpi_gpio->chip->parent, + "Failed to setup interrupt handler for %d\n", +-- +2.30.1 + diff --git a/queue-5.10/habanalabs-call-put_pid-when-releasing-control-devic.patch b/queue-5.10/habanalabs-call-put_pid-when-releasing-control-devic.patch new file mode 100644 index 00000000000..60f1710ded2 --- /dev/null +++ b/queue-5.10/habanalabs-call-put_pid-when-releasing-control-devic.patch @@ -0,0 +1,39 @@ +From 09749ba78ca521c3064fc3c14b70e8984a00b397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 14:05:33 +0200 +Subject: habanalabs: Call put_pid() when releasing control device + +From: Tomer Tayar + +[ Upstream commit 27ac5aada024e0821c86540ad18f37edadd77d5e ] + +The refcount of the "hl_fpriv" structure is not used for the control +device, and thus hl_hpriv_put() is not called when releasing this +device. +This results with no call to put_pid(), so add it explicitly in +hl_device_release_ctrl(). + +Signed-off-by: Tomer Tayar +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/common/device.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/habanalabs/common/device.c b/drivers/misc/habanalabs/common/device.c +index 71b3a4d5adc6..7b0bf470795c 100644 +--- a/drivers/misc/habanalabs/common/device.c ++++ b/drivers/misc/habanalabs/common/device.c +@@ -106,6 +106,8 @@ static int hl_device_release_ctrl(struct inode *inode, struct file *filp) + list_del(&hpriv->dev_node); + mutex_unlock(&hdev->fpriv_list_lock); + ++ put_pid(hpriv->taskpid); ++ + kfree(hpriv); + + return 0; +-- +2.30.1 + diff --git a/queue-5.10/ia64-fix-ia64_syscall_get_set_arguments-for-break-ba.patch b/queue-5.10/ia64-fix-ia64_syscall_get_set_arguments-for-break-ba.patch new file mode 100644 index 00000000000..8ebac50d2ff --- /dev/null +++ b/queue-5.10/ia64-fix-ia64_syscall_get_set_arguments-for-break-ba.patch @@ -0,0 +1,98 @@ +From c589d78781e99b06dda39c79fdab8ade4d94e5df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 21:08:23 -0800 +Subject: ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls + +From: Sergei Trofimovich + +[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ] + +In https://bugs.gentoo.org/769614 Dmitry noticed that +`ptrace(PTRACE_GET_SYSCALL_INFO)` does not work for syscalls called via +glibc's syscall() wrapper. + +ia64 has two ways to call syscalls from userspace: via `break` and via +`eps` instructions. + +The difference is in stack layout: + +1. `eps` creates simple stack frame: no locals, in{0..7} == out{0..8} +2. `break` uses userspace stack frame: may be locals (glibc provides + one), in{0..7} == out{0..8}. + +Both work fine in syscall handling cde itself. + +But `ptrace(PTRACE_GET_SYSCALL_INFO)` uses unwind mechanism to +re-extract syscall arguments but it does not account for locals. + +The change always skips locals registers. It should not change `eps` +path as kernel's handler already enforces locals=0 and fixes `break`. + +Tested on v5.10 on rx3600 machine (ia64 9040 CPU). + +Link: https://lkml.kernel.org/r/20210221002554.333076-1-slyfox@gentoo.org +Link: https://bugs.gentoo.org/769614 +Signed-off-by: Sergei Trofimovich +Reported-by: Dmitry V. Levin +Cc: Oleg Nesterov +Cc: John Paul Adrian Glaubitz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/arch/ia64/kernel/ptrace.c b/arch/ia64/kernel/ptrace.c +index 75c070aed81e..dad3a605cb7e 100644 +--- a/arch/ia64/kernel/ptrace.c ++++ b/arch/ia64/kernel/ptrace.c +@@ -2010,27 +2010,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) + { + struct syscall_get_set_args *args = data; + struct pt_regs *pt = args->regs; +- unsigned long *krbs, cfm, ndirty; ++ unsigned long *krbs, cfm, ndirty, nlocals, nouts; + int i, count; + + if (unw_unwind_to_user(info) < 0) + return; + ++ /* ++ * We get here via a few paths: ++ * - break instruction: cfm is shared with caller. ++ * syscall args are in out= regs, locals are non-empty. ++ * - epsinstruction: cfm is set by br.call ++ * locals don't exist. ++ * ++ * For both cases argguments are reachable in cfm.sof - cfm.sol. ++ * CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] ++ */ + cfm = pt->cr_ifs; ++ nlocals = (cfm >> 7) & 0x7f; /* aka sol */ ++ nouts = (cfm & 0x7f) - nlocals; /* aka sof - sol */ + krbs = (unsigned long *)info->task + IA64_RBS_OFFSET/8; + ndirty = ia64_rse_num_regs(krbs, krbs + (pt->loadrs >> 19)); + + count = 0; + if (in_syscall(pt)) +- count = min_t(int, args->n, cfm & 0x7f); ++ count = min_t(int, args->n, nouts); + ++ /* Iterate over outs. */ + for (i = 0; i < count; i++) { ++ int j = ndirty + nlocals + i + args->i; + if (args->rw) +- *ia64_rse_skip_regs(krbs, ndirty + i + args->i) = +- args->args[i]; ++ *ia64_rse_skip_regs(krbs, j) = args->args[i]; + else +- args->args[i] = *ia64_rse_skip_regs(krbs, +- ndirty + i + args->i); ++ args->args[i] = *ia64_rse_skip_regs(krbs, j); + } + + if (!args->rw) { +-- +2.30.1 + diff --git a/queue-5.10/ia64-fix-ptrace-ptrace_syscall_info_exit-sign.patch b/queue-5.10/ia64-fix-ptrace-ptrace_syscall_info_exit-sign.patch new file mode 100644 index 00000000000..aa4f85d44a2 --- /dev/null +++ b/queue-5.10/ia64-fix-ptrace-ptrace_syscall_info_exit-sign.patch @@ -0,0 +1,72 @@ +From b74e35ef4b15808894522b74a4e843c103fbb10d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 21:08:27 -0800 +Subject: ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign + +From: Sergei Trofimovich + +[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ] + +In https://bugs.gentoo.org/769614 Dmitry noticed that +`ptrace(PTRACE_GET_SYSCALL_INFO)` does not return error sign properly. + +The bug is in mismatch between get/set errors: + +static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) +{ + return regs->r10 == -1 ? regs->r8:0; +} + +static inline long syscall_get_return_value(struct task_struct *task, + struct pt_regs *regs) +{ + return regs->r8; +} + +static inline void syscall_set_return_value(struct task_struct *task, + struct pt_regs *regs, + int error, long val) +{ + if (error) { + /* error < 0, but ia64 uses > 0 return value */ + regs->r8 = -error; + regs->r10 = -1; + } else { + regs->r8 = val; + regs->r10 = 0; + } +} + +Tested on v5.10 on rx3600 machine (ia64 9040 CPU). + +Link: https://lkml.kernel.org/r/20210221002554.333076-2-slyfox@gentoo.org +Link: https://bugs.gentoo.org/769614 +Signed-off-by: Sergei Trofimovich +Reported-by: Dmitry V. Levin +Reviewed-by: Dmitry V. Levin +Cc: John Paul Adrian Glaubitz +Cc: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/ia64/include/asm/syscall.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/include/asm/syscall.h b/arch/ia64/include/asm/syscall.h +index 6c6f16e409a8..0d23c0049301 100644 +--- a/arch/ia64/include/asm/syscall.h ++++ b/arch/ia64/include/asm/syscall.h +@@ -32,7 +32,7 @@ static inline void syscall_rollback(struct task_struct *task, + static inline long syscall_get_error(struct task_struct *task, + struct pt_regs *regs) + { +- return regs->r10 == -1 ? regs->r8:0; ++ return regs->r10 == -1 ? -regs->r8:0; + } + + static inline long syscall_get_return_value(struct task_struct *task, +-- +2.30.1 + diff --git a/queue-5.10/irqchip-ingenic-add-support-for-the-jz4760.patch b/queue-5.10/irqchip-ingenic-add-support-for-the-jz4760.patch new file mode 100644 index 00000000000..3bbfa796e68 --- /dev/null +++ b/queue-5.10/irqchip-ingenic-add-support-for-the-jz4760.patch @@ -0,0 +1,47 @@ +From 8fec1a06d41a692b1e1c870163305986ce863738 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 17:20:14 +0000 +Subject: irqchip/ingenic: Add support for the JZ4760 + +From: Paul Cercueil + +[ Upstream commit 5fbecd2389f48e1415799c63130d0cdce1cf3f60 ] + +Add support for the interrupt controller found in the JZ4760 SoC, which +works exactly like the one in the JZ4770. + +Signed-off-by: Paul Cercueil +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210307172014.73481-2-paul@crapouillou.net +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-ingenic-tcu.c | 1 + + drivers/irqchip/irq-ingenic.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/irqchip/irq-ingenic-tcu.c b/drivers/irqchip/irq-ingenic-tcu.c +index 7a7222d4c19c..b938d1d04d96 100644 +--- a/drivers/irqchip/irq-ingenic-tcu.c ++++ b/drivers/irqchip/irq-ingenic-tcu.c +@@ -179,5 +179,6 @@ static int __init ingenic_tcu_irq_init(struct device_node *np, + } + IRQCHIP_DECLARE(jz4740_tcu_irq, "ingenic,jz4740-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(jz4725b_tcu_irq, "ingenic,jz4725b-tcu", ingenic_tcu_irq_init); ++IRQCHIP_DECLARE(jz4760_tcu_irq, "ingenic,jz4760-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(jz4770_tcu_irq, "ingenic,jz4770-tcu", ingenic_tcu_irq_init); + IRQCHIP_DECLARE(x1000_tcu_irq, "ingenic,x1000-tcu", ingenic_tcu_irq_init); +diff --git a/drivers/irqchip/irq-ingenic.c b/drivers/irqchip/irq-ingenic.c +index b61a8901ef72..ea36bb00be80 100644 +--- a/drivers/irqchip/irq-ingenic.c ++++ b/drivers/irqchip/irq-ingenic.c +@@ -155,6 +155,7 @@ static int __init intc_2chip_of_init(struct device_node *node, + { + return ingenic_intc_of_init(node, 2); + } ++IRQCHIP_DECLARE(jz4760_intc, "ingenic,jz4760-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4770_intc, "ingenic,jz4770-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4775_intc, "ingenic,jz4775-intc", intc_2chip_of_init); + IRQCHIP_DECLARE(jz4780_intc, "ingenic,jz4780-intc", intc_2chip_of_init); +-- +2.30.1 + diff --git a/queue-5.10/ixgbe-fix-memleak-in-ixgbe_configure_clsu32.patch b/queue-5.10/ixgbe-fix-memleak-in-ixgbe_configure_clsu32.patch new file mode 100644 index 00000000000..c86fba2c6d4 --- /dev/null +++ b/queue-5.10/ixgbe-fix-memleak-in-ixgbe_configure_clsu32.patch @@ -0,0 +1,42 @@ +From 094f04dbea17ed672a869f5fe9a9bbfb18f1aa04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Jan 2021 16:08:42 +0800 +Subject: ixgbe: Fix memleak in ixgbe_configure_clsu32 + +From: Dinghao Liu + +[ Upstream commit 7a766381634da19fc837619b0a34590498d9d29a ] + +When ixgbe_fdir_write_perfect_filter_82599() fails, +input allocated by kzalloc() has not been freed, +which leads to memleak. + +Signed-off-by: Dinghao Liu +Reviewed-by: Paul Menzel +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index f3f449f53920..278fc866fad4 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -9582,8 +9582,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter, + ixgbe_atr_compute_perfect_hash_82599(&input->filter, mask); + err = ixgbe_fdir_write_perfect_filter_82599(hw, &input->filter, + input->sw_idx, queue); +- if (!err) +- ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); ++ if (err) ++ goto err_out_w_lock; ++ ++ ixgbe_update_ethtool_fdir_entry(adapter, input, input->sw_idx); + spin_unlock(&adapter->fdir_perfect_lock); + + if ((uhtid != 0x800) && (adapter->jump_tables[uhtid])) +-- +2.30.1 + diff --git a/queue-5.10/kbuild-add-image_name-to-no-sync-config-targets.patch b/queue-5.10/kbuild-add-image_name-to-no-sync-config-targets.patch new file mode 100644 index 00000000000..607074bde54 --- /dev/null +++ b/queue-5.10/kbuild-add-image_name-to-no-sync-config-targets.patch @@ -0,0 +1,36 @@ +From 0c99a5f0c3971ef4792e4425208445cec4f9238c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 15:10:25 +0900 +Subject: kbuild: add image_name to no-sync-config-targets + +From: Masahiro Yamada + +[ Upstream commit 993bdde94547887faaad4a97f0b0480a6da271c3 ] + +'make image_name' needs include/config/auto.conf to show the correct +output because KBUILD_IMAGE depends on CONFIG options, but should not +attempt to resync the configuration. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index d4b87e604762..cb9a1592f72c 100644 +--- a/Makefile ++++ b/Makefile +@@ -265,7 +265,8 @@ no-dot-config-targets := $(clean-targets) \ + $(version_h) headers headers_% archheaders archscripts \ + %asm-generic kernelversion %src-pkg dt_binding_check \ + outputmakefile +-no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease ++no-sync-config-targets := $(no-dot-config-targets) %install kernelrelease \ ++ image_name + single-targets := %.a %.i %.ko %.lds %.ll %.lst %.mod %.o %.s %.symtypes %/ + + config-build := +-- +2.30.1 + diff --git a/queue-5.10/kbuild-dummy-tools-fix-inverted-tests-for-gcc.patch b/queue-5.10/kbuild-dummy-tools-fix-inverted-tests-for-gcc.patch new file mode 100644 index 00000000000..381efbc2885 --- /dev/null +++ b/queue-5.10/kbuild-dummy-tools-fix-inverted-tests-for-gcc.patch @@ -0,0 +1,40 @@ +From 5a97dd8a1bb4d1d8866bc492606550a0d93ba019 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 11:43:14 +0100 +Subject: kbuild: dummy-tools: fix inverted tests for gcc + +From: Jiri Slaby + +[ Upstream commit b3d9fc1436808a4ef9927e558b3415e728e710c5 ] + +There is a test in Kconfig which takes inverted value of a compiler +check: +* config CC_HAS_INT128 + def_bool !$(cc-option,$(m64-flag) -D__SIZEOF_INT128__=0) + +This results in CC_HAS_INT128 not being in super-config generated by +dummy-tools. So take this into account in the gcc script. + +Signed-off-by: Jiri Slaby +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/dummy-tools/gcc | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/scripts/dummy-tools/gcc b/scripts/dummy-tools/gcc +index 33487e99d83e..11c9f045ee4b 100755 +--- a/scripts/dummy-tools/gcc ++++ b/scripts/dummy-tools/gcc +@@ -89,3 +89,8 @@ if arg_contain -print-file-name=plugin "$@"; then + echo $plugin_dir + exit 0 + fi ++ ++# inverted return value ++if arg_contain -D__SIZEOF_INT128__=0 "$@"; then ++ exit 1 ++fi +-- +2.30.1 + diff --git a/queue-5.10/kselftest-arm64-fix-exit-code-of-sve-ptrace.patch b/queue-5.10/kselftest-arm64-fix-exit-code-of-sve-ptrace.patch new file mode 100644 index 00000000000..a74cebb4bfa --- /dev/null +++ b/queue-5.10/kselftest-arm64-fix-exit-code-of-sve-ptrace.patch @@ -0,0 +1,34 @@ +From be0c0a8bb71ec305e9bec2a8fd45a9c50d7cad77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 19:03:04 +0000 +Subject: kselftest: arm64: Fix exit code of sve-ptrace + +From: Mark Brown + +[ Upstream commit 07e644885bf6727a48db109fad053cb43f3c9859 ] + +We track if sve-ptrace encountered a failure in a variable but don't +actually use that value when we exit the program, do so. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20210309190304.39169-1-broonie@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/fp/sve-ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/arm64/fp/sve-ptrace.c b/tools/testing/selftests/arm64/fp/sve-ptrace.c +index b2282be6f938..612d3899614a 100644 +--- a/tools/testing/selftests/arm64/fp/sve-ptrace.c ++++ b/tools/testing/selftests/arm64/fp/sve-ptrace.c +@@ -332,5 +332,5 @@ int main(void) + + ksft_print_cnts(); + +- return 0; ++ return ret; + } +-- +2.30.1 + diff --git a/queue-5.10/mm-fork-clear-pasid-for-new-mm.patch b/queue-5.10/mm-fork-clear-pasid-for-new-mm.patch new file mode 100644 index 00000000000..87462a8cc21 --- /dev/null +++ b/queue-5.10/mm-fork-clear-pasid-for-new-mm.patch @@ -0,0 +1,74 @@ +From 4db06cbee29fe0ab432cb277509f9d02d6280471 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 21:07:15 -0800 +Subject: mm/fork: clear PASID for new mm + +From: Fenghua Yu + +[ Upstream commit 82e69a121be4b1597ce758534816a8ee04c8b761 ] + +When a new mm is created, its PASID should be cleared, i.e. the PASID is +initialized to its init state 0 on both ARM and X86. + +This patch was part of the series introducing mm->pasid, but got lost +along the way [1]. It still makes sense to have it, because each address +space has a different PASID. And the IOMMU code in +iommu_sva_alloc_pasid() expects the pasid field of a new mm struct to be +cleared. + +[1] https://lore.kernel.org/linux-iommu/YDgh53AcQHT+T3L0@otcwcpicx3.sc.intel.com/ + +Link: https://lkml.kernel.org/r/20210302103837.2562625-1-jean-philippe@linaro.org +Signed-off-by: Fenghua Yu +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Tony Luck +Cc: Jacob Pan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/mm_types.h | 1 + + kernel/fork.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h +index 915f4f100383..3433ecc9c1f7 100644 +--- a/include/linux/mm_types.h ++++ b/include/linux/mm_types.h +@@ -23,6 +23,7 @@ + #endif + #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) + ++#define INIT_PASID 0 + + struct address_space; + struct mem_cgroup; +diff --git a/kernel/fork.c b/kernel/fork.c +index c675fdbd3dce..7c044d377926 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -992,6 +992,13 @@ static void mm_init_owner(struct mm_struct *mm, struct task_struct *p) + #endif + } + ++static void mm_init_pasid(struct mm_struct *mm) ++{ ++#ifdef CONFIG_IOMMU_SUPPORT ++ mm->pasid = INIT_PASID; ++#endif ++} ++ + static void mm_init_uprobes_state(struct mm_struct *mm) + { + #ifdef CONFIG_UPROBES +@@ -1022,6 +1029,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, + mm_init_cpumask(mm); + mm_init_aio(mm); + mm_init_owner(mm, p); ++ mm_init_pasid(mm); + RCU_INIT_POINTER(mm->exe_file, NULL); + mmu_notifier_subscriptions_init(mm); + init_tlb_flush_pending(mm); +-- +2.30.1 + diff --git a/queue-5.10/mt76-fix-tx-skb-error-handling-in-mt76_dma_tx_queue_.patch b/queue-5.10/mt76-fix-tx-skb-error-handling-in-mt76_dma_tx_queue_.patch new file mode 100644 index 00000000000..4a2c6a085d0 --- /dev/null +++ b/queue-5.10/mt76-fix-tx-skb-error-handling-in-mt76_dma_tx_queue_.patch @@ -0,0 +1,76 @@ +From 2c1a15b45f6a25b41c99ca793c7a30810cb951a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Feb 2021 14:51:18 +0100 +Subject: mt76: fix tx skb error handling in mt76_dma_tx_queue_skb + +From: Felix Fietkau + +[ Upstream commit ae064fc0e32a4d28389086d9f4b260a0c157cfee ] + +When running out of room in the tx queue after calling drv->tx_prepare_skb, +the buffer list will already have been modified on MT7615 and newer drivers. +This can leak a DMA mapping and will show up as swiotlb allocation failures +on x86. + +Fix this by moving the queue length check further up. This is less accurate, +since it can overestimate the needed room in the queue on MT7615 and newer, +but the difference is small enough to not matter in practice. + +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210216135119.23809-1-nbd@nbd.name +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/dma.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index 262c40dc14a6..665a03ebf9ef 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -355,7 +355,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid, + }; + struct ieee80211_hw *hw; + int len, n = 0, ret = -ENOMEM; +- struct mt76_queue_entry e; + struct mt76_txwi_cache *t; + struct sk_buff *iter; + dma_addr_t addr; +@@ -397,6 +396,11 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid, + } + tx_info.nbuf = n; + ++ if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { ++ ret = -ENOMEM; ++ goto unmap; ++ } ++ + dma_sync_single_for_cpu(dev->dev, t->dma_addr, dev->drv->txwi_size, + DMA_TO_DEVICE); + ret = dev->drv->tx_prepare_skb(dev, txwi, qid, wcid, sta, &tx_info); +@@ -405,11 +409,6 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid, + if (ret < 0) + goto unmap; + +- if (q->queued + (tx_info.nbuf + 1) / 2 >= q->ndesc - 1) { +- ret = -ENOMEM; +- goto unmap; +- } +- + return mt76_dma_add_buf(dev, q, tx_info.buf, tx_info.nbuf, + tx_info.info, tx_info.skb, t); + +@@ -425,9 +424,7 @@ mt76_dma_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid, + dev->test.tx_done--; + #endif + +- e.skb = tx_info.skb; +- e.txwi = t; +- dev->drv->tx_complete_skb(dev, &e); ++ dev_kfree_skb(tx_info.skb); + mt76_put_txwi(dev, t); + return ret; + } +-- +2.30.1 + diff --git a/queue-5.10/net-davicom-use-platform_get_irq_optional.patch b/queue-5.10/net-davicom-use-platform_get_irq_optional.patch new file mode 100644 index 00000000000..e12441a2c36 --- /dev/null +++ b/queue-5.10/net-davicom-use-platform_get_irq_optional.patch @@ -0,0 +1,35 @@ +From 36c7599722fd946109ba8ec9d43d320a15c6def3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 13:17:49 +0000 +Subject: net: davicom: Use platform_get_irq_optional() + +From: Paul Cercueil + +[ Upstream commit 2e2696223676d56db1a93acfca722c1b96cd552d ] + +The second IRQ line really is optional, so use +platform_get_irq_optional() to obtain it. + +Signed-off-by: Paul Cercueil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index ba7f857d1710..ae09cac87602 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1510,7 +1510,7 @@ dm9000_probe(struct platform_device *pdev) + goto out; + } + +- db->irq_wake = platform_get_irq(pdev, 1); ++ db->irq_wake = platform_get_irq_optional(pdev, 1); + if (db->irq_wake >= 0) { + dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake); + +-- +2.30.1 + diff --git a/queue-5.10/net-enetc-set-mac-rx-fifo-to-recommended-value.patch b/queue-5.10/net-enetc-set-mac-rx-fifo-to-recommended-value.patch new file mode 100644 index 00000000000..74771f5f63f --- /dev/null +++ b/queue-5.10/net-enetc-set-mac-rx-fifo-to-recommended-value.patch @@ -0,0 +1,58 @@ +From bee510d0b5d1ea07d2b37a3d80a9539877cd1398 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 15:23:38 +0200 +Subject: net: enetc: set MAC RX FIFO to recommended value + +From: Alex Marginean + +[ Upstream commit 1b2395dfff5bb40228a187f21f577cd90673d344 ] + +On LS1028A, the MAC RX FIFO defaults to the value 2, which is too high +and may lead to RX lock-up under traffic at a rate higher than 6 Gbps. +Set it to 1 instead, as recommended by the hardware design team and by +later versions of the ENETC block guide. + +Signed-off-by: Alex Marginean +Reviewed-by: Claudiu Manoil +Reviewed-by: Jason Liu +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_hw.h | 2 ++ + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 6 ++++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_hw.h b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +index 21a6ce415cb2..2b90a345507b 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_hw.h ++++ b/drivers/net/ethernet/freescale/enetc/enetc_hw.h +@@ -234,6 +234,8 @@ enum enetc_bdr_type {TX, RX}; + #define ENETC_PM0_MAXFRM 0x8014 + #define ENETC_SET_TX_MTU(val) ((val) << 16) + #define ENETC_SET_MAXFRM(val) ((val) & 0xffff) ++#define ENETC_PM0_RX_FIFO 0x801c ++#define ENETC_PM0_RX_FIFO_VAL 1 + + #define ENETC_PM_IMDIO_BASE 0x8030 + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_pf.c b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +index 83187cd59fdd..68133563a40c 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_pf.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_pf.c +@@ -490,6 +490,12 @@ static void enetc_configure_port_mac(struct enetc_hw *hw) + + enetc_port_wr(hw, ENETC_PM1_CMD_CFG, ENETC_PM0_CMD_PHY_TX_EN | + ENETC_PM0_CMD_TXP | ENETC_PM0_PROMISC); ++ ++ /* On LS1028A, the MAC RX FIFO defaults to 2, which is too high ++ * and may lead to RX lock-up under traffic. Set it to 1 instead, ++ * as recommended by the hardware team. ++ */ ++ enetc_port_wr(hw, ENETC_PM0_RX_FIFO, ENETC_PM0_RX_FIFO_VAL); + } + + static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode) +-- +2.30.1 + diff --git a/queue-5.10/net-fec-ptp-avoid-register-access-when-ipg-clock-is-.patch b/queue-5.10/net-fec-ptp-avoid-register-access-when-ipg-clock-is-.patch new file mode 100644 index 00000000000..58fea537976 --- /dev/null +++ b/queue-5.10/net-fec-ptp-avoid-register-access-when-ipg-clock-is-.patch @@ -0,0 +1,53 @@ +From 9358cf8ea7ea559f28bb66d83fe4ea9ea9f2445f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 22:15:16 +0100 +Subject: net: fec: ptp: avoid register access when ipg clock is disabled + +From: Heiko Thiery + +[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ] + +When accessing the timecounter register on an i.MX8MQ the kernel hangs. +This is only the case when the interface is down. This can be reproduced +by reading with 'phc_ctrl eth0 get'. + +Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900 +the igp clock is disabled when the interface is down and leads to a +system hang. + +So we check if the ptp clock status before reading the timecounter +register. + +Signed-off-by: Heiko Thiery +Acked-by: Richard Cochran +Link: https://lore.kernel.org/r/20210225211514.9115-1-heiko.thiery@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c +index 2e344aada4c6..1753807cbf97 100644 +--- a/drivers/net/ethernet/freescale/fec_ptp.c ++++ b/drivers/net/ethernet/freescale/fec_ptp.c +@@ -377,9 +377,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + u64 ns; + unsigned long flags; + ++ mutex_lock(&adapter->ptp_clk_mutex); ++ /* Check the ptp clock */ ++ if (!adapter->ptp_clk_on) { ++ mutex_unlock(&adapter->ptp_clk_mutex); ++ return -EINVAL; ++ } + spin_lock_irqsave(&adapter->tmreg_lock, flags); + ns = timecounter_read(&adapter->tc); + spin_unlock_irqrestore(&adapter->tmreg_lock, flags); ++ mutex_unlock(&adapter->ptp_clk_mutex); + + *ts = ns_to_timespec64(ns); + +-- +2.30.1 + diff --git a/queue-5.10/net-hisilicon-hns-fix-error-return-code-of-hns_nic_c.patch b/queue-5.10/net-hisilicon-hns-fix-error-return-code-of-hns_nic_c.patch new file mode 100644 index 00000000000..60d0b08da15 --- /dev/null +++ b/queue-5.10/net-hisilicon-hns-fix-error-return-code-of-hns_nic_c.patch @@ -0,0 +1,41 @@ +From fed2f9349ca1feb424d7d5f0f938504d1501e4a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 00:40:12 -0800 +Subject: net: hisilicon: hns: fix error return code of + hns_nic_clear_all_rx_fetch() + +From: Jia-Ju Bai + +[ Upstream commit 143c253f42bad20357e7e4432087aca747c43384 ] + +When hns_assemble_skb() returns NULL to skb, no error return code of +hns_nic_clear_all_rx_fetch() is assigned. +To fix this bug, ret is assigned with -ENOMEM in this case. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 858cb293152a..8bce5f1510be 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -1663,8 +1663,10 @@ static int hns_nic_clear_all_rx_fetch(struct net_device *ndev) + for (j = 0; j < fetch_num; j++) { + /* alloc one skb and init */ + skb = hns_assemble_skb(ndev); +- if (!skb) ++ if (!skb) { ++ ret = -ENOMEM; + goto out; ++ } + rd = &tx_ring_data(priv, skb->queue_mapping); + hns_nic_net_xmit_hw(ndev, skb, rd); + +-- +2.30.1 + diff --git a/queue-5.10/net-intel-iavf-fix-error-return-code-of-iavf_init_ge.patch b/queue-5.10/net-intel-iavf-fix-error-return-code-of-iavf_init_ge.patch new file mode 100644 index 00000000000..cb0e8527edd --- /dev/null +++ b/queue-5.10/net-intel-iavf-fix-error-return-code-of-iavf_init_ge.patch @@ -0,0 +1,39 @@ +From 77c5a292f26b5ee32ac757e5078b392a4f65c166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 19:10:10 -0800 +Subject: net: intel: iavf: fix error return code of iavf_init_get_resources() + +From: Jia-Ju Bai + +[ Upstream commit 6650d31f21b8a0043613ae0a4a2e42e49dc20b2d ] + +When iavf_process_config() fails, no error return code of +iavf_init_get_resources() is assigned. +To fix this bug, err is assigned with the return value of +iavf_process_config(), and then err is checked. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 0a867d64d467..dc5b3c06d1e0 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1776,7 +1776,8 @@ static int iavf_init_get_resources(struct iavf_adapter *adapter) + goto err_alloc; + } + +- if (iavf_process_config(adapter)) ++ err = iavf_process_config(adapter); ++ if (err) + goto err_alloc; + adapter->current_op = VIRTCHNL_OP_UNKNOWN; + +-- +2.30.1 + diff --git a/queue-5.10/net-stmmac-fix-dma-physical-address-of-descriptor-wh.patch b/queue-5.10/net-stmmac-fix-dma-physical-address-of-descriptor-wh.patch new file mode 100644 index 00000000000..07987d1141b --- /dev/null +++ b/queue-5.10/net-stmmac-fix-dma-physical-address-of-descriptor-wh.patch @@ -0,0 +1,324 @@ +From 76a2a4519d0a8518080e3cb6acd58f7167c31de0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 17:01:12 +0800 +Subject: net: stmmac: fix dma physical address of descriptor when display ring + +From: Joakim Zhang + +[ Upstream commit bfaf91ca848e758ed7be99b61fd936d03819fa56 ] + +Driver uses dma_alloc_coherent to allocate dma memory for descriptors, +dma_alloc_coherent will return both the virtual address and physical +address. AFAIK, virt_to_phys could not convert virtual address to +physical address, for which memory is allocated by dma_alloc_coherent. + +dwmac4_display_ring() function is broken for various descriptor, it only +support normal descriptor(struct dma_desc) now, this patch also extends to +support all descriptor types. + +Signed-off-by: Joakim Zhang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/stmicro/stmmac/dwmac4_descs.c | 50 +++++++++++++--- + .../net/ethernet/stmicro/stmmac/enh_desc.c | 9 ++- + drivers/net/ethernet/stmicro/stmmac/hwif.h | 3 +- + .../net/ethernet/stmicro/stmmac/norm_desc.c | 9 ++- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 57 ++++++++++++------- + 5 files changed, 94 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +index 2ecd3a8a690c..cbf4429fb1d2 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +@@ -402,19 +402,53 @@ static void dwmac4_rd_set_tx_ic(struct dma_desc *p) + p->des2 |= cpu_to_le32(TDES2_INTERRUPT_ON_COMPLETION); + } + +-static void dwmac4_display_ring(void *head, unsigned int size, bool rx) ++static void dwmac4_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { +- struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); + +- for (i = 0; i < size; i++) { +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(p), +- le32_to_cpu(p->des0), le32_to_cpu(p->des1), +- le32_to_cpu(p->des2), le32_to_cpu(p->des3)); +- p++; ++ if (desc_size == sizeof(struct dma_desc)) { ++ struct dma_desc *p = (struct dma_desc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*p); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(p->des0), le32_to_cpu(p->des1), ++ le32_to_cpu(p->des2), le32_to_cpu(p->des3)); ++ p++; ++ } ++ } else if (desc_size == sizeof(struct dma_extended_desc)) { ++ struct dma_extended_desc *extp = (struct dma_extended_desc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*extp); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(extp->basic.des0), le32_to_cpu(extp->basic.des1), ++ le32_to_cpu(extp->basic.des2), le32_to_cpu(extp->basic.des3), ++ le32_to_cpu(extp->des4), le32_to_cpu(extp->des5), ++ le32_to_cpu(extp->des6), le32_to_cpu(extp->des7)); ++ extp++; ++ } ++ } else if (desc_size == sizeof(struct dma_edesc)) { ++ struct dma_edesc *ep = (struct dma_edesc *)head; ++ ++ for (i = 0; i < size; i++) { ++ dma_addr = dma_rx_phy + i * sizeof(*ep); ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, ++ le32_to_cpu(ep->des4), le32_to_cpu(ep->des5), ++ le32_to_cpu(ep->des6), le32_to_cpu(ep->des7), ++ le32_to_cpu(ep->basic.des0), le32_to_cpu(ep->basic.des1), ++ le32_to_cpu(ep->basic.des2), le32_to_cpu(ep->basic.des3)); ++ ep++; ++ } ++ } else { ++ pr_err("unsupported descriptor!"); + } + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index d02cec296f51..6650edfab5bc 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -417,19 +417,22 @@ static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, + } + } + +-static void enh_desc_display_ring(void *head, unsigned int size, bool rx) ++static void enh_desc_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { + struct dma_extended_desc *ep = (struct dma_extended_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("Extended %s descriptor ring:\n", rx ? "RX" : "TX"); + + for (i = 0; i < size; i++) { + u64 x; ++ dma_addr = dma_rx_phy + i * sizeof(*ep); + + x = *(u64 *)ep; +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(ep), ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + (unsigned int)x, (unsigned int)(x >> 32), + ep->basic.des2, ep->basic.des3); + ep++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h +index afe7ec496545..b0b84244ef10 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h ++++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h +@@ -78,7 +78,8 @@ struct stmmac_desc_ops { + /* get rx timestamp status */ + int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats); + /* Display ring */ +- void (*display_ring)(void *head, unsigned int size, bool rx); ++ void (*display_ring)(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size); + /* set MSS via context descriptor */ + void (*set_mss)(struct dma_desc *p, unsigned int mss); + /* get descriptor skbuff address */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index f083360e4ba6..98ef43f35802 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -269,19 +269,22 @@ static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats) + return 1; + } + +-static void ndesc_display_ring(void *head, unsigned int size, bool rx) ++static void ndesc_display_ring(void *head, unsigned int size, bool rx, ++ dma_addr_t dma_rx_phy, unsigned int desc_size) + { + struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + int i; + + pr_info("%s descriptor ring:\n", rx ? "RX" : "TX"); + + for (i = 0; i < size; i++) { + u64 x; ++ dma_addr = dma_rx_phy + i * sizeof(*p); + + x = *(u64 *)p; +- pr_info("%03d [0x%x]: 0x%x 0x%x 0x%x 0x%x", +- i, (unsigned int)virt_to_phys(p), ++ pr_info("%03d [%pad]: 0x%x 0x%x 0x%x 0x%x", ++ i, &dma_addr, + (unsigned int)x, (unsigned int)(x >> 32), + p->des2, p->des3); + p++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 7d01c5cf60c9..6012eadae460 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1109,6 +1109,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) + static void stmmac_display_rx_rings(struct stmmac_priv *priv) + { + u32 rx_cnt = priv->plat->rx_queues_to_use; ++ unsigned int desc_size; + void *head_rx; + u32 queue; + +@@ -1118,19 +1119,24 @@ static void stmmac_display_rx_rings(struct stmmac_priv *priv) + + pr_info("\tRX Queue %u rings\n", queue); + +- if (priv->extend_desc) ++ if (priv->extend_desc) { + head_rx = (void *)rx_q->dma_erx; +- else ++ desc_size = sizeof(struct dma_extended_desc); ++ } else { + head_rx = (void *)rx_q->dma_rx; ++ desc_size = sizeof(struct dma_desc); ++ } + + /* Display RX ring */ +- stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true); ++ stmmac_display_ring(priv, head_rx, priv->dma_rx_size, true, ++ rx_q->dma_rx_phy, desc_size); + } + } + + static void stmmac_display_tx_rings(struct stmmac_priv *priv) + { + u32 tx_cnt = priv->plat->tx_queues_to_use; ++ unsigned int desc_size; + void *head_tx; + u32 queue; + +@@ -1140,14 +1146,19 @@ static void stmmac_display_tx_rings(struct stmmac_priv *priv) + + pr_info("\tTX Queue %d rings\n", queue); + +- if (priv->extend_desc) ++ if (priv->extend_desc) { + head_tx = (void *)tx_q->dma_etx; +- else if (tx_q->tbs & STMMAC_TBS_AVAIL) ++ desc_size = sizeof(struct dma_extended_desc); ++ } else if (tx_q->tbs & STMMAC_TBS_AVAIL) { + head_tx = (void *)tx_q->dma_entx; +- else ++ desc_size = sizeof(struct dma_edesc); ++ } else { + head_tx = (void *)tx_q->dma_tx; ++ desc_size = sizeof(struct dma_desc); ++ } + +- stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false); ++ stmmac_display_ring(priv, head_tx, priv->dma_tx_size, false, ++ tx_q->dma_tx_phy, desc_size); + } + } + +@@ -3710,18 +3721,23 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) + unsigned int count = 0, error = 0, len = 0; + int status = 0, coe = priv->hw->rx_csum; + unsigned int next_entry = rx_q->cur_rx; ++ unsigned int desc_size; + struct sk_buff *skb = NULL; + + if (netif_msg_rx_status(priv)) { + void *rx_head; + + netdev_dbg(priv->dev, "%s: descriptor ring:\n", __func__); +- if (priv->extend_desc) ++ if (priv->extend_desc) { + rx_head = (void *)rx_q->dma_erx; +- else ++ desc_size = sizeof(struct dma_extended_desc); ++ } else { + rx_head = (void *)rx_q->dma_rx; ++ desc_size = sizeof(struct dma_desc); ++ } + +- stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true); ++ stmmac_display_ring(priv, rx_head, priv->dma_rx_size, true, ++ rx_q->dma_rx_phy, desc_size); + } + while (count < limit) { + unsigned int buf1_len = 0, buf2_len = 0; +@@ -4289,24 +4305,27 @@ static int stmmac_set_mac_address(struct net_device *ndev, void *addr) + static struct dentry *stmmac_fs_dir; + + static void sysfs_display_ring(void *head, int size, int extend_desc, +- struct seq_file *seq) ++ struct seq_file *seq, dma_addr_t dma_phy_addr) + { + int i; + struct dma_extended_desc *ep = (struct dma_extended_desc *)head; + struct dma_desc *p = (struct dma_desc *)head; ++ dma_addr_t dma_addr; + + for (i = 0; i < size; i++) { + if (extend_desc) { +- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(ep), ++ dma_addr = dma_phy_addr + i * sizeof(*ep); ++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + le32_to_cpu(ep->basic.des0), + le32_to_cpu(ep->basic.des1), + le32_to_cpu(ep->basic.des2), + le32_to_cpu(ep->basic.des3)); + ep++; + } else { +- seq_printf(seq, "%d [0x%x]: 0x%x 0x%x 0x%x 0x%x\n", +- i, (unsigned int)virt_to_phys(p), ++ dma_addr = dma_phy_addr + i * sizeof(*p); ++ seq_printf(seq, "%d [%pad]: 0x%x 0x%x 0x%x 0x%x\n", ++ i, &dma_addr, + le32_to_cpu(p->des0), le32_to_cpu(p->des1), + le32_to_cpu(p->des2), le32_to_cpu(p->des3)); + p++; +@@ -4334,11 +4353,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) + if (priv->extend_desc) { + seq_printf(seq, "Extended descriptor ring:\n"); + sysfs_display_ring((void *)rx_q->dma_erx, +- priv->dma_rx_size, 1, seq); ++ priv->dma_rx_size, 1, seq, rx_q->dma_rx_phy); + } else { + seq_printf(seq, "Descriptor ring:\n"); + sysfs_display_ring((void *)rx_q->dma_rx, +- priv->dma_rx_size, 0, seq); ++ priv->dma_rx_size, 0, seq, rx_q->dma_rx_phy); + } + } + +@@ -4350,11 +4369,11 @@ static int stmmac_rings_status_show(struct seq_file *seq, void *v) + if (priv->extend_desc) { + seq_printf(seq, "Extended descriptor ring:\n"); + sysfs_display_ring((void *)tx_q->dma_etx, +- priv->dma_tx_size, 1, seq); ++ priv->dma_tx_size, 1, seq, tx_q->dma_tx_phy); + } else if (!(tx_q->tbs & STMMAC_TBS_AVAIL)) { + seq_printf(seq, "Descriptor ring:\n"); + sysfs_display_ring((void *)tx_q->dma_tx, +- priv->dma_tx_size, 0, seq); ++ priv->dma_tx_size, 0, seq, tx_q->dma_tx_phy); + } + } + +-- +2.30.1 + diff --git a/queue-5.10/net-tehuti-fix-error-return-code-in-bdx_probe.patch b/queue-5.10/net-tehuti-fix-error-return-code-in-bdx_probe.patch new file mode 100644 index 00000000000..44185592d76 --- /dev/null +++ b/queue-5.10/net-tehuti-fix-error-return-code-in-bdx_probe.patch @@ -0,0 +1,36 @@ +From 2a307ece929e32f7f41b11252169631f3b7a5d02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Mar 2021 18:06:48 -0800 +Subject: net: tehuti: fix error return code in bdx_probe() + +From: Jia-Ju Bai + +[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ] + +When bdx_read_mac() fails, no error return code of bdx_probe() +is assigned. +To fix this bug, err is assigned with -EFAULT as error return code. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/tehuti/tehuti.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c +index b8f4f419173f..d054c6e83b1c 100644 +--- a/drivers/net/ethernet/tehuti/tehuti.c ++++ b/drivers/net/ethernet/tehuti/tehuti.c +@@ -2044,6 +2044,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + /*bdx_hw_reset(priv); */ + if (bdx_read_mac(priv)) { + pr_err("load MAC address failed\n"); ++ err = -EFAULT; + goto err_out_iomap; + } + SET_NETDEV_DEV(ndev, &pdev->dev); +-- +2.30.1 + diff --git a/queue-5.10/net-wan-fix-error-return-code-of-uhdlc_init.patch b/queue-5.10/net-wan-fix-error-return-code-of-uhdlc_init.patch new file mode 100644 index 00000000000..2d0caf2e15f --- /dev/null +++ b/queue-5.10/net-wan-fix-error-return-code-of-uhdlc_init.patch @@ -0,0 +1,49 @@ +From c0a08b48b6bd68f21781cc6fb864c0c87f71765b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Mar 2021 01:12:56 -0800 +Subject: net: wan: fix error return code of uhdlc_init() + +From: Jia-Ju Bai + +[ Upstream commit 62765d39553cfd1ad340124fe1e280450e8c89e2 ] + +When priv->rx_skbuff or priv->tx_skbuff is NULL, no error return code of +uhdlc_init() is assigned. +To fix this bug, ret is assigned with -ENOMEM in these cases. + +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/fsl_ucc_hdlc.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index dca97cd7c4e7..7eac6a3e1cde 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -204,14 +204,18 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + priv->rx_skbuff = kcalloc(priv->rx_ring_size, + sizeof(*priv->rx_skbuff), + GFP_KERNEL); +- if (!priv->rx_skbuff) ++ if (!priv->rx_skbuff) { ++ ret = -ENOMEM; + goto free_ucc_pram; ++ } + + priv->tx_skbuff = kcalloc(priv->tx_ring_size, + sizeof(*priv->tx_skbuff), + GFP_KERNEL); +- if (!priv->tx_skbuff) ++ if (!priv->tx_skbuff) { ++ ret = -ENOMEM; + goto free_rx_skbuff; ++ } + + priv->skb_curtx = 0; + priv->skb_dirtytx = 0; +-- +2.30.1 + diff --git a/queue-5.10/nfs-correct-size-calculation-for-create-reply-length.patch b/queue-5.10/nfs-correct-size-calculation-for-create-reply-length.patch new file mode 100644 index 00000000000..ebbaeebe478 --- /dev/null +++ b/queue-5.10/nfs-correct-size-calculation-for-create-reply-length.patch @@ -0,0 +1,49 @@ +From b444e69739cb90e1994b7190873cec8986179765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 12:12:13 -0600 +Subject: NFS: Correct size calculation for create reply length + +From: Frank Sorenson + +[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ] + +CREATE requests return a post_op_fh3, rather than nfs_fh3. The +post_op_fh3 includes an extra word to indicate 'handle_follows'. + +Without that additional word, create fails when full 64-byte +filehandles are in use. + +Add NFS3_post_op_fh_sz, and correct the size calculation for +NFS3_createres_sz. + +Signed-off-by: Frank Sorenson +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs3xdr.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index 69971f6c840d..dff6b52d26a8 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -35,6 +35,7 @@ + */ + #define NFS3_fhandle_sz (1+16) + #define NFS3_fh_sz (NFS3_fhandle_sz) /* shorthand */ ++#define NFS3_post_op_fh_sz (1+NFS3_fh_sz) + #define NFS3_sattr_sz (15) + #define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2)) + #define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2)) +@@ -72,7 +73,7 @@ + #define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1+1) + #define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3+1) + #define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) +-#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) ++#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) + #define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz)) + #define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) + #define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2+1) +-- +2.30.1 + diff --git a/queue-5.10/nfs-fix-pnfs_flexfile_layout-kconfig-default.patch b/queue-5.10/nfs-fix-pnfs_flexfile_layout-kconfig-default.patch new file mode 100644 index 00000000000..e4748b2f1e3 --- /dev/null +++ b/queue-5.10/nfs-fix-pnfs_flexfile_layout-kconfig-default.patch @@ -0,0 +1,36 @@ +From f20ce1181fec80a05136a1e7325afba2002d91f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 15:19:01 +0100 +Subject: nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default + +From: Timo Rothenpieler + +[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ] + +This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13. +With the default being m, it's impossible to build the module into the +kernel. + +Signed-off-by: Timo Rothenpieler +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig +index e2a488d403a6..14a72224b657 100644 +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -127,7 +127,7 @@ config PNFS_BLOCK + config PNFS_FLEXFILE_LAYOUT + tristate + depends on NFS_V4_1 && NFS_V3 +- default m ++ default NFS_V4 + + config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN + string "NFSv4.1 Implementation ID Domain" +-- +2.30.1 + diff --git a/queue-5.10/nfs-we-don-t-support-removing-system.nfs4_acl.patch b/queue-5.10/nfs-we-don-t-support-removing-system.nfs4_acl.patch new file mode 100644 index 00000000000..019748cc340 --- /dev/null +++ b/queue-5.10/nfs-we-don-t-support-removing-system.nfs4_acl.patch @@ -0,0 +1,40 @@ +From 242053e08add43ff7ab158825b664cd81747acde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 17:36:38 -0500 +Subject: nfs: we don't support removing system.nfs4_acl + +From: J. Bruce Fields + +[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ] + +The NFSv4 protocol doesn't have any notion of reomoving an attribute, so +removexattr(path,"system.nfs4_acl") doesn't make sense. + +There's no documented return value. Arguably it could be EOPNOTSUPP but +I'm a little worried an application might take that to mean that we +don't support ACLs or xattrs. How about EINVAL? + +Signed-off-by: J. Bruce Fields +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ba2dfba4854b..15ac6b6893e7 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5891,6 +5891,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t bufl + unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); + int ret, i; + ++ /* You can't remove system.nfs4_acl: */ ++ if (buflen == 0) ++ return -EINVAL; + if (!nfs4_server_supports_acls(server)) + return -EOPNOTSUPP; + if (npages > ARRAY_SIZE(pages)) +-- +2.30.1 + diff --git a/queue-5.10/nvme-add-nvme_req_cancelled-flag-in-nvme_cancel_requ.patch b/queue-5.10/nvme-add-nvme_req_cancelled-flag-in-nvme_cancel_requ.patch new file mode 100644 index 00000000000..87bdacbae15 --- /dev/null +++ b/queue-5.10/nvme-add-nvme_req_cancelled-flag-in-nvme_cancel_requ.patch @@ -0,0 +1,40 @@ +From f9c087ffd6784d22109c8872f11bdfa833c96cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 08:17:26 +0100 +Subject: nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request() + +From: Hannes Reinecke + +[ Upstream commit d3589381987ec879b03f8ce3039df57e87f05901 ] + +NVME_REQ_CANCELLED is translated into -EINTR in nvme_submit_sync_cmd(), +so we should be setting this flags during nvme_cancel_request() to +ensure that the callers to nvme_submit_sync_cmd() will get the correct +error code when the controller is reset. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Chao Leng +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index fbe2918ade78..30e834d84f36 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -346,6 +346,7 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved) + return true; + + nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD; ++ nvme_req(req)->flags |= NVME_REQ_CANCELLED; + blk_mq_complete_request(req); + return true; + } +-- +2.30.1 + diff --git a/queue-5.10/nvme-core-check-ctrl-css-before-setting-up-zns.patch b/queue-5.10/nvme-core-check-ctrl-css-before-setting-up-zns.patch new file mode 100644 index 00000000000..2b3f4a17ddf --- /dev/null +++ b/queue-5.10/nvme-core-check-ctrl-css-before-setting-up-zns.patch @@ -0,0 +1,40 @@ +From e0b7e5fc7a71a26badc08085e1113ac0677b011a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 20:58:21 -0800 +Subject: nvme-core: check ctrl css before setting up zns + +From: Chaitanya Kulkarni + +[ Upstream commit 0ec84df4953bd42c6583a555773f1d4996a061eb ] + +Ensure multiple Command Sets are supported before starting to setup a +ZNS namespace. + +Signed-off-by: Chaitanya Kulkarni +[hch: move the check around a bit] +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 30e834d84f36..140f19cbe73a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4019,6 +4019,12 @@ static void nvme_validate_or_alloc_ns(struct nvme_ctrl *ctrl, unsigned nsid) + nsid); + break; + } ++ if (!nvme_multi_css(ctrl)) { ++ dev_warn(ctrl->device, ++ "command set not reported for nsid: %d\n", ++ ns->head->ns_id); ++ break; ++ } + nvme_alloc_ns(ctrl, nsid, &ids); + break; + default: +-- +2.30.1 + diff --git a/queue-5.10/nvme-fc-return-nvme_sc_host_aborted_cmd-when-a-comma.patch b/queue-5.10/nvme-fc-return-nvme_sc_host_aborted_cmd-when-a-comma.patch new file mode 100644 index 00000000000..9f6af639a65 --- /dev/null +++ b/queue-5.10/nvme-fc-return-nvme_sc_host_aborted_cmd-when-a-comma.patch @@ -0,0 +1,39 @@ +From 8e0d007bb47ba7785fb128dbb8b812ca9fae03a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 08:17:28 +0100 +Subject: nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been + aborted + +From: Hannes Reinecke + +[ Upstream commit ae3afe6308b43bbf49953101d4ba2c1c481133a8 ] + +When a command has been aborted we should return NVME_SC_HOST_ABORTED_CMD +to be consistent with the other transports. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: James Smart +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index d221a98a677b..41257daf7464 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1956,7 +1956,7 @@ nvme_fc_fcpio_done(struct nvmefc_fcp_req *req) + sizeof(op->rsp_iu), DMA_FROM_DEVICE); + + if (opstate == FCPOP_STATE_ABORTED) +- status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); ++ status = cpu_to_le16(NVME_SC_HOST_ABORTED_CMD << 1); + else if (freq->status) { + status = cpu_to_le16(NVME_SC_HOST_PATH_ERROR << 1); + dev_info(ctrl->ctrl.device, +-- +2.30.1 + diff --git a/queue-5.10/nvme-fc-set-nvme_req_cancelled-in-nvme_fc_terminate_.patch b/queue-5.10/nvme-fc-set-nvme_req_cancelled-in-nvme_fc_terminate_.patch new file mode 100644 index 00000000000..1be9cc9542b --- /dev/null +++ b/queue-5.10/nvme-fc-set-nvme_req_cancelled-in-nvme_fc_terminate_.patch @@ -0,0 +1,39 @@ +From 94b63de1741b7a7ee25638a4ed48189976ff4957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 08:17:27 +0100 +Subject: nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange() + +From: Hannes Reinecke + +[ Upstream commit 3c7aafbc8d3d4d90430dfa126847a796c3e4ecfc ] + +nvme_fc_terminate_exchange() is being called when exchanges are +being deleted, and as such we should be setting the NVME_REQ_CANCELLED +flag to have identical behaviour on all transports. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: James Smart +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index fab068c8ba02..d221a98a677b 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2443,6 +2443,7 @@ nvme_fc_terminate_exchange(struct request *req, void *data, bool reserved) + struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); + struct nvme_fc_fcp_op *op = blk_mq_rq_to_pdu(req); + ++ op->nreq.flags |= NVME_REQ_CANCELLED; + __nvme_fc_abort_op(ctrl, op); + return true; + } +-- +2.30.1 + diff --git a/queue-5.10/nvme-pci-add-the-disable_write_zeroes-quirk-for-a-sa.patch b/queue-5.10/nvme-pci-add-the-disable_write_zeroes-quirk-for-a-sa.patch new file mode 100644 index 00000000000..220cecaf4f2 --- /dev/null +++ b/queue-5.10/nvme-pci-add-the-disable_write_zeroes-quirk-for-a-sa.patch @@ -0,0 +1,74 @@ +From 22d169742050e34b40795e577d452210644b262a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 12:06:41 +0000 +Subject: nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a + +From: Dmitry Monakhov + +[ Upstream commit abbb5f5929ec6c52574c430c5475c158a65c2a8c ] + +This adds a quirk for Samsung PM1725a drive which fixes timeouts and +I/O errors due to the fact that the controller does not properly +handle the Write Zeroes command, dmesg log: + +nvme nvme0: I/O 528 QID 10 timeout, aborting +nvme nvme0: I/O 529 QID 10 timeout, aborting +nvme nvme0: I/O 530 QID 10 timeout, aborting +nvme nvme0: I/O 531 QID 10 timeout, aborting +nvme nvme0: I/O 532 QID 10 timeout, aborting +nvme nvme0: I/O 533 QID 10 timeout, aborting +nvme nvme0: I/O 534 QID 10 timeout, aborting +nvme nvme0: I/O 535 QID 10 timeout, aborting +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: Abort status: 0x0 +nvme nvme0: I/O 528 QID 10 timeout, reset controller +nvme nvme0: controller is down; will reset: CSTS=0x3, PCI_STATUS=0x10 +nvme nvme0: Device not ready; aborting reset, CSTS=0x3 +nvme nvme0: Device not ready; aborting reset, CSTS=0x3 +nvme nvme0: Removing after probe failure status: -19 +nvme0n1: detected capacity change from 6251233968 to 0 +blk_update_request: I/O error, dev nvme0n1, sector 32776 op 0x1:(WRITE) flags 0x3000 phys_seg 6 prio class 0 +blk_update_request: I/O error, dev nvme0n1, sector 113319936 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 1, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113319680 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 2, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113319424 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 3, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113319168 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 4, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113318912 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 5, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113318656 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +Buffer I/O error on dev nvme0n1p2, logical block 6, lost async page write +blk_update_request: I/O error, dev nvme0n1, sector 113318400 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +blk_update_request: I/O error, dev nvme0n1, sector 113318144 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 +blk_update_request: I/O error, dev nvme0n1, sector 113317888 op 0x9:(WRITE_ZEROES) flags 0x0 phys_seg 0 prio class 0 + +Signed-off-by: Dmitry Monakhov +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 99c59f93a064..4dca58f4afdf 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3247,6 +3247,7 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY, }, + { PCI_DEVICE(0x144d, 0xa822), /* Samsung PM1725a */ + .driver_data = NVME_QUIRK_DELAY_BEFORE_CHK_RDY | ++ NVME_QUIRK_DISABLE_WRITE_ZEROES| + NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE(0x1987, 0x5016), /* Phison E16 */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, +-- +2.30.1 + diff --git a/queue-5.10/nvme-rdma-fix-a-use-after-free-in-nvmet_rdma_write_d.patch b/queue-5.10/nvme-rdma-fix-a-use-after-free-in-nvmet_rdma_write_d.patch new file mode 100644 index 00000000000..01221618842 --- /dev/null +++ b/queue-5.10/nvme-rdma-fix-a-use-after-free-in-nvmet_rdma_write_d.patch @@ -0,0 +1,40 @@ +From 47ee67f3c1927765fd75725d7888d9023aad872a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 21:44:13 -0800 +Subject: nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done + +From: Lv Yunlong + +[ Upstream commit abec6561fc4e0fbb19591a0b35676d8c783b5493 ] + +In nvmet_rdma_write_data_done, rsp is recoverd by wc->wr_cqe and freed by +nvmet_rdma_release_rsp(). But after that, pr_info() used the freed +chunk's member object and could leak the freed chunk address with +wc->wr_cqe by computing the offset. + +Signed-off-by: Lv Yunlong +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/rdma.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c +index 06b6b742bb21..6c1f3ab7649c 100644 +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -802,9 +802,8 @@ static void nvmet_rdma_write_data_done(struct ib_cq *cq, struct ib_wc *wc) + nvmet_req_uninit(&rsp->req); + nvmet_rdma_release_rsp(rsp); + if (wc->status != IB_WC_WR_FLUSH_ERR) { +- pr_info("RDMA WRITE for CQE 0x%p failed with status %s (%d).\n", +- wc->wr_cqe, ib_wc_status_msg(wc->status), +- wc->status); ++ pr_info("RDMA WRITE for CQE failed with status %s (%d).\n", ++ ib_wc_status_msg(wc->status), wc->status); + nvmet_rdma_error_comp(queue); + } + return; +-- +2.30.1 + diff --git a/queue-5.10/nvme-simplify-error-logic-in-nvme_validate_ns.patch b/queue-5.10/nvme-simplify-error-logic-in-nvme_validate_ns.patch new file mode 100644 index 00000000000..83afaccf4c9 --- /dev/null +++ b/queue-5.10/nvme-simplify-error-logic-in-nvme_validate_ns.patch @@ -0,0 +1,69 @@ +From eb76053233ce372fbf2bfca73bc4b64db926d0f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Feb 2021 08:17:25 +0100 +Subject: nvme: simplify error logic in nvme_validate_ns() + +From: Hannes Reinecke + +[ Upstream commit d95c1f4179a7f3ea8aa728ed00252a8ed0f8158f ] + +We only should remove namespaces when we get fatal error back from +the device or when the namespace IDs have changed. +So instead of painfully masking out error numbers which might indicate +that the error should be ignored we could use an NVME status code +to indicated when the namespace should be removed. +That simplifies the final logic and makes it less error-prone. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Daniel Wagner +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index de846aaa8728..fbe2918ade78 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1371,7 +1371,7 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid, + goto out_free_id; + } + +- error = -ENODEV; ++ error = NVME_SC_INVALID_NS | NVME_SC_DNR; + if ((*id)->ncap == 0) /* namespace not allocated or attached */ + goto out_free_id; + +@@ -3959,7 +3959,7 @@ static void nvme_ns_remove_by_nsid(struct nvme_ctrl *ctrl, u32 nsid) + static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + { + struct nvme_id_ns *id; +- int ret = -ENODEV; ++ int ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + + if (test_bit(NVME_NS_DEAD, &ns->flags)) + goto out; +@@ -3968,7 +3968,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + if (ret) + goto out; + +- ret = -ENODEV; ++ ret = NVME_SC_INVALID_NS | NVME_SC_DNR; + if (!nvme_ns_ids_equal(&ns->head->ids, ids)) { + dev_err(ns->ctrl->device, + "identifiers changed for nsid %d\n", ns->head->ns_id); +@@ -3986,7 +3986,7 @@ static void nvme_validate_ns(struct nvme_ns *ns, struct nvme_ns_ids *ids) + * + * TODO: we should probably schedule a delayed retry here. + */ +- if (ret && ret != -ENOMEM && !(ret > 0 && !(ret & NVME_SC_DNR))) ++ if (ret > 0 && (ret & NVME_SC_DNR)) + nvme_ns_remove(ns); + else + revalidate_disk_size(ns->disk, true); +-- +2.30.1 + diff --git a/queue-5.10/powerpc-4xx-fix-build-errors-from-mfdcr.patch b/queue-5.10/powerpc-4xx-fix-build-errors-from-mfdcr.patch new file mode 100644 index 00000000000..e33c1ca17ed --- /dev/null +++ b/queue-5.10/powerpc-4xx-fix-build-errors-from-mfdcr.patch @@ -0,0 +1,72 @@ +From 3e3527715e766a4bf86df2c1028d9c62b5fca07f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 23:30:58 +1100 +Subject: powerpc/4xx: Fix build errors from mfdcr() + +From: Michael Ellerman + +[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ] + +lkp reported a build error in fsp2.o: + + CC arch/powerpc/platforms/44x/fsp2.o + {standard input}:577: Error: unsupported relocation against base + +Which comes from: + + pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0)); + +Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and +passing that to the assembler, which obviously doesn't work. + +The mfdcr() macro already checks that the argument is constant using +__builtin_constant_p(), and if not calls the out-of-line version of +mfdcr(). But in this case GCC is smart enough to notice that "base + +PLB4OPB_GESR0" will be constant, even though it's not something we can +immediately stringify into a register number. + +Segher pointed out that passing the register number to the inline asm +as a constant would be better, and in fact it fixes the build error, +presumably because it gives GCC a chance to resolve the value. + +While we're at it, change mtdcr() similarly. + +Reported-by: kernel test robot +Suggested-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Acked-by: Feng Tang +Link: https://lore.kernel.org/r/20210218123058.748882-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/dcr-native.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/powerpc/include/asm/dcr-native.h b/arch/powerpc/include/asm/dcr-native.h +index 7141ccea8c94..a92059964579 100644 +--- a/arch/powerpc/include/asm/dcr-native.h ++++ b/arch/powerpc/include/asm/dcr-native.h +@@ -53,8 +53,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) + #define mfdcr(rn) \ + ({unsigned int rval; \ + if (__builtin_constant_p(rn) && rn < 1024) \ +- asm volatile("mfdcr %0," __stringify(rn) \ +- : "=r" (rval)); \ ++ asm volatile("mfdcr %0, %1" : "=r" (rval) \ ++ : "n" (rn)); \ + else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ + rval = mfdcrx(rn); \ + else \ +@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val) + #define mtdcr(rn, v) \ + do { \ + if (__builtin_constant_p(rn) && rn < 1024) \ +- asm volatile("mtdcr " __stringify(rn) ",%0" \ +- : : "r" (v)); \ ++ asm volatile("mtdcr %0, %1" \ ++ : : "n" (rn), "r" (v)); \ + else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ + mtdcrx(rn, v); \ + else \ +-- +2.30.1 + diff --git a/queue-5.10/regulator-qcom-rpmh-correct-the-pmic5_hfsmps515-buck.patch b/queue-5.10/regulator-qcom-rpmh-correct-the-pmic5_hfsmps515-buck.patch new file mode 100644 index 00000000000..9c15fef1448 --- /dev/null +++ b/queue-5.10/regulator-qcom-rpmh-correct-the-pmic5_hfsmps515-buck.patch @@ -0,0 +1,38 @@ +From 2be262fe48794e48706eab418b7f1b2f43a92a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 14:03:08 +0530 +Subject: regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck + +From: satya priya + +[ Upstream commit e610e072c87a30658479a7b4c51e1801cb3f450c ] + +Correct the REGULATOR_LINEAR_RANGE and n_voltges for +pmic5_hfsmps515 buck. + +Signed-off-by: satya priya +Link: https://lore.kernel.org/r/1614155592-14060-4-git-send-email-skakit@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/qcom-rpmh-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/qcom-rpmh-regulator.c b/drivers/regulator/qcom-rpmh-regulator.c +index 52e4396d4071..c3036591b259 100644 +--- a/drivers/regulator/qcom-rpmh-regulator.c ++++ b/drivers/regulator/qcom-rpmh-regulator.c +@@ -726,8 +726,8 @@ static const struct rpmh_vreg_hw_data pmic5_ftsmps510 = { + static const struct rpmh_vreg_hw_data pmic5_hfsmps515 = { + .regulator_type = VRM, + .ops = &rpmh_regulator_vrm_ops, +- .voltage_range = REGULATOR_LINEAR_RANGE(2800000, 0, 4, 16000), +- .n_voltages = 5, ++ .voltage_range = REGULATOR_LINEAR_RANGE(320000, 0, 235, 16000), ++ .n_voltages = 236, + .pmic_mode_map = pmic_mode_map_pmic5_smps, + .of_map_mode = rpmh_regulator_pmic4_smps_of_map_mode, + }; +-- +2.30.1 + diff --git a/queue-5.10/revert-r8152-adjust-the-settings-about-mac-clock-spe.patch b/queue-5.10/revert-r8152-adjust-the-settings-about-mac-clock-spe.patch new file mode 100644 index 00000000000..6f9a102cdd3 --- /dev/null +++ b/queue-5.10/revert-r8152-adjust-the-settings-about-mac-clock-spe.patch @@ -0,0 +1,112 @@ +From 8191681ae7b8b52508c4b9775a5289fa7b2575c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Mar 2021 16:39:47 +0800 +Subject: Revert "r8152: adjust the settings about MAC clock speed down for + RTL8153" + +From: Hayes Wang + +[ Upstream commit 4b5dc1a94d4f92b5845e98bd9ae344b26d933aad ] + +This reverts commit 134f98bcf1b898fb9d6f2b91bc85dd2e5478b4b8. + +The r8153_mac_clk_spd() is used for RTL8153A only, because the register +table of RTL8153B is different from RTL8153A. However, this function would +be called when RTL8153B calls r8153_first_init() and r8153_enter_oob(). +That causes RTL8153B becomes unstable when suspending and resuming. The +worst case may let the device stop working. + +Besides, revert this commit to disable MAC clock speed down for RTL8153A. +It would avoid the known issue when enabling U1. The data of the first +control transfer may be wrong when exiting U1. + +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 35 ++++++----------------------------- + 1 file changed, 6 insertions(+), 29 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 88f177aca342..d2862071b697 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3033,29 +3033,6 @@ static void __rtl_set_wol(struct r8152 *tp, u32 wolopts) + device_set_wakeup_enable(&tp->udev->dev, false); + } + +-static void r8153_mac_clk_spd(struct r8152 *tp, bool enable) +-{ +- /* MAC clock speed down */ +- if (enable) { +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, +- ALDPS_SPDWN_RATIO); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, +- EEE_SPDWN_RATIO); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, +- PKT_AVAIL_SPDWN_EN | SUSPEND_SPDWN_EN | +- U1U2_SPDWN_EN | L1_SPDWN_EN); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, +- PWRSAVE_SPDWN_EN | RXDV_SPDWN_EN | TX10MIDLE_EN | +- TP100_SPDWN_EN | TP500_SPDWN_EN | EEE_SPDWN_EN | +- TP1000_SPDWN_EN); +- } else { +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0); +- ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0); +- } +-} +- + static void r8153_u1u2en(struct r8152 *tp, bool enable) + { + u8 u1u2[8]; +@@ -3355,11 +3332,9 @@ static void rtl8153_runtime_enable(struct r8152 *tp, bool enable) + if (enable) { + r8153_u1u2en(tp, false); + r8153_u2p3en(tp, false); +- r8153_mac_clk_spd(tp, true); + rtl_runtime_suspend_enable(tp, true); + } else { + rtl_runtime_suspend_enable(tp, false); +- r8153_mac_clk_spd(tp, false); + + switch (tp->version) { + case RTL_VER_03: +@@ -4695,7 +4670,6 @@ static void r8153_first_init(struct r8152 *tp) + { + u32 ocp_data; + +- r8153_mac_clk_spd(tp, false); + rxdy_gated_en(tp, true); + r8153_teredo_off(tp); + +@@ -4746,8 +4720,6 @@ static void r8153_enter_oob(struct r8152 *tp) + { + u32 ocp_data; + +- r8153_mac_clk_spd(tp, true); +- + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL); + ocp_data &= ~NOW_IS_OOB; + ocp_write_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL, ocp_data); +@@ -5473,10 +5445,15 @@ static void r8153_init(struct r8152 *tp) + + ocp_write_word(tp, MCU_TYPE_USB, USB_CONNECT_TIMER, 0x0001); + ++ /* MAC clock speed down */ ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL2, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL3, 0); ++ ocp_write_word(tp, MCU_TYPE_PLA, PLA_MAC_PWR_CTRL4, 0); ++ + r8153_power_cut_en(tp, false); + rtl_runtime_suspend_enable(tp, false); + r8153_u1u2en(tp, true); +- r8153_mac_clk_spd(tp, false); + usb_enable_lpm(tp->udev); + + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_CONFIG6); +-- +2.30.1 + diff --git a/queue-5.10/scsi-ufs-ufs-qcom-disable-interrupt-in-reset-path.patch b/queue-5.10/scsi-ufs-ufs-qcom-disable-interrupt-in-reset-path.patch new file mode 100644 index 00000000000..962d6fa601b --- /dev/null +++ b/queue-5.10/scsi-ufs-ufs-qcom-disable-interrupt-in-reset-path.patch @@ -0,0 +1,59 @@ +From fcfcc419e3c30b093f560914050db603ee6ad30c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Feb 2021 21:36:48 -0800 +Subject: scsi: ufs: ufs-qcom: Disable interrupt in reset path + +From: Nitin Rawat + +[ Upstream commit 4a791574a0ccf36eb3a0a46fbd71d2768df3eef9 ] + +Disable interrupt in reset path to flush pending IRQ handler in order to +avoid possible NoC issues. + +Link: https://lore.kernel.org/r/1614145010-36079-3-git-send-email-cang@codeaurora.org +Reviewed-by: Avri Altman +Signed-off-by: Nitin Rawat +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index a244c8ae1b4e..20182e39cb28 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -253,12 +253,17 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) + { + int ret = 0; + struct ufs_qcom_host *host = ufshcd_get_variant(hba); ++ bool reenable_intr = false; + + if (!host->core_reset) { + dev_warn(hba->dev, "%s: reset control not set\n", __func__); + goto out; + } + ++ reenable_intr = hba->is_irq_enabled; ++ disable_irq(hba->irq); ++ hba->is_irq_enabled = false; ++ + ret = reset_control_assert(host->core_reset); + if (ret) { + dev_err(hba->dev, "%s: core_reset assert failed, err = %d\n", +@@ -280,6 +285,11 @@ static int ufs_qcom_host_reset(struct ufs_hba *hba) + + usleep_range(1000, 1100); + ++ if (reenable_intr) { ++ enable_irq(hba->irq); ++ hba->is_irq_enabled = true; ++ } ++ + out: + return ret; + } +-- +2.30.1 + diff --git a/queue-5.10/series b/queue-5.10/series index a3af8c33a3a..7a6eca22046 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,2 +1,56 @@ mm-memcg-rename-mem_cgroup_split_huge_fixup-to-split_page_memcg-and-add-nr_pages-argument.patch mm-memcg-set-memcg-when-splitting-page.patch +mt76-fix-tx-skb-error-handling-in-mt76_dma_tx_queue_.patch +net-stmmac-fix-dma-physical-address-of-descriptor-wh.patch +net-fec-ptp-avoid-register-access-when-ipg-clock-is-.patch +powerpc-4xx-fix-build-errors-from-mfdcr.patch +atm-eni-dont-release-is-never-initialized.patch +atm-lanai-dont-run-lanai_dev_close-if-not-open.patch +revert-r8152-adjust-the-settings-about-mac-clock-spe.patch +alsa-hda-ignore-invalid-nhlt-table.patch +ixgbe-fix-memleak-in-ixgbe_configure_clsu32.patch +scsi-ufs-ufs-qcom-disable-interrupt-in-reset-path.patch +blk-cgroup-fix-the-recursive-blkg-rwstat.patch +net-tehuti-fix-error-return-code-in-bdx_probe.patch +net-intel-iavf-fix-error-return-code-of-iavf_init_ge.patch +sun-niu-fix-wrong-rxmac_bc_frm_cnt_count-count.patch +gianfar-fix-jumbo-packets-napi-rx-overrun-crash.patch +cifs-ask-for-more-credit-on-async-read-write-code-pa.patch +gfs2-fix-use-after-free-in-trans_drain.patch +cpufreq-blacklist-arm-vexpress-platforms-in-cpufreq-.patch +gpiolib-acpi-add-missing-irqf_oneshot.patch +nfs-fix-pnfs_flexfile_layout-kconfig-default.patch +nfs-correct-size-calculation-for-create-reply-length.patch +net-hisilicon-hns-fix-error-return-code-of-hns_nic_c.patch +net-wan-fix-error-return-code-of-uhdlc_init.patch +net-davicom-use-platform_get_irq_optional.patch +net-enetc-set-mac-rx-fifo-to-recommended-value.patch +atm-upd98402-fix-incorrect-allocation.patch +atm-idt77252-fix-null-ptr-dereference.patch +cifs-change-noisy-error-message-to-fyi.patch +irqchip-ingenic-add-support-for-the-jz4760.patch +kbuild-add-image_name-to-no-sync-config-targets.patch +kbuild-dummy-tools-fix-inverted-tests-for-gcc.patch +umem-fix-error-return-code-in-mm_pci_probe.patch +sparc64-fix-opcode-filtering-in-handling-of-no-fault.patch +habanalabs-call-put_pid-when-releasing-control-devic.patch +staging-rtl8192e-fix-kconfig-dependency-on-crypto.patch +u64_stats-lockdep-fix-u64_stats_init-vs-lockdep.patch +kselftest-arm64-fix-exit-code-of-sve-ptrace.patch +regulator-qcom-rpmh-correct-the-pmic5_hfsmps515-buck.patch +block-fix-req_op_zone_reset_all-handling.patch +drm-amd-display-revert-dram_clock_change_latency-for.patch +drm-amdgpu-fb-bo-should-be-ttm_bo_type_device.patch +drm-radeon-fix-agp-dependency.patch +nvme-simplify-error-logic-in-nvme_validate_ns.patch +nvme-add-nvme_req_cancelled-flag-in-nvme_cancel_requ.patch +nvme-fc-set-nvme_req_cancelled-in-nvme_fc_terminate_.patch +nvme-fc-return-nvme_sc_host_aborted_cmd-when-a-comma.patch +nvme-core-check-ctrl-css-before-setting-up-zns.patch +nvme-rdma-fix-a-use-after-free-in-nvmet_rdma_write_d.patch +nvme-pci-add-the-disable_write_zeroes-quirk-for-a-sa.patch +nfs-we-don-t-support-removing-system.nfs4_acl.patch +block-suppress-uevent-for-hidden-device-when-removed.patch +mm-fork-clear-pasid-for-new-mm.patch +ia64-fix-ia64_syscall_get_set_arguments-for-break-ba.patch +ia64-fix-ptrace-ptrace_syscall_info_exit-sign.patch diff --git a/queue-5.10/sparc64-fix-opcode-filtering-in-handling-of-no-fault.patch b/queue-5.10/sparc64-fix-opcode-filtering-in-handling-of-no-fault.patch new file mode 100644 index 00000000000..0dc32bb6248 --- /dev/null +++ b/queue-5.10/sparc64-fix-opcode-filtering-in-handling-of-no-fault.patch @@ -0,0 +1,74 @@ +From 2a334632a61470b4c5692559690176bf6012a382 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 22:48:16 -0700 +Subject: sparc64: Fix opcode filtering in handling of no fault loads + +From: Rob Gardner + +[ Upstream commit e5e8b80d352ec999d2bba3ea584f541c83f4ca3f ] + +is_no_fault_exception() has two bugs which were discovered via random +opcode testing with stress-ng. Both are caused by improper filtering +of opcodes. + +The first bug can be triggered by a floating point store with a no-fault +ASI, for instance "sta %f0, [%g0] #ASI_PNF", opcode C1A01040. + +The code first tests op3[5] (0x1000000), which denotes a floating +point instruction, and then tests op3[2] (0x200000), which denotes a +store instruction. But these bits are not mutually exclusive, and the +above mentioned opcode has both bits set. The intent is to filter out +stores, so the test for stores must be done first in order to have +any effect. + +The second bug can be triggered by a floating point load with one of +the invalid ASI values 0x8e or 0x8f, which pass this check in +is_no_fault_exception(): + if ((asi & 0xf2) == ASI_PNF) + +An example instruction is "ldqa [%l7 + %o7] #ASI 0x8f, %f38", +opcode CF95D1EF. Asi values greater than 0x8b (ASI_SNFL) are fatal +in handle_ldf_stq(), and is_no_fault_exception() must not allow these +invalid asi values to make it that far. + +In both of these cases, handle_ldf_stq() reacts by calling +sun4v_data_access_exception() or spitfire_data_access_exception(), +which call is_no_fault_exception() and results in an infinite +recursion. + +Signed-off-by: Rob Gardner +Tested-by: Anatoly Pugachev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/traps_64.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c +index d92e5eaa4c1d..a850dccd78ea 100644 +--- a/arch/sparc/kernel/traps_64.c ++++ b/arch/sparc/kernel/traps_64.c +@@ -275,14 +275,13 @@ bool is_no_fault_exception(struct pt_regs *regs) + asi = (regs->tstate >> 24); /* saved %asi */ + else + asi = (insn >> 5); /* immediate asi */ +- if ((asi & 0xf2) == ASI_PNF) { +- if (insn & 0x1000000) { /* op3[5:4]=3 */ +- handle_ldf_stq(insn, regs); +- return true; +- } else if (insn & 0x200000) { /* op3[2], stores */ ++ if ((asi & 0xf6) == ASI_PNF) { ++ if (insn & 0x200000) /* op3[2], stores */ + return false; +- } +- handle_ld_nf(insn, regs); ++ if (insn & 0x1000000) /* op3[5:4]=3 (fp) */ ++ handle_ldf_stq(insn, regs); ++ else ++ handle_ld_nf(insn, regs); + return true; + } + } +-- +2.30.1 + diff --git a/queue-5.10/staging-rtl8192e-fix-kconfig-dependency-on-crypto.patch b/queue-5.10/staging-rtl8192e-fix-kconfig-dependency-on-crypto.patch new file mode 100644 index 00000000000..1116c78edbe --- /dev/null +++ b/queue-5.10/staging-rtl8192e-fix-kconfig-dependency-on-crypto.patch @@ -0,0 +1,51 @@ +From 338488977832db3c36af7ef30c49e9a29b2948b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 13:06:07 -0500 +Subject: staging: rtl8192e: fix kconfig dependency on CRYPTO + +From: Julian Braha + +[ Upstream commit 7c36194558cf49a86a53b5f60db8046c5e3013ae ] + +When RTLLIB_CRYPTO_TKIP is enabled and CRYPTO is disabled, +Kbuild gives the following warning: + +WARNING: unmet direct dependencies detected for CRYPTO_MICHAEL_MIC + Depends on [n]: CRYPTO [=n] + Selected by [m]: + - RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m] + +WARNING: unmet direct dependencies detected for CRYPTO_LIB_ARC4 + Depends on [n]: CRYPTO [=n] + Selected by [m]: + - RTLLIB_CRYPTO_TKIP [=m] && STAGING [=y] && RTLLIB [=m] + - RTLLIB_CRYPTO_WEP [=m] && STAGING [=y] && RTLLIB [=m] + +This is because RTLLIB_CRYPTO_TKIP selects CRYPTO_MICHAEL_MIC and +CRYPTO_LIB_ARC4, without depending on or selecting CRYPTO, +despite those config options being subordinate to CRYPTO. + +Acked-by: Randy Dunlap +Signed-off-by: Julian Braha +Link: https://lore.kernel.org/r/20210222180607.399753-1-julianbraha@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192e/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/rtl8192e/Kconfig b/drivers/staging/rtl8192e/Kconfig +index 03fcc23516fd..6e7d84ac06f5 100644 +--- a/drivers/staging/rtl8192e/Kconfig ++++ b/drivers/staging/rtl8192e/Kconfig +@@ -26,6 +26,7 @@ config RTLLIB_CRYPTO_CCMP + config RTLLIB_CRYPTO_TKIP + tristate "Support for rtllib TKIP crypto" + depends on RTLLIB ++ select CRYPTO + select CRYPTO_LIB_ARC4 + select CRYPTO_MICHAEL_MIC + default y +-- +2.30.1 + diff --git a/queue-5.10/sun-niu-fix-wrong-rxmac_bc_frm_cnt_count-count.patch b/queue-5.10/sun-niu-fix-wrong-rxmac_bc_frm_cnt_count-count.patch new file mode 100644 index 00000000000..143c6a92a9f --- /dev/null +++ b/queue-5.10/sun-niu-fix-wrong-rxmac_bc_frm_cnt_count-count.patch @@ -0,0 +1,35 @@ +From 660a1f38f382a8949c76bcb93efae041a9c744f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Mar 2021 20:02:12 +0300 +Subject: sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count + +From: Denis Efremov + +[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ] + +RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row +in niu_xmac_interrupt(). Remove the second addition. + +Signed-off-by: Denis Efremov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/niu.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 68695d4afacd..707ccdd03b19 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -3931,8 +3931,6 @@ static void niu_xmac_interrupt(struct niu *np) + mp->rx_mcasts += RXMAC_MC_FRM_CNT_COUNT; + if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) + mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; +- if (val & XRXMAC_STATUS_RXBCAST_CNT_EXP) +- mp->rx_bcasts += RXMAC_BC_FRM_CNT_COUNT; + if (val & XRXMAC_STATUS_RXHIST1_CNT_EXP) + mp->rx_hist_cnt1 += RXMAC_HIST_CNT1_COUNT; + if (val & XRXMAC_STATUS_RXHIST2_CNT_EXP) +-- +2.30.1 + diff --git a/queue-5.10/u64_stats-lockdep-fix-u64_stats_init-vs-lockdep.patch b/queue-5.10/u64_stats-lockdep-fix-u64_stats_init-vs-lockdep.patch new file mode 100644 index 00000000000..a3393b98d24 --- /dev/null +++ b/queue-5.10/u64_stats-lockdep-fix-u64_stats_init-vs-lockdep.patch @@ -0,0 +1,64 @@ +From ebc1f9e1f0cff3e87ef7a01a3bb0b93af4485e5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 09:38:12 +0100 +Subject: u64_stats,lockdep: Fix u64_stats_init() vs lockdep + +From: Peter Zijlstra + +[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ] + +Jakub reported that: + + static struct net_device *rtl8139_init_board(struct pci_dev *pdev) + { + ... + u64_stats_init(&tp->rx_stats.syncp); + u64_stats_init(&tp->tx_stats.syncp); + ... + } + +results in lockdep getting confused between the RX and TX stats lock. +This is because u64_stats_init() is an inline calling seqcount_init(), +which is a macro using a static variable to generate a lockdep class. + +By wrapping that in an inline, we negate the effect of the macro and +fold the static key variable, hence the confusion. + +Fix by also making u64_stats_init() a macro for the case where it +matters, leaving the other case an inline for argument validation +etc. + +Reported-by: Jakub Kicinski +Debugged-by: "Ahmed S. Darwish" +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: "Erhard F." +Link: https://lkml.kernel.org/r/YEXicy6+9MksdLZh@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + include/linux/u64_stats_sync.h | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h +index c6abb79501b3..e81856c0ba13 100644 +--- a/include/linux/u64_stats_sync.h ++++ b/include/linux/u64_stats_sync.h +@@ -115,12 +115,13 @@ static inline void u64_stats_inc(u64_stats_t *p) + } + #endif + ++#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) ++#define u64_stats_init(syncp) seqcount_init(&(syncp)->seq) ++#else + static inline void u64_stats_init(struct u64_stats_sync *syncp) + { +-#if BITS_PER_LONG == 32 && defined(CONFIG_SMP) +- seqcount_init(&syncp->seq); +-#endif + } ++#endif + + static inline void u64_stats_update_begin(struct u64_stats_sync *syncp) + { +-- +2.30.1 + diff --git a/queue-5.10/umem-fix-error-return-code-in-mm_pci_probe.patch b/queue-5.10/umem-fix-error-return-code-in-mm_pci_probe.patch new file mode 100644 index 00000000000..ad8c6a0d0ae --- /dev/null +++ b/queue-5.10/umem-fix-error-return-code-in-mm_pci_probe.patch @@ -0,0 +1,49 @@ +From 07cc990fc0fec3c94e5aea12521869dc2e1b2018 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Mar 2021 12:35:01 +0000 +Subject: umem: fix error return code in mm_pci_probe() + +From: Wei Yongjun + +[ Upstream commit eeb05595d22c19c8f814ff893dcf88ec277a2365 ] + +Fix to return negative error code -ENOMEM from the blk_alloc_queue() +and dma_alloc_coherent() error handling cases instead of 0, as done +elsewhere in this function. + +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20210308123501.2573816-1-weiyongjun1@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/umem.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/umem.c b/drivers/block/umem.c +index 2b95d7b33b91..5eb44e4a91ee 100644 +--- a/drivers/block/umem.c ++++ b/drivers/block/umem.c +@@ -877,6 +877,7 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + if (card->mm_pages[0].desc == NULL || + card->mm_pages[1].desc == NULL) { + dev_printk(KERN_ERR, &card->dev->dev, "alloc failed\n"); ++ ret = -ENOMEM; + goto failed_alloc; + } + reset_page(&card->mm_pages[0]); +@@ -888,8 +889,10 @@ static int mm_pci_probe(struct pci_dev *dev, const struct pci_device_id *id) + spin_lock_init(&card->lock); + + card->queue = blk_alloc_queue(NUMA_NO_NODE); +- if (!card->queue) ++ if (!card->queue) { ++ ret = -ENOMEM; + goto failed_alloc; ++ } + + tasklet_init(&card->tasklet, process_page, (unsigned long)card); + +-- +2.30.1 +