From: Greg Kroah-Hartman Date: Fri, 25 Feb 2022 11:40:57 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.9.304~67 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e7ae35b89b0d112b58c9253f8367427566da04b9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: clk-jz4725b-fix-mmc0-clock-gating.patch parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch vhost-vsock-don-t-check-owner-in-vhost_vsock_stop-while-releasing.patch --- diff --git a/queue-5.4/clk-jz4725b-fix-mmc0-clock-gating.patch b/queue-5.4/clk-jz4725b-fix-mmc0-clock-gating.patch new file mode 100644 index 00000000000..2495141a765 --- /dev/null +++ b/queue-5.4/clk-jz4725b-fix-mmc0-clock-gating.patch @@ -0,0 +1,43 @@ +From 2f0754f27a230fee6e6d753f07585cee03bedfe3 Mon Sep 17 00:00:00 2001 +From: Siarhei Volkau +Date: Sat, 5 Feb 2022 20:18:49 +0300 +Subject: clk: jz4725b: fix mmc0 clock gating + +From: Siarhei Volkau + +commit 2f0754f27a230fee6e6d753f07585cee03bedfe3 upstream. + +The mmc0 clock gate bit was mistakenly assigned to "i2s" clock. +You can find that the same bit is assigned to "mmc0" too. +It leads to mmc0 hang for a long time after any sound activity +also it prevented PM_SLEEP to work properly. +I guess it was introduced by copy-paste from jz4740 driver +where it is really controls I2S clock gate. + +Fixes: 226dfa4726eb ("clk: Add Ingenic jz4725b CGU driver") +Signed-off-by: Siarhei Volkau +Tested-by: Siarhei Volkau +Reviewed-by: Paul Cercueil +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20220205171849.687805-2-lis8215@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/ingenic/jz4725b-cgu.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/clk/ingenic/jz4725b-cgu.c ++++ b/drivers/clk/ingenic/jz4725b-cgu.c +@@ -135,11 +135,10 @@ static const struct ingenic_cgu_clk_info + }, + + [JZ4725B_CLK_I2S] = { +- "i2s", CGU_CLK_MUX | CGU_CLK_DIV | CGU_CLK_GATE, ++ "i2s", CGU_CLK_MUX | CGU_CLK_DIV, + .parents = { JZ4725B_CLK_EXT, JZ4725B_CLK_PLL_HALF, -1, -1 }, + .mux = { CGU_REG_CPCCR, 31, 1 }, + .div = { CGU_REG_I2SCDR, 0, 1, 9, -1, -1, -1 }, +- .gate = { CGU_REG_CLKGR, 6 }, + }, + + [JZ4725B_CLK_SPI] = { diff --git a/queue-5.4/parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch b/queue-5.4/parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch new file mode 100644 index 00000000000..3676a1f860e --- /dev/null +++ b/queue-5.4/parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch @@ -0,0 +1,80 @@ +From dd2288f4a020d693360e3e8d72f8b9d9c25f5ef6 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 18 Feb 2022 09:25:20 +0100 +Subject: parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel + +From: Helge Deller + +commit dd2288f4a020d693360e3e8d72f8b9d9c25f5ef6 upstream. + +Usually the kernel provides fixup routines to emulate the fldd and fstd +floating-point instructions if they load or store 8-byte from/to a not +natuarally aligned memory location. + +On a 32-bit kernel I noticed that those unaligned handlers didn't worked and +instead the application got a SEGV. +While checking the code I found two problems: + +First, the OPCODE_FLDD_L and OPCODE_FSTD_L cases were ifdef'ed out by the +CONFIG_PA20 option, and as such those weren't built on a pure 32-bit kernel. +This is now fixed by moving the CONFIG_PA20 #ifdef to prevent the compilation +of OPCODE_LDD_L and OPCODE_FSTD_L only, and handling the fldd and fstd +instructions. + +The second problem are two bugs in the 32-bit inline assembly code, where the +wrong registers where used. The calculation of the natural alignment used %2 +(vall) instead of %3 (ior), and the first word was stored back to address %1 +(valh) instead of %3 (ior). + +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/kernel/unaligned.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/parisc/kernel/unaligned.c ++++ b/arch/parisc/kernel/unaligned.c +@@ -397,7 +397,7 @@ static int emulate_std(struct pt_regs *r + __asm__ __volatile__ ( + " mtsp %4, %%sr1\n" + " zdep %2, 29, 2, %%r19\n" +-" dep %%r0, 31, 2, %2\n" ++" dep %%r0, 31, 2, %3\n" + " mtsar %%r19\n" + " zvdepi -2, 32, %%r19\n" + "1: ldw 0(%%sr1,%3),%%r20\n" +@@ -409,7 +409,7 @@ static int emulate_std(struct pt_regs *r + " andcm %%r21, %%r19, %%r21\n" + " or %1, %%r20, %1\n" + " or %2, %%r21, %2\n" +-"3: stw %1,0(%%sr1,%1)\n" ++"3: stw %1,0(%%sr1,%3)\n" + "4: stw %%r1,4(%%sr1,%3)\n" + "5: stw %2,8(%%sr1,%3)\n" + " copy %%r0, %0\n" +@@ -596,7 +596,6 @@ void handle_unaligned(struct pt_regs *re + ret = ERR_NOTHANDLED; /* "undefined", but lets kill them. */ + break; + } +-#ifdef CONFIG_PA20 + switch (regs->iir & OPCODE2_MASK) + { + case OPCODE_FLDD_L: +@@ -607,14 +606,15 @@ void handle_unaligned(struct pt_regs *re + flop=1; + ret = emulate_std(regs, R2(regs->iir),1); + break; ++#ifdef CONFIG_PA20 + case OPCODE_LDD_L: + ret = emulate_ldd(regs, R2(regs->iir),0); + break; + case OPCODE_STD_L: + ret = emulate_std(regs, R2(regs->iir),0); + break; +- } + #endif ++ } + switch (regs->iir & OPCODE3_MASK) + { + case OPCODE_FLDW_L: diff --git a/queue-5.4/parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch b/queue-5.4/parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch new file mode 100644 index 00000000000..2681d446ec4 --- /dev/null +++ b/queue-5.4/parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch @@ -0,0 +1,49 @@ +From a97279836867b1cb50a3d4f0b1bf60e0abe6d46c Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 18 Feb 2022 23:40:14 +0100 +Subject: parisc/unaligned: Fix ldw() and stw() unalignment handlers + +From: Helge Deller + +commit a97279836867b1cb50a3d4f0b1bf60e0abe6d46c upstream. + +Fix 3 bugs: + +a) emulate_stw() doesn't return the error code value, so faulting +instructions are not reported and aborted. + +b) Tell emulate_ldw() to handle fldw_l as floating point instruction + +c) Tell emulate_ldw() to handle ldw_m as integer instruction + +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/kernel/unaligned.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/kernel/unaligned.c ++++ b/arch/parisc/kernel/unaligned.c +@@ -340,7 +340,7 @@ static int emulate_stw(struct pt_regs *r + : "r" (val), "r" (regs->ior), "r" (regs->isr) + : "r19", "r20", "r21", "r22", "r1", FIXUP_BRANCH_CLOBBER ); + +- return 0; ++ return ret; + } + static int emulate_std(struct pt_regs *regs, int frreg, int flop) + { +@@ -619,10 +619,10 @@ void handle_unaligned(struct pt_regs *re + { + case OPCODE_FLDW_L: + flop=1; +- ret = emulate_ldw(regs, R2(regs->iir),0); ++ ret = emulate_ldw(regs, R2(regs->iir), 1); + break; + case OPCODE_LDW_M: +- ret = emulate_ldw(regs, R2(regs->iir),1); ++ ret = emulate_ldw(regs, R2(regs->iir), 0); + break; + + case OPCODE_FSTW_L: diff --git a/queue-5.4/series b/queue-5.4/series index 5ac931fd893..91fdf2307cd 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,5 @@ cgroup-cpuset-fix-a-race-between-cpuset_attach-and-cpu-hotplug.patch +clk-jz4725b-fix-mmc0-clock-gating.patch +vhost-vsock-don-t-check-owner-in-vhost_vsock_stop-while-releasing.patch +parisc-unaligned-fix-fldd-and-fstd-unaligned-handlers-on-32-bit-kernel.patch +parisc-unaligned-fix-ldw-and-stw-unalignment-handlers.patch diff --git a/queue-5.4/vhost-vsock-don-t-check-owner-in-vhost_vsock_stop-while-releasing.patch b/queue-5.4/vhost-vsock-don-t-check-owner-in-vhost_vsock_stop-while-releasing.patch new file mode 100644 index 00000000000..bd267dba950 --- /dev/null +++ b/queue-5.4/vhost-vsock-don-t-check-owner-in-vhost_vsock_stop-while-releasing.patch @@ -0,0 +1,85 @@ +From a58da53ffd70294ebea8ecd0eb45fd0d74add9f9 Mon Sep 17 00:00:00 2001 +From: Stefano Garzarella +Date: Tue, 22 Feb 2022 10:47:42 +0100 +Subject: vhost/vsock: don't check owner in vhost_vsock_stop() while releasing + +From: Stefano Garzarella + +commit a58da53ffd70294ebea8ecd0eb45fd0d74add9f9 upstream. + +vhost_vsock_stop() calls vhost_dev_check_owner() to check the device +ownership. It expects current->mm to be valid. + +vhost_vsock_stop() is also called by vhost_vsock_dev_release() when +the user has not done close(), so when we are in do_exit(). In this +case current->mm is invalid and we're releasing the device, so we +should clean it anyway. + +Let's check the owner only when vhost_vsock_stop() is called +by an ioctl. + +When invoked from release we can not fail so we don't check return +code of vhost_vsock_stop(). We need to stop vsock even if it's not +the owner. + +Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko") +Cc: stable@vger.kernel.org +Reported-by: syzbot+1e3ea63db39f2b4440e0@syzkaller.appspotmail.com +Reported-and-tested-by: syzbot+3140b17cb44a7b174008@syzkaller.appspotmail.com +Signed-off-by: Stefano Garzarella +Acked-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vhost/vsock.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -570,16 +570,18 @@ err: + return ret; + } + +-static int vhost_vsock_stop(struct vhost_vsock *vsock) ++static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) + { + size_t i; +- int ret; ++ int ret = 0; + + mutex_lock(&vsock->dev.mutex); + +- ret = vhost_dev_check_owner(&vsock->dev); +- if (ret) +- goto err; ++ if (check_owner) { ++ ret = vhost_dev_check_owner(&vsock->dev); ++ if (ret) ++ goto err; ++ } + + for (i = 0; i < ARRAY_SIZE(vsock->vqs); i++) { + struct vhost_virtqueue *vq = &vsock->vqs[i]; +@@ -694,7 +696,12 @@ static int vhost_vsock_dev_release(struc + * inefficient. Room for improvement here. */ + vsock_for_each_connected_socket(vhost_vsock_reset_orphans); + +- vhost_vsock_stop(vsock); ++ /* Don't check the owner, because we are in the release path, so we ++ * need to stop the vsock device in any case. ++ * vhost_vsock_stop() can not fail in this case, so we don't need to ++ * check the return code. ++ */ ++ vhost_vsock_stop(vsock, false); + vhost_vsock_flush(vsock); + vhost_dev_stop(&vsock->dev); + +@@ -792,7 +799,7 @@ static long vhost_vsock_dev_ioctl(struct + if (start) + return vhost_vsock_start(vsock); + else +- return vhost_vsock_stop(vsock); ++ return vhost_vsock_stop(vsock, true); + case VHOST_GET_FEATURES: + features = VHOST_VSOCK_FEATURES; + if (copy_to_user(argp, &features, sizeof(features)))