From: Sasha Levin Date: Fri, 10 Jun 2022 12:34:54 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.9.318~107 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d5f23b6e2dd485d75669b3906d24b26e731c88bc;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/bootconfig-make-the-bootconfig.o-as-a-normal-object-.patch b/queue-5.10/bootconfig-make-the-bootconfig.o-as-a-normal-object-.patch new file mode 100644 index 00000000000..d0c0604ba8f --- /dev/null +++ b/queue-5.10/bootconfig-make-the-bootconfig.o-as-a-normal-object-.patch @@ -0,0 +1,45 @@ +From 264f3f53edd8f0c210d86a3d708da0a70350a5fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 11:30:59 +0900 +Subject: bootconfig: Make the bootconfig.o as a normal object file + +From: Masami Hiramatsu + +[ Upstream commit 6014a23638cdee63a71ef13c51d7c563eb5829ee ] + +Since the APIs defined in the bootconfig.o are not individually used, +it is meaningless to build it as library by lib-y. Use obj-y for that. + +Link: https://lkml.kernel.org/r/164921225875.1090670.15565363126983098971.stgit@devnote2 + +Cc: Padmanabha Srinivasaiah +Cc: Jonathan Corbet +Cc: Randy Dunlap +Cc: Nick Desaulniers +Cc: Sami Tolvanen +Cc: Nathan Chancellor +Cc: Linux Kbuild mailing list +Reported-by: Masahiro Yamada +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + lib/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/Makefile b/lib/Makefile +index d415fc7067c5..69b8217652ed 100644 +--- a/lib/Makefile ++++ b/lib/Makefile +@@ -274,7 +274,7 @@ $(foreach file, $(libfdt_files), \ + $(eval CFLAGS_$(file) = -I $(srctree)/scripts/dtc/libfdt)) + lib-$(CONFIG_LIBFDT) += $(libfdt_files) + +-lib-$(CONFIG_BOOT_CONFIG) += bootconfig.o ++obj-$(CONFIG_BOOT_CONFIG) += bootconfig.o + + obj-$(CONFIG_RBTREE_TEST) += rbtree_test.o + obj-$(CONFIG_INTERVAL_TREE_TEST) += interval_tree_test.o +-- +2.35.1 + diff --git a/queue-5.10/dmaengine-idxd-set-dma_interrupt-cap-bit.patch b/queue-5.10/dmaengine-idxd-set-dma_interrupt-cap-bit.patch new file mode 100644 index 00000000000..5fd2074d2f6 --- /dev/null +++ b/queue-5.10/dmaengine-idxd-set-dma_interrupt-cap-bit.patch @@ -0,0 +1,37 @@ +From 025de6990b92e04172aa6959cab86bb85ab8aa91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Apr 2022 15:09:38 -0700 +Subject: dmaengine: idxd: set DMA_INTERRUPT cap bit + +From: Dave Jiang + +[ Upstream commit 4e5a4eb20393b851590b4465f1197a8041c2076b ] + +Even though idxd driver has always supported interrupt, it never actually +set the DMA_INTERRUPT cap bit. Rectify this mistake so the interrupt +capability is advertised. + +Reported-by: Ben Walker +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/164971497859.2201379.17925303210723708961.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/dma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dma/idxd/dma.c b/drivers/dma/idxd/dma.c +index aa7435555de9..d53ce22b4b8f 100644 +--- a/drivers/dma/idxd/dma.c ++++ b/drivers/dma/idxd/dma.c +@@ -188,6 +188,7 @@ int idxd_register_dma_device(struct idxd_device *idxd) + INIT_LIST_HEAD(&dma->channels); + dma->dev = dev; + ++ dma_cap_set(DMA_INTERRUPT, dma->cap_mask); + dma_cap_set(DMA_PRIVATE, dma->cap_mask); + dma_cap_set(DMA_COMPLETION_NO_ORDER, dma->cap_mask); + dma->device_release = idxd_dma_release; +-- +2.35.1 + diff --git a/queue-5.10/dmaengine-zynqmp_dma-in-struct-zynqmp_dma_chan-fix-d.patch b/queue-5.10/dmaengine-zynqmp_dma-in-struct-zynqmp_dma_chan-fix-d.patch new file mode 100644 index 00000000000..5c9c18dc46a --- /dev/null +++ b/queue-5.10/dmaengine-zynqmp_dma-in-struct-zynqmp_dma_chan-fix-d.patch @@ -0,0 +1,64 @@ +From 9149ae9b87a868c788b015d86266571b3d543d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 May 2022 12:42:40 +0530 +Subject: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data + type + +From: Radhey Shyam Pandey + +[ Upstream commit f9a9f43a62a04ec3183fb0da9226c7706eed0115 ] + +In zynqmp_dma_alloc/free_chan_resources functions there is a +potential overflow in the below expressions. + +dma_alloc_coherent(chan->dev, (2 * chan->desc_size * + ZYNQMP_DMA_NUM_DESCS), + &chan->desc_pool_p, GFP_KERNEL); + +dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * + ZYNQMP_DMA_NUM_DESCS), + chan->desc_pool_v, chan->desc_pool_p); + +The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though +this overflow condition is not observed but it is a potential problem +in the case of 32-bit multiplication. Hence fix it by changing the +desc_size data type to size_t. + +In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in +dma_alloc_coherent API argument. + +Addresses-Coverity: Event overflow_before_widen. +Signed-off-by: Radhey Shyam Pandey +Link: https://lore.kernel.org/r/1652166762-18317-2-git-send-email-radhey.shyam.pandey@xilinx.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/zynqmp_dma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c +index 5fecf5aa6e85..7e6be076e9d3 100644 +--- a/drivers/dma/xilinx/zynqmp_dma.c ++++ b/drivers/dma/xilinx/zynqmp_dma.c +@@ -232,7 +232,7 @@ struct zynqmp_dma_chan { + bool is_dmacoherent; + struct tasklet_struct tasklet; + bool idle; +- u32 desc_size; ++ size_t desc_size; + bool err; + u32 bus_width; + u32 src_burst_len; +@@ -490,7 +490,8 @@ static int zynqmp_dma_alloc_chan_resources(struct dma_chan *dchan) + } + + chan->desc_pool_v = dma_alloc_coherent(chan->dev, +- (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), ++ (2 * ZYNQMP_DMA_DESC_SIZE(chan) * ++ ZYNQMP_DMA_NUM_DESCS), + &chan->desc_pool_p, GFP_KERNEL); + if (!chan->desc_pool_v) + return -ENOMEM; +-- +2.35.1 + diff --git a/queue-5.10/f2fs-remove-warn_on-in-f2fs_is_valid_blkaddr.patch b/queue-5.10/f2fs-remove-warn_on-in-f2fs_is_valid_blkaddr.patch new file mode 100644 index 00000000000..bc7f75577b1 --- /dev/null +++ b/queue-5.10/f2fs-remove-warn_on-in-f2fs_is_valid_blkaddr.patch @@ -0,0 +1,60 @@ +From e99d25b191c10dd0d1f1e19fb9c35b35fb65ff81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Apr 2022 21:19:02 +0800 +Subject: f2fs: remove WARN_ON in f2fs_is_valid_blkaddr + +From: Dongliang Mu + +[ Upstream commit dc2f78e2d4cc844a1458653d57ce1b54d4a29f21 ] + +Syzbot triggers two WARNs in f2fs_is_valid_blkaddr and +__is_bitmap_valid. For example, in f2fs_is_valid_blkaddr, +if type is DATA_GENERIC_ENHANCE or DATA_GENERIC_ENHANCE_READ, +it invokes WARN_ON if blkaddr is not in the right range. +The call trace is as follows: + + f2fs_get_node_info+0x45f/0x1070 + read_node_page+0x577/0x1190 + __get_node_page.part.0+0x9e/0x10e0 + __get_node_page + f2fs_get_node_page+0x109/0x180 + do_read_inode + f2fs_iget+0x2a5/0x58b0 + f2fs_fill_super+0x3b39/0x7ca0 + +Fix these two WARNs by replacing WARN_ON with dump_stack. + +Reported-by: syzbot+763ae12a2ede1d99d4dc@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/checkpoint.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 77f30320f862..1c49b9959b32 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -148,7 +148,7 @@ static bool __is_bitmap_valid(struct f2fs_sb_info *sbi, block_t blkaddr, + f2fs_err(sbi, "Inconsistent error blkaddr:%u, sit bitmap:%d", + blkaddr, exist); + set_sbi_flag(sbi, SBI_NEED_FSCK); +- WARN_ON(1); ++ dump_stack(); + } + return exist; + } +@@ -186,7 +186,7 @@ bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi, + f2fs_warn(sbi, "access invalid blkaddr:%u", + blkaddr); + set_sbi_flag(sbi, SBI_NEED_FSCK); +- WARN_ON(1); ++ dump_stack(); + return false; + } else { + return __is_bitmap_valid(sbi, blkaddr, type); +-- +2.35.1 + diff --git a/queue-5.10/i2c-cadence-increase-timeout-per-message-if-necessar.patch b/queue-5.10/i2c-cadence-increase-timeout-per-message-if-necessar.patch new file mode 100644 index 00000000000..63211bb8b2c --- /dev/null +++ b/queue-5.10/i2c-cadence-increase-timeout-per-message-if-necessar.patch @@ -0,0 +1,64 @@ +From 9e38d0c53818d28758cfcd80c398ed6d6c45c166 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2022 10:14:10 +0100 +Subject: i2c: cadence: Increase timeout per message if necessary + +From: Lucas Tanure + +[ Upstream commit 96789dce043f5bff8b7d62aa28d52a7c59403a84 ] + +Timeout as 1 second sets an upper limit on the length +of the transfer executed, but there is no maximum length +of a write or read message set in i2c_adapter_quirks for +this controller. + +This upper limit affects devices that require sending +large firmware blobs over I2C. + +To remove that limitation, calculate the minimal time +necessary, plus some wiggle room, for every message and +use it instead of the default one second, if more than +one second. + +Signed-off-by: Lucas Tanure +Acked-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-cadence.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c +index c1bbc4caeb5c..50e3ddba52ba 100644 +--- a/drivers/i2c/busses/i2c-cadence.c ++++ b/drivers/i2c/busses/i2c-cadence.c +@@ -724,7 +724,7 @@ static void cdns_i2c_master_reset(struct i2c_adapter *adap) + static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + struct i2c_adapter *adap) + { +- unsigned long time_left; ++ unsigned long time_left, msg_timeout; + u32 reg; + + id->p_msg = msg; +@@ -749,8 +749,16 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg, + else + cdns_i2c_msend(id); + ++ /* Minimal time to execute this message */ ++ msg_timeout = msecs_to_jiffies((1000 * msg->len * BITS_PER_BYTE) / id->i2c_clk); ++ /* Plus some wiggle room */ ++ msg_timeout += msecs_to_jiffies(500); ++ ++ if (msg_timeout < adap->timeout) ++ msg_timeout = adap->timeout; ++ + /* Wait for the signal of completion */ +- time_left = wait_for_completion_timeout(&id->xfer_done, adap->timeout); ++ time_left = wait_for_completion_timeout(&id->xfer_done, msg_timeout); + if (time_left == 0) { + cdns_i2c_master_reset(adap); + dev_err(id->adap.dev.parent, +-- +2.35.1 + diff --git a/queue-5.10/iommu-arm-smmu-fix-possible-null-ptr-deref-in-arm_sm.patch b/queue-5.10/iommu-arm-smmu-fix-possible-null-ptr-deref-in-arm_sm.patch new file mode 100644 index 00000000000..955e2d9e278 --- /dev/null +++ b/queue-5.10/iommu-arm-smmu-fix-possible-null-ptr-deref-in-arm_sm.patch @@ -0,0 +1,44 @@ +From f0dfc64c7b66abcbbd955bbb41b5d6f26a991634 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 19:41:36 +0800 +Subject: iommu/arm-smmu: fix possible null-ptr-deref in + arm_smmu_device_probe() + +From: Yang Yingliang + +[ Upstream commit d9ed8af1dee37f181096631fb03729ece98ba816 ] + +It will cause null-ptr-deref when using 'res', if platform_get_resource() +returns NULL, so move using 'res' after devm_ioremap_resource() that +will check it to avoid null-ptr-deref. +And use devm_platform_get_and_ioremap_resource() to simplify code. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20220425114136.2649310-1-yangyingliang@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c +index df24bbe3ea4f..6b41fe229a05 100644 +--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c ++++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c +@@ -2123,11 +2123,10 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + if (err) + return err; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- ioaddr = res->start; +- smmu->base = devm_ioremap_resource(dev, res); ++ smmu->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(smmu->base)) + return PTR_ERR(smmu->base); ++ ioaddr = res->start; + /* + * The resource size should effectively match the value of SMMU_TOP; + * stash that temporarily until we know PAGESIZE to validate it with. +-- +2.35.1 + diff --git a/queue-5.10/iommu-arm-smmu-v3-check-return-value-after-calling-p.patch b/queue-5.10/iommu-arm-smmu-v3-check-return-value-after-calling-p.patch new file mode 100644 index 00000000000..b4ba0af465a --- /dev/null +++ b/queue-5.10/iommu-arm-smmu-v3-check-return-value-after-calling-p.patch @@ -0,0 +1,37 @@ +From 74ae36afe5be815e92a1cf935afa47e92fd5d889 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Apr 2022 19:45:25 +0800 +Subject: iommu/arm-smmu-v3: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit b131fa8c1d2afd05d0b7598621114674289c2fbb ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20220425114525.2651143-1-yangyingliang@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +index 483c1362cc4a..bc4cbc7542ce 100644 +--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c ++++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +@@ -3512,6 +3512,8 @@ static int arm_smmu_device_probe(struct platform_device *pdev) + + /* Base address */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + if (resource_size(res) < arm_smmu_resource_size(smmu)) { + dev_err(dev, "MMIO region too small (%pr)\n", res); + return -EINVAL; +-- +2.35.1 + diff --git a/queue-5.10/m68knommu-fix-undefined-reference-to-_init_sp.patch b/queue-5.10/m68knommu-fix-undefined-reference-to-_init_sp.patch new file mode 100644 index 00000000000..f741f2df942 --- /dev/null +++ b/queue-5.10/m68knommu-fix-undefined-reference-to-_init_sp.patch @@ -0,0 +1,43 @@ +From 4f8900dcb3a84816448f8a820d73d10cf5451462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 17:27:39 +1000 +Subject: m68knommu: fix undefined reference to `_init_sp' + +From: Greg Ungerer + +[ Upstream commit a71b9e66fee47c59b3ec34e652b5c23bc6550794 ] + +When configuring a nommu classic m68k system enabling the uboot parameter +passing support (CONFIG_UBOOT) will produce the following compile error: + + m68k-linux-ld: arch/m68k/kernel/uboot.o: in function `process_uboot_commandline': + uboot.c:(.init.text+0x32): undefined reference to `_init_sp' + +The logic to support this option is only used on ColdFire based platforms +(in its head.S startup code). So make the selection of this option +depend on building for a ColdFire based platform. + +Reported-by: kernel test robot +Reviewed-by: Geert Uytterhoeven +Acked-by: Geert Uytterhoeven +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/Kconfig.machine | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine +index 51a878803fb6..16730561d166 100644 +--- a/arch/m68k/Kconfig.machine ++++ b/arch/m68k/Kconfig.machine +@@ -321,6 +321,7 @@ comment "Machine Options" + + config UBOOT + bool "Support for U-Boot command line parameters" ++ depends on COLDFIRE + help + If you say Y here kernel will try to collect command + line parameters from the initial u-boot stack. +-- +2.35.1 + diff --git a/queue-5.10/m68knommu-set-zero_page-to-the-allocated-zeroed-page.patch b/queue-5.10/m68knommu-set-zero_page-to-the-allocated-zeroed-page.patch new file mode 100644 index 00000000000..9f7ffe6b57c --- /dev/null +++ b/queue-5.10/m68knommu-set-zero_page-to-the-allocated-zeroed-page.patch @@ -0,0 +1,47 @@ +From 0da2048527a1c420633a645cbed1e48442b92412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Apr 2022 23:27:47 +1000 +Subject: m68knommu: set ZERO_PAGE() to the allocated zeroed page + +From: Greg Ungerer + +[ Upstream commit dc068f46217970d9516f16cd37972a01d50dc055 ] + +The non-MMU m68k pagetable ZERO_PAGE() macro is being set to the +somewhat non-sensical value of "virt_to_page(0)". The zeroth page +is not in any way guaranteed to be a page full of "0". So the result +is that ZERO_PAGE() will almost certainly contain random values. + +We already allocate a real "empty_zero_page" in the mm setup code shared +between MMU m68k and non-MMU m68k. It is just not hooked up to the +ZERO_PAGE() macro for the non-MMU m68k case. + +Fix ZERO_PAGE() to use the allocated "empty_zero_page" pointer. + +I am not aware of any specific issues caused by the old code. + +Link: https://lore.kernel.org/linux-m68k/2a462b23-5b8e-bbf4-ec7d-778434a3b9d7@google.com/T/#t +Reported-by: Hugh Dickens +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/include/asm/pgtable_no.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/m68k/include/asm/pgtable_no.h b/arch/m68k/include/asm/pgtable_no.h +index 87151d67d91e..bce5ca56c388 100644 +--- a/arch/m68k/include/asm/pgtable_no.h ++++ b/arch/m68k/include/asm/pgtable_no.h +@@ -42,7 +42,8 @@ extern void paging_init(void); + * ZERO_PAGE is a global shared page that is always zero: used + * for zero-mapped memory areas etc.. + */ +-#define ZERO_PAGE(vaddr) (virt_to_page(0)) ++extern void *empty_zero_page; ++#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page)) + + /* + * All 32bit addresses are effectively valid for vmalloc... +-- +2.35.1 + diff --git a/queue-5.10/mips-cpc-fix-refcount-leak-in-mips_cpc_default_phys_.patch b/queue-5.10/mips-cpc-fix-refcount-leak-in-mips_cpc_default_phys_.patch new file mode 100644 index 00000000000..415f1a0605b --- /dev/null +++ b/queue-5.10/mips-cpc-fix-refcount-leak-in-mips_cpc_default_phys_.patch @@ -0,0 +1,35 @@ +From 2c1110a8ea83624f6352b979c277792b60d3c7c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 12:26:57 +0800 +Subject: mips: cpc: Fix refcount leak in mips_cpc_default_phys_base + +From: Gong Yuanjun + +[ Upstream commit 4107fa700f314592850e2c64608f6ede4c077476 ] + +Add the missing of_node_put() to release the refcount incremented +by of_find_compatible_node(). + +Signed-off-by: Gong Yuanjun +Reviewed-by: Serge Semin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/mips-cpc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c +index 8d2535123f11..d005be84c482 100644 +--- a/arch/mips/kernel/mips-cpc.c ++++ b/arch/mips/kernel/mips-cpc.c +@@ -27,6 +27,7 @@ phys_addr_t __weak mips_cpc_default_phys_base(void) + cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc"); + if (cpc_node) { + err = of_address_to_resource(cpc_node, 0, &res); ++ of_node_put(cpc_node); + if (!err) + return res.start; + } +-- +2.35.1 + diff --git a/queue-5.10/nfsv4-don-t-hold-the-layoutget-locks-across-multiple.patch b/queue-5.10/nfsv4-don-t-hold-the-layoutget-locks-across-multiple.patch new file mode 100644 index 00000000000..30bd4641d96 --- /dev/null +++ b/queue-5.10/nfsv4-don-t-hold-the-layoutget-locks-across-multiple.patch @@ -0,0 +1,39 @@ +From 1cff17593fb8404c8f38707be1e1d602a92f22a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 May 2022 10:08:14 -0400 +Subject: NFSv4: Don't hold the layoutget locks across multiple RPC calls + +From: Trond Myklebust + +[ Upstream commit 6949493884fe88500de4af182588e071cf1544ee ] + +When doing layoutget as part of the open() compound, we have to be +careful to release the layout locks before we can call any further RPC +calls, such as setattr(). The reason is that those calls could trigger +a recall, which could deadlock. + +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index b6d60e69043a..b22da4e3165b 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3086,6 +3086,10 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + } + + out: ++ if (opendata->lgp) { ++ nfs4_lgopen_release(opendata->lgp); ++ opendata->lgp = NULL; ++ } + if (!opendata->cancelled) + nfs4_sequence_free_slot(&opendata->o_res.seq_res); + return ret; +-- +2.35.1 + diff --git a/queue-5.10/series b/queue-5.10/series index 51e6c2ec048..94b1fad5465 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -73,3 +73,19 @@ scsi-sd-fix-potential-null-pointer-dereference.patch tipc-check-attribute-length-for-bearer-name.patch driver-core-fix-wait_for_device_probe-deferred_probe.patch perf-c2c-fix-sorting-in-percent_rmt_hitm_cmp.patch +dmaengine-idxd-set-dma_interrupt-cap-bit.patch +mips-cpc-fix-refcount-leak-in-mips_cpc_default_phys_.patch +bootconfig-make-the-bootconfig.o-as-a-normal-object-.patch +tracing-fix-sleeping-function-called-from-invalid-co.patch +tracing-avoid-adding-tracer-option-before-update_tra.patch +iommu-arm-smmu-fix-possible-null-ptr-deref-in-arm_sm.patch +iommu-arm-smmu-v3-check-return-value-after-calling-p.patch +f2fs-remove-warn_on-in-f2fs_is_valid_blkaddr.patch +i2c-cadence-increase-timeout-per-message-if-necessar.patch +m68knommu-set-zero_page-to-the-allocated-zeroed-page.patch +m68knommu-fix-undefined-reference-to-_init_sp.patch +dmaengine-zynqmp_dma-in-struct-zynqmp_dma_chan-fix-d.patch +nfsv4-don-t-hold-the-layoutget-locks-across-multiple.patch +video-fbdev-hyperv_fb-allow-resolutions-with-size-64.patch +video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch +xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch diff --git a/queue-5.10/tracing-avoid-adding-tracer-option-before-update_tra.patch b/queue-5.10/tracing-avoid-adding-tracer-option-before-update_tra.patch new file mode 100644 index 00000000000..a332b09b051 --- /dev/null +++ b/queue-5.10/tracing-avoid-adding-tracer-option-before-update_tra.patch @@ -0,0 +1,66 @@ +From cf4b33e8cdeda75820ab2768c66143fd342b49ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 20:24:06 +0800 +Subject: tracing: Avoid adding tracer option before update_tracer_options + +From: Mark-PK Tsai + +[ Upstream commit ef9188bcc6ca1d8a2ad83e826b548e6820721061 ] + +To prepare for support asynchronous tracer_init_tracefs initcall, +avoid calling create_trace_option_files before __update_tracer_options. +Otherwise, create_trace_option_files will show warning because +some tracers in trace_types list are already in tr->topts. + +For example, hwlat_tracer call register_tracer in late_initcall, +and global_trace.dir is already created in tracing_init_dentry, +hwlat_tracer will be put into tr->topts. +Then if the __update_tracer_options is executed after hwlat_tracer +registered, create_trace_option_files find that hwlat_tracer is +already in tr->topts. + +Link: https://lkml.kernel.org/r/20220426122407.17042-2-mark-pk.tsai@mediatek.com + +Link: https://lore.kernel.org/lkml/20220322133339.GA32582@xsang-OptiPlex-9020/ +Reported-by: kernel test robot +Signed-off-by: Mark-PK Tsai +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 124e3e25e155..50200898410d 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -5907,12 +5907,18 @@ static void tracing_set_nop(struct trace_array *tr) + tr->current_trace = &nop_trace; + } + ++static bool tracer_options_updated; ++ + static void add_tracer_options(struct trace_array *tr, struct tracer *t) + { + /* Only enable if the directory has been created already. */ + if (!tr->dir) + return; + ++ /* Only create trace option files after update_tracer_options finish */ ++ if (!tracer_options_updated) ++ return; ++ + create_trace_option_files(tr, t); + } + +@@ -8649,6 +8655,7 @@ static void __update_tracer_options(struct trace_array *tr) + static void update_tracer_options(struct trace_array *tr) + { + mutex_lock(&trace_types_lock); ++ tracer_options_updated = true; + __update_tracer_options(tr); + mutex_unlock(&trace_types_lock); + } +-- +2.35.1 + diff --git a/queue-5.10/tracing-fix-sleeping-function-called-from-invalid-co.patch b/queue-5.10/tracing-fix-sleeping-function-called-from-invalid-co.patch new file mode 100644 index 00000000000..dc00501fc82 --- /dev/null +++ b/queue-5.10/tracing-fix-sleeping-function-called-from-invalid-co.patch @@ -0,0 +1,93 @@ +From 74171c8755cf41a505c78f1ec1be52fa98eaff44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Apr 2022 09:39:10 +0800 +Subject: tracing: Fix sleeping function called from invalid context on RT + kernel + +From: Jun Miao + +[ Upstream commit 12025abdc8539ed9d5014e2d647a3fd1bd3de5cd ] + +When setting bootparams="trace_event=initcall:initcall_start tp_printk=1" in the +cmdline, the output_printk() was called, and the spin_lock_irqsave() was called in the +atomic and irq disable interrupt context suitation. On the PREEMPT_RT kernel, +these locks are replaced with sleepable rt-spinlock, so the stack calltrace will +be triggered. +Fix it by raw_spin_lock_irqsave when PREEMPT_RT and "trace_event=initcall:initcall_start +tp_printk=1" enabled. + + BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 + in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: swapper/0 + preempt_count: 2, expected: 0 + RCU nest depth: 0, expected: 0 + Preemption disabled at: + [] try_to_wake_up+0x7e/0xba0 + CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.17.1-rt17+ #19 34c5812404187a875f32bee7977f7367f9679ea7 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 + Call Trace: + + dump_stack_lvl+0x60/0x8c + dump_stack+0x10/0x12 + __might_resched.cold+0x11d/0x155 + rt_spin_lock+0x40/0x70 + trace_event_buffer_commit+0x2fa/0x4c0 + ? map_vsyscall+0x93/0x93 + trace_event_raw_event_initcall_start+0xbe/0x110 + ? perf_trace_initcall_finish+0x210/0x210 + ? probe_sched_wakeup+0x34/0x40 + ? ttwu_do_wakeup+0xda/0x310 + ? trace_hardirqs_on+0x35/0x170 + ? map_vsyscall+0x93/0x93 + do_one_initcall+0x217/0x3c0 + ? trace_event_raw_event_initcall_level+0x170/0x170 + ? push_cpu_stop+0x400/0x400 + ? cblist_init_generic+0x241/0x290 + kernel_init_freeable+0x1ac/0x347 + ? _raw_spin_unlock_irq+0x65/0x80 + ? rest_init+0xf0/0xf0 + kernel_init+0x1e/0x150 + ret_from_fork+0x22/0x30 + + +Link: https://lkml.kernel.org/r/20220419013910.894370-1-jun.miao@intel.com + +Signed-off-by: Jun Miao +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 953dd9568dd7..124e3e25e155 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2784,7 +2784,7 @@ trace_event_buffer_lock_reserve(struct trace_buffer **current_rb, + } + EXPORT_SYMBOL_GPL(trace_event_buffer_lock_reserve); + +-static DEFINE_SPINLOCK(tracepoint_iter_lock); ++static DEFINE_RAW_SPINLOCK(tracepoint_iter_lock); + static DEFINE_MUTEX(tracepoint_printk_mutex); + + static void output_printk(struct trace_event_buffer *fbuffer) +@@ -2812,14 +2812,14 @@ static void output_printk(struct trace_event_buffer *fbuffer) + + event = &fbuffer->trace_file->event_call->event; + +- spin_lock_irqsave(&tracepoint_iter_lock, flags); ++ raw_spin_lock_irqsave(&tracepoint_iter_lock, flags); + trace_seq_init(&iter->seq); + iter->ent = fbuffer->entry; + event_call->event.funcs->trace(iter, 0, event); + trace_seq_putc(&iter->seq, 0); + printk("%s", iter->seq.buffer); + +- spin_unlock_irqrestore(&tracepoint_iter_lock, flags); ++ raw_spin_unlock_irqrestore(&tracepoint_iter_lock, flags); + } + + int tracepoint_printk_sysctl(struct ctl_table *table, int write, +-- +2.35.1 + diff --git a/queue-5.10/video-fbdev-hyperv_fb-allow-resolutions-with-size-64.patch b/queue-5.10/video-fbdev-hyperv_fb-allow-resolutions-with-size-64.patch new file mode 100644 index 00000000000..fec99268a4c --- /dev/null +++ b/queue-5.10/video-fbdev-hyperv_fb-allow-resolutions-with-size-64.patch @@ -0,0 +1,63 @@ +From 7108461058ad7b13dfd6ae4b76b0ad94ee0fbea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Apr 2022 06:47:53 -0700 +Subject: video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 + +From: Saurabh Sengar + +[ Upstream commit c4b4d7047f16a8d138ce76da65faefb7165736f2 ] + +This patch fixes a bug where GEN1 VMs doesn't allow resolutions greater +than 64 MB size (eg 7680x4320). Unnecessary PCI check limits Gen1 VRAM +to legacy PCI BAR size only (ie 64MB). Thus any, resolution requesting +greater then 64MB (eg 7680x4320) would fail. MMIO region assigning this +memory shouldn't be limited by PCI bar size. + +Signed-off-by: Saurabh Sengar +Reviewed-by: Dexuan Cui +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/hyperv_fb.c | 19 +------------------ + 1 file changed, 1 insertion(+), 18 deletions(-) + +diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c +index 3c309ab20887..40baa79f8046 100644 +--- a/drivers/video/fbdev/hyperv_fb.c ++++ b/drivers/video/fbdev/hyperv_fb.c +@@ -1008,7 +1008,6 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + struct pci_dev *pdev = NULL; + void __iomem *fb_virt; + int gen2vm = efi_enabled(EFI_BOOT); +- resource_size_t pot_start, pot_end; + phys_addr_t paddr; + int ret; + +@@ -1059,23 +1058,7 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info) + dio_fb_size = + screen_width * screen_height * screen_depth / 8; + +- if (gen2vm) { +- pot_start = 0; +- pot_end = -1; +- } else { +- if (!(pci_resource_flags(pdev, 0) & IORESOURCE_MEM) || +- pci_resource_len(pdev, 0) < screen_fb_size) { +- pr_err("Resource not available or (0x%lx < 0x%lx)\n", +- (unsigned long) pci_resource_len(pdev, 0), +- (unsigned long) screen_fb_size); +- goto err1; +- } +- +- pot_end = pci_resource_end(pdev, 0); +- pot_start = pot_end - screen_fb_size + 1; +- } +- +- ret = vmbus_allocate_mmio(&par->mem, hdev, pot_start, pot_end, ++ ret = vmbus_allocate_mmio(&par->mem, hdev, 0, -1, + screen_fb_size, 0x100000, true); + if (ret != 0) { + pr_err("Unable to allocate framebuffer memory\n"); +-- +2.35.1 + diff --git a/queue-5.10/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch b/queue-5.10/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch new file mode 100644 index 00000000000..e12217ace92 --- /dev/null +++ b/queue-5.10/video-fbdev-pxa3xx-gcu-release-the-resources-correct.patch @@ -0,0 +1,67 @@ +From f942a8f6fd39d9e89228b6c0a3e603bad4dbf67f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 May 2022 18:05:41 +0800 +Subject: video: fbdev: pxa3xx-gcu: release the resources correctly in + pxa3xx_gcu_probe/remove() + +From: Yang Yingliang + +[ Upstream commit d87ad457f7e1b8d2492ca5b1531eb35030a1cc8f ] + +In pxa3xx_gcu_probe(), the sequence of error lable is wrong, it will +leads some resource leaked, so adjust the sequence to handle the error +correctly, and if pxa3xx_gcu_add_buffer() fails, pxa3xx_gcu_free_buffers() +need be called. +In pxa3xx_gcu_remove(), add missing clk_disable_unpreprare(). + +Signed-off-by: Yang Yingliang +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/pxa3xx-gcu.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c +index 4279e13a3b58..9421d14d0eb0 100644 +--- a/drivers/video/fbdev/pxa3xx-gcu.c ++++ b/drivers/video/fbdev/pxa3xx-gcu.c +@@ -650,6 +650,7 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) + for (i = 0; i < 8; i++) { + ret = pxa3xx_gcu_add_buffer(dev, priv); + if (ret) { ++ pxa3xx_gcu_free_buffers(dev, priv); + dev_err(dev, "failed to allocate DMA memory\n"); + goto err_disable_clk; + } +@@ -666,15 +667,15 @@ static int pxa3xx_gcu_probe(struct platform_device *pdev) + SHARED_SIZE, irq); + return 0; + +-err_free_dma: +- dma_free_coherent(dev, SHARED_SIZE, +- priv->shared, priv->shared_phys); ++err_disable_clk: ++ clk_disable_unprepare(priv->clk); + + err_misc_deregister: + misc_deregister(&priv->misc_dev); + +-err_disable_clk: +- clk_disable_unprepare(priv->clk); ++err_free_dma: ++ dma_free_coherent(dev, SHARED_SIZE, ++ priv->shared, priv->shared_phys); + + return ret; + } +@@ -687,6 +688,7 @@ static int pxa3xx_gcu_remove(struct platform_device *pdev) + pxa3xx_gcu_wait_idle(priv); + misc_deregister(&priv->misc_dev); + dma_free_coherent(dev, SHARED_SIZE, priv->shared, priv->shared_phys); ++ clk_disable_unprepare(priv->clk); + pxa3xx_gcu_free_buffers(dev, priv); + + return 0; +-- +2.35.1 + diff --git a/queue-5.10/xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch b/queue-5.10/xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch new file mode 100644 index 00000000000..0dd70830b4e --- /dev/null +++ b/queue-5.10/xprtrdma-treat-all-calls-not-a-bcall-when-bc_serv-is.patch @@ -0,0 +1,73 @@ +From 7109f762b8717b0b2175fd225143c93fbc068af5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 May 2022 20:36:48 +0800 +Subject: xprtrdma: treat all calls not a bcall when bc_serv is NULL + +From: Kinglong Mee + +[ Upstream commit 11270e7ca268e8d61b5d9e5c3a54bd1550642c9c ] + +When a rdma server returns a fault format reply, nfs v3 client may +treats it as a bcall when bc service is not exist. + +The debug message at rpcrdma_bc_receive_call are, + +[56579.837169] RPC: rpcrdma_bc_receive_call: callback XID +00000001, length=20 +[56579.837174] RPC: rpcrdma_bc_receive_call: 00 00 00 01 00 00 00 +00 00 00 00 00 00 00 00 00 00 00 00 04 + +After that, rpcrdma_bc_receive_call will meets NULL pointer as, + +[ 226.057890] BUG: unable to handle kernel NULL pointer dereference at +00000000000000c8 +... +[ 226.058704] RIP: 0010:_raw_spin_lock+0xc/0x20 +... +[ 226.059732] Call Trace: +[ 226.059878] rpcrdma_bc_receive_call+0x138/0x327 [rpcrdma] +[ 226.060011] __ib_process_cq+0x89/0x170 [ib_core] +[ 226.060092] ib_cq_poll_work+0x26/0x80 [ib_core] +[ 226.060257] process_one_work+0x1a7/0x360 +[ 226.060367] ? create_worker+0x1a0/0x1a0 +[ 226.060440] worker_thread+0x30/0x390 +[ 226.060500] ? create_worker+0x1a0/0x1a0 +[ 226.060574] kthread+0x116/0x130 +[ 226.060661] ? kthread_flush_work_fn+0x10/0x10 +[ 226.060724] ret_from_fork+0x35/0x40 +... + +Signed-off-by: Kinglong Mee +Reviewed-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/rpc_rdma.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c +index ca267a855a12..b8174c77dfe1 100644 +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -1137,6 +1137,7 @@ static bool + rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep) + #if defined(CONFIG_SUNRPC_BACKCHANNEL) + { ++ struct rpc_xprt *xprt = &r_xprt->rx_xprt; + struct xdr_stream *xdr = &rep->rr_stream; + __be32 *p; + +@@ -1160,6 +1161,10 @@ rpcrdma_is_bcall(struct rpcrdma_xprt *r_xprt, struct rpcrdma_rep *rep) + if (*p != cpu_to_be32(RPC_CALL)) + return false; + ++ /* No bc service. */ ++ if (xprt->bc_serv == NULL) ++ return false; ++ + /* Now that we are sure this is a backchannel call, + * advance to the RPC header. + */ +-- +2.35.1 +