From: Greg Kroah-Hartman Date: Fri, 24 Sep 2021 09:36:07 +0000 (+0200) Subject: 5.14-stable patches X-Git-Tag: v4.4.285~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b6782610c5a3653ae4b5c179e59c58f3bd39d157;p=thirdparty%2Fkernel%2Fstable-queue.git 5.14-stable patches added patches: 9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch n64cart-fix-return-value-check-in-n64cart_probe.patch nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch perf-test-fix-bpf-test-sample-mismatch-reporting.patch perf-tools-allow-build-id-with-trailing-zeros.patch pm-sleep-core-avoid-setting-power.must_resume-to-false.patch prctl-allow-to-setup-brk-for-et_dyn-executables.patch profiling-fix-shift-out-of-bounds-bugs.patch pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch --- diff --git a/queue-5.14/9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch b/queue-5.14/9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch new file mode 100644 index 00000000000..a7adecb8bf3 --- /dev/null +++ b/queue-5.14/9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch @@ -0,0 +1,41 @@ +From f997ea3b7afc108eb9761f321b57de2d089c7c48 Mon Sep 17 00:00:00 2001 +From: Xie Yongji +Date: Mon, 17 May 2021 16:35:57 +0800 +Subject: 9p/trans_virtio: Remove sysfs file on probe failure + +From: Xie Yongji + +commit f997ea3b7afc108eb9761f321b57de2d089c7c48 upstream. + +This ensures we don't leak the sysfs file if we failed to +allocate chan->vc_wq during probe. + +Link: http://lkml.kernel.org/r/20210517083557.172-1-xieyongji@bytedance.com +Fixes: 86c8437383ac ("net/9p: Add sysfs mount_tag file for virtio 9P device") +Signed-off-by: Xie Yongji +Signed-off-by: Dominique Martinet +Signed-off-by: Greg Kroah-Hartman +--- + net/9p/trans_virtio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -610,7 +610,7 @@ static int p9_virtio_probe(struct virtio + chan->vc_wq = kmalloc(sizeof(wait_queue_head_t), GFP_KERNEL); + if (!chan->vc_wq) { + err = -ENOMEM; +- goto out_free_tag; ++ goto out_remove_file; + } + init_waitqueue_head(chan->vc_wq); + chan->ring_bufs_avail = 1; +@@ -628,6 +628,8 @@ static int p9_virtio_probe(struct virtio + + return 0; + ++out_remove_file: ++ sysfs_remove_file(&vdev->dev.kobj, &dev_attr_mount_tag.attr); + out_free_tag: + kfree(tag); + out_free_vq: diff --git a/queue-5.14/ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch b/queue-5.14/ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch new file mode 100644 index 00000000000..83a492bf944 --- /dev/null +++ b/queue-5.14/ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch @@ -0,0 +1,64 @@ +From b4002173b7989588b6feaefc42edaf011b596782 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Tue, 27 Jul 2021 15:47:12 -0400 +Subject: ceph: cancel delayed work instead of flushing on mdsc teardown + +From: Jeff Layton + +commit b4002173b7989588b6feaefc42edaf011b596782 upstream. + +The first thing metric_delayed_work does is check mdsc->stopping, +and then return immediately if it's set. That's good since we would +have already torn down the metric structures at this point, otherwise, +but there is no locking around mdsc->stopping. + +It's possible that the ceph_metric_destroy call could race with the +delayed_work, in which case we could end up with the delayed_work +accessing destroyed percpu variables. + +At this point in the mdsc teardown, the "stopping" flag has already been +set, so there's no benefit to flushing the work. Move the work +cancellation in ceph_metric_destroy ahead of the percpu variable +destruction, and eliminate the flush_delayed_work call in +ceph_mdsc_destroy. + +Fixes: 18f473b384a6 ("ceph: periodically send perf metrics to MDSes") +Signed-off-by: Jeff Layton +Reviewed-by: Xiubo Li +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/mds_client.c | 1 - + fs/ceph/metric.c | 4 ++-- + 2 files changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -4912,7 +4912,6 @@ void ceph_mdsc_destroy(struct ceph_fs_cl + + ceph_metric_destroy(&mdsc->metric); + +- flush_delayed_work(&mdsc->metric.delayed_work); + fsc->mdsc = NULL; + kfree(mdsc); + dout("mdsc_destroy %p done\n", mdsc); +--- a/fs/ceph/metric.c ++++ b/fs/ceph/metric.c +@@ -302,6 +302,8 @@ void ceph_metric_destroy(struct ceph_cli + if (!m) + return; + ++ cancel_delayed_work_sync(&m->delayed_work); ++ + percpu_counter_destroy(&m->total_inodes); + percpu_counter_destroy(&m->opened_inodes); + percpu_counter_destroy(&m->i_caps_mis); +@@ -309,8 +311,6 @@ void ceph_metric_destroy(struct ceph_cli + percpu_counter_destroy(&m->d_lease_mis); + percpu_counter_destroy(&m->d_lease_hit); + +- cancel_delayed_work_sync(&m->delayed_work); +- + ceph_put_mds_session(m->session); + } + diff --git a/queue-5.14/n64cart-fix-return-value-check-in-n64cart_probe.patch b/queue-5.14/n64cart-fix-return-value-check-in-n64cart_probe.patch new file mode 100644 index 00000000000..5565f373f8e --- /dev/null +++ b/queue-5.14/n64cart-fix-return-value-check-in-n64cart_probe.patch @@ -0,0 +1,37 @@ +From 221e8360834c59f0c9952630fa5904a94ebd2bb8 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Thu, 9 Sep 2021 17:06:08 +0800 +Subject: n64cart: fix return value check in n64cart_probe() + +From: Yang Yingliang + +commit 221e8360834c59f0c9952630fa5904a94ebd2bb8 upstream. + +In case of error, the function devm_platform_ioremap_resource() +returns ERR_PTR() and never returns NULL. The NULL test in the +return value check should be replaced with IS_ERR(). + +Fixes: d9b2a2bbbb4d ("block: Add n64 cart driver") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Chaitanya Kulkarni +Link: https://lore.kernel.org/r/20210909090608.2989716-1-yangyingliang@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/n64cart.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/block/n64cart.c ++++ b/drivers/block/n64cart.c +@@ -129,8 +129,8 @@ static int __init n64cart_probe(struct p + } + + reg_base = devm_platform_ioremap_resource(pdev, 0); +- if (!reg_base) +- return -EINVAL; ++ if (IS_ERR(reg_base)) ++ return PTR_ERR(reg_base); + + disk = blk_alloc_disk(NUMA_NO_NODE); + if (!disk) diff --git a/queue-5.14/nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch b/queue-5.14/nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch new file mode 100644 index 00000000000..39f7480a6b9 --- /dev/null +++ b/queue-5.14/nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch @@ -0,0 +1,98 @@ +From 98e2e409e76ef7781d8511f997359e9c504a95c1 Mon Sep 17 00:00:00 2001 +From: Zhen Lei +Date: Tue, 7 Sep 2021 20:00:26 -0700 +Subject: nilfs2: use refcount_dec_and_lock() to fix potential UAF + +From: Zhen Lei + +commit 98e2e409e76ef7781d8511f997359e9c504a95c1 upstream. + +When the refcount is decreased to 0, the resource reclamation branch is +entered. Before CPU0 reaches the race point (1), CPU1 may obtain the +spinlock and traverse the rbtree to find 'root', see +nilfs_lookup_root(). + +Although CPU1 will call refcount_inc() to increase the refcount, it is +obviously too late. CPU0 will release 'root' directly, CPU1 then +accesses 'root' and triggers UAF. + +Use refcount_dec_and_lock() to ensure that both the operations of +decrease refcount to 0 and link deletion are lock protected eliminates +this risk. + + CPU0 CPU1 + nilfs_put_root(): + <-------- (1) + spin_lock(&nilfs->ns_cptree_lock); + rb_erase(&root->rb_node, &nilfs->ns_cptree); + spin_unlock(&nilfs->ns_cptree_lock); + + kfree(root); + <-------- use-after-free + + refcount_t: underflow; use-after-free. + WARNING: CPU: 2 PID: 9476 at lib/refcount.c:28 \ + refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28 + Modules linked in: + CPU: 2 PID: 9476 Comm: syz-executor.0 Not tainted 5.10.45-rc1+ #3 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), ... + RIP: 0010:refcount_warn_saturate+0x1cf/0x210 lib/refcount.c:28 + ... ... + Call Trace: + __refcount_sub_and_test include/linux/refcount.h:283 [inline] + __refcount_dec_and_test include/linux/refcount.h:315 [inline] + refcount_dec_and_test include/linux/refcount.h:333 [inline] + nilfs_put_root+0xc1/0xd0 fs/nilfs2/the_nilfs.c:795 + nilfs_segctor_destroy fs/nilfs2/segment.c:2749 [inline] + nilfs_detach_log_writer+0x3fa/0x570 fs/nilfs2/segment.c:2812 + nilfs_put_super+0x2f/0xf0 fs/nilfs2/super.c:467 + generic_shutdown_super+0xcd/0x1f0 fs/super.c:464 + kill_block_super+0x4a/0x90 fs/super.c:1446 + deactivate_locked_super+0x6a/0xb0 fs/super.c:335 + deactivate_super+0x85/0x90 fs/super.c:366 + cleanup_mnt+0x277/0x2e0 fs/namespace.c:1118 + __cleanup_mnt+0x15/0x20 fs/namespace.c:1125 + task_work_run+0x8e/0x110 kernel/task_work.c:151 + tracehook_notify_resume include/linux/tracehook.h:188 [inline] + exit_to_user_mode_loop kernel/entry/common.c:164 [inline] + exit_to_user_mode_prepare+0x13c/0x170 kernel/entry/common.c:191 + syscall_exit_to_user_mode+0x16/0x30 kernel/entry/common.c:266 + do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +There is no reproduction program, and the above is only theoretical +analysis. + +Link: https://lkml.kernel.org/r/1629859428-5906-1-git-send-email-konishi.ryusuke@gmail.com +Fixes: ba65ae4729bf ("nilfs2: add checkpoint tree to nilfs object") +Link: https://lkml.kernel.org/r/20210723012317.4146-1-thunder.leizhen@huawei.com +Signed-off-by: Zhen Lei +Signed-off-by: Ryusuke Konishi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/nilfs2/the_nilfs.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/fs/nilfs2/the_nilfs.c ++++ b/fs/nilfs2/the_nilfs.c +@@ -792,14 +792,13 @@ nilfs_find_or_create_root(struct the_nil + + void nilfs_put_root(struct nilfs_root *root) + { +- if (refcount_dec_and_test(&root->count)) { +- struct the_nilfs *nilfs = root->nilfs; ++ struct the_nilfs *nilfs = root->nilfs; + +- nilfs_sysfs_delete_snapshot_group(root); +- +- spin_lock(&nilfs->ns_cptree_lock); ++ if (refcount_dec_and_lock(&root->count, &nilfs->ns_cptree_lock)) { + rb_erase(&root->rb_node, &nilfs->ns_cptree); + spin_unlock(&nilfs->ns_cptree_lock); ++ ++ nilfs_sysfs_delete_snapshot_group(root); + iput(root->ifile); + + kfree(root); diff --git a/queue-5.14/perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch b/queue-5.14/perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch new file mode 100644 index 00000000000..69b8f409f7f --- /dev/null +++ b/queue-5.14/perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch @@ -0,0 +1,76 @@ +From d2930ede5218be28413a00130a6895d14393c325 Mon Sep 17 00:00:00 2001 +From: Remi Bernon +Date: Thu, 9 Sep 2021 21:26:36 +0200 +Subject: perf symbol: Look for ImageBase in PE file to compute .text offset + +From: Remi Bernon + +commit d2930ede5218be28413a00130a6895d14393c325 upstream. + +Instead of using the file offset in the debug file. + +This fixes a regression from 00a3423492bc90be ("perf symbols: Make +dso__load_bfd_symbols() load PE files from debug cache only"), causing +incorrect symbol resolution when debug file have been stripped from +non-debug sections (in which case its .text section is empty and doesn't +have any file position). + +The debug files could also be created with a different file alignment, +and have different file positions from the mmap-ed binary, or have the +section reordered. + +This instead looks for the file image base, using the corresponding bfd +*ABS* symbols. As PE symbols only have 4 bytes, it also needs to keep +.text section vma high bits. + +Signed-off-by: Remi Bernon +Fixes: 00a3423492bc90be ("perf symbols: Make dso__load_bfd_symbols() load PE files from debug cache only") +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Nicholas Fraser +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210909192637.4139125-1-rbernon@codeweavers.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/symbol.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -1581,10 +1581,6 @@ int dso__load_bfd_symbols(struct dso *ds + if (bfd_get_flavour(abfd) == bfd_target_elf_flavour) + goto out_close; + +- section = bfd_get_section_by_name(abfd, ".text"); +- if (section) +- dso->text_offset = section->vma - section->filepos; +- + symbols_size = bfd_get_symtab_upper_bound(abfd); + if (symbols_size == 0) { + bfd_close(abfd); +@@ -1602,6 +1598,22 @@ int dso__load_bfd_symbols(struct dso *ds + if (symbols_count < 0) + goto out_free; + ++ section = bfd_get_section_by_name(abfd, ".text"); ++ if (section) { ++ for (i = 0; i < symbols_count; ++i) { ++ if (!strcmp(bfd_asymbol_name(symbols[i]), "__ImageBase") || ++ !strcmp(bfd_asymbol_name(symbols[i]), "__image_base__")) ++ break; ++ } ++ if (i < symbols_count) { ++ /* PE symbols can only have 4 bytes, so use .text high bits */ ++ dso->text_offset = section->vma - (u32)section->vma; ++ dso->text_offset += (u32)bfd_asymbol_value(symbols[i]); ++ } else { ++ dso->text_offset = section->vma - section->filepos; ++ } ++ } ++ + qsort(symbols, symbols_count, sizeof(asymbol *), bfd_symbols__cmpvalue); + + #ifdef bfd_get_section diff --git a/queue-5.14/perf-test-fix-bpf-test-sample-mismatch-reporting.patch b/queue-5.14/perf-test-fix-bpf-test-sample-mismatch-reporting.patch new file mode 100644 index 00000000000..c411dfd36df --- /dev/null +++ b/queue-5.14/perf-test-fix-bpf-test-sample-mismatch-reporting.patch @@ -0,0 +1,37 @@ +From 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc Mon Sep 17 00:00:00 2001 +From: Michael Petlan +Date: Thu, 5 Aug 2021 18:06:11 +0200 +Subject: perf test: Fix bpf test sample mismatch reporting + +From: Michael Petlan + +commit 3e11300cdfd5f1bc13a05dfc6dccf69aca5dd1dc upstream. + +When the expected sample count in the condition changed, the message +needs to be changed too, otherwise we'll get: + + 0x1001f2091d8: mmap mask[0]: + BPF filter result incorrect, expected 56, got 56 samples + +Fixes: 4b04e0decd2518e5 ("perf test: Fix basic bpf filtering test") +Signed-off-by: Michael Petlan +Cc: Jiri Olsa +Cc: Sumanth Korikkar +Link: https //lore.kernel.org/r/20210805160611.5542-1-mpetlan@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/bpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/tests/bpf.c ++++ b/tools/perf/tests/bpf.c +@@ -192,7 +192,7 @@ static int do_test(struct bpf_object *ob + } + + if (count != expect * evlist->core.nr_entries) { +- pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect, count); ++ pr_debug("BPF filter result incorrect, expected %d, got %d samples\n", expect * evlist->core.nr_entries, count); + goto out_delete_evlist; + } + diff --git a/queue-5.14/perf-tools-allow-build-id-with-trailing-zeros.patch b/queue-5.14/perf-tools-allow-build-id-with-trailing-zeros.patch new file mode 100644 index 00000000000..4ce700b0f2a --- /dev/null +++ b/queue-5.14/perf-tools-allow-build-id-with-trailing-zeros.patch @@ -0,0 +1,65 @@ +From 4a86d41404005a3c7e7b6065e8169ac6202887a9 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Fri, 10 Sep 2021 15:46:30 -0700 +Subject: perf tools: Allow build-id with trailing zeros + +From: Namhyung Kim + +commit 4a86d41404005a3c7e7b6065e8169ac6202887a9 upstream. + +Currently perf saves a build-id with size but old versions assumes the +size of 20. In case the build-id is less than 20 (like for MD5), it'd +fill the rest with 0s. + +I saw a problem when old version of perf record saved a binary in the +build-id cache and new version of perf reads the data. The symbols +should be read from the build-id cache (as the path no longer has the +same binary) but it failed due to mismatch in the build-id. + + symsrc__init: build id mismatch for /home/namhyung/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf. + +The build-id event in the data has 20 byte build-ids, but it saw a +different size (16) when it reads the build-id of the elf file in the +build-id cache. + + $ readelf -n ~/.debug/.build-id/53/e4c2f42a4c61a2d632d92a72afa08f00000000/elf + + Displaying notes found in: .note.gnu.build-id + Owner Data size Description + GNU 0x00000010 NT_GNU_BUILD_ID (unique build ID bitstring) + Build ID: 53e4c2f42a4c61a2d632d92a72afa08f + +Let's fix this by allowing trailing zeros if the size is different. + +Fixes: 39be8d0115b321ed ("perf tools: Pass build_id object to dso__build_id_equal()") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210910224630.1084877-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/dso.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -1349,6 +1349,16 @@ void dso__set_build_id(struct dso *dso, + + bool dso__build_id_equal(const struct dso *dso, struct build_id *bid) + { ++ if (dso->bid.size > bid->size && dso->bid.size == BUILD_ID_SIZE) { ++ /* ++ * For the backward compatibility, it allows a build-id has ++ * trailing zeros. ++ */ ++ return !memcmp(dso->bid.data, bid->data, bid->size) && ++ !memchr_inv(&dso->bid.data[bid->size], 0, ++ dso->bid.size - bid->size); ++ } ++ + return dso->bid.size == bid->size && + memcmp(dso->bid.data, bid->data, dso->bid.size) == 0; + } diff --git a/queue-5.14/pm-sleep-core-avoid-setting-power.must_resume-to-false.patch b/queue-5.14/pm-sleep-core-avoid-setting-power.must_resume-to-false.patch new file mode 100644 index 00000000000..33c1e04d7f1 --- /dev/null +++ b/queue-5.14/pm-sleep-core-avoid-setting-power.must_resume-to-false.patch @@ -0,0 +1,51 @@ +From 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 Mon Sep 17 00:00:00 2001 +From: Prasad Sodagudi +Date: Tue, 7 Sep 2021 04:24:23 -0700 +Subject: PM: sleep: core: Avoid setting power.must_resume to false + +From: Prasad Sodagudi + +commit 4a9344cd0aa4499beb3772bbecb40bb78888c0e1 upstream. + +There are variables(power.may_skip_resume and dev->power.must_resume) +and DPM_FLAG_MAY_SKIP_RESUME flags to control the resume of devices after +a system wide suspend transition. + +Setting the DPM_FLAG_MAY_SKIP_RESUME flag means that the driver allows +its "noirq" and "early" resume callbacks to be skipped if the device +can be left in suspend after a system-wide transition into the working +state. PM core determines that the driver's "noirq" and "early" resume +callbacks should be skipped or not with dev_pm_skip_resume() function by +checking power.may_skip_resume variable. + +power.must_resume variable is getting set to false in __device_suspend() +function without checking device's DPM_FLAG_MAY_SKIP_RESUME settings. +In problematic scenario, where all the devices in the suspend_late +stage are successful and some device can fail to suspend in +suspend_noirq phase. So some devices successfully suspended in suspend_late +stage are not getting chance to execute __device_suspend_noirq() +to set dev->power.must_resume variable to true and not getting +resumed in early_resume phase. + +Add a check for device's DPM_FLAG_MAY_SKIP_RESUME flag before +setting power.must_resume variable in __device_suspend function. + +Fixes: 6e176bf8d461 ("PM: sleep: core: Do not skip callbacks in the resume phase") +Signed-off-by: Prasad Sodagudi +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1642,7 +1642,7 @@ static int __device_suspend(struct devic + } + + dev->power.may_skip_resume = true; +- dev->power.must_resume = false; ++ dev->power.must_resume = !dev_pm_test_driver_flags(dev, DPM_FLAG_MAY_SKIP_RESUME); + + dpm_watchdog_set(&wd, dev); + device_lock(dev); diff --git a/queue-5.14/prctl-allow-to-setup-brk-for-et_dyn-executables.patch b/queue-5.14/prctl-allow-to-setup-brk-for-et_dyn-executables.patch new file mode 100644 index 00000000000..ee2918477b5 --- /dev/null +++ b/queue-5.14/prctl-allow-to-setup-brk-for-et_dyn-executables.patch @@ -0,0 +1,80 @@ +From e1fbbd073137a9d63279f6bf363151a938347640 Mon Sep 17 00:00:00 2001 +From: Cyrill Gorcunov +Date: Tue, 7 Sep 2021 20:00:41 -0700 +Subject: prctl: allow to setup brk for et_dyn executables + +From: Cyrill Gorcunov + +commit e1fbbd073137a9d63279f6bf363151a938347640 upstream. + +Keno Fischer reported that when a binray loaded via ld-linux-x the +prctl(PR_SET_MM_MAP) doesn't allow to setup brk value because it lays +before mm:end_data. + +For example a test program shows + + | # ~/t + | + | start_code 401000 + | end_code 401a15 + | start_stack 7ffce4577dd0 + | start_data 403e10 + | end_data 40408c + | start_brk b5b000 + | sbrk(0) b5b000 + +and when executed via ld-linux + + | # /lib64/ld-linux-x86-64.so.2 ~/t + | + | start_code 7fc25b0a4000 + | end_code 7fc25b0c4524 + | start_stack 7fffcc6b2400 + | start_data 7fc25b0ce4c0 + | end_data 7fc25b0cff98 + | start_brk 55555710c000 + | sbrk(0) 55555710c000 + +This of course prevent criu from restoring such programs. Looking into +how kernel operates with brk/start_brk inside brk() syscall I don't see +any problem if we allow to setup brk/start_brk without checking for +end_data. Even if someone pass some weird address here on a purpose then +the worst possible result will be an unexpected unmapping of existing vma +(own vma, since prctl works with the callers memory) but test for +RLIMIT_DATA is still valid and a user won't be able to gain more memory in +case of expanding VMAs via new values shipped with prctl call. + +Link: https://lkml.kernel.org/r/20210121221207.GB2174@grain +Fixes: bbdc6076d2e5 ("binfmt_elf: move brk out of mmap when doing direct loader exec") +Signed-off-by: Cyrill Gorcunov +Reported-by: Keno Fischer +Acked-by: Andrey Vagin +Tested-by: Andrey Vagin +Cc: Dmitry Safonov <0x7f454c46@gmail.com> +Cc: Kirill Tkhai +Cc: Eric W. Biederman +Cc: Pavel Tikhomirov +Cc: Alexander Mikhalitsyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sys.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1960,13 +1960,6 @@ static int validate_prctl_map_addr(struc + error = -EINVAL; + + /* +- * @brk should be after @end_data in traditional maps. +- */ +- if (prctl_map->start_brk <= prctl_map->end_data || +- prctl_map->brk <= prctl_map->end_data) +- goto out; +- +- /* + * Neither we should allow to override limits if they set. + */ + if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk, diff --git a/queue-5.14/profiling-fix-shift-out-of-bounds-bugs.patch b/queue-5.14/profiling-fix-shift-out-of-bounds-bugs.patch new file mode 100644 index 00000000000..c4d275d0446 --- /dev/null +++ b/queue-5.14/profiling-fix-shift-out-of-bounds-bugs.patch @@ -0,0 +1,98 @@ +From 2d186afd04d669fe9c48b994c41a7405a3c9f16d Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Tue, 7 Sep 2021 19:58:21 -0700 +Subject: profiling: fix shift-out-of-bounds bugs + +From: Pavel Skripkin + +commit 2d186afd04d669fe9c48b994c41a7405a3c9f16d upstream. + +Syzbot reported shift-out-of-bounds bug in profile_init(). +The problem was in incorrect prof_shift. Since prof_shift value comes from +userspace we need to clamp this value into [0, BITS_PER_LONG -1] +boundaries. + +Second possible shiht-out-of-bounds was found by Tetsuo: +sample_step local variable in read_profile() had "unsigned int" type, +but prof_shift allows to make a BITS_PER_LONG shift. So, to prevent +possible shiht-out-of-bounds sample_step type was changed to +"unsigned long". + +Also, "unsigned short int" will be sufficient for storing +[0, BITS_PER_LONG] value, that's why there is no need for +"unsigned long" prof_shift. + +Link: https://lkml.kernel.org/r/20210813140022.5011-1-paskripkin@gmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+e68c89a9510c159d9684@syzkaller.appspotmail.com +Suggested-by: Tetsuo Handa +Signed-off-by: Pavel Skripkin +Cc: Thomas Gleixner +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + kernel/profile.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/kernel/profile.c ++++ b/kernel/profile.c +@@ -41,7 +41,8 @@ struct profile_hit { + #define NR_PROFILE_GRP (NR_PROFILE_HIT/PROFILE_GRPSZ) + + static atomic_t *prof_buffer; +-static unsigned long prof_len, prof_shift; ++static unsigned long prof_len; ++static unsigned short int prof_shift; + + int prof_on __read_mostly; + EXPORT_SYMBOL_GPL(prof_on); +@@ -67,8 +68,8 @@ int profile_setup(char *str) + if (str[strlen(sleepstr)] == ',') + str += strlen(sleepstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel sleep profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel sleep profiling enabled (shift: %u)\n", + prof_shift); + #else + pr_warn("kernel sleep profiling requires CONFIG_SCHEDSTATS\n"); +@@ -78,21 +79,21 @@ int profile_setup(char *str) + if (str[strlen(schedstr)] == ',') + str += strlen(schedstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel schedule profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel schedule profiling enabled (shift: %u)\n", + prof_shift); + } else if (!strncmp(str, kvmstr, strlen(kvmstr))) { + prof_on = KVM_PROFILING; + if (str[strlen(kvmstr)] == ',') + str += strlen(kvmstr) + 1; + if (get_option(&str, &par)) +- prof_shift = par; +- pr_info("kernel KVM profiling enabled (shift: %ld)\n", ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); ++ pr_info("kernel KVM profiling enabled (shift: %u)\n", + prof_shift); + } else if (get_option(&str, &par)) { +- prof_shift = par; ++ prof_shift = clamp(par, 0, BITS_PER_LONG - 1); + prof_on = CPU_PROFILING; +- pr_info("kernel profiling enabled (shift: %ld)\n", ++ pr_info("kernel profiling enabled (shift: %u)\n", + prof_shift); + } + return 1; +@@ -468,7 +469,7 @@ read_profile(struct file *file, char __u + unsigned long p = *ppos; + ssize_t read; + char *pnt; +- unsigned int sample_step = 1 << prof_shift; ++ unsigned long sample_step = 1UL << prof_shift; + + profile_flip_buffers(); + if (p >= (prof_len+1)*sizeof(unsigned int)) diff --git a/queue-5.14/pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch b/queue-5.14/pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch new file mode 100644 index 00000000000..383117e6192 --- /dev/null +++ b/queue-5.14/pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch @@ -0,0 +1,106 @@ +From eb41f334589d66b9da6f2b1acf7963ef8ca8d94e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Mon, 5 Jul 2021 18:55:10 +0200 +Subject: pwm: ab8500: Fix register offset calculation to not depend on probe order +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit eb41f334589d66b9da6f2b1acf7963ef8ca8d94e upstream. + +The assumption that lead to commit 5e5da1e9fbee ("pwm: ab8500: +Explicitly allocate pwm chip base dynamically") was wrong: The +pwm-ab8500 devices are not directly instantiated from device tree, but +from the ab8500 mfd driver. So the pdev->id isn't -1, but a number +between 1 and 3. Now that pwmchip ids are always allocated dynamically, +this cannot easily be reverted. + +Introduce a new member in the driver data struct that tracks the +hardware id and use this to calculate the register offset. + +Side-note: Using chip->base to calculate the offset was never robust +because if there was already a PWM with id 1 at the time ab8500-pwm.1 +was probed, the associated pwmchip would get assigned chip->base = 2 (or +something bigger). + +Fixes: 5e5da1e9fbee ("pwm: ab8500: Explicitly allocate pwm chip base dynamically") +Fixes: 6173f8f4ed9c ("pwm: Move AB8500 PWM driver to PWM framework") +Signed-off-by: Uwe Kleine-König +Acked-by: Linus Walleij +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-ab8500.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/pwm/pwm-ab8500.c ++++ b/drivers/pwm/pwm-ab8500.c +@@ -22,14 +22,21 @@ + + struct ab8500_pwm_chip { + struct pwm_chip chip; ++ unsigned int hwid; + }; + ++static struct ab8500_pwm_chip *ab8500_pwm_from_chip(struct pwm_chip *chip) ++{ ++ return container_of(chip, struct ab8500_pwm_chip, chip); ++} ++ + static int ab8500_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + const struct pwm_state *state) + { + int ret; + u8 reg; + unsigned int higher_val, lower_val; ++ struct ab8500_pwm_chip *ab8500 = ab8500_pwm_from_chip(chip); + + if (state->polarity != PWM_POLARITY_NORMAL) + return -EINVAL; +@@ -37,7 +44,7 @@ static int ab8500_pwm_apply(struct pwm_c + if (!state->enabled) { + ret = abx500_mask_and_set_register_interruptible(chip->dev, + AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG, +- 1 << (chip->base - 1), 0); ++ 1 << ab8500->hwid, 0); + + if (ret < 0) + dev_err(chip->dev, "%s: Failed to disable PWM, Error %d\n", +@@ -56,7 +63,7 @@ static int ab8500_pwm_apply(struct pwm_c + */ + higher_val = ((state->duty_cycle & 0x0300) >> 8); + +- reg = AB8500_PWM_OUT_CTRL1_REG + ((chip->base - 1) * 2); ++ reg = AB8500_PWM_OUT_CTRL1_REG + (ab8500->hwid * 2); + + ret = abx500_set_register_interruptible(chip->dev, AB8500_MISC, + reg, (u8)lower_val); +@@ -70,7 +77,7 @@ static int ab8500_pwm_apply(struct pwm_c + + ret = abx500_mask_and_set_register_interruptible(chip->dev, + AB8500_MISC, AB8500_PWM_OUT_CTRL7_REG, +- 1 << (chip->base - 1), 1 << (chip->base - 1)); ++ 1 << ab8500->hwid, 1 << ab8500->hwid); + if (ret < 0) + dev_err(chip->dev, "%s: Failed to enable PWM, Error %d\n", + pwm->label, ret); +@@ -88,6 +95,9 @@ static int ab8500_pwm_probe(struct platf + struct ab8500_pwm_chip *ab8500; + int err; + ++ if (pdev->id < 1 || pdev->id > 31) ++ return dev_err_probe(&pdev->dev, EINVAL, "Invalid device id %d\n", pdev->id); ++ + /* + * Nothing to be done in probe, this is required to get the + * device which is required for ab8500 read and write +@@ -99,6 +109,7 @@ static int ab8500_pwm_probe(struct platf + ab8500->chip.dev = &pdev->dev; + ab8500->chip.ops = &ab8500_pwm_ops; + ab8500->chip.npwm = 1; ++ ab8500->hwid = pdev->id - 1; + + err = pwmchip_add(&ab8500->chip); + if (err < 0) diff --git a/queue-5.14/pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch b/queue-5.14/pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch new file mode 100644 index 00000000000..977496d19bb --- /dev/null +++ b/queue-5.14/pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch @@ -0,0 +1,55 @@ +From 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 7 Jul 2021 18:27:49 +0200 +Subject: pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 3d2813fb17e5fd0d73c1d1442ca0192bde4af10e upstream. + +This fixes a race condition: After pwmchip_add() is called there might +already be a consumer and then modifying the hardware behind the +consumer's back is bad. So set the default before. + +(Side-note: I don't know what this register setting actually does, if +this modifies the polarity there is an inconsistency because the +inversed polarity isn't considered if the PWM is already running during +.probe().) + +Fixes: acfd92fdfb93 ("pwm: lpc32xx: Set PWM_PIN_LEVEL bit to default value") +Cc: Sylvain Lemieux +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-lpc32xx.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/pwm/pwm-lpc32xx.c ++++ b/drivers/pwm/pwm-lpc32xx.c +@@ -117,17 +117,17 @@ static int lpc32xx_pwm_probe(struct plat + lpc32xx->chip.ops = &lpc32xx_pwm_ops; + lpc32xx->chip.npwm = 1; + ++ /* If PWM is disabled, configure the output to the default value */ ++ val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ val &= ~PWM_PIN_LEVEL; ++ writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); ++ + ret = pwmchip_add(&lpc32xx->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add PWM chip, error %d\n", ret); + return ret; + } + +- /* When PWM is disable, configure the output to the default value */ +- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); +- val &= ~PWM_PIN_LEVEL; +- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2)); +- + platform_set_drvdata(pdev, lpc32xx); + + return 0; diff --git a/queue-5.14/pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch b/queue-5.14/pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch new file mode 100644 index 00000000000..5e59ae4c1a8 --- /dev/null +++ b/queue-5.14/pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch @@ -0,0 +1,60 @@ +From 020162d6f49f2963062229814a56a89c86cbeaa8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 7 Jul 2021 18:27:50 +0200 +Subject: pwm: mxs: Don't modify HW state in .probe() after the PWM chip was registered +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +commit 020162d6f49f2963062229814a56a89c86cbeaa8 upstream. + +This fixes a race condition: After pwmchip_add() is called there might +already be a consumer and then modifying the hardware behind the +consumer's back is bad. So reset before calling pwmchip_add(). + +Note that reseting the hardware isn't the right thing to do if the PWM +is already running as it might e.g. disable (or even enable) a backlight +that is supposed to be on (or off). + +Fixes: 4dce82c1e840 ("pwm: add pwm-mxs support") +Cc: Sascha Hauer +Cc: Shawn Guo +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pwm/pwm-mxs.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +--- a/drivers/pwm/pwm-mxs.c ++++ b/drivers/pwm/pwm-mxs.c +@@ -145,6 +145,11 @@ static int mxs_pwm_probe(struct platform + return ret; + } + ++ /* FIXME: Only do this if the PWM isn't already running */ ++ ret = stmp_reset_block(mxs->base); ++ if (ret) ++ return dev_err_probe(&pdev->dev, ret, "failed to reset PWM\n"); ++ + ret = pwmchip_add(&mxs->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add pwm chip %d\n", ret); +@@ -153,15 +158,7 @@ static int mxs_pwm_probe(struct platform + + platform_set_drvdata(pdev, mxs); + +- ret = stmp_reset_block(mxs->base); +- if (ret) +- goto pwm_remove; +- + return 0; +- +-pwm_remove: +- pwmchip_remove(&mxs->chip); +- return ret; + } + + static int mxs_pwm_remove(struct platform_device *pdev) diff --git a/queue-5.14/series b/queue-5.14/series index 0b8b4c8ab85..906cb354f4c 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -8,3 +8,19 @@ um-virtio_uml-fix-memory-leak-on-init-failures.patch rdma-hns-enable-stash-feature-of-hip09.patch rdma-mlx5-fix-xlt_chunk_align-calculation.patch dmaengine-acpi-avoid-comparison-gsi-with-linux-virq.patch +perf-test-fix-bpf-test-sample-mismatch-reporting.patch +perf-symbol-look-for-imagebase-in-pe-file-to-compute-.text-offset.patch +perf-tools-allow-build-id-with-trailing-zeros.patch +staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch +n64cart-fix-return-value-check-in-n64cart_probe.patch +thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch +9p-trans_virtio-remove-sysfs-file-on-probe-failure.patch +pwm-ab8500-fix-register-offset-calculation-to-not-depend-on-probe-order.patch +prctl-allow-to-setup-brk-for-et_dyn-executables.patch +nilfs2-use-refcount_dec_and_lock-to-fix-potential-uaf.patch +profiling-fix-shift-out-of-bounds-bugs.patch +pm-sleep-core-avoid-setting-power.must_resume-to-false.patch +thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch +ceph-cancel-delayed-work-instead-of-flushing-on-mdsc-teardown.patch +pwm-lpc32xx-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch +pwm-mxs-don-t-modify-hw-state-in-.probe-after-the-pwm-chip-was-registered.patch diff --git a/queue-5.14/staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch b/queue-5.14/staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch new file mode 100644 index 00000000000..f54695d60f9 --- /dev/null +++ b/queue-5.14/staging-rtl8723bs-fix-wpa_set_auth_algs-function.patch @@ -0,0 +1,47 @@ +From b658acbf64ae38b8fca982c2929ccc0bf4eb1ea2 Mon Sep 17 00:00:00 2001 +From: Fabio Aiuto +Date: Thu, 15 Jul 2021 16:57:00 +0200 +Subject: staging: rtl8723bs: fix wpa_set_auth_algs() function + +From: Fabio Aiuto + +commit b658acbf64ae38b8fca982c2929ccc0bf4eb1ea2 upstream. + +fix authentication algorithm constants. +wpa_set_auth_algs() function contains some conditional +statements masking the checked value with the wrong +constants. This produces some unintentional dead code. +Mask the value with the right macros. + +Fixes: 5befa937e8da ("staging: rtl8723bs: Fix IEEE80211 authentication algorithm constants.") +Reported-by: Colin Ian King +Tested-on: Lenovo Ideapad MiiX 300-10IBY +Signed-off-by: Fabio Aiuto +Link: https://lore.kernel.org/r/20210715145700.9427-1-fabioaiuto83@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c ++++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c +@@ -349,16 +349,16 @@ static int wpa_set_auth_algs(struct net_ + struct adapter *padapter = rtw_netdev_priv(dev); + int ret = 0; + +- if ((value & WLAN_AUTH_SHARED_KEY) && (value & WLAN_AUTH_OPEN)) { ++ if ((value & IW_AUTH_ALG_SHARED_KEY) && (value & IW_AUTH_ALG_OPEN_SYSTEM)) { + padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled; + padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeAutoSwitch; + padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Auto; +- } else if (value & WLAN_AUTH_SHARED_KEY) { ++ } else if (value & IW_AUTH_ALG_SHARED_KEY) { + padapter->securitypriv.ndisencryptstatus = Ndis802_11Encryption1Enabled; + + padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeShared; + padapter->securitypriv.dot11AuthAlgrthm = dot11AuthAlgrthm_Shared; +- } else if (value & WLAN_AUTH_OPEN) { ++ } else if (value & IW_AUTH_ALG_OPEN_SYSTEM) { + /* padapter->securitypriv.ndisencryptstatus = Ndis802_11EncryptionDisabled; */ + if (padapter->securitypriv.ndisauthtype < Ndis802_11AuthModeWPAPSK) { + padapter->securitypriv.ndisauthtype = Ndis802_11AuthModeOpen; diff --git a/queue-5.14/thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch b/queue-5.14/thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch new file mode 100644 index 00000000000..52b4a869ce4 --- /dev/null +++ b/queue-5.14/thermal-drivers-exynos-fix-an-error-code-in-exynos_tmu_probe.patch @@ -0,0 +1,32 @@ +From 02d438f62c05f0d055ceeedf12a2f8796b258c08 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 10 Aug 2021 11:44:13 +0300 +Subject: thermal/drivers/exynos: Fix an error code in exynos_tmu_probe() + +From: Dan Carpenter + +commit 02d438f62c05f0d055ceeedf12a2f8796b258c08 upstream. + +This error path return success but it should propagate the negative +error code from devm_clk_get(). + +Fixes: 6c247393cfdd ("thermal: exynos: Add TMU support for Exynos7 SoC") +Signed-off-by: Dan Carpenter +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210810084413.GA23810@kili +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/samsung/exynos_tmu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -1073,6 +1073,7 @@ static int exynos_tmu_probe(struct platf + data->sclk = devm_clk_get(&pdev->dev, "tmu_sclk"); + if (IS_ERR(data->sclk)) { + dev_err(&pdev->dev, "Failed to get sclk\n"); ++ ret = PTR_ERR(data->sclk); + goto err_clk; + } else { + ret = clk_prepare_enable(data->sclk); diff --git a/queue-5.14/thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch b/queue-5.14/thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch new file mode 100644 index 00000000000..a498dc00652 --- /dev/null +++ b/queue-5.14/thermal-drivers-qcom-spmi-adc-tm5-don-t-abort-probing-if-a-sensor-is-not-used.patch @@ -0,0 +1,46 @@ +From 70ee251ded6ba24c15537f4abb8a318e233d0d1a Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Mon, 23 Aug 2021 13:47:30 -0700 +Subject: thermal/drivers/qcom/spmi-adc-tm5: Don't abort probing if a sensor is not used + +From: Matthias Kaehlcke + +commit 70ee251ded6ba24c15537f4abb8a318e233d0d1a upstream. + +adc_tm5_register_tzd() registers the thermal zone sensors for all +channels of the thermal monitor. If the registration of one channel +fails the function skips the processing of the remaining channels +and returns an error, which results in _probe() being aborted. + +One of the reasons the registration could fail is that none of the +thermal zones is using the channel/sensor, which hardly is a critical +error (if it is an error at all). If this case is detected emit a +warning and continue with processing the remaining channels. + +Fixes: ca66dca5eda6 ("thermal: qcom: add support for adc-tm5 PMIC thermal monitor") +Signed-off-by: Matthias Kaehlcke +Reported-by: Stephen Boyd +Reviewed-by: Stephen Boyd +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210823134726.1.I1dd23ddf77e5b3568625d80d6827653af071ce19@changeid +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/qcom/qcom-spmi-adc-tm5.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/thermal/qcom/qcom-spmi-adc-tm5.c ++++ b/drivers/thermal/qcom/qcom-spmi-adc-tm5.c +@@ -359,6 +359,12 @@ static int adc_tm5_register_tzd(struct a + &adc_tm->channels[i], + &adc_tm5_ops); + if (IS_ERR(tzd)) { ++ if (PTR_ERR(tzd) == -ENODEV) { ++ dev_warn(adc_tm->dev, "thermal sensor on channel %d is not used\n", ++ adc_tm->channels[i].channel); ++ continue; ++ } ++ + dev_err(adc_tm->dev, "Error registering TZ zone for channel %d: %ld\n", + adc_tm->channels[i].channel, PTR_ERR(tzd)); + return PTR_ERR(tzd);