From: Greg Kroah-Hartman Date: Mon, 24 Sep 2018 07:27:25 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v3.18.123~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7df9185b7bcb0081d0bb3a3db0cd9d57d26ecaf4;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch arm-hisi-fix-error-handling-and-missing-of_node_put.patch arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch audit-fix-use-after-free-in-audit_add_watch.patch binfmt_elf-respect-error-return-from-regset-active.patch coresight-handle-errors-in-finding-input-output-ports.patch coresight-tpiu-fix-disabling-timeouts.patch drm-amdkfd-fix-error-codes-in-kfd_get_process.patch drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch ib-nes-fix-a-compiler-warning.patch mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch mtdchar-fix-overflows-in-adjustment-of-count.patch parport-sunbpp-fix-error-return-code.patch pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch rtc-bq4802-add-error-handling-for-devm_ioremap.patch selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch --- diff --git a/queue-4.4/alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch b/queue-4.4/alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch new file mode 100644 index 00000000000..f27382b33d6 --- /dev/null +++ b/queue-4.4/alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch @@ -0,0 +1,68 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Timo Wischer +Date: Tue, 10 Jul 2018 17:28:45 +0200 +Subject: ALSA: pcm: Fix snd_interval_refine first/last with open min/max + +From: Timo Wischer + +[ Upstream commit ff2d6acdf6f13d9f8fdcd890844c6d7535ac1f10 ] + +Without this commit the following intervals [x y), (x y) were be +replaced to (y-1 y) by snd_interval_refine_last(). This was also done +if y-1 is part of the previous interval. +With this changes it will be replaced with [y-1 y) in case of y-1 is +part of the previous interval. A similar behavior will be used for +snd_interval_refine_first(). + +This commit adapts the changes for alsa-lib of commit +9bb985c ("pcm: snd_interval_refine_first/last: exclude value only if +also excluded before") + +Signed-off-by: Timo Wischer +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_lib.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + diff --git a/queue-4.4/arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch b/queue-4.4/arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch new file mode 100644 index 00000000000..768c617c74e --- /dev/null +++ b/queue-4.4/arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch @@ -0,0 +1,47 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Nicholas Mc Guire +Date: Thu, 12 Jul 2018 11:28:23 +0200 +Subject: ARM: hisi: check of_iomap and fix missing of_node_put + +From: Nicholas Mc Guire + +[ Upstream commit 81646a3d39ef14749301374a3a0b8311384cd412 ] + +of_find_compatible_node() returns a device node with refcount incremented +and thus needs an explicit of_node_put(). Further relying on an unchecked +of_iomap() which can return NULL is problematic here, after all ctrl_base +is critical enough for hix5hd2_set_cpu() to call BUG() if not available +so a check seems mandated here. + +Signed-off-by: Nicholas Mc Guire +0002 Fixes: commit 06cc5c1d4d73 ("ARM: hisi: enable hix5hd2 SoC") +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-hisi/hotplug.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -180,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) diff --git a/queue-4.4/arm-hisi-fix-error-handling-and-missing-of_node_put.patch b/queue-4.4/arm-hisi-fix-error-handling-and-missing-of_node_put.patch new file mode 100644 index 00000000000..141c550738e --- /dev/null +++ b/queue-4.4/arm-hisi-fix-error-handling-and-missing-of_node_put.patch @@ -0,0 +1,40 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Nicholas Mc Guire +Date: Thu, 12 Jul 2018 11:28:22 +0200 +Subject: ARM: hisi: fix error handling and missing of_node_put + +From: Nicholas Mc Guire + +[ Upstream commit 9f30b5ae0585ca5234fe979294b8f897299dec99 ] + +of_iomap() can return NULL which seems critical here and thus should be +explicitly flagged so that the cause of system halting can be understood. +As of_find_compatible_node() is returning a device node with refcount +incremented it must be explicitly decremented here. + +Signed-off-by: Nicholas Mc Guire +Fixes: commit 7fda91e73155 ("ARM: hisi: enable smp for HiP01") +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-hisi/hotplug.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -226,10 +226,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { diff --git a/queue-4.4/arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch b/queue-4.4/arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch new file mode 100644 index 00000000000..ef0ddfdbb4d --- /dev/null +++ b/queue-4.4/arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch @@ -0,0 +1,52 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Nicholas Mc Guire +Date: Thu, 12 Jul 2018 11:28:24 +0200 +Subject: ARM: hisi: handle of_iomap and fix missing of_node_put + +From: Nicholas Mc Guire + +[ Upstream commit d396cb185c0337aae5664b250cdd9a73f6eb1503 ] + +Relying on an unchecked of_iomap() which can return NULL is problematic +here, an explicit check seems mandatory. Also the call to +of_find_compatible_node() returns a device node with refcount incremented +therefor an explicit of_node_put() is needed here. + +Signed-off-by: Nicholas Mc Guire +Fixes: commit 22bae4290457 ("ARM: hi3xxx: add hotplug support") +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-hisi/hotplug.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) diff --git a/queue-4.4/audit-fix-use-after-free-in-audit_add_watch.patch b/queue-4.4/audit-fix-use-after-free-in-audit_add_watch.patch new file mode 100644 index 00000000000..9887cfe424a --- /dev/null +++ b/queue-4.4/audit-fix-use-after-free-in-audit_add_watch.patch @@ -0,0 +1,75 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Ronny Chevalier +Date: Wed, 11 Jul 2018 14:39:37 +0200 +Subject: audit: fix use-after-free in audit_add_watch + +From: Ronny Chevalier + +[ Upstream commit baa2a4fdd525c8c4b0f704d20457195b29437839 ] + +audit_add_watch stores locally krule->watch without taking a reference +on watch. Then, it calls audit_add_to_parent, and uses the watch stored +locally. + +Unfortunately, it is possible that audit_add_to_parent updates +krule->watch. +When it happens, it also drops a reference of watch which +could free the watch. + +How to reproduce (with KASAN enabled): + + auditctl -w /etc/passwd -F success=0 -k test_passwd + auditctl -w /etc/passwd -F success=1 -k test_passwd2 + +The second call to auditctl triggers the use-after-free, because +audit_to_parent updates krule->watch to use a previous existing watch +and drops the reference to the newly created watch. + +To fix the issue, we grab a reference of watch and we release it at the +end of the function. + +Signed-off-by: Ronny Chevalier +Reviewed-by: Richard Guy Briggs +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/audit_watch.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule * + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule * + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule * + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + diff --git a/queue-4.4/binfmt_elf-respect-error-return-from-regset-active.patch b/queue-4.4/binfmt_elf-respect-error-return-from-regset-active.patch new file mode 100644 index 00000000000..b1d92b00602 --- /dev/null +++ b/queue-4.4/binfmt_elf-respect-error-return-from-regset-active.patch @@ -0,0 +1,47 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: "Maciej W. Rozycki" +Date: Tue, 15 May 2018 23:32:45 +0100 +Subject: binfmt_elf: Respect error return from `regset->active' + +From: "Maciej W. Rozycki" + +[ Upstream commit 2f819db565e82e5f73cd42b39925098986693378 ] + +The regset API documented in defines -ENODEV as the +result of the `->active' handler to be used where the feature requested +is not available on the hardware found. However code handling core file +note generation in `fill_thread_core_info' interpretes any non-zero +result from the `->active' handler as the regset requested being active. +Consequently processing continues (and hopefully gracefully fails later +on) rather than being abandoned right away for the regset requested. + +Fix the problem then by making the code proceed only if a positive +result is returned from the `->active' handler. + +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Paul Burton +Fixes: 4206d3aa1978 ("elf core dump: notes user_regset") +Patchwork: https://patchwork.linux-mips.org/patch/19332/ +Cc: Alexander Viro +Cc: James Hogan +Cc: Ralf Baechle +Cc: linux-fsdevel@vger.kernel.org +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/binfmt_elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1707,7 +1707,7 @@ static int fill_thread_core_info(struct + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); diff --git a/queue-4.4/coresight-handle-errors-in-finding-input-output-ports.patch b/queue-4.4/coresight-handle-errors-in-finding-input-output-ports.patch new file mode 100644 index 00000000000..c0be4ae83a1 --- /dev/null +++ b/queue-4.4/coresight-handle-errors-in-finding-input-output-ports.patch @@ -0,0 +1,53 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Suzuki K Poulose +Date: Wed, 11 Jul 2018 13:40:28 -0600 +Subject: coresight: Handle errors in finding input/output ports + +From: Suzuki K Poulose + +[ Upstream commit fe470f5f7f684ed15bc49b6183a64237547910ff ] + +If we fail to find the input / output port for a LINK component +while enabling a path, we should fail gracefully rather than +assuming port "0". + +Cc: Mathieu Poirier +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -86,7 +86,7 @@ static int coresight_find_link_inport(st + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev) +@@ -107,7 +107,7 @@ static int coresight_find_link_outport(s + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev) +@@ -155,6 +155,9 @@ static int coresight_enable_link(struct + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); diff --git a/queue-4.4/coresight-tpiu-fix-disabling-timeouts.patch b/queue-4.4/coresight-tpiu-fix-disabling-timeouts.patch new file mode 100644 index 00000000000..6ec6da7907d --- /dev/null +++ b/queue-4.4/coresight-tpiu-fix-disabling-timeouts.patch @@ -0,0 +1,65 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Robin Murphy +Date: Wed, 11 Jul 2018 13:40:35 -0600 +Subject: coresight: tpiu: Fix disabling timeouts + +From: Robin Murphy + +[ Upstream commit ccff2dfaceaca4517432f5c149594215fe9098cc ] + +Probing the TPIU driver under UBSan triggers an out-of-bounds shift +warning in coresight_timeout(): + +... +[ 5.677530] UBSAN: Undefined behaviour in drivers/hwtracing/coresight/coresight.c:929:16 +[ 5.685542] shift exponent 64 is too large for 64-bit type 'long unsigned int' +... + +On closer inspection things are exponentially out of whack because we're +passing a bitmask where a bit number should be. Amusingly, it seems that +both calls will find their expected values by sheer luck and appear to +succeed: 1 << FFCR_FON_MAN ends up at bit 64 which whilst undefined +evaluates as zero in practice, while 1 << FFSR_FT_STOPPED finds bit 2 +(TCPresent) which apparently is usually tied high. + +Following the examples of other drivers, define separate FOO and FOO_BIT +macros for masks vs. indices, and put things right. + +CC: Robert Walker +CC: Mike Leach +CC: Mathieu Poirier +Fixes: 11595db8e17f ("coresight: Fix disabling of CoreSight TPIU") +Signed-off-by: Robin Murphy +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight-tpiu.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_ + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } diff --git a/queue-4.4/drm-amdkfd-fix-error-codes-in-kfd_get_process.patch b/queue-4.4/drm-amdkfd-fix-error-codes-in-kfd_get_process.patch new file mode 100644 index 00000000000..000fdb0bf2a --- /dev/null +++ b/queue-4.4/drm-amdkfd-fix-error-codes-in-kfd_get_process.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Wei Lu +Date: Wed, 11 Jul 2018 22:32:47 -0400 +Subject: drm/amdkfd: Fix error codes in kfd_get_process + +From: Wei Lu + +[ Upstream commit e47cb828eb3fca3e8999a0b9aa053dda18552071 ] + +Return ERR_PTR(-EINVAL) if kfd_get_process fails to find the process. +This fixes kernel oopses when a child process calls KFD ioctls with +a file descriptor inherited from the parent process. + +Signed-off-by: Wei Lu +Reviewed-by: Felix Kuehling +Signed-off-by: Felix Kuehling +Acked-by: Christian König +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_process.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -125,6 +125,8 @@ struct kfd_process *kfd_get_process(cons + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } diff --git a/queue-4.4/drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch b/queue-4.4/drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch new file mode 100644 index 00000000000..920d0959f3e --- /dev/null +++ b/queue-4.4/drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch @@ -0,0 +1,70 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Thierry Reding +Date: Wed, 30 May 2018 16:06:25 +0200 +Subject: drm/nouveau: tegra: Detach from ARM DMA/IOMMU mapping + +From: Thierry Reding + +[ Upstream commit b59fb482b52269977ee5de205308e5b236a03917 ] + +Depending on the kernel configuration, early ARM architecture setup code +may have attached the GPU to a DMA/IOMMU mapping that transparently uses +the IOMMU to back the DMA API. Tegra requires special handling for IOMMU +backed buffers (a special bit in the GPU's MMU page tables indicates the +memory path to take: via the SMMU or directly to the memory controller). +Transparently backing DMA memory with an IOMMU prevents Nouveau from +properly handling such memory accesses and causes memory access faults. + +As a side-note: buffers other than those allocated in instance memory +don't need to be physically contiguous from the GPU's perspective since +the GPU can map them into contiguous buffers using its own MMU. Mapping +these buffers through the IOMMU is unnecessary and will even lead to +performance degradation because of the additional translation. One +exception to this are compressible buffers which need large pages. In +order to enable these large pages, multiple small pages will have to be +combined into one large (I/O virtually contiguous) mapping via the +IOMMU. However, that is a topic outside the scope of this fix and isn't +currently supported. An implementation will want to explicitly create +these large pages in the Nouveau driver, so detaching from a DMA/IOMMU +mapping would still be required. + +Signed-off-by: Thierry Reding +Acked-by: Christoph Hellwig +Reviewed-by: Robin Murphy +Tested-by: Nicolas Chauvet +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -85,6 +89,15 @@ nvkm_device_tegra_probe_iommu(struct nvk + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + diff --git a/queue-4.4/drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch b/queue-4.4/drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch new file mode 100644 index 00000000000..06015673ea8 --- /dev/null +++ b/queue-4.4/drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Dan Carpenter +Date: Wed, 4 Jul 2018 12:38:09 +0300 +Subject: drm/panel: type promotion bug in s6e8aa0_read_mtp_id() + +From: Dan Carpenter + +[ Upstream commit cd0e0ca69109d025b1a1b6609f70682db62138b0 ] + +The ARRAY_SIZE() macro is type size_t. If s6e8aa0_dcs_read() returns a +negative error code, then "ret < ARRAY_SIZE(id)" is false because the +negative error code is type promoted to a high positive value. + +Fixes: 02051ca06371 ("drm/panel: add S6E8AA0 driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrzej Hajda +Signed-off-by: Thierry Reding +Link: https://patchwork.freedesktop.org/patch/msgid/20180704093807.s3lqsb2v6dg2k43d@kili.mountain +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; diff --git a/queue-4.4/gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch b/queue-4.4/gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch new file mode 100644 index 00000000000..2c16addb5fb --- /dev/null +++ b/queue-4.4/gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch @@ -0,0 +1,43 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Andy Shevchenko +Date: Mon, 9 Jul 2018 21:47:27 +0300 +Subject: gpiolib: Mark gpio_suffixes array with __maybe_unused + +From: Andy Shevchenko + +[ Upstream commit b23ec59926faf05b0c43680d05671c484e810ac4 ] + +Since we put static variable to a header file it's copied to each module +that includes the header. But not all of them are actually used it. + +Mark gpio_suffixes array with __maybe_unused to hide a compiler warning: + +In file included from +drivers/gpio/gpiolib-legacy.c:6:0: +drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=] + static const char * const gpio_suffixes[] = { "gpios", "gpio" }; + ^~~~~~~~~~~~~ +In file included from drivers/gpio/gpiolib-devprop.c:17:0: +drivers/gpio/gpiolib.h:95:27: warning: ‘gpio_suffixes’ defined but not used [-Wunused-const-variable=] + static const char * const gpio_suffixes[] = { "gpios", "gpio" }; + ^~~~~~~~~~~~~ + +Signed-off-by: Andy Shevchenko +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -30,7 +30,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_ACPI + void acpi_gpiochip_add(struct gpio_chip *chip); diff --git a/queue-4.4/ib-nes-fix-a-compiler-warning.patch b/queue-4.4/ib-nes-fix-a-compiler-warning.patch new file mode 100644 index 00000000000..7d5e6d65880 --- /dev/null +++ b/queue-4.4/ib-nes-fix-a-compiler-warning.patch @@ -0,0 +1,33 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Bart Van Assche +Date: Thu, 5 Jul 2018 10:51:35 -0700 +Subject: IB/nes: Fix a compiler warning + +From: Bart Van Assche + +[ Upstream commit 4c5743bc4fe3233cecc1c184a773c79c8ee45bbe ] + +Avoid that the following compiler warning is reported when building with +W=1: + +drivers/infiniband/hw/nes/nes_hw.c:646:51: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] + +Signed-off-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/nes/nes.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/nes/nes.h ++++ b/drivers/infiniband/hw/nes/nes.h +@@ -156,7 +156,7 @@ do { \ + + #define NES_EVENT_TIMEOUT 1200000 + #else +-#define nes_debug(level, fmt, args...) ++#define nes_debug(level, fmt, args...) do {} while (0) + #define assert(expr) do {} while (0) + + #define NES_EVENT_TIMEOUT 100000 diff --git a/queue-4.4/mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch b/queue-4.4/mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch new file mode 100644 index 00000000000..304e06919d9 --- /dev/null +++ b/queue-4.4/mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch @@ -0,0 +1,49 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Paul Burton +Date: Mon, 16 Jul 2018 08:26:36 -0700 +Subject: MIPS: loongson64: cs5536: Fix PCI_OHCI_INT_REG reads + +From: Paul Burton + +[ Upstream commit cd87668d601f622e0ebcfea4f78d116d5f572f4d ] + +The PCI_OHCI_INT_REG case in pci_ohci_read_reg() contains the following +if statement: + + if ((lo & 0x00000f00) == CS5536_USB_INTR) + +CS5536_USB_INTR expands to the constant 11, which gives us the following +condition which can never evaluate true: + + if ((lo & 0xf00) == 11) + +At least when using GCC 8.1.0 this falls foul of the tautoligcal-compare +warning, and since the code is built with the -Werror flag the build +fails. + +Fix this by shifting lo right by 8 bits in order to match the +corresponding PCI_OHCI_INT_REG case in pci_ohci_write_reg(). + +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/19861/ +Cc: Huacai Chen +Cc: James Hogan +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/loongson64/common/cs5536/cs5536_ohci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: diff --git a/queue-4.4/mtdchar-fix-overflows-in-adjustment-of-count.patch b/queue-4.4/mtdchar-fix-overflows-in-adjustment-of-count.patch new file mode 100644 index 00000000000..01b7675338d --- /dev/null +++ b/queue-4.4/mtdchar-fix-overflows-in-adjustment-of-count.patch @@ -0,0 +1,53 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Jann Horn +Date: Sat, 7 Jul 2018 05:37:22 +0200 +Subject: mtdchar: fix overflows in adjustment of `count` + +From: Jann Horn + +[ Upstream commit 6c6bc9ea84d0008024606bf5ba10519e20d851bf ] + +The first checks in mtdchar_read() and mtdchar_write() attempt to limit +`count` such that `*ppos + count <= mtd->size`. However, they ignore the +possibility of `*ppos > mtd->size`, allowing the calculation of `count` to +wrap around. `mtdchar_lseek()` prevents seeking beyond mtd->size, but the +pread/pwrite syscalls bypass this. + +I haven't found any codepath on which this actually causes dangerous +behavior, but it seems like a sensible change anyway. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Jann Horn +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/mtdchar.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) diff --git a/queue-4.4/parport-sunbpp-fix-error-return-code.patch b/queue-4.4/parport-sunbpp-fix-error-return-code.patch new file mode 100644 index 00000000000..da6dea32e94 --- /dev/null +++ b/queue-4.4/parport-sunbpp-fix-error-return-code.patch @@ -0,0 +1,44 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Julia Lawall +Date: Thu, 12 Jul 2018 22:29:55 +0100 +Subject: parport: sunbpp: fix error return code + +From: Julia Lawall + +[ Upstream commit faa1a47388b33623e4d504c23569188907b039a0 ] + +Return an error code on failure. Change leading spaces to tab on the +first if. + +Problem found using Coccinelle. + +Signed-off-by: Julia Lawall +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parport/parport_sunbpp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_dev + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; diff --git a/queue-4.4/pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch b/queue-4.4/pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch new file mode 100644 index 00000000000..d5087b5b18c --- /dev/null +++ b/queue-4.4/pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch @@ -0,0 +1,103 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Douglas Anderson +Date: Mon, 2 Jul 2018 15:59:39 -0700 +Subject: pinctrl: qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant + +From: Douglas Anderson + +[ Upstream commit 1cf86bc21257a330e3af51f2a4e885f1a705f6a5 ] + +If you do this on an sdm845 board: + grep "" /sys/kernel/debug/pinctrl/*spmi:pmic*/pinconf-groups + +...it looks like nonsense. For every pin you see listed: + input bias disabled, input bias high impedance, input bias pull down, input bias pull up, ... + +That's because pmic_gpio_config_get() isn't complying with the rules +that pinconf_generic_dump_one() expects. Specifically for boolean +parameters (anything with a "struct pin_config_item" where has_arg is +false) the function expects that the function should return its value +not through the "config" parameter but should return "0" if the value +is set and "-EINVAL" if the value isn't set. + +Let's fix this. + +>From a quick sample of other pinctrl drivers, it appears to be +tradition to also return 1 through the config parameter for these +boolean parameters when they exist. I'm not one to knock tradition, +so I'll follow tradition and return 1 in these cases. While I'm at +it, I'll also continue searching for four leaf clovers, kocking on +wood three times, and trying not to break mirrors. + +NOTE: This also fixes an apparent typo for reading +PIN_CONFIG_BIAS_DISABLE where the old driver was accidentally +using "=" instead of "==" and thus was setting some internal +state when you tried to query PIN_CONFIG_BIAS_DISABLE. Oops. + +Fixes: eadff3024472 ("pinctrl: Qualcomm SPMI PMIC GPIO pin controller driver") +Signed-off-by: Douglas Anderson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 32 +++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -291,31 +291,47 @@ static int pmic_gpio_config_get(struct p + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; diff --git a/queue-4.4/rtc-bq4802-add-error-handling-for-devm_ioremap.patch b/queue-4.4/rtc-bq4802-add-error-handling-for-devm_ioremap.patch new file mode 100644 index 00000000000..4611cd03f29 --- /dev/null +++ b/queue-4.4/rtc-bq4802-add-error-handling-for-devm_ioremap.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: Zhouyang Jia +Date: Tue, 12 Jun 2018 12:40:03 +0800 +Subject: rtc: bq4802: add error handling for devm_ioremap + +From: Zhouyang Jia + +[ Upstream commit 7874b919866ba91bac253fa219d3d4c82bb944df ] + +When devm_ioremap fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling devm_ioremap. + +Signed-off-by: Zhouyang Jia +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-bq4802.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_ + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { diff --git a/queue-4.4/selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch b/queue-4.4/selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch new file mode 100644 index 00000000000..72b18062fa3 --- /dev/null +++ b/queue-4.4/selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch @@ -0,0 +1,52 @@ +From foo@baz Mon Sep 24 09:26:11 CEST 2018 +From: John Stultz +Date: Tue, 29 May 2018 19:12:18 -0700 +Subject: selftest: timers: Tweak raw_skew to SKIP when ADJ_OFFSET/other clock adjustments are in progress + +From: John Stultz + +[ Upstream commit 1416270f4a1ae83ea84156ceba19a66a8f88be1f ] + +In the past we've warned when ADJ_OFFSET was in progress, usually +caused by ntpd or some other time adjusting daemon running in non +steady sate, which can cause the skew calculations to be +incorrect. + +Thus, this patch checks to see if the clock was being adjusted +when we fail so that we don't cause false negatives. + +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: Miroslav Lichvar +Cc: Richard Cochran +Cc: Prarit Bhargava +Cc: Stephen Boyd +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Suggested-by: Miroslav Lichvar +Signed-off-by: John Stultz +Signed-off-by: Greg Kroah-Hartman +--- +v2: Widened the checks to look for other clock adjustments that + could happen, as suggested by Miroslav +v3: Fixed up commit message +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/timers/raw_skew.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } diff --git a/queue-4.4/series b/queue-4.4/series index e2623e03805..a50e1269374 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -44,3 +44,22 @@ usb-yurex-fix-buffer-over-read-in-yurex_write.patch usb-cdc-wdm-fix-a-sleep-in-atomic-context-bug-in-service_outstanding_interrupt.patch cifs-prevent-integer-overflow-in-nxt_dir_entry.patch cifs-fix-wrapping-bugs-in-num_entries.patch +binfmt_elf-respect-error-return-from-regset-active.patch +audit-fix-use-after-free-in-audit_add_watch.patch +mtdchar-fix-overflows-in-adjustment-of-count.patch +mips-loongson64-cs5536-fix-pci_ohci_int_reg-reads.patch +arm-hisi-handle-of_iomap-and-fix-missing-of_node_put.patch +arm-hisi-fix-error-handling-and-missing-of_node_put.patch +arm-hisi-check-of_iomap-and-fix-missing-of_node_put.patch +drm-nouveau-tegra-detach-from-arm-dma-iommu-mapping.patch +parport-sunbpp-fix-error-return-code.patch +coresight-handle-errors-in-finding-input-output-ports.patch +coresight-tpiu-fix-disabling-timeouts.patch +gpiolib-mark-gpio_suffixes-array-with-__maybe_unused.patch +drm-amdkfd-fix-error-codes-in-kfd_get_process.patch +rtc-bq4802-add-error-handling-for-devm_ioremap.patch +alsa-pcm-fix-snd_interval_refine-first-last-with-open-min-max.patch +selftest-timers-tweak-raw_skew-to-skip-when-adj_offset-other-clock-adjustments-are-in-progress.patch +drm-panel-type-promotion-bug-in-s6e8aa0_read_mtp_id.patch +ib-nes-fix-a-compiler-warning.patch +pinctrl-qcom-spmi-gpio-fix-pmic_gpio_config_get-to-be-compliant.patch