From: Greg Kroah-Hartman Date: Sun, 2 Sep 2018 17:55:18 +0000 (+0200) Subject: 4.18-stable patches X-Git-Tag: v3.18.121~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cd60fe51d1253e0b2987d0827f98d002261be401;p=thirdparty%2Fkernel%2Fstable-queue.git 4.18-stable patches added patches: asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch asoc-sirf-fix-potential-null-pointer-dereference.patch asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch asoc-zte-fix-incorrect-pcm-format-bit-usages.patch b43-leds-ensure-nul-termination-of-led-name-string.patch b43legacy-leds-ensure-nul-termination-of-led-name-string.patch lib-vsprintf-do-not-handle-po-as-px.patch pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch scsi-qla2xxx-fix-stalled-relogin.patch soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch udl-kms-avoid-division.patch udl-kms-change-down_interruptible-to-down.patch udl-kms-fix-crash-due-to-uninitialized-memory.patch udl-kms-handle-allocation-failure.patch --- diff --git a/queue-4.18/asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch b/queue-4.18/asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch new file mode 100644 index 00000000000..87f1e73820a --- /dev/null +++ b/queue-4.18/asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch @@ -0,0 +1,45 @@ +From 4febced15ac8ddb9cf3e603edb111842e4863d9a Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Wed, 27 Jun 2018 17:36:38 +0200 +Subject: ASoC: dpcm: don't merge format from invalid codec dai + +From: Jerome Brunet + +commit 4febced15ac8ddb9cf3e603edb111842e4863d9a upstream. + +When merging codec formats, dpcm_runtime_base_format() should skip +the codecs which are not supporting the current stream direction. + +At the moment, if a BE link has more than one codec, and only one +of these codecs has no capture DAI, it becomes impossible to start +a capture stream because the merged format would be 0. + +Skipping invalid codec DAI solves the problem. + +Fixes: b073ed4e2126 ("ASoC: soc-pcm: DPCM cares BE format") +Signed-off-by: Jerome Brunet +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-pcm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1694,6 +1694,14 @@ static u64 dpcm_runtime_base_format(stru + int i; + + for (i = 0; i < be->num_codecs; i++) { ++ /* ++ * Skip CODECs which don't support the current stream ++ * type. See soc_pcm_init_runtime_hw() for more details ++ */ ++ if (!snd_soc_dai_stream_valid(be->codec_dais[i], ++ stream)) ++ continue; ++ + codec_dai_drv = be->codec_dais[i]->driver; + if (stream == SNDRV_PCM_STREAM_PLAYBACK) + codec_stream = &codec_dai_drv->playback; diff --git a/queue-4.18/asoc-sirf-fix-potential-null-pointer-dereference.patch b/queue-4.18/asoc-sirf-fix-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..f72eb2f84b7 --- /dev/null +++ b/queue-4.18/asoc-sirf-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,44 @@ +From ae1c696a480c67c45fb23b35162183f72c6be0e1 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Thu, 26 Jul 2018 15:49:10 -0500 +Subject: ASoC: sirf: Fix potential NULL pointer dereference + +From: Gustavo A. R. Silva + +commit ae1c696a480c67c45fb23b35162183f72c6be0e1 upstream. + +There is a potential execution path in which function +platform_get_resource() returns NULL. If this happens, +we will end up having a NULL pointer dereference. + +Fix this by replacing devm_ioremap with devm_ioremap_resource, +which has the NULL check and the memory region request. + +This code was detected with the help of Coccinelle. + +Cc: stable@vger.kernel.org +Fixes: 2bd8d1d5cf89 ("ASoC: sirf: Add audio usp interface driver") +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/sirf/sirf-usp.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/sound/soc/sirf/sirf-usp.c ++++ b/sound/soc/sirf/sirf-usp.c +@@ -370,10 +370,9 @@ static int sirf_usp_pcm_probe(struct pla + platform_set_drvdata(pdev, usp); + + mem_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- base = devm_ioremap(&pdev->dev, mem_res->start, +- resource_size(mem_res)); +- if (base == NULL) +- return -ENOMEM; ++ base = devm_ioremap_resource(&pdev->dev, mem_res); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); + usp->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &sirf_usp_regmap_config); + if (IS_ERR(usp->regmap)) diff --git a/queue-4.18/asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch b/queue-4.18/asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch new file mode 100644 index 00000000000..71364ac35d4 --- /dev/null +++ b/queue-4.18/asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch @@ -0,0 +1,51 @@ +From b1470d4ce77c2d60661c7d5325d4fb8063e15ff8 Mon Sep 17 00:00:00 2001 +From: Ajit Pandey +Date: Tue, 7 Aug 2018 18:30:42 +0100 +Subject: ASoC: wm_adsp: Correct DSP pointer for preloader control + +From: Ajit Pandey + +commit b1470d4ce77c2d60661c7d5325d4fb8063e15ff8 upstream. + +The offset of the DSP core needs to be taken into account for the DSP +preloader control get and put. Currently the dsp->preloaded variable +will only ever be read/updated on the first DSP, whilst this doesn't +affect the operation of the control the readback will be incorrect. + +Signed-off-by: Ajit Pandey +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/wm_adsp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -2642,7 +2642,10 @@ int wm_adsp2_preloader_get(struct snd_kc + struct snd_ctl_elem_value *ucontrol) + { + struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol); +- struct wm_adsp *dsp = snd_soc_component_get_drvdata(component); ++ struct wm_adsp *dsps = snd_soc_component_get_drvdata(component); ++ struct soc_mixer_control *mc = ++ (struct soc_mixer_control *)kcontrol->private_value; ++ struct wm_adsp *dsp = &dsps[mc->shift - 1]; + + ucontrol->value.integer.value[0] = dsp->preloaded; + +@@ -2654,10 +2657,11 @@ int wm_adsp2_preloader_put(struct snd_kc + struct snd_ctl_elem_value *ucontrol) + { + struct snd_soc_component *component = snd_soc_kcontrol_component(kcontrol); +- struct wm_adsp *dsp = snd_soc_component_get_drvdata(component); ++ struct wm_adsp *dsps = snd_soc_component_get_drvdata(component); + struct snd_soc_dapm_context *dapm = snd_soc_component_get_dapm(component); + struct soc_mixer_control *mc = + (struct soc_mixer_control *)kcontrol->private_value; ++ struct wm_adsp *dsp = &dsps[mc->shift - 1]; + char preload[32]; + + snprintf(preload, ARRAY_SIZE(preload), "DSP%u Preload", mc->shift); diff --git a/queue-4.18/asoc-zte-fix-incorrect-pcm-format-bit-usages.patch b/queue-4.18/asoc-zte-fix-incorrect-pcm-format-bit-usages.patch new file mode 100644 index 00000000000..e28a466262d --- /dev/null +++ b/queue-4.18/asoc-zte-fix-incorrect-pcm-format-bit-usages.patch @@ -0,0 +1,40 @@ +From c889a45d229938a94b50aadb819def8bb11a6a54 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Wed, 25 Jul 2018 22:40:49 +0200 +Subject: ASoC: zte: Fix incorrect PCM format bit usages + +From: Takashi Iwai + +commit c889a45d229938a94b50aadb819def8bb11a6a54 upstream. + +zx-tdm driver sets the DAI driver definitions with the format bits +wrongly set with SNDRV_PCM_FORMAT_*, instead of SNDRV_PCM_FMTBIT_*. + +This patch corrects the definitions. + +Spotted by a sparse warning: + sound/soc/zte/zx-tdm.c:363:35: warning: restricted snd_pcm_format_t degrades to integer + +Fixes: 870e0ddc4345 ("ASoC: zx-tdm: add zte's tdm controller driver") +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/zte/zx-tdm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/zte/zx-tdm.c ++++ b/sound/soc/zte/zx-tdm.c +@@ -144,8 +144,8 @@ static void zx_tdm_rx_dma_en(struct zx_t + #define ZX_TDM_RATES (SNDRV_PCM_RATE_8000 | SNDRV_PCM_RATE_16000) + + #define ZX_TDM_FMTBIT \ +- (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FORMAT_MU_LAW | \ +- SNDRV_PCM_FORMAT_A_LAW) ++ (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_MU_LAW | \ ++ SNDRV_PCM_FMTBIT_A_LAW) + + static int zx_tdm_dai_probe(struct snd_soc_dai *dai) + { diff --git a/queue-4.18/b43-leds-ensure-nul-termination-of-led-name-string.patch b/queue-4.18/b43-leds-ensure-nul-termination-of-led-name-string.patch new file mode 100644 index 00000000000..009379d074c --- /dev/null +++ b/queue-4.18/b43-leds-ensure-nul-termination-of-led-name-string.patch @@ -0,0 +1,32 @@ +From 2aa650d1950fce94f696ebd7db30b8830c2c946f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michael=20B=C3=BCsch?= +Date: Tue, 31 Jul 2018 21:14:04 +0200 +Subject: b43/leds: Ensure NUL-termination of LED name string + +From: Michael Buesch + +commit 2aa650d1950fce94f696ebd7db30b8830c2c946f upstream. + +strncpy might not NUL-terminate the string, if the name equals the buffer size. +Use strlcpy instead. + +Signed-off-by: Michael Buesch +Cc: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/broadcom/b43/leds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/b43/leds.c ++++ b/drivers/net/wireless/broadcom/b43/leds.c +@@ -131,7 +131,7 @@ static int b43_register_led(struct b43_w + led->wl = dev->wl; + led->index = led_index; + led->activelow = activelow; +- strncpy(led->name, name, sizeof(led->name)); ++ strlcpy(led->name, name, sizeof(led->name)); + atomic_set(&led->state, 0); + + led->led_dev.name = led->name; diff --git a/queue-4.18/b43legacy-leds-ensure-nul-termination-of-led-name-string.patch b/queue-4.18/b43legacy-leds-ensure-nul-termination-of-led-name-string.patch new file mode 100644 index 00000000000..aab1eb12587 --- /dev/null +++ b/queue-4.18/b43legacy-leds-ensure-nul-termination-of-led-name-string.patch @@ -0,0 +1,32 @@ +From 4d77a89e3924b12f4a5628b21237e57ab4703866 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michael=20B=C3=BCsch?= +Date: Tue, 31 Jul 2018 21:14:16 +0200 +Subject: b43legacy/leds: Ensure NUL-termination of LED name string + +From: Michael Buesch + +commit 4d77a89e3924b12f4a5628b21237e57ab4703866 upstream. + +strncpy might not NUL-terminate the string, if the name equals the buffer size. +Use strlcpy instead. + +Signed-off-by: Michael Buesch +Cc: stable@vger.kernel.org +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/broadcom/b43legacy/leds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/b43legacy/leds.c ++++ b/drivers/net/wireless/broadcom/b43legacy/leds.c +@@ -101,7 +101,7 @@ static int b43legacy_register_led(struct + led->dev = dev; + led->index = led_index; + led->activelow = activelow; +- strncpy(led->name, name, sizeof(led->name)); ++ strlcpy(led->name, name, sizeof(led->name)); + + led->led_dev.name = led->name; + led->led_dev.default_trigger = default_trigger; diff --git a/queue-4.18/lib-vsprintf-do-not-handle-po-as-px.patch b/queue-4.18/lib-vsprintf-do-not-handle-po-as-px.patch new file mode 100644 index 00000000000..55c1ffb8a04 --- /dev/null +++ b/queue-4.18/lib-vsprintf-do-not-handle-po-as-px.patch @@ -0,0 +1,41 @@ +From 554ec508653688c21d9b8024af73a1ffaa0164b9 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Mon, 6 Aug 2018 15:34:21 -0700 +Subject: lib/vsprintf: Do not handle %pO[^F] as %px + +From: Bart Van Assche + +commit 554ec508653688c21d9b8024af73a1ffaa0164b9 upstream. + +This patch avoids that gcc reports the following when building with W=1: + +lib/vsprintf.c:1941:3: warning: this statement may fall through [-Wimplicit-fallthrough=] + switch (fmt[1]) { + ^~~~~~ + +Fixes: 7b1924a1d930eb2 ("vsprintf: add printk specifier %px") +Link: http://lkml.kernel.org/r/20180806223421.11995-1-bart.vanassche@wdc.com +Cc: linux-kernel@vger.kernel.org +Cc: Bart Van Assche +Cc: Pantelis Antoniou +Cc: Joe Perches +Cc: Rob Herring +Cc: v4.15+ +Signed-off-by: Bart Van Assche +Signed-off-by: Petr Mladek +Signed-off-by: Greg Kroah-Hartman + +--- + lib/vsprintf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1942,6 +1942,7 @@ char *pointer(const char *fmt, char *buf + case 'F': + return device_node_string(buf, end, ptr, spec, fmt + 1); + } ++ break; + case 'x': + return pointer_string(buf, end, ptr, spec); + } diff --git a/queue-4.18/pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch b/queue-4.18/pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch new file mode 100644 index 00000000000..5dff66708be --- /dev/null +++ b/queue-4.18/pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch @@ -0,0 +1,39 @@ +From 19da44cd33a3a6ff7c97fff0189999ff15b241e4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 13 Jul 2018 17:55:15 +0300 +Subject: pinctrl: freescale: off by one in imx1_pinconf_group_dbg_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +commit 19da44cd33a3a6ff7c97fff0189999ff15b241e4 upstream. + +The info->groups[] array is allocated in imx1_pinctrl_parse_dt(). It +has info->ngroups elements. Thus the > here should be >= to prevent +reading one element beyond the end of the array. + +Cc: stable@vger.kernel.org +Fixes: 30612cd90005 ("pinctrl: imx1 core driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Uwe Kleine-König +Acked-by: Dong Aisheng +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/freescale/pinctrl-imx1-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c +@@ -429,7 +429,7 @@ static void imx1_pinconf_group_dbg_show( + const char *name; + int i, ret; + +- if (group > info->ngroups) ++ if (group >= info->ngroups) + return; + + seq_puts(s, "\n"); diff --git a/queue-4.18/scsi-qla2xxx-fix-stalled-relogin.patch b/queue-4.18/scsi-qla2xxx-fix-stalled-relogin.patch new file mode 100644 index 00000000000..f556858d27e --- /dev/null +++ b/queue-4.18/scsi-qla2xxx-fix-stalled-relogin.patch @@ -0,0 +1,45 @@ +From 15b6c3c9568765f0717b2dd3aa67a5f7eadd9734 Mon Sep 17 00:00:00 2001 +From: Himanshu Madhani +Date: Thu, 2 Aug 2018 13:16:55 -0700 +Subject: scsi: qla2xxx: Fix stalled relogin + +From: Himanshu Madhani + +commit 15b6c3c9568765f0717b2dd3aa67a5f7eadd9734 upstream. + +This patch sets and clears FCF_ASYNC_{SENT|ACTIVE} flags to prevent +stalling of relogin attempt. Once flag are correctly set/cleared, relogin +timer can retry relogin attempt for driver to continue login. + +Fixes: fa83e65885b9 ("scsi: qla2xxx: ensure async flags are reset correctly") +Cc: stable@vger.kernel.org #4.17 +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/qla2xxx/qla_init.c | 2 +- + drivers/scsi/qla2xxx/qla_iocb.c | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -382,7 +382,7 @@ qla2x00_async_adisc_sp_done(void *ptr, i + "Async done-%s res %x %8phC\n", + sp->name, res, sp->fcport->port_name); + +- sp->fcport->flags &= ~FCF_ASYNC_SENT; ++ sp->fcport->flags &= ~(FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE); + + memset(&ea, 0, sizeof(ea)); + ea.event = FCME_ADISC_DONE; +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2656,6 +2656,7 @@ qla24xx_els_dcmd2_iocb(scsi_qla_host_t * + ql_dbg(ql_dbg_io, vha, 0x3073, + "Enter: PLOGI portid=%06x\n", fcport->d_id.b24); + ++ fcport->flags |= FCF_ASYNC_SENT; + sp->type = SRB_ELS_DCMD; + sp->name = "ELS_DCMD"; + sp->fcport = fcport; diff --git a/queue-4.18/series b/queue-4.18/series index 5b530c7ca08..d613cc93069 100644 --- a/queue-4.18/series +++ b/queue-4.18/series @@ -62,4 +62,18 @@ fuse-fix-unlocked-access-to-processing-queue.patch fuse-umount-should-wait-for-all-requests.patch fuse-fix-oops-at-process_init_reply.patch fuse-add-missed-unlock_page-to-fuse_readpages_fill.patch +lib-vsprintf-do-not-handle-po-as-px.patch +udl-kms-change-down_interruptible-to-down.patch +udl-kms-handle-allocation-failure.patch +udl-kms-fix-crash-due-to-uninitialized-memory.patch +udl-kms-avoid-division.patch +b43legacy-leds-ensure-nul-termination-of-led-name-string.patch +b43-leds-ensure-nul-termination-of-led-name-string.patch +asoc-dpcm-don-t-merge-format-from-invalid-codec-dai.patch +asoc-zte-fix-incorrect-pcm-format-bit-usages.patch +asoc-sirf-fix-potential-null-pointer-dereference.patch +asoc-wm_adsp-correct-dsp-pointer-for-preloader-control.patch +soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch +pinctrl-freescale-off-by-one-in-imx1_pinconf_group_dbg_show.patch +scsi-qla2xxx-fix-stalled-relogin.patch x86-kvm-avoid-unused-variable-warning.patch diff --git a/queue-4.18/soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch b/queue-4.18/soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch new file mode 100644 index 00000000000..49495341fa9 --- /dev/null +++ b/queue-4.18/soc-qcom-rmtfs-mem-fix-memleak-in-probe-error-paths.patch @@ -0,0 +1,43 @@ +From 78ee559d7fc65e37670a46cfbeaaa62cb014af67 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 12 Jun 2018 14:41:41 +0200 +Subject: soc: qcom: rmtfs-mem: fix memleak in probe error paths + +From: Johan Hovold + +commit 78ee559d7fc65e37670a46cfbeaaa62cb014af67 upstream. + +Make sure to set the mem device release callback before calling +put_device() in a couple of probe error paths so that the containing +object also gets freed. + +Fixes: d1de6d6c639b ("soc: qcom: Remote filesystem memory driver") +Cc: stable # 4.15 +Cc: Bjorn Andersson +Signed-off-by: Johan Hovold +Signed-off-by: Andy Gross +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/qcom/rmtfs_mem.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/soc/qcom/rmtfs_mem.c ++++ b/drivers/soc/qcom/rmtfs_mem.c +@@ -184,6 +184,7 @@ static int qcom_rmtfs_mem_probe(struct p + device_initialize(&rmtfs_mem->dev); + rmtfs_mem->dev.parent = &pdev->dev; + rmtfs_mem->dev.groups = qcom_rmtfs_mem_groups; ++ rmtfs_mem->dev.release = qcom_rmtfs_mem_release_device; + + rmtfs_mem->base = devm_memremap(&rmtfs_mem->dev, rmtfs_mem->addr, + rmtfs_mem->size, MEMREMAP_WC); +@@ -206,8 +207,6 @@ static int qcom_rmtfs_mem_probe(struct p + goto put_device; + } + +- rmtfs_mem->dev.release = qcom_rmtfs_mem_release_device; +- + ret = of_property_read_u32(node, "qcom,vmid", &vmid); + if (ret < 0 && ret != -EINVAL) { + dev_err(&pdev->dev, "failed to parse qcom,vmid\n"); diff --git a/queue-4.18/udl-kms-avoid-division.patch b/queue-4.18/udl-kms-avoid-division.patch new file mode 100644 index 00000000000..44a33bd7ed9 --- /dev/null +++ b/queue-4.18/udl-kms-avoid-division.patch @@ -0,0 +1,194 @@ +From 91ba11fb7d7ca0a3bbe8a512e65e666e2ec1e889 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 3 Jun 2018 16:41:00 +0200 +Subject: udl-kms: avoid division + +From: Mikulas Patocka + +commit 91ba11fb7d7ca0a3bbe8a512e65e666e2ec1e889 upstream. + +Division is slow, so it shouldn't be done by the pixel generating code. +The driver supports only 2 or 4 bytes per pixel, so we can replace +division with a shift. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/udl/udl_drv.h | 2 - + drivers/gpu/drm/udl/udl_fb.c | 15 ++++++++------ + drivers/gpu/drm/udl/udl_transfer.c | 39 ++++++++++++++++++------------------- + 3 files changed, 30 insertions(+), 26 deletions(-) + +--- a/drivers/gpu/drm/udl/udl_drv.h ++++ b/drivers/gpu/drm/udl/udl_drv.h +@@ -112,7 +112,7 @@ udl_fb_user_fb_create(struct drm_device + struct drm_file *file, + const struct drm_mode_fb_cmd2 *mode_cmd); + +-int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr, ++int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, + const char *front, char **urb_buf_ptr, + u32 byte_offset, u32 device_byte_offset, u32 byte_width, + int *ident_ptr, int *sent_ptr); +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -90,7 +90,10 @@ int udl_handle_damage(struct udl_framebu + int bytes_identical = 0; + struct urb *urb; + int aligned_x; +- int bpp = fb->base.format->cpp[0]; ++ int log_bpp; ++ ++ BUG_ON(!is_power_of_2(fb->base.format->cpp[0])); ++ log_bpp = __ffs(fb->base.format->cpp[0]); + + if (!fb->active_16) + return 0; +@@ -125,12 +128,12 @@ int udl_handle_damage(struct udl_framebu + + for (i = y; i < y + height ; i++) { + const int line_offset = fb->base.pitches[0] * i; +- const int byte_offset = line_offset + (x * bpp); +- const int dev_byte_offset = (fb->base.width * bpp * i) + (x * bpp); +- if (udl_render_hline(dev, bpp, &urb, ++ const int byte_offset = line_offset + (x << log_bpp); ++ const int dev_byte_offset = (fb->base.width * i + x) << log_bpp; ++ if (udl_render_hline(dev, log_bpp, &urb, + (char *) fb->obj->vmapping, + &cmd, byte_offset, dev_byte_offset, +- width * bpp, ++ width << log_bpp, + &bytes_identical, &bytes_sent)) + goto error; + } +@@ -149,7 +152,7 @@ int udl_handle_damage(struct udl_framebu + error: + atomic_add(bytes_sent, &udl->bytes_sent); + atomic_add(bytes_identical, &udl->bytes_identical); +- atomic_add(width*height*bpp, &udl->bytes_rendered); ++ atomic_add((width * height) << log_bpp, &udl->bytes_rendered); + end_cycles = get_cycles(); + atomic_add(((unsigned int) ((end_cycles - start_cycles) + >> 10)), /* Kcycles */ +--- a/drivers/gpu/drm/udl/udl_transfer.c ++++ b/drivers/gpu/drm/udl/udl_transfer.c +@@ -83,12 +83,12 @@ static inline u16 pixel32_to_be16(const + ((pixel >> 8) & 0xf800)); + } + +-static inline u16 get_pixel_val16(const uint8_t *pixel, int bpp) ++static inline u16 get_pixel_val16(const uint8_t *pixel, int log_bpp) + { +- u16 pixel_val16 = 0; +- if (bpp == 2) ++ u16 pixel_val16; ++ if (log_bpp == 1) + pixel_val16 = *(const uint16_t *)pixel; +- else if (bpp == 4) ++ else + pixel_val16 = pixel32_to_be16(*(const uint32_t *)pixel); + return pixel_val16; + } +@@ -125,8 +125,9 @@ static void udl_compress_hline16( + const u8 *const pixel_end, + uint32_t *device_address_ptr, + uint8_t **command_buffer_ptr, +- const uint8_t *const cmd_buffer_end, int bpp) ++ const uint8_t *const cmd_buffer_end, int log_bpp) + { ++ const int bpp = 1 << log_bpp; + const u8 *pixel = *pixel_start_ptr; + uint32_t dev_addr = *device_address_ptr; + uint8_t *cmd = *command_buffer_ptr; +@@ -153,12 +154,12 @@ static void udl_compress_hline16( + raw_pixels_count_byte = cmd++; /* we'll know this later */ + raw_pixel_start = pixel; + +- cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL, +- (unsigned long)(pixel_end - pixel) / bpp, +- (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) * bpp; ++ cmd_pixel_end = pixel + (min3(MAX_CMD_PIXELS + 1UL, ++ (unsigned long)(pixel_end - pixel) >> log_bpp, ++ (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) << log_bpp); + + prefetch_range((void *) pixel, cmd_pixel_end - pixel); +- pixel_val16 = get_pixel_val16(pixel, bpp); ++ pixel_val16 = get_pixel_val16(pixel, log_bpp); + + while (pixel < cmd_pixel_end) { + const u8 *const start = pixel; +@@ -170,7 +171,7 @@ static void udl_compress_hline16( + pixel += bpp; + + while (pixel < cmd_pixel_end) { +- pixel_val16 = get_pixel_val16(pixel, bpp); ++ pixel_val16 = get_pixel_val16(pixel, log_bpp); + if (pixel_val16 != repeating_pixel_val16) + break; + pixel += bpp; +@@ -179,10 +180,10 @@ static void udl_compress_hline16( + if (unlikely(pixel > start + bpp)) { + /* go back and fill in raw pixel count */ + *raw_pixels_count_byte = (((start - +- raw_pixel_start) / bpp) + 1) & 0xFF; ++ raw_pixel_start) >> log_bpp) + 1) & 0xFF; + + /* immediately after raw data is repeat byte */ +- *cmd++ = (((pixel - start) / bpp) - 1) & 0xFF; ++ *cmd++ = (((pixel - start) >> log_bpp) - 1) & 0xFF; + + /* Then start another raw pixel span */ + raw_pixel_start = pixel; +@@ -192,14 +193,14 @@ static void udl_compress_hline16( + + if (pixel > raw_pixel_start) { + /* finalize last RAW span */ +- *raw_pixels_count_byte = ((pixel-raw_pixel_start) / bpp) & 0xFF; ++ *raw_pixels_count_byte = ((pixel - raw_pixel_start) >> log_bpp) & 0xFF; + } else { + /* undo unused byte */ + cmd--; + } + +- *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) / bpp) & 0xFF; +- dev_addr += ((pixel - cmd_pixel_start) / bpp) * 2; ++ *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) >> log_bpp) & 0xFF; ++ dev_addr += ((pixel - cmd_pixel_start) >> log_bpp) * 2; + } + + if (cmd_buffer_end <= MIN_RLX_CMD_BYTES + cmd) { +@@ -222,19 +223,19 @@ static void udl_compress_hline16( + * (that we can only write to, slowly, and can never read), and (optionally) + * our shadow copy that tracks what's been sent to that hardware buffer. + */ +-int udl_render_hline(struct drm_device *dev, int bpp, struct urb **urb_ptr, ++int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr, + const char *front, char **urb_buf_ptr, + u32 byte_offset, u32 device_byte_offset, + u32 byte_width, + int *ident_ptr, int *sent_ptr) + { + const u8 *line_start, *line_end, *next_pixel; +- u32 base16 = 0 + (device_byte_offset / bpp) * 2; ++ u32 base16 = 0 + (device_byte_offset >> log_bpp) * 2; + struct urb *urb = *urb_ptr; + u8 *cmd = *urb_buf_ptr; + u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length; + +- BUG_ON(!(bpp == 2 || bpp == 4)); ++ BUG_ON(!(log_bpp == 1 || log_bpp == 2)); + + line_start = (u8 *) (front + byte_offset); + next_pixel = line_start; +@@ -244,7 +245,7 @@ int udl_render_hline(struct drm_device * + + udl_compress_hline16(&next_pixel, + line_end, &base16, +- (u8 **) &cmd, (u8 *) cmd_end, bpp); ++ (u8 **) &cmd, (u8 *) cmd_end, log_bpp); + + if (cmd >= cmd_end) { + int len = cmd - (u8 *) urb->transfer_buffer; diff --git a/queue-4.18/udl-kms-change-down_interruptible-to-down.patch b/queue-4.18/udl-kms-change-down_interruptible-to-down.patch new file mode 100644 index 00000000000..f6a421ae8f7 --- /dev/null +++ b/queue-4.18/udl-kms-change-down_interruptible-to-down.patch @@ -0,0 +1,44 @@ +From 8456b99c16d193c4c3b7df305cf431e027f0189c Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 3 Jun 2018 16:40:55 +0200 +Subject: udl-kms: change down_interruptible to down + +From: Mikulas Patocka + +commit 8456b99c16d193c4c3b7df305cf431e027f0189c upstream. + +If we leave urbs around, it causes not only leak, but also memory +corruption. This patch fixes the function udl_free_urb_list, so that it +always waits for all urbs that are in progress. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/udl/udl_main.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/gpu/drm/udl/udl_main.c ++++ b/drivers/gpu/drm/udl/udl_main.c +@@ -170,18 +170,13 @@ static void udl_free_urb_list(struct drm + struct list_head *node; + struct urb_node *unode; + struct urb *urb; +- int ret; + unsigned long flags; + + DRM_DEBUG("Waiting for completes and freeing all render urbs\n"); + + /* keep waiting and freeing, until we've got 'em all */ + while (count--) { +- +- /* Getting interrupted means a leak, but ok at shutdown*/ +- ret = down_interruptible(&udl->urbs.limit_sem); +- if (ret) +- break; ++ down(&udl->urbs.limit_sem); + + spin_lock_irqsave(&udl->urbs.lock, flags); + diff --git a/queue-4.18/udl-kms-fix-crash-due-to-uninitialized-memory.patch b/queue-4.18/udl-kms-fix-crash-due-to-uninitialized-memory.patch new file mode 100644 index 00000000000..7ce4ef2d1f3 --- /dev/null +++ b/queue-4.18/udl-kms-fix-crash-due-to-uninitialized-memory.patch @@ -0,0 +1,32 @@ +From 09a00abe3a9941c2715ca83eb88172cd2f54d8fd Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 3 Jun 2018 16:40:57 +0200 +Subject: udl-kms: fix crash due to uninitialized memory + +From: Mikulas Patocka + +commit 09a00abe3a9941c2715ca83eb88172cd2f54d8fd upstream. + +We must use kzalloc when allocating the fb_deferred_io structure. +Otherwise, the field first_io is undefined and it causes a crash. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/udl/udl_fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -221,7 +221,7 @@ static int udl_fb_open(struct fb_info *i + + struct fb_deferred_io *fbdefio; + +- fbdefio = kmalloc(sizeof(struct fb_deferred_io), GFP_KERNEL); ++ fbdefio = kzalloc(sizeof(struct fb_deferred_io), GFP_KERNEL); + + if (fbdefio) { + fbdefio->delay = DL_DEFIO_WRITE_DELAY; diff --git a/queue-4.18/udl-kms-handle-allocation-failure.patch b/queue-4.18/udl-kms-handle-allocation-failure.patch new file mode 100644 index 00000000000..666a90586cd --- /dev/null +++ b/queue-4.18/udl-kms-handle-allocation-failure.patch @@ -0,0 +1,89 @@ +From 542bb9788a1f485eb1a2229178f665d8ea166156 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Sun, 3 Jun 2018 16:40:56 +0200 +Subject: udl-kms: handle allocation failure + +From: Mikulas Patocka + +commit 542bb9788a1f485eb1a2229178f665d8ea166156 upstream. + +Allocations larger than PAGE_ALLOC_COSTLY_ORDER are unreliable and they +may fail anytime. This patch fixes the udl kms driver so that when a large +alloactions fails, it tries to do multiple smaller allocations. + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/udl/udl_main.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +--- a/drivers/gpu/drm/udl/udl_main.c ++++ b/drivers/gpu/drm/udl/udl_main.c +@@ -200,17 +200,22 @@ static void udl_free_urb_list(struct drm + static int udl_alloc_urb_list(struct drm_device *dev, int count, size_t size) + { + struct udl_device *udl = dev->dev_private; +- int i = 0; + struct urb *urb; + struct urb_node *unode; + char *buf; ++ size_t wanted_size = count * size; + + spin_lock_init(&udl->urbs.lock); + ++retry: + udl->urbs.size = size; + INIT_LIST_HEAD(&udl->urbs.list); + +- while (i < count) { ++ sema_init(&udl->urbs.limit_sem, 0); ++ udl->urbs.count = 0; ++ udl->urbs.available = 0; ++ ++ while (udl->urbs.count * size < wanted_size) { + unode = kzalloc(sizeof(struct urb_node), GFP_KERNEL); + if (!unode) + break; +@@ -226,11 +231,16 @@ static int udl_alloc_urb_list(struct drm + } + unode->urb = urb; + +- buf = usb_alloc_coherent(udl->udev, MAX_TRANSFER, GFP_KERNEL, ++ buf = usb_alloc_coherent(udl->udev, size, GFP_KERNEL, + &urb->transfer_dma); + if (!buf) { + kfree(unode); + usb_free_urb(urb); ++ if (size > PAGE_SIZE) { ++ size /= 2; ++ udl_free_urb_list(dev); ++ goto retry; ++ } + break; + } + +@@ -241,16 +251,14 @@ static int udl_alloc_urb_list(struct drm + + list_add_tail(&unode->entry, &udl->urbs.list); + +- i++; ++ up(&udl->urbs.limit_sem); ++ udl->urbs.count++; ++ udl->urbs.available++; + } + +- sema_init(&udl->urbs.limit_sem, i); +- udl->urbs.count = i; +- udl->urbs.available = i; +- +- DRM_DEBUG("allocated %d %d byte urbs\n", i, (int) size); ++ DRM_DEBUG("allocated %d %d byte urbs\n", udl->urbs.count, (int) size); + +- return i; ++ return udl->urbs.count; + } + + struct urb *udl_get_urb(struct drm_device *dev)