From: Sasha Levin Date: Mon, 31 Aug 2020 01:27:35 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v4.4.235~52 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b3c2e9e4d4633423cd9a9fc97c2fdcddfd1e4db6;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/ext4-don-t-bug-on-inconsistent-journal-feature.patch b/queue-4.14/ext4-don-t-bug-on-inconsistent-journal-feature.patch new file mode 100644 index 00000000000..05052ef4edd --- /dev/null +++ b/queue-4.14/ext4-don-t-bug-on-inconsistent-journal-feature.patch @@ -0,0 +1,212 @@ +From 6c3419acef9ca9003b03a281938619884065d56e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 16:07:59 +0200 +Subject: ext4: don't BUG on inconsistent journal feature + +From: Jan Kara + +[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ] + +A customer has reported a BUG_ON in ext4_clear_journal_err() hitting +during an LTP testing. Either this has been caused by a test setup +issue where the filesystem was being overwritten while LTP was mounting +it or the journal replay has overwritten the superblock with invalid +data. In either case it is preferable we don't take the machine down +with a BUG_ON. So handle the situation of unexpectedly missing +has_journal feature more gracefully. We issue warning and fail the mount +in the cases where the race window is narrow and the failed check is +most likely a programming error. In cases where fs corruption is more +likely, we do full ext4_error() handling before failing mount / remount. + +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200710140759.18031-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 47 insertions(+), 21 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ffc985d781373..da0cb9a7d6fdc 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -63,10 +63,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, + unsigned long journal_devnum); + static int ext4_show_options(struct seq_file *seq, struct dentry *root); + static int ext4_commit_super(struct super_block *sb, int sync); +-static void ext4_mark_recovery_complete(struct super_block *sb, ++static int ext4_mark_recovery_complete(struct super_block *sb, + struct ext4_super_block *es); +-static void ext4_clear_journal_err(struct super_block *sb, +- struct ext4_super_block *es); ++static int ext4_clear_journal_err(struct super_block *sb, ++ struct ext4_super_block *es); + static int ext4_sync_fs(struct super_block *sb, int wait); + static int ext4_remount(struct super_block *sb, int *flags, char *data); + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf); +@@ -4458,7 +4458,9 @@ no_journal: + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; + if (needs_recovery) { + ext4_msg(sb, KERN_INFO, "recovery complete"); +- ext4_mark_recovery_complete(sb, es); ++ err = ext4_mark_recovery_complete(sb, es); ++ if (err) ++ goto failed_mount8; + } + if (EXT4_SB(sb)->s_journal) { + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +@@ -4501,10 +4503,8 @@ cantfind_ext4: + ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); + goto failed_mount; + +-#ifdef CONFIG_QUOTA + failed_mount8: + ext4_unregister_sysfs(sb); +-#endif + failed_mount7: + ext4_unregister_li_request(sb); + failed_mount6: +@@ -4640,7 +4640,8 @@ static journal_t *ext4_get_journal(struct super_block *sb, + struct inode *journal_inode; + journal_t *journal; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + journal_inode = ext4_get_journal_inode(sb, journal_inum); + if (!journal_inode) +@@ -4670,7 +4671,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, + struct ext4_super_block *es; + struct block_device *bdev; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + bdev = ext4_blkdev_get(j_dev, sb); + if (bdev == NULL) +@@ -4762,7 +4764,8 @@ static int ext4_load_journal(struct super_block *sb, + int err = 0; + int really_read_only; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return -EFSCORRUPTED; + + if (journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -4831,7 +4834,12 @@ static int ext4_load_journal(struct super_block *sb, + } + + EXT4_SB(sb)->s_journal = journal; +- ext4_clear_journal_err(sb, es); ++ err = ext4_clear_journal_err(sb, es); ++ if (err) { ++ EXT4_SB(sb)->s_journal = NULL; ++ jbd2_journal_destroy(journal); ++ return err; ++ } + + if (!really_read_only && journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -4930,26 +4938,32 @@ static int ext4_commit_super(struct super_block *sb, int sync) + * remounting) the filesystem readonly, then we will end up with a + * consistent fs on disk. Record that fact. + */ +-static void ext4_mark_recovery_complete(struct super_block *sb, +- struct ext4_super_block *es) ++static int ext4_mark_recovery_complete(struct super_block *sb, ++ struct ext4_super_block *es) + { ++ int err; + journal_t *journal = EXT4_SB(sb)->s_journal; + + if (!ext4_has_feature_journal(sb)) { +- BUG_ON(journal != NULL); +- return; ++ if (journal != NULL) { ++ ext4_error(sb, "Journal got removed while the fs was " ++ "mounted!"); ++ return -EFSCORRUPTED; ++ } ++ return 0; + } + jbd2_journal_lock_updates(journal); +- if (jbd2_journal_flush(journal) < 0) ++ err = jbd2_journal_flush(journal); ++ if (err < 0) + goto out; + + if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) { + ext4_clear_feature_journal_needs_recovery(sb); + ext4_commit_super(sb, 1); + } +- + out: + jbd2_journal_unlock_updates(journal); ++ return err; + } + + /* +@@ -4957,14 +4971,17 @@ out: + * has recorded an error from a previous lifetime, move that error to the + * main filesystem now. + */ +-static void ext4_clear_journal_err(struct super_block *sb, ++static int ext4_clear_journal_err(struct super_block *sb, + struct ext4_super_block *es) + { + journal_t *journal; + int j_errno; + const char *errstr; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (!ext4_has_feature_journal(sb)) { ++ ext4_error(sb, "Journal got removed while the fs was mounted!"); ++ return -EFSCORRUPTED; ++ } + + journal = EXT4_SB(sb)->s_journal; + +@@ -4989,6 +5006,7 @@ static void ext4_clear_journal_err(struct super_block *sb, + jbd2_journal_clear_err(journal); + jbd2_journal_update_sb_errno(journal); + } ++ return 0; + } + + /* +@@ -5268,8 +5286,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + (sbi->s_mount_state & EXT4_VALID_FS)) + es->s_state = cpu_to_le16(sbi->s_mount_state); + +- if (sbi->s_journal) ++ if (sbi->s_journal) { ++ /* ++ * We let remount-ro finish even if marking fs ++ * as clean failed... ++ */ + ext4_mark_recovery_complete(sb, es); ++ } + if (sbi->s_mmp_tsk) + kthread_stop(sbi->s_mmp_tsk); + } else { +@@ -5317,8 +5340,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + * been changed by e2fsck since we originally mounted + * the partition.) + */ +- if (sbi->s_journal) +- ext4_clear_journal_err(sb, es); ++ if (sbi->s_journal) { ++ err = ext4_clear_journal_err(sb, es); ++ if (err) ++ goto restore_opts; ++ } + sbi->s_mount_state = le16_to_cpu(es->s_state); + if (!ext4_setup_super(sb, es, 0)) + sb->s_flags &= ~MS_RDONLY; +-- +2.25.1 + diff --git a/queue-4.14/fs-prevent-bug_on-in-submit_bh_wbc.patch b/queue-4.14/fs-prevent-bug_on-in-submit_bh_wbc.patch new file mode 100644 index 00000000000..efc6161da34 --- /dev/null +++ b/queue-4.14/fs-prevent-bug_on-in-submit_bh_wbc.patch @@ -0,0 +1,131 @@ +From e8df0c7d6f198b152db2c4f217f958d9001d31a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 12:10:25 -0400 +Subject: fs: prevent BUG_ON in submit_bh_wbc() + +From: Xianting Tian + +[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ] + +If a device is hot-removed --- for example, when a physical device is +unplugged from pcie slot or a nbd device's network is shutdown --- +this can result in a BUG_ON() crash in submit_bh_wbc(). This is +because the when the block device dies, the buffer heads will have +their Buffer_Mapped flag get cleared, leading to the crash in +submit_bh_wbc. + +We had attempted to work around this problem in commit a17712c8 +("ext4: check superblock mapped prior to committing"). Unfortunately, +it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the +device dies between when the work-around check in ext4_commit_super() +and when submit_bh_wbh() is finally called: + +Code path: +ext4_commit_super + judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8 + lock_buffer(sbh) + ... + unlock_buffer(sbh) + __sync_dirty_buffer(sbh,... + lock_buffer(sbh) + judge if 'buffer_mapped(sbh))' is false, return <== added by this patch + submit_bh(...,sbh) + submit_bh_wbc(...,sbh,...) + +[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc() +[100722.966503] invalid opcode: 0000 [#1] SMP +[100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000 +[100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190 +[100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246 +[100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000 +[100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001 +[100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d +[100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800 +[100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000 +[100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000 +[100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0 +[100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[100722.966583] PKRU: 55555554 +[100722.966583] Call Trace: +[100722.966588] __sync_dirty_buffer+0x6e/0xd0 +[100722.966614] ext4_commit_super+0x1d8/0x290 [ext4] +[100722.966626] __ext4_std_error+0x78/0x100 [ext4] +[100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4] +[100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4] +[100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4] +[100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4] +[100722.966679] ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966682] __mark_inode_dirty+0x17f/0x350 +[100722.966686] generic_update_time+0x87/0xd0 +[100722.966687] touch_atime+0xa9/0xd0 +[100722.966690] generic_file_read_iter+0xa09/0xcd0 +[100722.966694] ? page_cache_tree_insert+0xb0/0xb0 +[100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4] +[100722.966707] ? __inode_security_revalidate+0x4f/0x60 +[100722.966709] __vfs_read+0xec/0x160 +[100722.966711] vfs_read+0x8c/0x130 +[100722.966712] SyS_pread64+0x87/0xb0 +[100722.966716] do_syscall_64+0x67/0x1b0 +[100722.966719] entry_SYSCALL64_slow_path+0x25/0x25 + +To address this, add the check of 'buffer_mapped(bh)' to +__sync_dirty_buffer(). This also has the benefit of fixing this for +other file systems. + +With this addition, we can drop the workaround in ext4_commit_supper(). + +[ Commit description rewritten by tytso. ] + +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/1596211825-8750-1-git-send-email-xianting_tian@126.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 9 +++++++++ + fs/ext4/super.c | 7 ------- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/fs/buffer.c b/fs/buffer.c +index cae7f24a0410e..9fbeddb6834a4 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3250,6 +3250,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) + WARN_ON(atomic_read(&bh->b_count) < 1); + lock_buffer(bh); + if (test_clear_buffer_dirty(bh)) { ++ /* ++ * The bh should be mapped, but it might not be if the ++ * device was hot-removed. Not much we can do but fail the I/O. ++ */ ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); ++ return -EIO; ++ } ++ + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; + ret = submit_bh(REQ_OP_WRITE, op_flags, bh); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index da0cb9a7d6fdc..634c822d1dc98 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4861,13 +4861,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) + if (!sbh || block_device_ejected(sb)) + return error; + +- /* +- * The superblock bh should be mapped, but it might not be if the +- * device was hot-removed. Not much we can do but fail the I/O. +- */ +- if (!buffer_mapped(sbh)) +- return error; +- + /* + * If the file system is mounted read-only, don't update the + * superblock write time. This avoids updating the superblock +-- +2.25.1 + diff --git a/queue-4.14/i2c-rcar-in-slave-mode-clear-nack-earlier.patch b/queue-4.14/i2c-rcar-in-slave-mode-clear-nack-earlier.patch new file mode 100644 index 00000000000..e0b50dae132 --- /dev/null +++ b/queue-4.14/i2c-rcar-in-slave-mode-clear-nack-earlier.patch @@ -0,0 +1,38 @@ +From 542f37894ef8d791ab2e40aa20a7462deb8f227b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 14:19:30 +0200 +Subject: i2c: rcar: in slave mode, clear NACK earlier + +From: Wolfram Sang + +[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ] + +Currently, a NACK in slave mode is set/cleared when SCL is held low by +the IP core right before the bit is about to be pushed out. This is too +late for clearing and then a NACK from the previous byte is still used +for the current one. Now, let's clear the NACK right after we detected +the STOP condition following the NACK. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index ed0f068109785..d5d0809a6283c 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -545,6 +545,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } +-- +2.25.1 + diff --git a/queue-4.14/jbd2-abort-journal-if-free-a-async-write-error-metad.patch b/queue-4.14/jbd2-abort-journal-if-free-a-async-write-error-metad.patch new file mode 100644 index 00000000000..bc7d185c2a8 --- /dev/null +++ b/queue-4.14/jbd2-abort-journal-if-free-a-async-write-error-metad.patch @@ -0,0 +1,66 @@ +From 4c278972a8a2a587424fd9d0eeef44d65bba64ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 10:54:26 +0800 +Subject: jbd2: abort journal if free a async write error metadata buffer + +From: zhangyi (F) + +[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ] + +If we free a metadata buffer which has been failed to async write out +in the background, the jbd2 checkpoint procedure will not detect this +failure in jbd2_log_do_checkpoint(), so it may lead to filesystem +inconsistency after cleanup journal tail. This patch abort the journal +if free a buffer has write_io_error flag to prevent potential further +inconsistency. + +Signed-off-by: zhangyi (F) +Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index b4bde0ae10948..3311b1e684def 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2008,6 +2008,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + { + struct buffer_head *head; + struct buffer_head *bh; ++ bool has_write_io_error = false; + int ret = 0; + + J_ASSERT(PageLocked(page)); +@@ -2032,11 +2033,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + jbd_unlock_bh_state(bh); + if (buffer_jbd(bh)) + goto busy; ++ ++ /* ++ * If we free a metadata buffer which has been failed to ++ * write out, the jbd2 checkpoint procedure will not detect ++ * this failure and may lead to filesystem inconsistency ++ * after cleanup journal tail. ++ */ ++ if (buffer_write_io_error(bh)) { ++ pr_err("JBD2: Error while async write back metadata bh %llu.", ++ (unsigned long long)bh->b_blocknr); ++ has_write_io_error = true; ++ } + } while ((bh = bh->b_this_page) != head); + + ret = try_to_free_buffers(page); + + busy: ++ if (has_write_io_error) ++ jbd2_journal_abort(journal, -EIO); ++ + return ret; + } + +-- +2.25.1 + diff --git a/queue-4.14/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch b/queue-4.14/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch new file mode 100644 index 00000000000..36d9565b03a --- /dev/null +++ b/queue-4.14/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch @@ -0,0 +1,62 @@ +From 05eddd2e5517974ae3d220aa5c4a59c246a2c855 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:25:49 +0200 +Subject: jbd2: make sure jh have b_transaction set in refile/unfile_buffer + +From: Lukas Czerner + +[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ] + +Callers of __jbd2_journal_unfile_buffer() and +__jbd2_journal_refile_buffer() assume that the b_transaction is set. In +fact if it's not, we can end up with journal_head refcounting errors +leading to crash much later that might be very hard to track down. Add +asserts to make sure that is the case. + +We also make sure that b_next_transaction is NULL in +__jbd2_journal_unfile_buffer() since the callers expect that as well and +we should not get into that stage in this state anyway, leading to +problems later on if we do. + +Tested with fstests. + +Signed-off-by: Lukas Czerner +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index a355ca418e788..b4bde0ae10948 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1914,6 +1914,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) + */ + static void __jbd2_journal_unfile_buffer(struct journal_head *jh) + { ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); ++ + __jbd2_journal_temp_unlink_buffer(jh); + jh->b_transaction = NULL; + jbd2_journal_put_journal_head(jh); +@@ -2461,6 +2464,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) + + was_dirty = test_clear_buffer_jbddirty(bh); + __jbd2_journal_temp_unlink_buffer(jh); ++ ++ /* ++ * b_transaction must be set, otherwise the new b_transaction won't ++ * be holding jh reference ++ */ ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ + /* + * We set b_transaction here because b_next_transaction will inherit + * our jh reference and thus __jbd2_journal_file_buffer() must not +-- +2.25.1 + diff --git a/queue-4.14/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch b/queue-4.14/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch new file mode 100644 index 00000000000..fde9da54586 --- /dev/null +++ b/queue-4.14/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch @@ -0,0 +1,43 @@ +From ce3de87458fc4d734f179c4eb5daac4f507d2050 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 May 2020 14:50:52 +0200 +Subject: media: gpio-ir-tx: improve precision of transmitted signal due to + scheduling + +From: Sean Young + +[ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ] + +usleep_range() may take longer than the max argument due to scheduling, +especially under load. This is causing random errors in the transmitted +IR. Remove the usleep_range() in favour of busy-looping with udelay(). + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-tx.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c +index cd476cab97820..4e70b67ccd181 100644 +--- a/drivers/media/rc/gpio-ir-tx.c ++++ b/drivers/media/rc/gpio-ir-tx.c +@@ -87,13 +87,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf, + // space + edge = ktime_add_us(edge, txbuf[i]); + delta = ktime_us_delta(edge, ktime_get()); +- if (delta > 10) { +- spin_unlock_irqrestore(&gpio_ir->lock, flags); +- usleep_range(delta, delta + 10); +- spin_lock_irqsave(&gpio_ir->lock, flags); +- } else if (delta > 0) { ++ if (delta > 0) + udelay(delta); +- } + } else { + // pulse + ktime_t last = ktime_add_us(edge, txbuf[i]); +-- +2.25.1 + diff --git a/queue-4.14/net-gianfar-add-of_node_put-before-goto-statement.patch b/queue-4.14/net-gianfar-add-of_node_put-before-goto-statement.patch new file mode 100644 index 00000000000..80bafb50f20 --- /dev/null +++ b/queue-4.14/net-gianfar-add-of_node_put-before-goto-statement.patch @@ -0,0 +1,46 @@ +From 3730484b0528ef8bdfbf7272e914245be47dbe79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 00:22:41 +0530 +Subject: net: gianfar: Add of_node_put() before goto statement + +From: Sumera Priyadarsini + +[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ] + +Every iteration of for_each_available_child_of_node() decrements +reference count of the previous node, however when control +is transferred from the middle of the loop, as in the case of +a return or break or goto, there is no decrement thus ultimately +resulting in a memory leak. + +Fix a potential memory leak in gianfar.c by inserting of_node_put() +before the goto statement. + +Issue found with Coccinelle. + +Signed-off-by: Sumera Priyadarsini +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index e4a2c74a9b47e..6b95334e172d1 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -844,8 +844,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) + continue; + + err = gfar_parse_group(child, priv, model); +- if (err) ++ if (err) { ++ of_node_put(child); + goto err_grp_init; ++ } + } + } else { /* SQ_SG_MODE */ + err = gfar_parse_group(np, priv, model); +-- +2.25.1 + diff --git a/queue-4.14/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch b/queue-4.14/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch new file mode 100644 index 00000000000..3c8463f2e2f --- /dev/null +++ b/queue-4.14/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch @@ -0,0 +1,35 @@ +From 31dfa51ee58195b8407c1311b88eb248b89e87ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 04:34:42 -0400 +Subject: null_blk: fix passing of REQ_FUA flag in null_handle_rq + +From: Hou Pu + +[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ] + +REQ_FUA should be checked using rq->cmd_flags instead of req_op(). + +Fixes: deb78b419dfda ("nullb: emulate cache") +Signed-off-by: Hou Pu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c +index b12e373aa956a..ec670a1b7e02f 100644 +--- a/drivers/block/null_blk.c ++++ b/drivers/block/null_blk.c +@@ -1135,7 +1135,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) + len = bvec.bv_len; + err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset, + op_is_write(req_op(rq)), sector, +- req_op(rq) & REQ_FUA); ++ rq->cmd_flags & REQ_FUA); + if (err) { + spin_unlock_irq(&nullb->lock); + return err; +-- +2.25.1 + diff --git a/queue-4.14/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch b/queue-4.14/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch new file mode 100644 index 00000000000..7af5a04a8f1 --- /dev/null +++ b/queue-4.14/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch @@ -0,0 +1,49 @@ +From 4c572779c3cb16e49ba2d0036dbbaa93d1c9a594 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:45 +0800 +Subject: nvme-fc: Fix wrong return value in __nvme_fc_init_request() + +From: Tianjia Zhang + +[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ] + +On an error exit path, a negative error code should be returned +instead of a positive return value. + +Fixes: e399441de9115 ("nvme-fabrics: Add host support for FC transport") +Cc: James Smart +Signed-off-by: Tianjia Zhang +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 058d542647dd5..13c89cc9d10cf 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1492,7 +1492,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) { + dev_err(ctrl->dev, + "FCP Op failed - cmdiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + goto out_on_error; + } + +@@ -1502,7 +1502,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) { + dev_err(ctrl->dev, + "FCP Op failed - rspiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + } + + atomic_set(&op->state, FCPOP_STATE_IDLE); +-- +2.25.1 + diff --git a/queue-4.14/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch b/queue-4.14/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch new file mode 100644 index 00000000000..57383498b5c --- /dev/null +++ b/queue-4.14/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch @@ -0,0 +1,56 @@ +From 04046ae994a8e4287c11e4a2052238cd70eda6f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 08:46:32 -0400 +Subject: powerpc/perf: Fix soft lockups due to missed interrupt accounting + +From: Athira Rajeev + +[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ] + +Performance monitor interrupt handler checks if any counter has +overflown and calls record_and_restart() in core-book3s which invokes +perf_event_overflow() to record the sample information. Apart from +creating sample, perf_event_overflow() also does the interrupt and +period checks via perf_event_account_interrupt(). + +Currently we record information only if the SIAR (Sampled Instruction +Address Register) valid bit is set (using siar_valid() check) and +hence the interrupt check. + +But it is possible that we do sampling for some events that are not +generating valid SIAR, and hence there is no chance to disable the +event if interrupts are more than max_samples_per_tick. This leads to +soft lockup. + +Fix this by adding perf_event_account_interrupt() in the invalid SIAR +code path for a sampling event. ie if SIAR is invalid, just do +interrupt check and don't record the sample information. + +Reported-by: Alexey Kardashevskiy +Signed-off-by: Athira Rajeev +Tested-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index 3188040022c4f..78f75e48dfe7f 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2096,6 +2096,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + + if (perf_event_overflow(event, &data, regs)) + power_pmu_stop(event, 0); ++ } else if (period) { ++ /* Account for interrupt in case of invalid SIAR */ ++ if (perf_event_account_interrupt(event)) ++ power_pmu_stop(event, 0); + } + } + +-- +2.25.1 + diff --git a/queue-4.14/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch b/queue-4.14/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch new file mode 100644 index 00000000000..6d4d3fecef7 --- /dev/null +++ b/queue-4.14/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch @@ -0,0 +1,43 @@ +From e6d24215cae2ed600f01d586af646a8b5db93f21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 16:42:45 +0200 +Subject: s390/cio: add cond_resched() in the slow_eval_known_fn() loop + +From: Vineeth Vijayan + +[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ] + +The scanning through subchannels during the time of an event could +take significant amount of time in case of platforms with lots of +known subchannels. This might result in higher scheduling latencies +for other tasks especially on systems with a single CPU. Add +cond_resched() call, as the loop in slow_eval_known_fn() can be +executed for a longer duration. + +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index dadff1838fec1..e2026d54dd375 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -581,6 +581,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) + rc = css_evaluate_known_subchannel(sch, 1); + if (rc == -EAGAIN) + css_schedule_eval(sch->schid); ++ /* ++ * The loop might take long time for platforms with lots of ++ * known devices. Allow scheduling here. ++ */ ++ cond_resched(); + } + return 0; + } +-- +2.25.1 + diff --git a/queue-4.14/scsi-ufs-clean-up-completed-request-without-interrup.patch b/queue-4.14/scsi-ufs-clean-up-completed-request-without-interrup.patch new file mode 100644 index 00000000000..0cdf8400cab --- /dev/null +++ b/queue-4.14/scsi-ufs-clean-up-completed-request-without-interrup.patch @@ -0,0 +1,56 @@ +From 2e4586bff96a2377548618a193a97b6605dd407d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:18:58 +0200 +Subject: scsi: ufs: Clean up completed request without interrupt notification + +From: Stanley Chu + +[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ] + +If somehow no interrupt notification is raised for a completed request and +its doorbell bit is cleared by host, UFS driver needs to cleanup its +outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally +in the following scenario: + +After ufshcd_abort() returns, this request will be requeued by SCSI layer +with its outstanding bit set. Any future completed request will trigger +ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At +this time the "abnormal outstanding bit" will be detected and the "requeued +request" will be chosen to execute request post-processing flow. This is +wrong because this request is still "alive". + +Link: https://lore.kernel.org/r/20200811141859.27399-2-huobean@gmail.com +Reviewed-by: Can Guo +Acked-by: Avri Altman +Signed-off-by: Stanley Chu +Signed-off-by: Bean Huo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 619fe46fcc5f0..c1792f271ac5d 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5694,7 +5694,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + /* command completed already */ + dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n", + __func__, tag); +- goto out; ++ goto cleanup; + } else { + dev_err(hba->dev, + "%s: no response from device. tag = %d, err %d\n", +@@ -5728,6 +5728,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + goto out; + } + ++cleanup: + scsi_dma_unmap(cmd); + + spin_lock_irqsave(host->host_lock, flags); +-- +2.25.1 + diff --git a/queue-4.14/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch b/queue-4.14/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch new file mode 100644 index 00000000000..7a25e08050a --- /dev/null +++ b/queue-4.14/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch @@ -0,0 +1,57 @@ +From 86a7e672c6b8bf7fb14835a5b6a2a295c2676c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 13:07:34 +0800 +Subject: scsi: ufs: Fix possible infinite loop in ufshcd_hold + +From: Stanley Chu + +[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ] + +In ufshcd_suspend(), after clk-gating is suspended and link is set +as Hibern8 state, ufshcd_hold() is still possibly invoked before +ufshcd_suspend() returns. For example, MediaTek's suspend vops may +issue UIC commands which would call ufshcd_hold() during the command +issuing flow. + +Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled, +then ufshcd_hold() may enter infinite loops because there is no +clk-ungating work scheduled or pending. In this case, ufshcd_hold() +shall just bypass, and keep the link as Hibern8 state. + +Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com +Reviewed-by: Avri Altman +Co-developed-by: Andy Teng +Signed-off-by: Andy Teng +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 11e917b44a0f1..3b4214feae971 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1425,6 +1425,7 @@ unblock_reqs: + int ufshcd_hold(struct ufs_hba *hba, bool async) + { + int rc = 0; ++ bool flush_result; + unsigned long flags; + + if (!ufshcd_is_clkgating_allowed(hba)) +@@ -1456,7 +1457,9 @@ start: + break; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +- flush_work(&hba->clk_gating.ungate_work); ++ flush_result = flush_work(&hba->clk_gating.ungate_work); ++ if (hba->clk_gating.is_suspended && !flush_result) ++ goto out; + spin_lock_irqsave(hba->host->host_lock, flags); + goto start; + } +-- +2.25.1 + diff --git a/queue-4.14/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch b/queue-4.14/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch new file mode 100644 index 00000000000..aef00d0742a --- /dev/null +++ b/queue-4.14/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch @@ -0,0 +1,55 @@ +From f2a082751e5e20b3f6ccf0ff25bf59521727a1d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:39:36 +0300 +Subject: scsi: ufs: Improve interrupt handling for shared interrupts + +From: Adrian Hunter + +[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ] + +For shared interrupts, the interrupt status might be zero, so check that +first. + +Link: https://lore.kernel.org/r/20200811133936.19171-2-adrian.hunter@intel.com +Reviewed-by: Avri Altman +Signed-off-by: Adrian Hunter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 3b4214feae971..619fe46fcc5f0 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5373,7 +5373,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) + */ + static irqreturn_t ufshcd_intr(int irq, void *__hba) + { +- u32 intr_status, enabled_intr_status; ++ u32 intr_status, enabled_intr_status = 0; + irqreturn_t retval = IRQ_NONE; + struct ufs_hba *hba = __hba; + int retries = hba->nutrs; +@@ -5387,7 +5387,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + * read, make sure we handle them by checking the interrupt status + * again in a loop until we process all of the reqs before returning. + */ +- do { ++ while (intr_status && retries--) { + enabled_intr_status = + intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + if (intr_status) +@@ -5398,7 +5398,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + } + + intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); +- } while (intr_status && --retries); ++ } + + spin_unlock(hba->host->host_lock); + return retval; +-- +2.25.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 5ec836bc950..cd0db6b1527 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -39,3 +39,19 @@ powerpc-spufs-add-config_coredump-dependency.patch usb-sisusbvga-fix-a-potential-ub-casued-by-left-shif.patch efi-provide-empty-efi_enter_virtual_mode-implementat.patch revert-ath10k-fix-dma-related-firmware-crashes-on-mu.patch +media-gpio-ir-tx-improve-precision-of-transmitted-si.patch +nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch +null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch +i2c-rcar-in-slave-mode-clear-nack-earlier.patch +usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch +jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch +ext4-don-t-bug-on-inconsistent-journal-feature.patch +jbd2-abort-journal-if-free-a-async-write-error-metad.patch +fs-prevent-bug_on-in-submit_bh_wbc.patch +spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch +s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch +scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch +scsi-ufs-improve-interrupt-handling-for-shared-inter.patch +scsi-ufs-clean-up-completed-request-without-interrup.patch +net-gianfar-add-of_node_put-before-goto-statement.patch +powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch diff --git a/queue-4.14/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch b/queue-4.14/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch new file mode 100644 index 00000000000..a186a44aa80 --- /dev/null +++ b/queue-4.14/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch @@ -0,0 +1,38 @@ +From 1bdd249cf40072faab568dab339843b792c6a1ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:36 +0200 +Subject: spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate + +From: Amelie Delaunay + +[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ] + +Fix spi->clk_rate when it is odd to the nearest lowest even value because +minimum SPI divider is 2. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index ba9743fa2326d..179749f354c33 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -254,7 +254,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz) + { + u32 div, mbrdiv; + +- div = DIV_ROUND_UP(spi->clk_rate, speed_hz); ++ /* Ensure spi->clk_rate is even */ ++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); + + /* + * SPI framework set xfer->speed_hz to master->max_speed_hz if +-- +2.25.1 + diff --git a/queue-4.14/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch b/queue-4.14/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch new file mode 100644 index 00000000000..e57e576eced --- /dev/null +++ b/queue-4.14/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch @@ -0,0 +1,46 @@ +From 70bfff7097031b0659323ccee04e87617b89cd67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 07:55:01 +0200 +Subject: usb: gadget: f_tcm: Fix some resource leaks in some error paths + +From: Christophe JAILLET + +[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ] + +If a memory allocation fails within a 'usb_ep_alloc_request()' call, the +already allocated memory must be released. + +Fix a mix-up in the code and free the correct requests. + +Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT") +Signed-off-by: Christophe JAILLET +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_tcm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c +index a82e2bd5ea34d..c41d09166a1d6 100644 +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) + goto err_sts; + + return 0; ++ + err_sts: +- usb_ep_free_request(fu->ep_status, stream->req_status); +- stream->req_status = NULL; +-err_out: + usb_ep_free_request(fu->ep_out, stream->req_out); + stream->req_out = NULL; ++err_out: ++ usb_ep_free_request(fu->ep_in, stream->req_in); ++ stream->req_in = NULL; + out: + return -ENOMEM; + } +-- +2.25.1 +