From: Sasha Levin Date: Mon, 5 Sep 2022 12:52:12 +0000 (-0400) Subject: Fixes for 4.14 X-Git-Tag: v5.10.142~84 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d37655213ede9a1f3843f516c38857733dd77e17;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/drm-msm-dsi-fix-number-of-regulators-for-msm8996_dsi.patch b/queue-4.14/drm-msm-dsi-fix-number-of-regulators-for-msm8996_dsi.patch new file mode 100644 index 00000000000..833ca880208 --- /dev/null +++ b/queue-4.14/drm-msm-dsi-fix-number-of-regulators-for-msm8996_dsi.patch @@ -0,0 +1,39 @@ +From 7921e274402ecd520c17b371ad955cb687b84c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 07:38:48 -0700 +Subject: drm/msm/dsi: Fix number of regulators for msm8996_dsi_cfg + +From: Douglas Anderson + +[ Upstream commit 1e00d6ac8a3422765bae37aeac2002dfd3c0bda6 ] + +3 regulators are listed but the number 2 is specified. Fix it. + +Fixes: 3a3ff88a0fc1 ("drm/msm/dsi: Add 8x96 info in dsi_cfg") +Signed-off-by: Douglas Anderson +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/496318/ +Link: https://lore.kernel.org/r/20220804073608.v4.1.I1056ee3f77f71287f333279efe4c85f88d403f65@changeid +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_cfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_cfg.c b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +index a5d75c9b3a737..2b8c39a1f7484 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_cfg.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_cfg.c +@@ -105,7 +105,7 @@ static const char * const dsi_8996_bus_clk_names[] = { + static const struct msm_dsi_config msm8996_dsi_cfg = { + .io_offset = DSI_6G_REG_SHIFT, + .reg_cfg = { +- .num = 2, ++ .num = 3, + .regs = { + {"vdda", 18160, 1 }, /* 1.25 V */ + {"vcca", 17000, 32 }, /* 0.925 V */ +-- +2.35.1 + diff --git a/queue-4.14/ethernet-rocker-fix-sleep-in-atomic-context-bug-in-n.patch b/queue-4.14/ethernet-rocker-fix-sleep-in-atomic-context-bug-in-n.patch new file mode 100644 index 00000000000..7560bbc54b1 --- /dev/null +++ b/queue-4.14/ethernet-rocker-fix-sleep-in-atomic-context-bug-in-n.patch @@ -0,0 +1,57 @@ +From 5c573c205dbffbb338c3875696cffce1ee210d35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Aug 2022 23:38:15 +0800 +Subject: ethernet: rocker: fix sleep in atomic context bug in + neigh_timer_handler + +From: Duoming Zhou + +[ Upstream commit c0955bf957be4bead01fae1d791476260da7325d ] + +The function neigh_timer_handler() is a timer handler that runs in an +atomic context. When used by rocker, neigh_timer_handler() calls +"kzalloc(.., GFP_KERNEL)" that may sleep. As a result, the sleep in +atomic context bug will happen. One of the processes is shown below: + +ofdpa_fib4_add() + ... + neigh_add_timer() + +(wait a timer) + +neigh_timer_handler() + neigh_release() + neigh_destroy() + rocker_port_neigh_destroy() + rocker_world_port_neigh_destroy() + ofdpa_port_neigh_destroy() + ofdpa_port_ipv4_neigh() + kzalloc(sizeof(.., GFP_KERNEL) //may sleep + +This patch changes the gfp_t parameter of kzalloc() from GFP_KERNEL to +GFP_ATOMIC in order to mitigate the bug. + +Fixes: 00fc0c51e35b ("rocker: Change world_ops API and implementation to be switchdev independant") +Signed-off-by: Duoming Zhou +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/rocker/rocker_ofdpa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/rocker/rocker_ofdpa.c b/drivers/net/ethernet/rocker/rocker_ofdpa.c +index 0653b70723a34..5dad40257e12e 100644 +--- a/drivers/net/ethernet/rocker/rocker_ofdpa.c ++++ b/drivers/net/ethernet/rocker/rocker_ofdpa.c +@@ -1277,7 +1277,7 @@ static int ofdpa_port_ipv4_neigh(struct ofdpa_port *ofdpa_port, + bool removing; + int err = 0; + +- entry = kzalloc(sizeof(*entry), GFP_KERNEL); ++ entry = kzalloc(sizeof(*entry), GFP_ATOMIC); + if (!entry) + return -ENOMEM; + +-- +2.35.1 + diff --git a/queue-4.14/kcm-fix-strp_init-order-and-cleanup.patch b/queue-4.14/kcm-fix-strp_init-order-and-cleanup.patch new file mode 100644 index 00000000000..cc476604c24 --- /dev/null +++ b/queue-4.14/kcm-fix-strp_init-order-and-cleanup.patch @@ -0,0 +1,74 @@ +From c2773e54ee3a7c980b918c874c15368d459fd2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Aug 2022 11:13:14 -0700 +Subject: kcm: fix strp_init() order and cleanup + +From: Cong Wang + +[ Upstream commit 8fc29ff3910f3af08a7c40a75d436b5720efe2bf ] + +strp_init() is called just a few lines above this csk->sk_user_data +check, it also initializes strp->work etc., therefore, it is +unnecessary to call strp_done() to cancel the freshly initialized +work. + +And if sk_user_data is already used by KCM, psock->strp should not be +touched, particularly strp->work state, so we need to move strp_init() +after the csk->sk_user_data check. + +This also makes a lockdep warning reported by syzbot go away. + +Reported-and-tested-by: syzbot+9fc084a4348493ef65d2@syzkaller.appspotmail.com +Reported-by: syzbot+e696806ef96cdd2d87cd@syzkaller.appspotmail.com +Fixes: e5571240236c ("kcm: Check if sk_user_data already set in kcm_attach") +Fixes: dff8baa26117 ("kcm: Call strp_stop before strp_done in kcm_attach") +Cc: Tom Herbert +Signed-off-by: Cong Wang +Link: https://lore.kernel.org/r/20220827181314.193710-1-xiyou.wangcong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/kcm/kcmsock.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 7b4f3f8658617..c364d849e7c3d 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1412,12 +1412,6 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + psock->sk = csk; + psock->bpf_prog = prog; + +- err = strp_init(&psock->strp, csk, &cb); +- if (err) { +- kmem_cache_free(kcm_psockp, psock); +- goto out; +- } +- + write_lock_bh(&csk->sk_callback_lock); + + /* Check if sk_user_data is aready by KCM or someone else. +@@ -1425,13 +1419,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + */ + if (csk->sk_user_data) { + write_unlock_bh(&csk->sk_callback_lock); +- strp_stop(&psock->strp); +- strp_done(&psock->strp); + kmem_cache_free(kcm_psockp, psock); + err = -EALREADY; + goto out; + } + ++ err = strp_init(&psock->strp, csk, &cb); ++ if (err) { ++ write_unlock_bh(&csk->sk_callback_lock); ++ kmem_cache_free(kcm_psockp, psock); ++ goto out; ++ } ++ + psock->save_data_ready = csk->sk_data_ready; + psock->save_write_space = csk->sk_write_space; + psock->save_state_change = csk->sk_state_change; +-- +2.35.1 + diff --git a/queue-4.14/platform-x86-pmc_atom-fix-slp_typx-bitfield-mask.patch b/queue-4.14/platform-x86-pmc_atom-fix-slp_typx-bitfield-mask.patch new file mode 100644 index 00000000000..8b4de52b247 --- /dev/null +++ b/queue-4.14/platform-x86-pmc_atom-fix-slp_typx-bitfield-mask.patch @@ -0,0 +1,67 @@ +From 9e0c1540e2ff61136f688988f3f0808224eb4125 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Aug 2022 14:37:31 +0300 +Subject: platform/x86: pmc_atom: Fix SLP_TYPx bitfield mask + +From: Andy Shevchenko + +[ Upstream commit 0a90ed8d0cfa29735a221eba14d9cb6c735d35b6 ] + +On Intel hardware the SLP_TYPx bitfield occupies bits 10-12 as per ACPI +specification (see Table 4.13 "PM1 Control Registers Fixed Hardware +Feature Control Bits" for the details). + +Fix the mask and other related definitions accordingly. + +Fixes: 93e5eadd1f6e ("x86/platform: New Intel Atom SOC power management controller driver") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20220801113734.36131-1-andriy.shevchenko@linux.intel.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/pmc_atom.c | 2 +- + include/linux/platform_data/x86/pmc_atom.h | 6 ++++-- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/pmc_atom.c b/drivers/platform/x86/pmc_atom.c +index d1d5ec3c0f141..d1f10354c3550 100644 +--- a/drivers/platform/x86/pmc_atom.c ++++ b/drivers/platform/x86/pmc_atom.c +@@ -253,7 +253,7 @@ static void pmc_power_off(void) + pm1_cnt_port = acpi_base_addr + PM1_CNT; + + pm1_cnt_value = inl(pm1_cnt_port); +- pm1_cnt_value &= SLEEP_TYPE_MASK; ++ pm1_cnt_value &= ~SLEEP_TYPE_MASK; + pm1_cnt_value |= SLEEP_TYPE_S5; + pm1_cnt_value |= SLEEP_ENABLE; + +diff --git a/include/linux/platform_data/x86/pmc_atom.h b/include/linux/platform_data/x86/pmc_atom.h +index e4905fe69c381..e4cfcb6f16633 100644 +--- a/include/linux/platform_data/x86/pmc_atom.h ++++ b/include/linux/platform_data/x86/pmc_atom.h +@@ -16,6 +16,8 @@ + #ifndef PMC_ATOM_H + #define PMC_ATOM_H + ++#include ++ + /* ValleyView Power Control Unit PCI Device ID */ + #define PCI_DEVICE_ID_VLV_PMC 0x0F1C + /* CherryTrail Power Control Unit PCI Device ID */ +@@ -148,9 +150,9 @@ + #define ACPI_MMIO_REG_LEN 0x100 + + #define PM1_CNT 0x4 +-#define SLEEP_TYPE_MASK 0xFFFFECFF ++#define SLEEP_TYPE_MASK GENMASK(12, 10) + #define SLEEP_TYPE_S5 0x1C00 +-#define SLEEP_ENABLE 0x2000 ++#define SLEEP_ENABLE BIT(13) + + extern int pmc_atom_read(int offset, u32 *value); + extern int pmc_atom_write(int offset, u32 value); +-- +2.35.1 + diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..be8cab89d3f --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,5 @@ +drm-msm-dsi-fix-number-of-regulators-for-msm8996_dsi.patch +platform-x86-pmc_atom-fix-slp_typx-bitfield-mask.patch +wifi-cfg80211-debugfs-fix-return-type-in-ht40allow_m.patch +ethernet-rocker-fix-sleep-in-atomic-context-bug-in-n.patch +kcm-fix-strp_init-order-and-cleanup.patch diff --git a/queue-4.14/wifi-cfg80211-debugfs-fix-return-type-in-ht40allow_m.patch b/queue-4.14/wifi-cfg80211-debugfs-fix-return-type-in-ht40allow_m.patch new file mode 100644 index 00000000000..3901eef1e91 --- /dev/null +++ b/queue-4.14/wifi-cfg80211-debugfs-fix-return-type-in-ht40allow_m.patch @@ -0,0 +1,41 @@ +From 5efecc7bfb18430123a5bbeeb8e0fbf935e145c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Aug 2022 10:03:21 +0300 +Subject: wifi: cfg80211: debugfs: fix return type in ht40allow_map_read() + +From: Dan Carpenter + +[ Upstream commit d776763f48084926b5d9e25507a3ddb7c9243d5e ] + +The return type is supposed to be ssize_t, which is signed long, +but "r" was declared as unsigned int. This means that on 64 bit systems +we return positive values instead of negative error codes. + +Fixes: 80a3511d70e8 ("cfg80211: add debugfs HT40 allow map") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YutvOQeJm0UjLhwU@kili +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/debugfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c +index 30fc6eb352bcc..e6410487e25da 100644 +--- a/net/wireless/debugfs.c ++++ b/net/wireless/debugfs.c +@@ -68,9 +68,10 @@ static ssize_t ht40allow_map_read(struct file *file, + { + struct wiphy *wiphy = file->private_data; + char *buf; +- unsigned int offset = 0, buf_size = PAGE_SIZE, i, r; ++ unsigned int offset = 0, buf_size = PAGE_SIZE, i; + enum nl80211_band band; + struct ieee80211_supported_band *sband; ++ ssize_t r; + + buf = kzalloc(buf_size, GFP_KERNEL); + if (!buf) +-- +2.35.1 +