From: Greg Kroah-Hartman Date: Sat, 30 Mar 2019 20:24:11 +0000 (+0100) Subject: 5.0-stable patches X-Git-Tag: v3.18.138~30 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=955d73e0dcd7d05222a7402096287d685813e22a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.0-stable patches added patches: blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch cpufreq-scpi-fix-use-after-free.patch disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch drm-i915-mark-aml-0x87ca-as-ulx.patch drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch usb-common-consider-only-available-nodes-for-dr_mode.patch usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch usb-mtu3-fix-extcon-dependency.patch --- diff --git a/queue-5.0/blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch b/queue-5.0/blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch new file mode 100644 index 00000000000..e7f8843a8b0 --- /dev/null +++ b/queue-5.0/blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch @@ -0,0 +1,81 @@ +From e861857545567adec8da3bdff728efdf7db12285 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Mon, 25 Mar 2019 12:34:10 -0600 +Subject: blk-mq: fix sbitmap ws_active for shared tags + +From: Jens Axboe + +commit e861857545567adec8da3bdff728efdf7db12285 upstream. + +We now wrap sbitmap waitqueues in an active counter, so we can avoid +iterating wakeups unless we have waiters there. This works as long as +everyone that's manipulating the waitqueues use the proper helpers. For +the tag wait case for shared tags, however, we add ourselves to the +waitqueue without incrementing/decrementing the ->ws_active count. This +means that wakeups can take a long time to happen. + +Fix this by manually doing the inc/dec as needed for the wait queue +handling. + +Reported-by: Michael Leun +Tested-by: Michael Leun +Cc: stable@vger.kernel.org +Reviewed-by: Omar Sandoval +Fixes: 5d2ee7122c73 ("sbitmap: optimize wakeup check") +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-mq.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1076,7 +1076,13 @@ static int blk_mq_dispatch_wake(wait_que + hctx = container_of(wait, struct blk_mq_hw_ctx, dispatch_wait); + + spin_lock(&hctx->dispatch_wait_lock); +- list_del_init(&wait->entry); ++ if (!list_empty(&wait->entry)) { ++ struct sbitmap_queue *sbq; ++ ++ list_del_init(&wait->entry); ++ sbq = &hctx->tags->bitmap_tags; ++ atomic_dec(&sbq->ws_active); ++ } + spin_unlock(&hctx->dispatch_wait_lock); + + blk_mq_run_hw_queue(hctx, true); +@@ -1092,6 +1098,7 @@ static int blk_mq_dispatch_wake(wait_que + static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx, + struct request *rq) + { ++ struct sbitmap_queue *sbq = &hctx->tags->bitmap_tags; + struct wait_queue_head *wq; + wait_queue_entry_t *wait; + bool ret; +@@ -1115,7 +1122,7 @@ static bool blk_mq_mark_tag_wait(struct + if (!list_empty_careful(&wait->entry)) + return false; + +- wq = &bt_wait_ptr(&hctx->tags->bitmap_tags, hctx)->wait; ++ wq = &bt_wait_ptr(sbq, hctx)->wait; + + spin_lock_irq(&wq->lock); + spin_lock(&hctx->dispatch_wait_lock); +@@ -1125,6 +1132,7 @@ static bool blk_mq_mark_tag_wait(struct + return false; + } + ++ atomic_inc(&sbq->ws_active); + wait->flags &= ~WQ_FLAG_EXCLUSIVE; + __add_wait_queue(wq, wait); + +@@ -1145,6 +1153,7 @@ static bool blk_mq_mark_tag_wait(struct + * someone else gets the wakeup. + */ + list_del_init(&wait->entry); ++ atomic_dec(&sbq->ws_active); + spin_unlock(&hctx->dispatch_wait_lock); + spin_unlock_irq(&wq->lock); + diff --git a/queue-5.0/cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch b/queue-5.0/cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch new file mode 100644 index 00000000000..816ca820785 --- /dev/null +++ b/queue-5.0/cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch @@ -0,0 +1,46 @@ +From 92a3e426ec06e72b1c363179c79d30712447ff76 Mon Sep 17 00:00:00 2001 +From: Srinivas Pandruvada +Date: Mon, 25 Mar 2019 09:04:40 -0700 +Subject: cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency + +From: Srinivas Pandruvada + +commit 92a3e426ec06e72b1c363179c79d30712447ff76 upstream. + +The ACPI specification states that if the "Guaranteed Performance +Register" is not implemented, the OSPM assumes guaranteed performance +to always be equal to nominal performance. + +So for invalid or unimplemented guaranteed performance register, use +nominal performance as guaranteed performance. + +This change will fall back to nominal_perf when guranteed_perf is +invalid. If nominal_perf is also invalid or not present, fall back +to the existing implementation, which is to read from HWP Capabilities +MSR. + +Fixes: 86d333a8cc7f ("cpufreq: intel_pstate: Add base_frequency attribute") +Suggested-by: Rafael J. Wysocki +Signed-off-by: Srinivas Pandruvada +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/intel_pstate.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -383,7 +383,10 @@ static int intel_pstate_get_cppc_gurante + if (ret) + return ret; + +- return cppc_perf.guaranteed_perf; ++ if (cppc_perf.guaranteed_perf) ++ return cppc_perf.guaranteed_perf; ++ ++ return cppc_perf.nominal_perf; + } + + #else /* CONFIG_ACPI_CPPC_LIB */ diff --git a/queue-5.0/cpufreq-scpi-fix-use-after-free.patch b/queue-5.0/cpufreq-scpi-fix-use-after-free.patch new file mode 100644 index 00000000000..fbbe71400f6 --- /dev/null +++ b/queue-5.0/cpufreq-scpi-fix-use-after-free.patch @@ -0,0 +1,36 @@ +From 31d4c528cea4023cf36f6148c03bb960cedefeef Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= +Date: Wed, 27 Mar 2019 23:06:42 +0100 +Subject: cpufreq: scpi: Fix use after free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +commit 31d4c528cea4023cf36f6148c03bb960cedefeef upstream. + +Free the priv structure only after we are done using it. + +Fixes: 1690d8bb91e370ab ("cpufreq: scpi/scmi: Fix freeing of dynamic OPPs") +Signed-off-by: Vincent Stehlé +Cc: 4.20+ # 4.20+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cpufreq/scpi-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cpufreq/scpi-cpufreq.c ++++ b/drivers/cpufreq/scpi-cpufreq.c +@@ -189,8 +189,8 @@ static int scpi_cpufreq_exit(struct cpuf + cpufreq_cooling_unregister(priv->cdev); + clk_put(priv->clk); + dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table); +- kfree(priv); + dev_pm_opp_remove_all_dynamic(priv->cpu_dev); ++ kfree(priv); + + return 0; + } diff --git a/queue-5.0/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch b/queue-5.0/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch new file mode 100644 index 00000000000..a61003a75cb --- /dev/null +++ b/queue-5.0/disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch @@ -0,0 +1,43 @@ +From 3ec8002951ea173e24b466df1ea98c56b7920e63 Mon Sep 17 00:00:00 2001 +From: Wentao Wang +Date: Wed, 20 Mar 2019 15:30:39 +0000 +Subject: Disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wentao Wang + +commit 3ec8002951ea173e24b466df1ea98c56b7920e63 upstream. + +Echo "" to /sys/module/kgdboc/parameters/kgdboc will fail with "No such +device” error. + +This is caused by function "configure_kgdboc" who init err to ENODEV +when the config is empty (legal input) the code go out with ENODEV +returned. + +Fixes: 2dd453168643 ("kgdboc: Fix restrict error") +Signed-off-by: Wentao Wang +Cc: stable +Acked-by: Daniel Thompson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/kgdboc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -148,8 +148,10 @@ static int configure_kgdboc(void) + char *cptr = config; + struct console *cons; + +- if (!strlen(config) || isspace(config[0])) ++ if (!strlen(config) || isspace(config[0])) { ++ err = 0; + goto noconfig; ++ } + + kgdboc_io_ops.is_console = 0; + kgdb_tty_driver = NULL; diff --git a/queue-5.0/drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch b/queue-5.0/drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch new file mode 100644 index 00000000000..701f3da6573 --- /dev/null +++ b/queue-5.0/drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch @@ -0,0 +1,130 @@ +From 0bc9f5d14a93971c6cd9c0d81b0fc154fc54c65d Mon Sep 17 00:00:00 2001 +From: Minchan Kim +Date: Thu, 28 Mar 2019 20:44:24 -0700 +Subject: drivers/block/zram/zram_drv.c: fix idle/writeback string compare + +From: Minchan Kim + +commit 0bc9f5d14a93971c6cd9c0d81b0fc154fc54c65d upstream. + +Makoto report a below KASAN error: zram does out-of-bounds read. Because +strscpy copies from source up to count bytes unconditionally. It could +cause out-of-bounds read on next object in slab. + +To prevent it, use strlcpy which checks source's length automatically. + + BUG: KASAN: slab-out-of-bounds in strscpy+0x68/0x154 + Read of size 8 at addr ffffffc0c3495a00 by task system_server/1314 + .. + Call trace: + strscpy+0x68/0x154 + idle_store+0xc4/0x34c + dev_attr_store+0x50/0x6c + sysfs_kf_write+0x98/0xb4 + kernfs_fop_write+0x198/0x260 + __vfs_write+0x10c/0x338 + vfs_write+0x114/0x238 + SyS_write+0xc8/0x168 + __sys_trace_return+0x0/0x4 + + Allocated by task 1314: + __kmalloc+0x280/0x318 + kernfs_fop_write+0xac/0x260 + __vfs_write+0x10c/0x338 + vfs_write+0x114/0x238 + SyS_write+0xc8/0x168 + __sys_trace_return+0x0/0x4 + + Freed by task 2855: + kfree+0x138/0x630 + kernfs_put_open_node+0x10c/0x124 + kernfs_fop_release+0xd8/0x114 + __fput+0x130/0x2a4 + ____fput+0x1c/0x28 + task_work_run+0x16c/0x1c8 + do_notify_resume+0x2bc/0x107c + work_pending+0x8/0x10 + + The buggy address belongs to the object at ffffffc0c3495a00 + which belongs to the cache kmalloc-128 of size 128 + The buggy address is located 0 bytes inside of + 128-byte region [ffffffc0c3495a00, ffffffc0c3495a80) + The buggy address belongs to the page: + page:ffffffbf030d2500 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 + flags: 0x4000000000010200(slab|head) + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ffffffc0c3495900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + ffffffc0c3495980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + >ffffffc0c3495a00: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ^ + ffffffc0c3495a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffffffc0c3495b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +Link: http://lkml.kernel.org/r/20190319231911.145968-1-minchan@kernel.org +Cc: [5.0] +Signed-off-by: Minchan Kim +Reported-by: Makoto Wu +Reviewed-by: Sergey Senozhatsky +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/zram/zram_drv.c | 32 ++++++-------------------------- + 1 file changed, 6 insertions(+), 26 deletions(-) + +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -290,18 +290,8 @@ static ssize_t idle_store(struct device + struct zram *zram = dev_to_zram(dev); + unsigned long nr_pages = zram->disksize >> PAGE_SHIFT; + int index; +- char mode_buf[8]; +- ssize_t sz; + +- sz = strscpy(mode_buf, buf, sizeof(mode_buf)); +- if (sz <= 0) +- return -EINVAL; +- +- /* ignore trailing new line */ +- if (mode_buf[sz - 1] == '\n') +- mode_buf[sz - 1] = 0x00; +- +- if (strcmp(mode_buf, "all")) ++ if (!sysfs_streq(buf, "all")) + return -EINVAL; + + down_read(&zram->init_lock); +@@ -635,25 +625,15 @@ static ssize_t writeback_store(struct de + struct bio bio; + struct bio_vec bio_vec; + struct page *page; +- ssize_t ret, sz; +- char mode_buf[8]; +- int mode = -1; ++ ssize_t ret; ++ int mode; + unsigned long blk_idx = 0; + +- sz = strscpy(mode_buf, buf, sizeof(mode_buf)); +- if (sz <= 0) +- return -EINVAL; +- +- /* ignore trailing newline */ +- if (mode_buf[sz - 1] == '\n') +- mode_buf[sz - 1] = 0x00; +- +- if (!strcmp(mode_buf, "idle")) ++ if (sysfs_streq(buf, "idle")) + mode = IDLE_WRITEBACK; +- else if (!strcmp(mode_buf, "huge")) ++ else if (sysfs_streq(buf, "huge")) + mode = HUGE_WRITEBACK; +- +- if (mode == -1) ++ else + return -EINVAL; + + down_read(&zram->init_lock); diff --git a/queue-5.0/drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch b/queue-5.0/drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch new file mode 100644 index 00000000000..268464ea74f --- /dev/null +++ b/queue-5.0/drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch @@ -0,0 +1,41 @@ +From 13bcb80b7ee79431fce361e060611134cb19e209 Mon Sep 17 00:00:00 2001 +From: Zhenyu Wang +Date: Wed, 20 Feb 2019 16:25:04 +0800 +Subject: drm/i915/gvt: Fix MI_FLUSH_DW parsing with correct index check + +From: Zhenyu Wang + +commit 13bcb80b7ee79431fce361e060611134cb19e209 upstream. + +When MI_FLUSH_DW post write hw status page in index mode, the index +value is in dword step and turned into address offset in cmd dword1. +As status page size is 4K, so can't exceed that. + +This fixed upper bound check in cmd parser code which incorrectly +stopped VM for reason of invalid MI_FLUSH_DW write index. + +v2: +- Fix upper bound as 4K page size because index value is address offset. + +Fixes: be1da7070aea ("drm/i915/gvt: vGPU command scanner") +Cc: stable@vger.kernel.org # v4.10+ +Cc: "Zhao, Yan Y" +Reviewed-by: Yan Zhao +Signed-off-by: Zhenyu Wang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gvt/cmd_parser.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gvt/cmd_parser.c ++++ b/drivers/gpu/drm/i915/gvt/cmd_parser.c +@@ -1446,7 +1446,7 @@ static inline int cmd_address_audit(stru + } + + if (index_mode) { +- if (guest_gma >= I915_GTT_PAGE_SIZE / sizeof(u64)) { ++ if (guest_gma >= I915_GTT_PAGE_SIZE) { + ret = -EFAULT; + goto err; + } diff --git a/queue-5.0/drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch b/queue-5.0/drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch new file mode 100644 index 00000000000..bfd01f1e762 --- /dev/null +++ b/queue-5.0/drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch @@ -0,0 +1,40 @@ +From 69903dfae0310afe8a15f5cd4e376ebb7c6da1d2 Mon Sep 17 00:00:00 2001 +From: Manasi Navare +Date: Tue, 19 Mar 2019 15:18:47 -0700 +Subject: drm/i915/icl: Fix the TRANS_DDI_FUNC_CTL2 bitfield macro + +From: Manasi Navare + +commit 69903dfae0310afe8a15f5cd4e376ebb7c6da1d2 upstream. + +This patch fixes the PORT_SYNC_MODE_MASTER_SELECT macro +to correctly do the left shifting to set the port sync +master select correctly. +I have tested this fix on ICL. + +Fixes: 49edbd49786e ("drm/i915/icl: Define TRANS_DDI_FUNC_CTL DSI registers") +Cc: Madhav Chauhan +Cc: Jani Nikula +Cc: # v5.0+ +Signed-off-by: Manasi Navare +Reviewed-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20190319221847.21311-1-manasi.d.navare@intel.com +(cherry picked from commit 7264aebb81d15aa6bbed650c816bba90f026bc35) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_reg.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -9205,7 +9205,7 @@ enum skl_power_gate { + #define TRANS_DDI_FUNC_CTL2(tran) _MMIO_TRANS2(tran, \ + _TRANS_DDI_FUNC_CTL2_A) + #define PORT_SYNC_MODE_ENABLE (1 << 4) +-#define PORT_SYNC_MODE_MASTER_SELECT(x) ((x) < 0) ++#define PORT_SYNC_MODE_MASTER_SELECT(x) ((x) << 0) + #define PORT_SYNC_MODE_MASTER_SELECT_MASK (0x7 << 0) + #define PORT_SYNC_MODE_MASTER_SELECT_SHIFT 0 + diff --git a/queue-5.0/drm-i915-mark-aml-0x87ca-as-ulx.patch b/queue-5.0/drm-i915-mark-aml-0x87ca-as-ulx.patch new file mode 100644 index 00000000000..f0b70213e43 --- /dev/null +++ b/queue-5.0/drm-i915-mark-aml-0x87ca-as-ulx.patch @@ -0,0 +1,43 @@ +From 4b9a3932e7ba929baa231231e61874c7a56f8959 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Fri, 22 Mar 2019 22:49:44 +0200 +Subject: drm/i915: Mark AML 0x87CA as ULX +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 4b9a3932e7ba929baa231231e61874c7a56f8959 upstream. + +If I'm reading the spec right AML 0x87CA is a Y SKU, so it +should be marked as ULX in our old style terminology. + +Cc: stable@vger.kernel.org +Cc: José Roberto de Souza +Cc: Rodrigo Vivi +Cc: Tvrtko Ursulin +Fixes: c0c46ca461f1 ("drm/i915/aml: Add new Amber Lake PCI ID") +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20190322204944.23613-1-ville.syrjala@linux.intel.com +Reviewed-by: José Roberto de Souza +(cherry picked from commit 57b1c4460dc46a00f6ec439f3f11d670736b0209) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_drv.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -2293,7 +2293,8 @@ intel_info(const struct drm_i915_private + INTEL_DEVID(dev_priv) == 0x5915 || \ + INTEL_DEVID(dev_priv) == 0x591E) + #define IS_AML_ULX(dev_priv) (INTEL_DEVID(dev_priv) == 0x591C || \ +- INTEL_DEVID(dev_priv) == 0x87C0) ++ INTEL_DEVID(dev_priv) == 0x87C0 || \ ++ INTEL_DEVID(dev_priv) == 0x87CA) + #define IS_SKL_GT2(dev_priv) (IS_SKYLAKE(dev_priv) && \ + (dev_priv)->info.gt == 2) + #define IS_SKL_GT3(dev_priv) (IS_SKYLAKE(dev_priv) && \ diff --git a/queue-5.0/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch b/queue-5.0/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch new file mode 100644 index 00000000000..385e90af870 --- /dev/null +++ b/queue-5.0/drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch @@ -0,0 +1,51 @@ +From 21d2b122732318b48c10b7262e15595ce54511d3 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 26 Feb 2019 13:44:51 -0800 +Subject: drm/vgem: fix use-after-free when drm_gem_handle_create() fails + +From: Eric Biggers + +commit 21d2b122732318b48c10b7262e15595ce54511d3 upstream. + +If drm_gem_handle_create() fails in vgem_gem_create(), then the +drm_vgem_gem_object is freed twice: once when the reference is dropped +by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy(). + +This was hit by syzkaller using fault injection. + +Fix it by skipping the second free. + +Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com +Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces") +Reviewed-by: Chris Wilson +Cc: Laura Abbott +Cc: Daniel Vetter +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Acked-by: Laura Abbott +Signed-off-by: Rodrigo Siqueira +Link: https://patchwork.freedesktop.org/patch/msgid/20190226214451.195123-1-ebiggers@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vgem/vgem_drv.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -191,13 +191,9 @@ static struct drm_gem_object *vgem_gem_c + ret = drm_gem_handle_create(file, &obj->base, handle); + drm_gem_object_put_unlocked(&obj->base); + if (ret) +- goto err; ++ return ERR_PTR(ret); + + return &obj->base; +- +-err: +- __vgem_gem_destroy(obj); +- return ERR_PTR(ret); + } + + static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, diff --git a/queue-5.0/drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch b/queue-5.0/drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch new file mode 100644 index 00000000000..4973141c88d --- /dev/null +++ b/queue-5.0/drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch @@ -0,0 +1,52 @@ +From 36b6c9ed45afe89045973e8dee1b004dd5372d40 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Tue, 26 Feb 2019 14:08:58 -0800 +Subject: drm/vkms: fix use-after-free when drm_gem_handle_create() fails + +From: Eric Biggers + +commit 36b6c9ed45afe89045973e8dee1b004dd5372d40 upstream. + +If drm_gem_handle_create() fails in vkms_gem_create(), then the +vkms_gem_object is freed twice: once when the reference is dropped by +drm_gem_object_put_unlocked(), and again by the extra calls to +drm_gem_object_release() and kfree(). + +Fix it by skipping the second release and free. + +This bug was originally found in the vgem driver by syzkaller using +fault injection, but I noticed it's also present in the vkms driver. + +Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations") +Cc: Rodrigo Siqueira +Cc: Haneen Mohammed +Cc: Daniel Vetter +Cc: Chris Wilson +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Reviewed-by: Chris Wilson +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Rodrigo Siqueira +Link: https://patchwork.freedesktop.org/patch/msgid/20190226220858.214438-1-ebiggers@kernel.org +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vkms/vkms_gem.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/gpu/drm/vkms/vkms_gem.c ++++ b/drivers/gpu/drm/vkms/vkms_gem.c +@@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(s + + ret = drm_gem_handle_create(file, &obj->gem, handle); + drm_gem_object_put_unlocked(&obj->gem); +- if (ret) { +- drm_gem_object_release(&obj->gem); +- kfree(obj); ++ if (ret) + return ERR_PTR(ret); +- } + + return &obj->gem; + } diff --git a/queue-5.0/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch b/queue-5.0/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch new file mode 100644 index 00000000000..f74b19c74f1 --- /dev/null +++ b/queue-5.0/fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch @@ -0,0 +1,99 @@ +From 23da9588037ecdd4901db76a5b79a42b529c4ec3 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 28 Mar 2019 20:44:40 -0700 +Subject: fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links + +From: YueHaibing + +commit 23da9588037ecdd4901db76a5b79a42b529c4ec3 upstream. + +Syzkaller reports: + +kasan: GPF could be caused by NULL-ptr deref or user memory access +general protection fault: 0000 [#1] SMP KASAN PTI +CPU: 1 PID: 5373 Comm: syz-executor.0 Not tainted 5.0.0-rc8+ #3 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 +RIP: 0010:put_links+0x101/0x440 fs/proc/proc_sysctl.c:1599 +Code: 00 0f 85 3a 03 00 00 48 8b 43 38 48 89 44 24 20 48 83 c0 38 48 89 c2 48 89 44 24 28 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 fe 02 00 00 48 8b 74 24 20 48 c7 c7 60 2a 9d 91 +RSP: 0018:ffff8881d828f238 EFLAGS: 00010202 +RAX: dffffc0000000000 RBX: ffff8881e01b1140 RCX: ffffffff8ee98267 +RDX: 0000000000000007 RSI: ffffc90001479000 RDI: ffff8881e01b1178 +RBP: dffffc0000000000 R08: ffffed103ee27259 R09: ffffed103ee27259 +R10: 0000000000000001 R11: ffffed103ee27258 R12: fffffffffffffff4 +R13: 0000000000000006 R14: ffff8881f59838c0 R15: dffffc0000000000 +FS: 00007f072254f700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fff8b286668 CR3: 00000001f0542002 CR4: 00000000007606e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +PKRU: 55555554 +Call Trace: + drop_sysctl_table+0x152/0x9f0 fs/proc/proc_sysctl.c:1629 + get_subdir fs/proc/proc_sysctl.c:1022 [inline] + __register_sysctl_table+0xd65/0x1090 fs/proc/proc_sysctl.c:1335 + br_netfilter_init+0xbc/0x1000 [br_netfilter] + do_one_initcall+0xfa/0x5ca init/main.c:887 + do_init_module+0x204/0x5f6 kernel/module.c:3460 + load_module+0x66b2/0x8570 kernel/module.c:3808 + __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 + do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x462e99 +Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f072254ec58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 +RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 +RBP: 00007f072254ec70 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00007f072254f6bc +R13: 00000000004bcefa R14: 00000000006f6fb0 R15: 0000000000000004 +Modules linked in: br_netfilter(+) dvb_usb_dibusb_mc_common dib3000mc dibx000_common dvb_usb_dibusb_common dvb_usb_dw2102 dvb_usb classmate_laptop palmas_regulator cn videobuf2_v4l2 v4l2_common snd_soc_bd28623 mptbase snd_usb_usx2y snd_usbmidi_lib snd_rawmidi wmi libnvdimm lockd sunrpc grace rc_kworld_pc150u rc_core rtc_da9063 sha1_ssse3 i2c_cros_ec_tunnel adxl34x_spi adxl34x nfnetlink lib80211 i5500_temp dvb_as102 dvb_core videobuf2_common videodev media videobuf2_vmalloc videobuf2_memops udc_core lnbp22 leds_lp3952 hid_roccat_ryos s1d13xxxfb mtd vport_geneve openvswitch nf_conncount nf_nat_ipv6 nsh geneve udp_tunnel ip6_udp_tunnel snd_soc_mt6351 sis_agp phylink snd_soc_adau1761_spi snd_soc_adau1761 snd_soc_adau17x1 snd_soc_core snd_pcm_dmaengine ac97_bus snd_compress snd_soc_adau_utils snd_soc_sigmadsp_regmap snd_soc_sigmadsp raid_class hid_roccat_konepure hid_roccat_common hid_roccat c2port_duramar2150 core mdio_bcm_unimac iptable_security iptable_raw iptable_mangle + iptable_nat nf_nat_ipv4 nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bpfilter ip6_vti ip_vti ip_gre ipip sit tunnel4 ip_tunnel hsr veth netdevsim devlink vxcan batman_adv cfg80211 rfkill chnl_net caif nlmon dummy team bonding vcan bridge stp llc ip6_gre gre ip6_tunnel tunnel6 tun crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel joydev mousedev ide_pci_generic piix aesni_intel aes_x86_64 ide_core crypto_simd atkbd cryptd glue_helper serio_raw ata_generic pata_acpi i2c_piix4 floppy sch_fq_codel ip_tables x_tables ipv6 [last unloaded: lm73] +Dumping ftrace buffer: + (ftrace buffer empty) +---[ end trace 770020de38961fd0 ]--- + +A new dir entry can be created in get_subdir and its 'header->parent' is +set to NULL. Only after insert_header success, it will be set to 'dir', +otherwise 'header->parent' is set to NULL and drop_sysctl_table is called. +However in err handling path of get_subdir, drop_sysctl_table also be +called on 'new->header' regardless its value of parent pointer. Then +put_links is called, which triggers NULL-ptr deref when access member of +header->parent. + +In fact we have multiple error paths which call drop_sysctl_table() there, +upon failure on insert_links() we also call drop_sysctl_table().And even +in the successful case on __register_sysctl_table() we still always call +drop_sysctl_table().This patch fix it. + +Link: http://lkml.kernel.org/r/20190314085527.13244-1-yuehaibing@huawei.com +Fixes: 0e47c99d7fe25 ("sysctl: Replace root_list with links between sysctl_table_sets") +Signed-off-by: YueHaibing +Reported-by: Hulk Robot +Acked-by: Luis Chamberlain +Cc: Kees Cook +Cc: Alexey Dobriyan +Cc: Alexei Starovoitov +Cc: Daniel Borkmann +Cc: Al Viro +Cc: Eric W. Biederman +Cc: [3.4+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/proc_sysctl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -1626,7 +1626,8 @@ static void drop_sysctl_table(struct ctl + if (--header->nreg) + return; + +- put_links(header); ++ if (parent) ++ put_links(header); + start_unregistering(header); + if (!--header->count) + kfree_rcu(header, rcu); diff --git a/queue-5.0/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch b/queue-5.0/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch new file mode 100644 index 00000000000..0b02590dc30 --- /dev/null +++ b/queue-5.0/gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch @@ -0,0 +1,40 @@ +From c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b Mon Sep 17 00:00:00 2001 +From: Axel Lin +Date: Mon, 11 Mar 2019 21:29:37 +0800 +Subject: gpio: adnp: Fix testing wrong value in adnp_gpio_direction_input + +From: Axel Lin + +commit c5bc6e526d3f217ed2cc3681d256dc4a2af4cc2b upstream. + +Current code test wrong value so it does not verify if the written +data is correctly read back. Fix it. +Also make it return -EPERM if read value does not match written bit, +just like it done for adnp_gpio_direction_output(). + +Fixes: 5e969a401a01 ("gpio: Add Avionic Design N-bit GPIO expander support") +Cc: +Signed-off-by: Axel Lin +Reviewed-by: Thierry Reding +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-adnp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpio/gpio-adnp.c ++++ b/drivers/gpio/gpio-adnp.c +@@ -132,8 +132,10 @@ static int adnp_gpio_direction_input(str + if (err < 0) + goto out; + +- if (err & BIT(pos)) +- err = -EACCES; ++ if (value & BIT(pos)) { ++ err = -EPERM; ++ goto out; ++ } + + err = 0; + diff --git a/queue-5.0/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch b/queue-5.0/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch new file mode 100644 index 00000000000..1c65addb5af --- /dev/null +++ b/queue-5.0/gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch @@ -0,0 +1,32 @@ +From 7ecced0934e574b528a1ba6c237731e682216a74 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Fri, 8 Mar 2019 22:07:57 -0600 +Subject: gpio: exar: add a check for the return value of ida_simple_get fails + +From: Kangjie Lu + +commit 7ecced0934e574b528a1ba6c237731e682216a74 upstream. + +ida_simple_get may fail and return a negative error number. +The fix checks its return value; if it fails, go to err_destroy. + +Cc: +Signed-off-by: Kangjie Lu +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpio/gpio-exar.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpio/gpio-exar.c ++++ b/drivers/gpio/gpio-exar.c +@@ -148,6 +148,8 @@ static int gpio_exar_probe(struct platfo + mutex_init(&exar_gpio->lock); + + index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL); ++ if (index < 0) ++ goto err_destroy; + + sprintf(exar_gpio->name, "exar_gpio%d", index); + exar_gpio->gpio_chip.label = exar_gpio->name; diff --git a/queue-5.0/mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch b/queue-5.0/mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch new file mode 100644 index 00000000000..277492b28bb --- /dev/null +++ b/queue-5.0/mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch @@ -0,0 +1,77 @@ +From cae85cb8add35f678cf487139d05e083ce2f570a Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Thu, 28 Mar 2019 20:43:19 -0700 +Subject: mm/memory.c: fix modifying of page protection by insert_pfn() + +From: Jan Kara + +commit cae85cb8add35f678cf487139d05e083ce2f570a upstream. + +Aneesh has reported that PPC triggers the following warning when +excercising DAX code: + + IP set_pte_at+0x3c/0x190 + LR insert_pfn+0x208/0x280 + Call Trace: + insert_pfn+0x68/0x280 + dax_iomap_pte_fault.isra.7+0x734/0xa40 + __xfs_filemap_fault+0x280/0x2d0 + do_wp_page+0x48c/0xa40 + __handle_mm_fault+0x8d0/0x1fd0 + handle_mm_fault+0x140/0x250 + __do_page_fault+0x300/0xd60 + handle_page_fault+0x18 + +Now that is WARN_ON in set_pte_at which is + + VM_WARN_ON(pte_hw_valid(*ptep) && !pte_protnone(*ptep)); + +The problem is that on some architectures set_pte_at() cannot cope with +a situation where there is already some (different) valid entry present. + +Use ptep_set_access_flags() instead to modify the pfn which is built to +deal with modifying existing PTE. + +Link: http://lkml.kernel.org/r/20190311084537.16029-1-jack@suse.cz +Fixes: b2770da64254 "mm: add vm_insert_mixed_mkwrite()" +Signed-off-by: Jan Kara +Reported-by: "Aneesh Kumar K.V" +Reviewed-by: Aneesh Kumar K.V +Acked-by: Dan Williams +Cc: Chandan Rajendra +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1546,10 +1546,12 @@ static vm_fault_t insert_pfn(struct vm_a + WARN_ON_ONCE(!is_zero_pfn(pte_pfn(*pte))); + goto out_unlock; + } +- entry = *pte; +- goto out_mkwrite; +- } else +- goto out_unlock; ++ entry = pte_mkyoung(*pte); ++ entry = maybe_mkwrite(pte_mkdirty(entry), vma); ++ if (ptep_set_access_flags(vma, addr, pte, entry, 1)) ++ update_mmu_cache(vma, addr, pte); ++ } ++ goto out_unlock; + } + + /* Ok, finally just insert the thing.. */ +@@ -1558,7 +1560,6 @@ static vm_fault_t insert_pfn(struct vm_a + else + entry = pte_mkspecial(pfn_t_pte(pfn, prot)); + +-out_mkwrite: + if (mkwrite) { + entry = pte_mkyoung(entry); + entry = maybe_mkwrite(pte_mkdirty(entry), vma); diff --git a/queue-5.0/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch b/queue-5.0/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch new file mode 100644 index 00000000000..4982bb9e28d --- /dev/null +++ b/queue-5.0/phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch @@ -0,0 +1,42 @@ +From 1396929e8a903db80425343cacca766a18ad6409 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Fri, 22 Mar 2019 16:51:07 +0800 +Subject: phy: sun4i-usb: Support set_mode to USB_HOST for non-OTG PHYs + +From: Chen-Yu Tsai + +commit 1396929e8a903db80425343cacca766a18ad6409 upstream. + +While only the first PHY supports mode switching, the remaining PHYs +work in USB host mode. They should support set_mode with mode=USB_HOST +instead of failing. This is especially needed now that the USB core does +set_mode for all USB ports, which was added in commit b97a31348379 ("usb: +core: comply to PHY framework"). + +Make set_mode with mode=USB_HOST a no-op instead of failing for the +non-OTG USB PHYs. + +Fixes: 6ba43c291961 ("phy-sun4i-usb: Add support for phy_set_mode") +Signed-off-by: Chen-Yu Tsai +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/allwinner/phy-sun4i-usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -485,8 +485,11 @@ static int sun4i_usb_phy_set_mode(struct + struct sun4i_usb_phy_data *data = to_sun4i_usb_phy_data(phy); + int new_mode; + +- if (phy->index != 0) ++ if (phy->index != 0) { ++ if (mode == PHY_MODE_USB_HOST) ++ return 0; + return -EINVAL; ++ } + + switch (mode) { + case PHY_MODE_USB_HOST: diff --git a/queue-5.0/series b/queue-5.0/series index 370261a6306..19cfc16eb61 100644 --- a/queue-5.0/series +++ b/queue-5.0/series @@ -97,3 +97,21 @@ usb-serial-option-set-driver_info-for-sim5218-and-compatibles.patch usb-serial-option-add-support-for-quectel-em12.patch usb-serial-option-add-olicard-600.patch acpi-cppc-fix-guaranteed-performance-handling.patch +disable-kgdboc-failed-by-echo-space-to-sys-module-kgdboc-parameters-kgdboc.patch +fs-proc-proc_sysctl.c-fix-null-pointer-dereference-in-put_links.patch +drivers-block-zram-zram_drv.c-fix-idle-writeback-string-compare.patch +blk-mq-fix-sbitmap-ws_active-for-shared-tags.patch +cpufreq-intel_pstate-also-use-cppc-nominal_perf-for-base_frequency.patch +cpufreq-scpi-fix-use-after-free.patch +drm-vgem-fix-use-after-free-when-drm_gem_handle_create-fails.patch +drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch +drm-i915-mark-aml-0x87ca-as-ulx.patch +drm-i915-gvt-fix-mi_flush_dw-parsing-with-correct-index-check.patch +drm-i915-icl-fix-the-trans_ddi_func_ctl2-bitfield-macro.patch +gpio-exar-add-a-check-for-the-return-value-of-ida_simple_get-fails.patch +gpio-adnp-fix-testing-wrong-value-in-adnp_gpio_direction_input.patch +phy-sun4i-usb-support-set_mode-to-usb_host-for-non-otg-phys.patch +usb-mtu3-fix-extcon-dependency.patch +usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch +usb-common-consider-only-available-nodes-for-dr_mode.patch +mm-memory.c-fix-modifying-of-page-protection-by-insert_pfn.patch diff --git a/queue-5.0/usb-common-consider-only-available-nodes-for-dr_mode.patch b/queue-5.0/usb-common-consider-only-available-nodes-for-dr_mode.patch new file mode 100644 index 00000000000..00a67785d95 --- /dev/null +++ b/queue-5.0/usb-common-consider-only-available-nodes-for-dr_mode.patch @@ -0,0 +1,34 @@ +From 238e0268c82789e4c107a37045d529a6dbce51a9 Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Fri, 1 Mar 2019 11:05:45 +0000 +Subject: usb: common: Consider only available nodes for dr_mode + +From: Fabrizio Castro + +commit 238e0268c82789e4c107a37045d529a6dbce51a9 upstream. + +There are cases where multiple device tree nodes point to the +same phy node by means of the "phys" property, but we should +only consider those nodes that are marked as available rather +than just any node. + +Fixes: 98bfb3946695 ("usb: of: add an api to get dr_mode by the phy node") +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Fabrizio Castro +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/common/common.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/common/common.c ++++ b/drivers/usb/common/common.c +@@ -145,6 +145,8 @@ enum usb_dr_mode of_usb_get_dr_mode_by_p + + do { + controller = of_find_node_with_property(controller, "phys"); ++ if (!of_device_is_available(controller)) ++ continue; + index = 0; + do { + if (arg0 == -1) { diff --git a/queue-5.0/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch b/queue-5.0/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch new file mode 100644 index 00000000000..6fdf3bc1496 --- /dev/null +++ b/queue-5.0/usb-gadget-f_hid-fix-deadlock-in-f_hidg_write.patch @@ -0,0 +1,64 @@ +From 072684e8c58d17e853f8e8b9f6d9ce2e58d2b036 Mon Sep 17 00:00:00 2001 +From: Radoslav Gerganov +Date: Tue, 5 Mar 2019 10:10:34 +0000 +Subject: USB: gadget: f_hid: fix deadlock in f_hidg_write() + +From: Radoslav Gerganov + +commit 072684e8c58d17e853f8e8b9f6d9ce2e58d2b036 upstream. + +In f_hidg_write() the write_spinlock is acquired before calling +usb_ep_queue() which causes a deadlock when dummy_hcd is being used. +This is because dummy_queue() callbacks into f_hidg_req_complete() which +tries to acquire the same spinlock. This is (part of) the backtrace when +the deadlock occurs: + + 0xffffffffc06b1410 in f_hidg_req_complete + 0xffffffffc06a590a in usb_gadget_giveback_request + 0xffffffffc06cfff2 in dummy_queue + 0xffffffffc06a4b96 in usb_ep_queue + 0xffffffffc06b1eb6 in f_hidg_write + 0xffffffff8127730b in __vfs_write + 0xffffffff812774d1 in vfs_write + 0xffffffff81277725 in SYSC_write + +Fix this by releasing the write_spinlock before calling usb_ep_queue() + +Reviewed-by: James Bottomley +Tested-by: James Bottomley +Cc: stable@vger.kernel.org # 4.11+ +Fixes: 749494b6bdbb ("usb: gadget: f_hid: fix: Move IN request allocation to set_alt()") +Signed-off-by: Radoslav Gerganov +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/gadget/function/f_hid.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -391,20 +391,20 @@ try_again: + req->complete = f_hidg_req_complete; + req->context = hidg; + ++ spin_unlock_irqrestore(&hidg->write_spinlock, flags); ++ + status = usb_ep_queue(hidg->in_ep, req, GFP_ATOMIC); + if (status < 0) { + ERROR(hidg->func.config->cdev, + "usb_ep_queue error on int endpoint %zd\n", status); +- goto release_write_pending_unlocked; ++ goto release_write_pending; + } else { + status = count; + } +- spin_unlock_irqrestore(&hidg->write_spinlock, flags); + + return status; + release_write_pending: + spin_lock_irqsave(&hidg->write_spinlock, flags); +-release_write_pending_unlocked: + hidg->write_pending = 0; + spin_unlock_irqrestore(&hidg->write_spinlock, flags); + diff --git a/queue-5.0/usb-mtu3-fix-extcon-dependency.patch b/queue-5.0/usb-mtu3-fix-extcon-dependency.patch new file mode 100644 index 00000000000..ea477210519 --- /dev/null +++ b/queue-5.0/usb-mtu3-fix-extcon-dependency.patch @@ -0,0 +1,36 @@ +From 3d54d10c6afed34fd45b852bf76f55e8da31d8ef Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 25 Mar 2019 14:54:30 +0100 +Subject: usb: mtu3: fix EXTCON dependency + +From: Arnd Bergmann + +commit 3d54d10c6afed34fd45b852bf76f55e8da31d8ef upstream. + +When EXTCON is a loadable module, mtu3 fails to link as built-in: + +drivers/usb/mtu3/mtu3_plat.o: In function `mtu3_probe': +mtu3_plat.c:(.text+0x690): undefined reference to `extcon_get_edev_by_phandle' + +Add a Kconfig dependency to force mtu3 also to be a loadable module +if extconn is, but still allow it to be built without extcon. + +Fixes: d0ed062a8b75 ("usb: mtu3: dual-role mode support") +Signed-off-by: Arnd Bergmann +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mtu3/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/mtu3/Kconfig ++++ b/drivers/usb/mtu3/Kconfig +@@ -4,6 +4,7 @@ config USB_MTU3 + tristate "MediaTek USB3 Dual Role controller" + depends on USB || USB_GADGET + depends on ARCH_MEDIATEK || COMPILE_TEST ++ depends on EXTCON || !EXTCON + select USB_XHCI_MTK if USB_SUPPORT && USB_XHCI_HCD + help + Say Y or M here if your system runs on MediaTek SoCs with