From: Greg Kroah-Hartman Date: Sun, 11 Nov 2018 18:14:40 +0000 (-0800) Subject: 4.18-stable patches X-Git-Tag: v4.19.2~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=84bfd92b9c44c9a03a1d371383ede6dd99a7eae3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.18-stable patches added patches: arm-dts-socfpga-fix-sdram-node-address-for-arria10.patch arm64-dts-stratix10-correct-system-manager-register-size.patch cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch rpmsg-smd-fix-memory-leak-on-channel-create.patch selftests-ftrace-fix-synthetic-event-test-to-delete-event-correctly.patch selftests-powerpc-fix-ptrace-tm-failure.patch soc-qcom-rmtfs-mem-validate-that-scm-is-available.patch soc-tegra-pmc-fix-child-node-lookup.patch tracing-return-enoent-if-there-is-no-target-synthetic-event.patch --- diff --git a/queue-4.18/arm-dts-socfpga-fix-sdram-node-address-for-arria10.patch b/queue-4.18/arm-dts-socfpga-fix-sdram-node-address-for-arria10.patch new file mode 100644 index 00000000000..7218a4c7c1f --- /dev/null +++ b/queue-4.18/arm-dts-socfpga-fix-sdram-node-address-for-arria10.patch @@ -0,0 +1,33 @@ +From ce3bf934f919a7d675c5b7fa4cc233ded9c6256e Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Tue, 25 Sep 2018 10:21:10 -0500 +Subject: ARM: dts: socfpga: Fix SDRAM node address for Arria10 + +From: Thor Thayer + +commit ce3bf934f919a7d675c5b7fa4cc233ded9c6256e upstream. + +The address in the SDRAM node was incorrect. Fix this to agree with the +correct address and to match the reg definition block. + +Cc: stable@vger.kernel.org +Fixes: 54b4a8f57848b("arm: socfpga: dts: Add Arria10 SDRAM EDAC DTS support") +Signed-off-by: Thor Thayer +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/socfpga_arria10.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -601,7 +601,7 @@ + status = "disabled"; + }; + +- sdr: sdr@ffc25000 { ++ sdr: sdr@ffcfb100 { + compatible = "altr,sdr-ctl", "syscon"; + reg = <0xffcfb100 0x80>; + }; diff --git a/queue-4.18/arm64-dts-stratix10-correct-system-manager-register-size.patch b/queue-4.18/arm64-dts-stratix10-correct-system-manager-register-size.patch new file mode 100644 index 00000000000..57dc5f7ff22 --- /dev/null +++ b/queue-4.18/arm64-dts-stratix10-correct-system-manager-register-size.patch @@ -0,0 +1,32 @@ +From 74121b9aa3cd571ddfff014a9f47db36cae3cda9 Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Tue, 25 Sep 2018 10:31:52 -0500 +Subject: arm64: dts: stratix10: Correct System Manager register size + +From: Thor Thayer + +commit 74121b9aa3cd571ddfff014a9f47db36cae3cda9 upstream. + +Correct the register size of the System Manager node. + +Cc: stable@vger.kernel.org +Fixes: 78cd6a9d8e154 ("arm64: dts: Add base stratix 10 dtsi") +Signed-off-by: Thor Thayer +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi ++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10.dtsi +@@ -327,7 +327,7 @@ + + sysmgr: sysmgr@ffd12000 { + compatible = "altr,sys-mgr", "syscon"; +- reg = <0xffd12000 0x1000>; ++ reg = <0xffd12000 0x228>; + }; + + /* Local timer */ diff --git a/queue-4.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch b/queue-4.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch new file mode 100644 index 00000000000..7d229b6d63c --- /dev/null +++ b/queue-4.18/cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch @@ -0,0 +1,34 @@ +From 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 Mon Sep 17 00:00:00 2001 +From: Nicolas Pitre +Date: Tue, 30 Oct 2018 13:26:15 -0400 +Subject: Cramfs: fix abad comparison when wrap-arounds occur + +From: Nicolas Pitre + +commit 672ca9dd13f1aca0c17516f76fc5b0e8344b3e46 upstream. + +It is possible for corrupted filesystem images to produce very large +block offsets that may wrap when a length is added, and wrongly pass +the buffer size test. + +Reported-by: Anatoly Trosinenko +Signed-off-by: Nicolas Pitre +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cramfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/cramfs/inode.c ++++ b/fs/cramfs/inode.c +@@ -202,7 +202,8 @@ static void *cramfs_blkdev_read(struct s + continue; + blk_offset = (blocknr - buffer_blocknr[i]) << PAGE_SHIFT; + blk_offset += offset; +- if (blk_offset + len > BUFFER_SIZE) ++ if (blk_offset > BUFFER_SIZE || ++ blk_offset + len > BUFFER_SIZE) + continue; + return read_buffers[i] + blk_offset; + } diff --git a/queue-4.18/rpmsg-smd-fix-memory-leak-on-channel-create.patch b/queue-4.18/rpmsg-smd-fix-memory-leak-on-channel-create.patch new file mode 100644 index 00000000000..1c40af0164b --- /dev/null +++ b/queue-4.18/rpmsg-smd-fix-memory-leak-on-channel-create.patch @@ -0,0 +1,48 @@ +From 940c620d6af8fca7d115de40f19870fba415efac Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 27 Sep 2018 22:36:27 +0100 +Subject: rpmsg: smd: fix memory leak on channel create + +From: Colin Ian King + +commit 940c620d6af8fca7d115de40f19870fba415efac upstream. + +Currently a failed allocation of channel->name leads to an +immediate return without freeing channel. Fix this by setting +ret to -ENOMEM and jumping to an exit path that kfree's channel. + +Detected by CoverityScan, CID#1473692 ("Resource Leak") + +Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") +Cc: stable@vger.kernel.org +Signed-off-by: Colin Ian King +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rpmsg/qcom_smd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1114,8 +1114,10 @@ static struct qcom_smd_channel *qcom_smd + + channel->edge = edge; + channel->name = kstrdup(name, GFP_KERNEL); +- if (!channel->name) +- return ERR_PTR(-ENOMEM); ++ if (!channel->name) { ++ ret = -ENOMEM; ++ goto free_channel; ++ } + + spin_lock_init(&channel->tx_lock); + spin_lock_init(&channel->recv_lock); +@@ -1165,6 +1167,7 @@ static struct qcom_smd_channel *qcom_smd + + free_name_and_channel: + kfree(channel->name); ++free_channel: + kfree(channel); + + return ERR_PTR(ret); diff --git a/queue-4.18/selftests-ftrace-fix-synthetic-event-test-to-delete-event-correctly.patch b/queue-4.18/selftests-ftrace-fix-synthetic-event-test-to-delete-event-correctly.patch new file mode 100644 index 00000000000..699bc1bb659 --- /dev/null +++ b/queue-4.18/selftests-ftrace-fix-synthetic-event-test-to-delete-event-correctly.patch @@ -0,0 +1,70 @@ +From 0d0352d8b3d6d7ca9a710b40e194cbbaeb841c88 Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Mon, 22 Oct 2018 00:08:48 +0900 +Subject: selftests/ftrace: Fix synthetic event test to delete event correctly + +From: Masami Hiramatsu + +commit 0d0352d8b3d6d7ca9a710b40e194cbbaeb841c88 upstream. + +Fix the synthetic event test case to remove event correctly. +If redirecting command to synthetic_event file without append +mode, it cleans up all existing events and execute (parse) the +command. This means "delete event" always fails to find the +target event. + +Since previous synthetic event has a bug which doesn't return +-ENOENT even if it fails to find the deleting event, this test +passed. But fixing that bug, this test fails because this test +itself has a bug. + +This fixes that bug by trying to delete event right after +adding an event, and use append mode redirection ('>>') instead +of normal redirection ('>'). + +Link: http://lkml.kernel.org/r/154013452832.25576.2305459545429386517.stgit@devbox + +Acked-by: Shuah Khan +Acked-by: Tom Zanussi +Tested-by: Tom Zanussi +Cc: Tom Zanussi +Cc: Tom Zanussi +Cc: Rajvi Jingar +Cc: Shuah Khan +Cc: stable@vger.kernel.org +Fixes: f06eec4d0f2c ('selftests: ftrace: Add inter-event hist triggers testcases') +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc | 12 +++++----- + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-synthetic-event-createremove.tc +@@ -35,18 +35,18 @@ fi + + reset_trigger + +-echo "Test create synthetic event with an error" +-echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null ++echo "Test remove synthetic event" ++echo '!wakeup_latency u64 lat pid_t pid char comm[16]' >> synthetic_events + if [ -d events/synthetic/wakeup_latency ]; then +- fail "Created wakeup_latency synthetic event with an invalid format" ++ fail "Failed to delete wakeup_latency synthetic event" + fi + + reset_trigger + +-echo "Test remove synthetic event" +-echo '!wakeup_latency u64 lat pid_t pid char comm[16]' > synthetic_events ++echo "Test create synthetic event with an error" ++echo 'wakeup_latency u64 lat pid_t pid char' > synthetic_events > /dev/null + if [ -d events/synthetic/wakeup_latency ]; then +- fail "Failed to delete wakeup_latency synthetic event" ++ fail "Created wakeup_latency synthetic event with an invalid format" + fi + + do_reset diff --git a/queue-4.18/selftests-powerpc-fix-ptrace-tm-failure.patch b/queue-4.18/selftests-powerpc-fix-ptrace-tm-failure.patch new file mode 100644 index 00000000000..34ca4184385 --- /dev/null +++ b/queue-4.18/selftests-powerpc-fix-ptrace-tm-failure.patch @@ -0,0 +1,60 @@ +From 48dc0ef19044bfb69193302fbe3a834e3331b7ae Mon Sep 17 00:00:00 2001 +From: Breno Leitao +Date: Mon, 22 Oct 2018 18:16:26 -0300 +Subject: selftests/powerpc: Fix ptrace tm failure + +From: Breno Leitao + +commit 48dc0ef19044bfb69193302fbe3a834e3331b7ae upstream. + +Test ptrace-tm-spd-gpr fails on current kernel (4.19) due to a segmentation +fault that happens on the child process prior to setting cptr[2] = 1. This +causes the parent process to wait forever at 'while (!pptr[2])' and the test to +be killed by the test harness framework by timeout, thus, failing. + +The segmentation fault happens because of a inline assembly being +generated as: + + 0x10000355c lfs f0, 0(0) + +This is reading memory position 0x0 and causing the segmentation fault. + +This code is being generated by ASM_LOAD_FPR_SINGLE_PRECISION(flt_4), where +flt_4 is passed to the inline assembly block as: + + [flt_4] "r" (&d) + +Since the inline assembly 'r' constraint means any GPR, gpr0 is being +chosen, thus causing this issue when issuing a Load Floating-Point Single +instruction. + +This patch simply changes the constraint to 'b', which specify that this +register will be used as base, and r0 is not allowed to be used, avoiding +this issue. + +Other than that, removing flt_2 register from the input operands, since it +is not used by the inline assembly code at all. + +Cc: stable@vger.kernel.org +Signed-off-by: Breno Leitao +Acked-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-gpr.c +@@ -67,8 +67,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2), [gpr_4]"i"(GPR_4), +- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a), +- [flt_2] "r" (&b), [flt_4] "r" (&d) ++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a), ++ [flt_4] "b" (&d) + : "memory", "r5", "r6", "r7", + "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15", + "r16", "r17", "r18", "r19", "r20", "r21", "r22", "r23", diff --git a/queue-4.18/series b/queue-4.18/series index bd3000d20fd..4429e26b7b8 100644 --- a/queue-4.18/series +++ b/queue-4.18/series @@ -306,3 +306,12 @@ media-media-colorspaces-.rst-rename-adobergb-to-oprgb.patch media-replace-adobergb-by-oprgb.patch media-hdmi.h-rename-adobe_rgb-to-oprgb-and-adobe_ycc-to-opycc.patch arm64-lse-remove-fcall-used-x0-flag.patch +rpmsg-smd-fix-memory-leak-on-channel-create.patch +cramfs-fix-abad-comparison-when-wrap-arounds-occur.patch +arm-dts-socfpga-fix-sdram-node-address-for-arria10.patch +arm64-dts-stratix10-correct-system-manager-register-size.patch +soc-qcom-rmtfs-mem-validate-that-scm-is-available.patch +soc-tegra-pmc-fix-child-node-lookup.patch +selftests-ftrace-fix-synthetic-event-test-to-delete-event-correctly.patch +selftests-powerpc-fix-ptrace-tm-failure.patch +tracing-return-enoent-if-there-is-no-target-synthetic-event.patch diff --git a/queue-4.18/soc-qcom-rmtfs-mem-validate-that-scm-is-available.patch b/queue-4.18/soc-qcom-rmtfs-mem-validate-that-scm-is-available.patch new file mode 100644 index 00000000000..05a96c4c801 --- /dev/null +++ b/queue-4.18/soc-qcom-rmtfs-mem-validate-that-scm-is-available.patch @@ -0,0 +1,37 @@ +From 137dc5843faeacabf48fc22a8dc58c4e0b4f0927 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Mon, 27 Aug 2018 22:05:48 -0700 +Subject: soc: qcom: rmtfs-mem: Validate that scm is available + +From: Bjorn Andersson + +commit 137dc5843faeacabf48fc22a8dc58c4e0b4f0927 upstream. + +The scm device must be present in order for the rmtfs driver to +configure memory permissions for the rmtfs memory region, so check that +it is probed before continuing. + +Cc: stable@vger.kernel.org +Fixes: fa65f8045137 ("soc: qcom: rmtfs-mem: Add support for assigning memory to remote") +Signed-off-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/qcom/rmtfs_mem.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/soc/qcom/rmtfs_mem.c ++++ b/drivers/soc/qcom/rmtfs_mem.c +@@ -212,6 +212,11 @@ static int qcom_rmtfs_mem_probe(struct p + dev_err(&pdev->dev, "failed to parse qcom,vmid\n"); + goto remove_cdev; + } else if (!ret) { ++ if (!qcom_scm_is_available()) { ++ ret = -EPROBE_DEFER; ++ goto remove_cdev; ++ } ++ + perms[0].vmid = QCOM_SCM_VMID_HLOS; + perms[0].perm = QCOM_SCM_PERM_RW; + perms[1].vmid = vmid; diff --git a/queue-4.18/soc-tegra-pmc-fix-child-node-lookup.patch b/queue-4.18/soc-tegra-pmc-fix-child-node-lookup.patch new file mode 100644 index 00000000000..b056d7ea300 --- /dev/null +++ b/queue-4.18/soc-tegra-pmc-fix-child-node-lookup.patch @@ -0,0 +1,39 @@ +From 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 15 Nov 2017 10:44:58 +0100 +Subject: soc/tegra: pmc: Fix child-node lookup + +From: Johan Hovold + +commit 1dc6bd5e39a29453bdcc17348dd2a89f1aa4004e upstream. + +Fix child-node lookup during probe, which ended up searching the whole +device tree depth-first starting at the parent rather than just matching +on its children. + +To make things worse, the parent pmc node could end up being prematurely +freed as of_find_node_by_name() drops a reference to its first argument. + +Fixes: 3568df3d31d6 ("soc: tegra: Add thermal reset (thermtrip) support to PMC") +Cc: stable # 4.0 +Cc: Mikko Perttunen +Signed-off-by: Johan Hovold +Reviewed-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/tegra/pmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -1288,7 +1288,7 @@ static void tegra_pmc_init_tsense_reset( + if (!pmc->soc->has_tsense_reset) + return; + +- np = of_find_node_by_name(pmc->dev->of_node, "i2c-thermtrip"); ++ np = of_get_child_by_name(pmc->dev->of_node, "i2c-thermtrip"); + if (!np) { + dev_warn(dev, "i2c-thermtrip node not found, %s.\n", disabled); + return; diff --git a/queue-4.18/tracing-return-enoent-if-there-is-no-target-synthetic-event.patch b/queue-4.18/tracing-return-enoent-if-there-is-no-target-synthetic-event.patch new file mode 100644 index 00000000000..b1fe35868e0 --- /dev/null +++ b/queue-4.18/tracing-return-enoent-if-there-is-no-target-synthetic-event.patch @@ -0,0 +1,46 @@ +From 18858511fd8a877303cc34c06efa461b26a0e070 Mon Sep 17 00:00:00 2001 +From: Masami Hiramatsu +Date: Mon, 22 Oct 2018 00:08:20 +0900 +Subject: tracing: Return -ENOENT if there is no target synthetic event + +From: Masami Hiramatsu + +commit 18858511fd8a877303cc34c06efa461b26a0e070 upstream. + +Return -ENOENT error if there is no target synthetic event. +This notices an operation failure to user as below; + + # echo 'wakeup_latency u64 lat; pid_t pid;' > synthetic_events + # echo '!wakeup' >> synthetic_events + sh: write error: No such file or directory + +Link: http://lkml.kernel.org/r/154013449986.25576.9487131386597290172.stgit@devbox + +Acked-by: Tom Zanussi +Tested-by: Tom Zanussi +Cc: Shuah Khan +Cc: Rajvi Jingar +Cc: stable@vger.kernel.org +Fixes: 4b147936fa50 ('tracing: Add support for 'synthetic' events') +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_events_hist.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -1072,8 +1072,10 @@ static int create_synth_event(int argc, + event = NULL; + ret = -EEXIST; + goto out; +- } else if (delete_event) ++ } else if (delete_event) { ++ ret = -ENOENT; + goto out; ++ } + + if (argc < 2) { + ret = -EINVAL;