From: Sasha Levin Date: Thu, 2 May 2019 13:51:58 +0000 (-0400) Subject: autosel fixes for 4.4 X-Git-Tag: v4.9.173~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=dcd32332411f85830de63b703ec146d0d6962a85;p=thirdparty%2Fkernel%2Fstable-queue.git autosel fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/arm-dts-pfla02-increase-phy-reset-duration.patch b/queue-4.4/arm-dts-pfla02-increase-phy-reset-duration.patch new file mode 100644 index 00000000000..74ba58f9a0e --- /dev/null +++ b/queue-4.4/arm-dts-pfla02-increase-phy-reset-duration.patch @@ -0,0 +1,48 @@ +From 57d9109993eceddf7f93ae5eab3ebb4cc6965070 Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Mon, 4 Mar 2019 11:49:40 +0100 +Subject: ARM: dts: pfla02: increase phy reset duration + +[ Upstream commit 032f85c9360fb1a08385c584c2c4ed114b33c260 ] + +Increase the reset duration to ensure correct phy functionality. The +reset duration is taken from barebox commit 52fdd510de ("ARM: dts: +pfla02: use long enough reset for ethernet phy"): + + Use a longer reset time for ethernet phy Micrel KSZ9031RNX. Otherwise a + small percentage of modules have 'transmission timeouts' errors like + + barebox@Phytec phyFLEX-i.MX6 Quad Carrier-Board:/ ifup eth0 + warning: No MAC address set. Using random address 7e:94:4d:02:f8:f3 + eth0: 1000Mbps full duplex link detected + eth0: transmission timeout + T eth0: transmission timeout + T eth0: transmission timeout + T eth0: transmission timeout + T eth0: transmission timeout + +Cc: Stefan Christ +Cc: Christian Hemp +Signed-off-by: Marco Felsch +Fixes: 3180f956668e ("ARM: dts: Phytec imx6q pfla02 and pbab01 support") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin (Microsoft) +--- + arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +index d6d98d426384..cae04e806036 100644 +--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +@@ -90,6 +90,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii"; ++ phy-reset-duration = <10>; /* in msecs */ + phy-reset-gpios = <&gpio3 23 GPIO_ACTIVE_LOW>; + phy-supply = <&vdd_eth_io_reg>; + status = "disabled"; +-- +2.19.1 + diff --git a/queue-4.4/ceph-fix-use-after-free-on-symlink-traversal.patch b/queue-4.4/ceph-fix-use-after-free-on-symlink-traversal.patch new file mode 100644 index 00000000000..4082e3b692b --- /dev/null +++ b/queue-4.4/ceph-fix-use-after-free-on-symlink-traversal.patch @@ -0,0 +1,42 @@ +From 0a17a064e10a590c45ffa66140fd6f6cd62149b2 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Tue, 26 Mar 2019 01:38:58 +0000 +Subject: ceph: fix use-after-free on symlink traversal + +[ Upstream commit daf5cc27eed99afdea8d96e71b89ba41f5406ef6 ] + +free the symlink body after the same RCU delay we have for freeing the +struct inode itself, so that traversal during RCU pathwalk wouldn't step +into freed memory. + +Signed-off-by: Al Viro +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin (Microsoft) +--- + fs/ceph/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 9f0d99094cc1..a663b676d566 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -474,6 +474,7 @@ static void ceph_i_callback(struct rcu_head *head) + struct inode *inode = container_of(head, struct inode, i_rcu); + struct ceph_inode_info *ci = ceph_inode(inode); + ++ kfree(ci->i_symlink); + kmem_cache_free(ceph_inode_cachep, ci); + } + +@@ -505,7 +506,6 @@ void ceph_destroy_inode(struct inode *inode) + ceph_put_snap_realm(mdsc, realm); + } + +- kfree(ci->i_symlink); + while ((n = rb_first(&ci->i_fragtree)) != NULL) { + frag = rb_entry(n, struct ceph_inode_frag, node); + rb_erase(n, &ci->i_fragtree); +-- +2.19.1 + diff --git a/queue-4.4/kconfig-mn-conf-handle-backspace-h-key.patch b/queue-4.4/kconfig-mn-conf-handle-backspace-h-key.patch new file mode 100644 index 00000000000..e7726f521f7 --- /dev/null +++ b/queue-4.4/kconfig-mn-conf-handle-backspace-h-key.patch @@ -0,0 +1,65 @@ +From 7aff03ec481d8e686c2e8087e1ab72d39398d3f1 Mon Sep 17 00:00:00 2001 +From: Changbin Du +Date: Mon, 25 Mar 2019 15:16:47 +0000 +Subject: kconfig/[mn]conf: handle backspace (^H) key + +[ Upstream commit 9c38f1f044080392603c497ecca4d7d09876ff99 ] + +Backspace is not working on some terminal emulators which do not send the +key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127). +But currently only '^?' is handled. Let's also handle '^H' for those +terminals. + +Signed-off-by: Changbin Du +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin (Microsoft) +--- + scripts/kconfig/lxdialog/inputbox.c | 3 ++- + scripts/kconfig/nconf.c | 2 +- + scripts/kconfig/nconf.gui.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/scripts/kconfig/lxdialog/inputbox.c b/scripts/kconfig/lxdialog/inputbox.c +index d58de1dc5360..510049a7bd1d 100644 +--- a/scripts/kconfig/lxdialog/inputbox.c ++++ b/scripts/kconfig/lxdialog/inputbox.c +@@ -126,7 +126,8 @@ int dialog_inputbox(const char *title, const char *prompt, int height, int width + case KEY_DOWN: + break; + case KEY_BACKSPACE: +- case 127: ++ case 8: /* ^H */ ++ case 127: /* ^? */ + if (pos) { + wattrset(dialog, dlg.inputbox.atr); + if (input_x == 0) { +diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c +index d42d534a66cd..f7049e288e93 100644 +--- a/scripts/kconfig/nconf.c ++++ b/scripts/kconfig/nconf.c +@@ -1046,7 +1046,7 @@ static int do_match(int key, struct match_state *state, int *ans) + state->match_direction = FIND_NEXT_MATCH_UP; + *ans = get_mext_match(state->pattern, + state->match_direction); +- } else if (key == KEY_BACKSPACE || key == 127) { ++ } else if (key == KEY_BACKSPACE || key == 8 || key == 127) { + state->pattern[strlen(state->pattern)-1] = '\0'; + adj_match_dir(&state->match_direction); + } else +diff --git a/scripts/kconfig/nconf.gui.c b/scripts/kconfig/nconf.gui.c +index 4b2f44c20caf..9a65035cf787 100644 +--- a/scripts/kconfig/nconf.gui.c ++++ b/scripts/kconfig/nconf.gui.c +@@ -439,7 +439,8 @@ int dialog_inputbox(WINDOW *main_window, + case KEY_F(F_EXIT): + case KEY_F(F_BACK): + break; +- case 127: ++ case 8: /* ^H */ ++ case 127: /* ^? */ + case KEY_BACKSPACE: + if (cursor_position > 0) { + memmove(&result[cursor_position-1], +-- +2.19.1 + diff --git a/queue-4.4/libata-fix-using-dma-buffers-on-stack.patch b/queue-4.4/libata-fix-using-dma-buffers-on-stack.patch new file mode 100644 index 00000000000..f8637f0bf7a --- /dev/null +++ b/queue-4.4/libata-fix-using-dma-buffers-on-stack.patch @@ -0,0 +1,87 @@ +From b98a86a12eb236bf0594ccd1ecd4b4cf333de00b Mon Sep 17 00:00:00 2001 +From: raymond pang +Date: Thu, 28 Mar 2019 12:19:25 +0000 +Subject: libata: fix using DMA buffers on stack + +[ Upstream commit dd08a8d9a66de4b54575c294a92630299f7e0fe7 ] + +When CONFIG_VMAP_STACK=y, __pa() returns incorrect physical address for +a stack virtual address. Stack DMA buffers must be avoided. + +Signed-off-by: raymond pang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/ata/libata-zpodd.c | 34 ++++++++++++++++++++++++---------- + 1 file changed, 24 insertions(+), 10 deletions(-) + +diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c +index 0ad96c647541..7017a81d53cf 100644 +--- a/drivers/ata/libata-zpodd.c ++++ b/drivers/ata/libata-zpodd.c +@@ -51,38 +51,52 @@ static int eject_tray(struct ata_device *dev) + /* Per the spec, only slot type and drawer type ODD can be supported */ + static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev) + { +- char buf[16]; ++ char *buf; + unsigned int ret; +- struct rm_feature_desc *desc = (void *)(buf + 8); ++ struct rm_feature_desc *desc; + struct ata_taskfile tf; + static const char cdb[] = { GPCMD_GET_CONFIGURATION, + 2, /* only 1 feature descriptor requested */ + 0, 3, /* 3, removable medium feature */ + 0, 0, 0,/* reserved */ +- 0, sizeof(buf), ++ 0, 16, + 0, 0, 0, + }; + ++ buf = kzalloc(16, GFP_KERNEL); ++ if (!buf) ++ return ODD_MECH_TYPE_UNSUPPORTED; ++ desc = (void *)(buf + 8); ++ + ata_tf_init(dev, &tf); + tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; + tf.command = ATA_CMD_PACKET; + tf.protocol = ATAPI_PROT_PIO; +- tf.lbam = sizeof(buf); ++ tf.lbam = 16; + + ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE, +- buf, sizeof(buf), 0); +- if (ret) ++ buf, 16, 0); ++ if (ret) { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + +- if (be16_to_cpu(desc->feature_code) != 3) ++ if (be16_to_cpu(desc->feature_code) != 3) { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + +- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) ++ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) { ++ kfree(buf); + return ODD_MECH_TYPE_SLOT; +- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1) ++ } else if (desc->mech_type == 1 && desc->load == 0 && ++ desc->eject == 1) { ++ kfree(buf); + return ODD_MECH_TYPE_DRAWER; +- else ++ } else { ++ kfree(buf); + return ODD_MECH_TYPE_UNSUPPORTED; ++ } + } + + /* Test if ODD is zero power ready by sense code */ +-- +2.19.1 + diff --git a/queue-4.4/net-ethernet-ti-fix-possible-object-reference-leak.patch b/queue-4.4/net-ethernet-ti-fix-possible-object-reference-leak.patch new file mode 100644 index 00000000000..6ca5266c0e1 --- /dev/null +++ b/queue-4.4/net-ethernet-ti-fix-possible-object-reference-leak.patch @@ -0,0 +1,53 @@ +From b3b3e5157a5c38ea5b9c3501951ad36affe4e3e3 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Fri, 22 Mar 2019 11:04:09 +0800 +Subject: net: ethernet: ti: fix possible object reference leak + +[ Upstream commit 75eac7b5f68b0a0671e795ac636457ee27cc11d8 ] + +The call to of_get_child_by_name returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +./drivers/net/ethernet/ti/netcp_ethss.c:3661:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function. +./drivers/net/ethernet/ti/netcp_ethss.c:3665:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3654, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Cc: Wingman Kwok +Cc: Murali Karicheri +Cc: "David S. Miller" +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/ti/netcp_ethss.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ti/netcp_ethss.c b/drivers/net/ethernet/ti/netcp_ethss.c +index 4e70e7586a09..a5732edc8437 100644 +--- a/drivers/net/ethernet/ti/netcp_ethss.c ++++ b/drivers/net/ethernet/ti/netcp_ethss.c +@@ -3122,12 +3122,16 @@ static int gbe_probe(struct netcp_device *netcp_device, struct device *dev, + + ret = netcp_txpipe_init(&gbe_dev->tx_pipe, netcp_device, + gbe_dev->dma_chan_name, gbe_dev->tx_queue_id); +- if (ret) ++ if (ret) { ++ of_node_put(interfaces); + return ret; ++ } + + ret = netcp_txpipe_open(&gbe_dev->tx_pipe); +- if (ret) ++ if (ret) { ++ of_node_put(interfaces); + return ret; ++ } + + /* Create network interfaces */ + INIT_LIST_HEAD(&gbe_dev->gbe_intf_head); +-- +2.19.1 + diff --git a/queue-4.4/net-ibm-fix-possible-object-reference-leak.patch b/queue-4.4/net-ibm-fix-possible-object-reference-leak.patch new file mode 100644 index 00000000000..0a6c090d376 --- /dev/null +++ b/queue-4.4/net-ibm-fix-possible-object-reference-leak.patch @@ -0,0 +1,40 @@ +From 2e308cb67ad38c2e320fbba5bbcdbe35f82de92c Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Fri, 22 Mar 2019 11:04:08 +0800 +Subject: net: ibm: fix possible object reference leak + +[ Upstream commit be693df3cf9dd113ff1d2c0d8150199efdba37f6 ] + +The call to ehea_get_eth_dn returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +./drivers/net/ethernet/ibm/ehea/ehea_main.c:3163:2-8: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 3154, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Cc: Douglas Miller +Cc: "David S. Miller" +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 2a0dc127df3f..1a56de06b014 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -3183,6 +3183,7 @@ static ssize_t ehea_probe_port(struct device *dev, + + if (ehea_add_adapter_mr(adapter)) { + pr_err("creating MR failed\n"); ++ of_node_put(eth_dn); + return -EIO; + } + +-- +2.19.1 + diff --git a/queue-4.4/net-ks8851-delay-requesting-irq-until-opened.patch b/queue-4.4/net-ks8851-delay-requesting-irq-until-opened.patch new file mode 100644 index 00000000000..07a67340433 --- /dev/null +++ b/queue-4.4/net-ks8851-delay-requesting-irq-until-opened.patch @@ -0,0 +1,94 @@ +From d063da3d5d6be8ac9b5d3e8eee812616f05608f5 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 20 Mar 2019 15:02:00 +0100 +Subject: net: ks8851: Delay requesting IRQ until opened + +[ Upstream commit d268f31552794abf5b6aa5af31021643411f25f5 ] + +The ks8851 driver currently requests the IRQ before registering the +net_device. Because the net_device name is used as IRQ name and is +still "eth%d" when the IRQ is requested, it's impossibe to tell IRQs +apart if multiple ks8851 chips are present. Most other drivers delay +requesting the IRQ until the net_device is opened. Do the same. + +The driver doesn't enable interrupts on the chip before opening the +net_device and disables them when closing it, so there doesn't seem to +be a need to request the IRQ already on probe. + +Signed-off-by: Lukas Wunner +Cc: Frank Pavlic +Cc: Ben Dooks +Cc: Tristram Ha +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/micrel/ks8851.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c +index a8c5641ff955..ff6cab4f6343 100644 +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -797,6 +797,15 @@ static void ks8851_tx_work(struct work_struct *work) + static int ks8851_net_open(struct net_device *dev) + { + struct ks8851_net *ks = netdev_priv(dev); ++ int ret; ++ ++ ret = request_threaded_irq(dev->irq, NULL, ks8851_irq, ++ IRQF_TRIGGER_LOW | IRQF_ONESHOT, ++ dev->name, ks); ++ if (ret < 0) { ++ netdev_err(dev, "failed to get irq\n"); ++ return ret; ++ } + + /* lock the card, even if we may not actually be doing anything + * else at the moment */ +@@ -911,6 +920,8 @@ static int ks8851_net_stop(struct net_device *dev) + dev_kfree_skb(txb); + } + ++ free_irq(dev->irq, ks); ++ + return 0; + } + +@@ -1542,14 +1553,6 @@ static int ks8851_probe(struct spi_device *spi) + ks8851_read_selftest(ks); + ks8851_init_mac(ks); + +- ret = request_threaded_irq(spi->irq, NULL, ks8851_irq, +- IRQF_TRIGGER_LOW | IRQF_ONESHOT, +- ndev->name, ks); +- if (ret < 0) { +- dev_err(&spi->dev, "failed to get irq\n"); +- goto err_irq; +- } +- + ret = register_netdev(ndev); + if (ret) { + dev_err(&spi->dev, "failed to register network device\n"); +@@ -1562,11 +1565,7 @@ static int ks8851_probe(struct spi_device *spi) + + return 0; + +- + err_netdev: +- free_irq(ndev->irq, ks); +- +-err_irq: + err_id: + if (gpio_is_valid(gpio)) + gpio_set_value(gpio, 0); +@@ -1587,7 +1586,6 @@ static int ks8851_remove(struct spi_device *spi) + dev_info(&spi->dev, "remove\n"); + + unregister_netdev(priv->netdev); +- free_irq(spi->irq, priv); + if (gpio_is_valid(priv->gpio)) + gpio_set_value(priv->gpio, 0); + regulator_disable(priv->vdd_reg); +-- +2.19.1 + diff --git a/queue-4.4/net-ks8851-dequeue-rx-packets-explicitly.patch b/queue-4.4/net-ks8851-dequeue-rx-packets-explicitly.patch new file mode 100644 index 00000000000..bc278a3f204 --- /dev/null +++ b/queue-4.4/net-ks8851-dequeue-rx-packets-explicitly.patch @@ -0,0 +1,76 @@ +From 56d7bd1a67e3aadec779b9e4b444fd367c1e83e0 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 20 Mar 2019 15:02:00 +0100 +Subject: net: ks8851: Dequeue RX packets explicitly + +[ Upstream commit 536d3680fd2dab5c39857d62a3e084198fc74ff9 ] + +The ks8851 driver lets the chip auto-dequeue received packets once they +have been read in full. It achieves that by setting the ADRFE flag in +the RXQCR register ("Auto-Dequeue RXQ Frame Enable"). + +However if allocation of a packet's socket buffer or retrieval of the +packet over the SPI bus fails, the packet will not have been read in +full and is not auto-dequeued. Such partial retrieval of a packet +confuses the chip's RX queue management: On the next RX interrupt, +the first packet read from the queue will be the one left there +previously and this one can be retrieved without issues. But for any +newly received packets, the frame header status and byte count registers +(RXFHSR and RXFHBCR) contain bogus values, preventing their retrieval. + +The chip allows explicitly dequeueing a packet from the RX queue by +setting the RRXEF flag in the RXQCR register ("Release RX Error Frame"). +This could be used to dequeue the packet in case of an error, but if +that error is a failed SPI transfer, it is unknown if the packet was +transferred in full and was auto-dequeued or if it was only transferred +in part and requires an explicit dequeue. The safest approach is thus +to always dequeue packets explicitly and forgo auto-dequeueing. + +Without this change, I've witnessed packet retrieval break completely +when an SPI DMA transfer fails, requiring a chip reset. Explicit +dequeueing magically fixes this and makes packet retrieval absolutely +robust for me. + +The chip's documentation suggests auto-dequeuing and uses the RRXEF +flag only to dequeue error frames which the driver doesn't want to +retrieve. But that seems to be a fair-weather approach. + +Signed-off-by: Lukas Wunner +Cc: Frank Pavlic +Cc: Ben Dooks +Cc: Tristram Ha +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/micrel/ks8851.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c +index 1edc973df4c4..247a3377b951 100644 +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -547,9 +547,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) + /* set dma read address */ + ks8851_wrreg16(ks, KS_RXFDPR, RXFDPR_RXFPAI | 0x00); + +- /* start the packet dma process, and set auto-dequeue rx */ +- ks8851_wrreg16(ks, KS_RXQCR, +- ks->rc_rxqcr | RXQCR_SDA | RXQCR_ADRFE); ++ /* start DMA access */ ++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); + + if (rxlen > 4) { + unsigned int rxalign; +@@ -580,7 +579,8 @@ static void ks8851_rx_pkts(struct ks8851_net *ks) + } + } + +- ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr); ++ /* end DMA access and dequeue packet */ ++ ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_RRXEF); + } + } + +-- +2.19.1 + diff --git a/queue-4.4/net-ks8851-reassert-reset-pin-if-chip-id-check-fails.patch b/queue-4.4/net-ks8851-reassert-reset-pin-if-chip-id-check-fails.patch new file mode 100644 index 00000000000..492f72c4f3b --- /dev/null +++ b/queue-4.4/net-ks8851-reassert-reset-pin-if-chip-id-check-fails.patch @@ -0,0 +1,45 @@ +From 988c0a6135260e97da4b1eefb1bd7b32341a7dad Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 20 Mar 2019 15:02:00 +0100 +Subject: net: ks8851: Reassert reset pin if chip ID check fails + +[ Upstream commit 761cfa979a0c177d6c2d93ef5585cd79ae49a7d5 ] + +Commit 73fdeb82e963 ("net: ks8851: Add optional vdd_io regulator and +reset gpio") amended the ks8851 driver to briefly assert the chip's +reset pin on probe. It also amended the probe routine's error path to +reassert the reset pin if a subsequent initialization step fails. + +However the commit misplaced reassertion of the reset pin in the error +path such that it is not performed if the check of the Chip ID and +Enable Register (CIDER) fails. The error path is therefore slightly +asymmetrical to the probe routine's body. Fix it. + +Signed-off-by: Lukas Wunner +Cc: Frank Pavlic +Cc: Stephen Boyd +Cc: Nishanth Menon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/micrel/ks8851.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c +index 247a3377b951..a8c5641ff955 100644 +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -1567,9 +1567,9 @@ static int ks8851_probe(struct spi_device *spi) + free_irq(ndev->irq, ks); + + err_irq: ++err_id: + if (gpio_is_valid(gpio)) + gpio_set_value(gpio, 0); +-err_id: + regulator_disable(ks->vdd_reg); + err_reg: + regulator_disable(ks->vdd_io); +-- +2.19.1 + diff --git a/queue-4.4/net-ks8851-set-initial-carrier-state-to-down.patch b/queue-4.4/net-ks8851-set-initial-carrier-state-to-down.patch new file mode 100644 index 00000000000..82c503b7fbd --- /dev/null +++ b/queue-4.4/net-ks8851-set-initial-carrier-state-to-down.patch @@ -0,0 +1,54 @@ +From 531de818fccb2b5064ee33e80b2058034541fe1a Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Wed, 20 Mar 2019 15:02:00 +0100 +Subject: net: ks8851: Set initial carrier state to down + +[ Upstream commit 9624bafa5f6418b9ca5b3f66d1f6a6a2e8bf6d4c ] + +The ks8851 chip's initial carrier state is down. A Link Change Interrupt +is signaled once interrupts are enabled if the carrier is up. + +The ks8851 driver has it backwards by assuming that the initial carrier +state is up. The state is therefore misrepresented if the interface is +opened with no cable attached. Fix it. + +The Link Change interrupt is sometimes not signaled unless the P1MBSR +register (which contains the Link Status bit) is read on ->ndo_open(). +This might be a hardware erratum. Read the register by calling +mii_check_link(), which has the desirable side effect of setting the +carrier state to down if the cable was detached while the interface was +closed. + +Signed-off-by: Lukas Wunner +Cc: Frank Pavlic +Cc: Ben Dooks +Cc: Tristram Ha +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/micrel/ks8851.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c +index ff6cab4f6343..7377dca6eb57 100644 +--- a/drivers/net/ethernet/micrel/ks8851.c ++++ b/drivers/net/ethernet/micrel/ks8851.c +@@ -870,6 +870,7 @@ static int ks8851_net_open(struct net_device *dev) + netif_dbg(ks, ifup, ks->netdev, "network device up\n"); + + mutex_unlock(&ks->lock); ++ mii_check_link(&ks->mii); + return 0; + } + +@@ -1527,6 +1528,7 @@ static int ks8851_probe(struct spi_device *spi) + + spi_set_drvdata(spi, ks); + ++ netif_carrier_off(ks->netdev); + ndev->if_port = IF_PORT_100BASET; + ndev->netdev_ops = &ks8851_netdev_ops; + ndev->irq = spi->irq; +-- +2.19.1 + diff --git a/queue-4.4/net-xilinx-fix-possible-object-reference-leak.patch b/queue-4.4/net-xilinx-fix-possible-object-reference-leak.patch new file mode 100644 index 00000000000..988ce735370 --- /dev/null +++ b/queue-4.4/net-xilinx-fix-possible-object-reference-leak.patch @@ -0,0 +1,50 @@ +From 4e43b618f5c7018764bfaf79a3b8166d991eb510 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Fri, 22 Mar 2019 11:04:07 +0800 +Subject: net: xilinx: fix possible object reference leak + +[ Upstream commit fa3a419d2f674b431d38748cb58fb7da17ee8949 ] + +The call to of_parse_phandle returns a node pointer with refcount +incremented thus it must be explicitly decremented after the last +usage. + +Detected by coccinelle with the following warnings: +./drivers/net/ethernet/xilinx/xilinx_axienet_main.c:1624:1-7: ERROR: missing of_node_put; acquired a node pointer with refcount incremented on line 1569, but without a corresponding object release within this function. + +Signed-off-by: Wen Yang +Cc: Anirudha Sarangi +Cc: John Linn +Cc: "David S. Miller" +Cc: Michal Simek +Cc: netdev@vger.kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 4684644703cc..58ba579793f8 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1595,12 +1595,14 @@ static int axienet_probe(struct platform_device *pdev) + ret = of_address_to_resource(np, 0, &dmares); + if (ret) { + dev_err(&pdev->dev, "unable to get DMA resource\n"); ++ of_node_put(np); + goto free_netdev; + } + lp->dma_regs = devm_ioremap_resource(&pdev->dev, &dmares); + if (IS_ERR(lp->dma_regs)) { + dev_err(&pdev->dev, "could not map DMA regs\n"); + ret = PTR_ERR(lp->dma_regs); ++ of_node_put(np); + goto free_netdev; + } + lp->rx_irq = irq_of_parse_and_map(np, 1); +-- +2.19.1 + diff --git a/queue-4.4/netfilter-bridge-set-skb-transport_header-before-ent.patch b/queue-4.4/netfilter-bridge-set-skb-transport_header-before-ent.patch new file mode 100644 index 00000000000..574a7a34817 --- /dev/null +++ b/queue-4.4/netfilter-bridge-set-skb-transport_header-before-ent.patch @@ -0,0 +1,57 @@ +From ea901f2c717db7178042a2e592186ee1df0a8b23 Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Wed, 13 Mar 2019 16:33:29 +0800 +Subject: netfilter: bridge: set skb transport_header before entering + NF_INET_PRE_ROUTING + +[ Upstream commit e166e4fdaced850bee3d5ee12a5740258fb30587 ] + +Since Commit 21d1196a35f5 ("ipv4: set transport header earlier"), +skb->transport_header has been always set before entering INET +netfilter. This patch is to set skb->transport_header for bridge +before entering INET netfilter by bridge-nf-call-iptables. + +It also fixes an issue that sctp_error() couldn't compute a right +csum due to unset skb->transport_header. + +Fixes: e6d8b64b34aa ("net: sctp: fix and consolidate SCTP checksumming code") +Reported-by: Li Shuang +Suggested-by: Pablo Neira Ayuso +Signed-off-by: Xin Long +Acked-by: Neil Horman +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin (Microsoft) +--- + net/bridge/br_netfilter_hooks.c | 1 + + net/bridge/br_netfilter_ipv6.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 93b5525bcccf..2ae0451fd634 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -507,6 +507,7 @@ static unsigned int br_nf_pre_routing(void *priv, + nf_bridge->ipv4_daddr = ip_hdr(skb)->daddr; + + skb->protocol = htons(ETH_P_IP); ++ skb->transport_header = skb->network_header + ip_hdr(skb)->ihl * 4; + + NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, state->net, state->sk, skb, + skb->dev, NULL, +diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c +index 69dfd212e50d..f94c83f5cc37 100644 +--- a/net/bridge/br_netfilter_ipv6.c ++++ b/net/bridge/br_netfilter_ipv6.c +@@ -237,6 +237,8 @@ unsigned int br_nf_pre_routing_ipv6(void *priv, + nf_bridge->ipv6_daddr = ipv6_hdr(skb)->daddr; + + skb->protocol = htons(ETH_P_IPV6); ++ skb->transport_header = skb->network_header + sizeof(struct ipv6hdr); ++ + NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, state->net, state->sk, skb, + skb->dev, NULL, + br_nf_pre_routing_finish_ipv6); +-- +2.19.1 + diff --git a/queue-4.4/qlcnic-avoid-potential-null-pointer-dereference.patch b/queue-4.4/qlcnic-avoid-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..865ea795303 --- /dev/null +++ b/queue-4.4/qlcnic-avoid-potential-null-pointer-dereference.patch @@ -0,0 +1,33 @@ +From 10a24ff36c9d74998d396b864a00e5293e90b53d Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Thu, 14 Mar 2019 15:31:40 -0500 +Subject: qlcnic: Avoid potential NULL pointer dereference + +[ Upstream commit 5bf7295fe34a5251b1d241b9736af4697b590670 ] + +netdev_alloc_skb can fail and return a NULL pointer which is +dereferenced without a check. The patch avoids such a scenario. + +Signed-off-by: Aditya Pakki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index 0a2318cad34d..63ebc491057b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -1038,6 +1038,8 @@ int qlcnic_do_lb_test(struct qlcnic_adapter *adapter, u8 mode) + + for (i = 0; i < QLCNIC_NUM_ILB_PKT; i++) { + skb = netdev_alloc_skb(adapter->netdev, QLCNIC_ILB_PKT_SIZE); ++ if (!skb) ++ break; + qlcnic_create_loopback_buff(skb->data, adapter->mac_addr); + skb_put(skb, QLCNIC_ILB_PKT_SIZE); + adapter->ahw->diag_cnt = 0; +-- +2.19.1 + diff --git a/queue-4.4/sc16is7xx-missing-unregister-delete-driver-on-error-.patch b/queue-4.4/sc16is7xx-missing-unregister-delete-driver-on-error-.patch new file mode 100644 index 00000000000..bdc2fb4fda7 --- /dev/null +++ b/queue-4.4/sc16is7xx-missing-unregister-delete-driver-on-error-.patch @@ -0,0 +1,55 @@ +From eee2c6316c5a769cb3d0ea6f877fe9b2b76bbf50 Mon Sep 17 00:00:00 2001 +From: Mao Wenan +Date: Fri, 8 Mar 2019 22:08:31 +0800 +Subject: sc16is7xx: missing unregister/delete driver on error in + sc16is7xx_init() + +[ Upstream commit ac0cdb3d990108df795b676cd0d0e65ac34b2273 ] + +Add the missing uart_unregister_driver() and i2c_del_driver() before return +from sc16is7xx_init() in the error handling case. + +Signed-off-by: Mao Wenan +Reviewed-by: Vladimir Zapolskiy +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/tty/serial/sc16is7xx.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index 17a22073d226..032f3c13b8c4 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -1448,7 +1448,7 @@ static int __init sc16is7xx_init(void) + ret = i2c_add_driver(&sc16is7xx_i2c_uart_driver); + if (ret < 0) { + pr_err("failed to init sc16is7xx i2c --> %d\n", ret); +- return ret; ++ goto err_i2c; + } + #endif + +@@ -1456,10 +1456,18 @@ static int __init sc16is7xx_init(void) + ret = spi_register_driver(&sc16is7xx_spi_uart_driver); + if (ret < 0) { + pr_err("failed to init sc16is7xx spi --> %d\n", ret); +- return ret; ++ goto err_spi; + } + #endif + return ret; ++ ++err_spi: ++#ifdef CONFIG_SERIAL_SC16IS7XX_I2C ++ i2c_del_driver(&sc16is7xx_i2c_uart_driver); ++#endif ++err_i2c: ++ uart_unregister_driver(&sc16is7xx_uart); ++ return ret; + } + module_init(sc16is7xx_init); + +-- +2.19.1 + diff --git a/queue-4.4/scsi-qla4xxx-fix-a-potential-null-pointer-dereferenc.patch b/queue-4.4/scsi-qla4xxx-fix-a-potential-null-pointer-dereferenc.patch new file mode 100644 index 00000000000..f679261fdf2 --- /dev/null +++ b/queue-4.4/scsi-qla4xxx-fix-a-potential-null-pointer-dereferenc.patch @@ -0,0 +1,35 @@ +From 22ba4acc3cef0061d77cc01b18a82140b3d8c9f8 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Thu, 14 Mar 2019 01:30:59 -0500 +Subject: scsi: qla4xxx: fix a potential NULL pointer dereference + +[ Upstream commit fba1bdd2a9a93f3e2181ec1936a3c2f6b37e7ed6 ] + +In case iscsi_lookup_endpoint fails, the fix returns -EINVAL to avoid NULL +pointer dereference. + +Signed-off-by: Kangjie Lu +Acked-by: Manish Rangankar +Reviewed-by: Mukesh Ojha +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/scsi/qla4xxx/ql4_os.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index f9f899ec9427..c158967b59d7 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -3207,6 +3207,8 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session, + if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) + return -EINVAL; + ep = iscsi_lookup_endpoint(transport_fd); ++ if (!ep) ++ return -EINVAL; + conn = cls_conn->dd_data; + qla_conn = conn->dd_data; + qla_conn->qla_ep = ep->dd_data; +-- +2.19.1 + diff --git a/queue-4.4/scsi-zfcp-reduce-flood-of-fcrscn1-trace-records-on-m.patch b/queue-4.4/scsi-zfcp-reduce-flood-of-fcrscn1-trace-records-on-m.patch new file mode 100644 index 00000000000..e3a13c3e5bf --- /dev/null +++ b/queue-4.4/scsi-zfcp-reduce-flood-of-fcrscn1-trace-records-on-m.patch @@ -0,0 +1,112 @@ +From e925cd8562c1fbe85603d18b49cd08e76a7f95bc Mon Sep 17 00:00:00 2001 +From: Steffen Maier +Date: Tue, 26 Mar 2019 14:37:00 +0100 +Subject: scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element + RSCN + +[ Upstream commit c8206579175c34a2546de8a74262456278a7795a ] + +If an incoming ELS of type RSCN contains more than one element, zfcp +suboptimally causes repeated erp trigger NOP trace records for each +previously failed port. These could be ports that went away. It loops over +each RSCN element, and for each of those in an inner loop over all +zfcp_ports. + +The trigger to recover failed ports should be just the reception of some +RSCN, no matter how many elements it has. So we can loop over failed ports +separately, and only then loop over each RSCN element to handle the +non-failed ports. + +The call chain was: + + zfcp_fc_incoming_rscn + for (i = 1; i < no_entries; i++) + _zfcp_fc_incoming_rscn + list_for_each_entry(port, &adapter->port_list, list) + if (masked port->d_id match) zfcp_fc_test_link + if (!port->d_id) zfcp_erp_port_reopen "fcrscn1" <=== + +In order the reduce the "flooding" of the REC trace area in such cases, we +factor out handling the failed ports to be outside of the entries loop: + + zfcp_fc_incoming_rscn + if (no_entries > 1) <=== + list_for_each_entry(port, &adapter->port_list, list) <=== + if (!port->d_id) zfcp_erp_port_reopen "fcrscn1" <=== + for (i = 1; i < no_entries; i++) + _zfcp_fc_incoming_rscn + list_for_each_entry(port, &adapter->port_list, list) + if (masked port->d_id match) zfcp_fc_test_link + +Abbreviated example trace records before this code change: + +Tag : fcrscn1 +WWPN : 0x500507630310d327 +ERP want : 0x02 +ERP need : 0x02 + +Tag : fcrscn1 +WWPN : 0x500507630310d327 +ERP want : 0x02 +ERP need : 0x00 NOP => superfluous trace record + +The last trace entry repeats if there are more than 2 RSCN elements. + +Signed-off-by: Steffen Maier +Reviewed-by: Benjamin Block +Reviewed-by: Jens Remus +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/s390/scsi/zfcp_fc.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c +index 237688af179b..f7630cf581cd 100644 +--- a/drivers/s390/scsi/zfcp_fc.c ++++ b/drivers/s390/scsi/zfcp_fc.c +@@ -238,10 +238,6 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, + list_for_each_entry(port, &adapter->port_list, list) { + if ((port->d_id & range) == (ntoh24(page->rscn_fid) & range)) + zfcp_fc_test_link(port); +- if (!port->d_id) +- zfcp_erp_port_reopen(port, +- ZFCP_STATUS_COMMON_ERP_FAILED, +- "fcrscn1"); + } + read_unlock_irqrestore(&adapter->port_list_lock, flags); + } +@@ -249,6 +245,7 @@ static void _zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req, u32 range, + static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) + { + struct fsf_status_read_buffer *status_buffer = (void *)fsf_req->data; ++ struct zfcp_adapter *adapter = fsf_req->adapter; + struct fc_els_rscn *head; + struct fc_els_rscn_page *page; + u16 i; +@@ -261,6 +258,22 @@ static void zfcp_fc_incoming_rscn(struct zfcp_fsf_req *fsf_req) + /* see FC-FS */ + no_entries = head->rscn_plen / sizeof(struct fc_els_rscn_page); + ++ if (no_entries > 1) { ++ /* handle failed ports */ ++ unsigned long flags; ++ struct zfcp_port *port; ++ ++ read_lock_irqsave(&adapter->port_list_lock, flags); ++ list_for_each_entry(port, &adapter->port_list, list) { ++ if (port->d_id) ++ continue; ++ zfcp_erp_port_reopen(port, ++ ZFCP_STATUS_COMMON_ERP_FAILED, ++ "fcrscn1"); ++ } ++ read_unlock_irqrestore(&adapter->port_list_lock, flags); ++ } ++ + for (i = 1; i < no_entries; i++) { + /* skip head and start with 1st element */ + page++; +-- +2.19.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 028e3c867a1..37f0c93f9ec 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -86,3 +86,23 @@ powerpc-fsl-add-fsl_ppc_book3e-as-supported-arch-for-nospectre_v2-boot-arg.patch documentation-add-nospectre_v1-parameter.patch usbnet-ipheth-prevent-tx-queue-timeouts-when-device-not-ready.patch usbnet-ipheth-fix-potential-null-pointer-dereference-in-ipheth_carrier_set.patch +qlcnic-avoid-potential-null-pointer-dereference.patch +netfilter-bridge-set-skb-transport_header-before-ent.patch +sc16is7xx-missing-unregister-delete-driver-on-error-.patch +usb-gadget-net2280-fix-overrun-of-out-messages.patch +usb-gadget-net2280-fix-net2280_dequeue.patch +usb-gadget-net2272-fix-net2272_dequeue.patch +arm-dts-pfla02-increase-phy-reset-duration.patch +net-ks8851-dequeue-rx-packets-explicitly.patch +net-ks8851-reassert-reset-pin-if-chip-id-check-fails.patch +net-ks8851-delay-requesting-irq-until-opened.patch +net-ks8851-set-initial-carrier-state-to-down.patch +net-xilinx-fix-possible-object-reference-leak.patch +net-ibm-fix-possible-object-reference-leak.patch +net-ethernet-ti-fix-possible-object-reference-leak.patch +scsi-qla4xxx-fix-a-potential-null-pointer-dereferenc.patch +usb-u132-hcd-fix-resource-leak.patch +ceph-fix-use-after-free-on-symlink-traversal.patch +scsi-zfcp-reduce-flood-of-fcrscn1-trace-records-on-m.patch +libata-fix-using-dma-buffers-on-stack.patch +kconfig-mn-conf-handle-backspace-h-key.patch diff --git a/queue-4.4/usb-gadget-net2272-fix-net2272_dequeue.patch b/queue-4.4/usb-gadget-net2272-fix-net2272_dequeue.patch new file mode 100644 index 00000000000..fef47eadb44 --- /dev/null +++ b/queue-4.4/usb-gadget-net2272-fix-net2272_dequeue.patch @@ -0,0 +1,41 @@ +From 7adf2316b536a8827fe3880f48c5432d8fe731f2 Mon Sep 17 00:00:00 2001 +From: Guido Kiener +Date: Mon, 18 Mar 2019 09:18:34 +0100 +Subject: usb: gadget: net2272: Fix net2272_dequeue() + +[ Upstream commit 091dacc3cc10979ab0422f0a9f7fcc27eee97e69 ] + +Restore the status of ep->stopped in function net2272_dequeue(). + +When the given request is not found in the endpoint queue +the function returns -EINVAL without restoring the state of +ep->stopped. Thus the endpoint keeps blocked and does not transfer +any data anymore. + +This fix is only compile-tested, since we do not have a +corresponding hardware. An analogous fix was tested in the sibling +driver. See "usb: gadget: net2280: Fix net2280_dequeue()" + +Acked-by: Alan Stern +Signed-off-by: Guido Kiener +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/usb/gadget/udc/net2272.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/udc/net2272.c b/drivers/usb/gadget/udc/net2272.c +index 3b6e34fc032b..553922c3be85 100644 +--- a/drivers/usb/gadget/udc/net2272.c ++++ b/drivers/usb/gadget/udc/net2272.c +@@ -962,6 +962,7 @@ net2272_dequeue(struct usb_ep *_ep, struct usb_request *_req) + break; + } + if (&req->req != _req) { ++ ep->stopped = stopped; + spin_unlock_irqrestore(&ep->dev->lock, flags); + return -EINVAL; + } +-- +2.19.1 + diff --git a/queue-4.4/usb-gadget-net2280-fix-net2280_dequeue.patch b/queue-4.4/usb-gadget-net2280-fix-net2280_dequeue.patch new file mode 100644 index 00000000000..88c976f68b2 --- /dev/null +++ b/queue-4.4/usb-gadget-net2280-fix-net2280_dequeue.patch @@ -0,0 +1,43 @@ +From 4cf28811e6cf47b324cf2b17e9e246bf63fd38ee Mon Sep 17 00:00:00 2001 +From: Guido Kiener +Date: Mon, 18 Mar 2019 09:18:33 +0100 +Subject: usb: gadget: net2280: Fix net2280_dequeue() + +[ Upstream commit f1d3fba17cd4eeea20397f1324b7b9c69a6a935c ] + +When a request must be dequeued with net2280_dequeue() e.g. due +to a device clear action and the same request is finished by the +function scan_dma_completions() then the function net2280_dequeue() +does not find the request in the following search loop and +returns the error -EINVAL without restoring the status ep->stopped. +Thus the endpoint keeps blocked and does not receive any data +anymore. +This fix restores the status and does not issue an error message. + +Acked-by: Alan Stern +Signed-off-by: Guido Kiener +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/usb/gadget/udc/net2280.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index fc94a09e2a5a..3a8d056a5d16 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1270,9 +1270,9 @@ static int net2280_dequeue(struct usb_ep *_ep, struct usb_request *_req) + break; + } + if (&req->req != _req) { ++ ep->stopped = stopped; + spin_unlock_irqrestore(&ep->dev->lock, flags); +- dev_err(&ep->dev->pdev->dev, "%s: Request mismatch\n", +- __func__); ++ ep_dbg(ep->dev, "%s: Request mismatch\n", __func__); + return -EINVAL; + } + +-- +2.19.1 + diff --git a/queue-4.4/usb-gadget-net2280-fix-overrun-of-out-messages.patch b/queue-4.4/usb-gadget-net2280-fix-overrun-of-out-messages.patch new file mode 100644 index 00000000000..99577e48ed1 --- /dev/null +++ b/queue-4.4/usb-gadget-net2280-fix-overrun-of-out-messages.patch @@ -0,0 +1,62 @@ +From 60ce7e2e2907db48c54cece62f828926d1da535a Mon Sep 17 00:00:00 2001 +From: Guido Kiener +Date: Tue, 19 Mar 2019 19:12:03 +0100 +Subject: usb: gadget: net2280: Fix overrun of OUT messages + +[ Upstream commit 9d6a54c1430647355a5e23434881b2ca3d192b48 ] + +The OUT endpoint normally blocks (NAK) subsequent packets when a +short packet was received and returns an incomplete queue entry to +the gadget driver. Thereby the gadget driver can detect a short packet +when reading queue entries with a length that is not equal to a +multiple of packet size. + +The start_queue() function enables receiving OUT packets regardless of +the content of the OUT FIFO. This results in a race: With the current +code, it's possible that the "!ep->is_in && (readl(&ep->regs->ep_stat) +& BIT(NAK_OUT_PACKETS))" test in start_dma() will fail, then a short +packet will be received, and then start_queue() will call +stop_out_naking(). That's what we don't want (OUT naking gets turned +off while there is data in the FIFO) because then the next driver +request might receive a mixture of old and new packets. + +With the patch, this race can't occur because the FIFO's state is +tested after we know that OUT naking is already turned on, and OUT +naking is stopped only when both of the conditions are met. This +ensures that all received data is delivered to the gadget driver, +which can detect a short packet now before new packets are appended +to the last short packet. + +Acked-by: Alan Stern +Signed-off-by: Guido Kiener +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/usb/gadget/udc/net2280.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index 8efeadf30b4d..fc94a09e2a5a 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -870,9 +870,6 @@ static void start_queue(struct net2280_ep *ep, u32 dmactl, u32 td_dma) + (void) readl(&ep->dev->pci->pcimstctl); + + writel(BIT(DMA_START), &dma->dmastat); +- +- if (!ep->is_in) +- stop_out_naking(ep); + } + + static void start_dma(struct net2280_ep *ep, struct net2280_request *req) +@@ -911,6 +908,7 @@ static void start_dma(struct net2280_ep *ep, struct net2280_request *req) + writel(BIT(DMA_START), &dma->dmastat); + return; + } ++ stop_out_naking(ep); + } + + tmp = dmactl_default; +-- +2.19.1 + diff --git a/queue-4.4/usb-u132-hcd-fix-resource-leak.patch b/queue-4.4/usb-u132-hcd-fix-resource-leak.patch new file mode 100644 index 00000000000..769a3c8c273 --- /dev/null +++ b/queue-4.4/usb-u132-hcd-fix-resource-leak.patch @@ -0,0 +1,34 @@ +From f0ef6b77f1d624c44976010f32287314ff6bf73a Mon Sep 17 00:00:00 2001 +From: Mukesh Ojha +Date: Tue, 26 Mar 2019 13:42:22 +0530 +Subject: usb: u132-hcd: fix resource leak + +[ Upstream commit f276e002793cdb820862e8ea8f76769d56bba575 ] + +if platform_driver_register fails, cleanup the allocated resource +gracefully. + +Signed-off-by: Mukesh Ojha +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin (Microsoft) +--- + drivers/usb/host/u132-hcd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index d5434e7a3b2e..86f9944f337d 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -3214,6 +3214,9 @@ static int __init u132_hcd_init(void) + printk(KERN_INFO "driver %s\n", hcd_name); + workqueue = create_singlethread_workqueue("u132"); + retval = platform_driver_register(&u132_platform_driver); ++ if (retval) ++ destroy_workqueue(workqueue); ++ + return retval; + } + +-- +2.19.1 +