From: Sasha Levin Date: Fri, 11 Jun 2021 02:13:09 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.273~57 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fd2db62accbc55c5049a70ade6f753347bac78b7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch b/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch new file mode 100644 index 00000000000..bfad6ac4bbd --- /dev/null +++ b/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch @@ -0,0 +1,47 @@ +From 572c0bcde70d1e5190e77f568807e4db79f55314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:45 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet + +From: Hans de Goede + +[ Upstream commit 28c268d3acdd4cbcd2ac320b85609e77f84e74a7 ] + +Add a quirk for the Glavey TM800A550L tablet, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210508150146.28403-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 4ebc023f1507..077529113ee7 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -565,6 +565,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Glavey TM800A550L */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS version */ ++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.30.2 + diff --git a/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch b/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch new file mode 100644 index 00000000000..571be155f1e --- /dev/null +++ b/queue-4.19/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch @@ -0,0 +1,49 @@ +From 3a48572189ebf8f695fbb3344376bdcfab7ac24e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:46 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet + +From: Hans de Goede + +[ Upstream commit f0353e1f53f92f7b3da91e6669f5d58ee222ebe8 ] + +The Lenovo Miix 3-830 tablet has only 1 speaker, has an internal analog +mic on IN1 and uses JD2 for jack-detect, add a quirk to automatically +apply these settings on Lenovo Miix 3-830 tablets. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210508150146.28403-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 077529113ee7..186c0ee059da 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -643,6 +643,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_MCLK_EN), + }, ++ { /* Lenovo Miix 3-830 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Linx Linx7 tablet */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"), +-- +2.30.2 + diff --git a/queue-4.19/asoc-sti-sas-add-missing-module_device_table.patch b/queue-4.19/asoc-sti-sas-add-missing-module_device_table.patch new file mode 100644 index 00000000000..2dc64a55eb0 --- /dev/null +++ b/queue-4.19/asoc-sti-sas-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 6be59233cbd765ac9ffa0aebd508a054ee0408a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:12:25 +0800 +Subject: ASoC: sti-sas: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1620789145-14936-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sti-sas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c +index 7316c80b8179..27196126f710 100644 +--- a/sound/soc/codecs/sti-sas.c ++++ b/sound/soc/codecs/sti-sas.c +@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, sti_sas_dev_match); + + static int sti_sas_driver_probe(struct platform_device *pdev) + { +-- +2.30.2 + diff --git a/queue-4.19/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch b/queue-4.19/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch new file mode 100644 index 00000000000..c28be71d985 --- /dev/null +++ b/queue-4.19/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch @@ -0,0 +1,41 @@ +From 55d4211748a3a47a734b0e3fb53080271726a191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 19:00:12 +0800 +Subject: bnx2x: Fix missing error code in bnx2x_iov_init_one() + +From: Jiapeng Chong + +[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ] + +Eliminate the follow smatch warning: + +drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227 +bnx2x_iov_init_one() warn: missing error code 'err'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index ab60f4f9cc24..77005f6366eb 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -1244,8 +1244,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, + goto failed; + + /* SR-IOV capability was enabled but there are no VFs*/ +- if (iov->total == 0) ++ if (iov->total == 0) { ++ err = -EINVAL; + goto failed; ++ } + + iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param); + +-- +2.30.2 + diff --git a/queue-4.19/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch b/queue-4.19/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch new file mode 100644 index 00000000000..b9af75e230c --- /dev/null +++ b/queue-4.19/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch @@ -0,0 +1,53 @@ +From bc6638154c68ca584d63c918f0883726205f9065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:13:35 +0200 +Subject: bonding: init notify_work earlier to avoid uninitialized use + +From: Johannes Berg + +[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ] + +If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail, +then we call kobject_put() on the slave->kobj. This in turn calls +the release function slave_kobj_release() which will always try to +cancel_delayed_work_sync(&slave->notify_work), which shouldn't be +done on an uninitialized work struct. + +Always initialize the work struct earlier to avoid problems here. + +Syzbot bisected this down to a completely pointless commit, some +fault injection may have been at work here that caused the alloc +failure in the first place, which may interact badly with bisect. + +Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Acked-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index c21c4291921f..c814b266af79 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1310,6 +1310,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + + slave->bond = bond; + slave->dev = slave_dev; ++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + if (bond_kobj_init(slave)) + return NULL; +@@ -1322,7 +1323,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + return NULL; + } + } +- INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + return slave; + } +-- +2.30.2 + diff --git a/queue-4.19/cgroup-disable-controllers-at-parse-time.patch b/queue-4.19/cgroup-disable-controllers-at-parse-time.patch new file mode 100644 index 00000000000..42da1676ce8 --- /dev/null +++ b/queue-4.19/cgroup-disable-controllers-at-parse-time.patch @@ -0,0 +1,75 @@ +From ff4bab94206a4784608c88cf5c6eb0bd95fd6c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 13:19:46 -0700 +Subject: cgroup: disable controllers at parse time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shakeel Butt + +[ Upstream commit 45e1ba40837ac2f6f4d4716bddb8d44bd7e4a251 ] + +This patch effectively reverts the commit a3e72739b7a7 ("cgroup: fix +too early usage of static_branch_disable()"). The commit 6041186a3258 +("init: initialize jump labels before command line option parsing") has +moved the jump_label_init() before parse_args() which has made the +commit a3e72739b7a7 unnecessary. On the other hand there are +consequences of disabling the controllers later as there are subsystems +doing the controller checks for different decisions. One such incident +is reported [1] regarding the memory controller and its impact on memory +reclaim code. + +[1] https://lore.kernel.org/linux-mm/921e53f3-4b13-aab8-4a9e-e83ff15371e4@nec.com + +Signed-off-by: Shakeel Butt +Reported-by: NOMURA JUNICHI(野村　淳一) +Signed-off-by: Tejun Heo +Tested-by: Jun'ichi Nomura +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 2a879d34bbe5..a74549693e7f 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -5347,8 +5347,6 @@ int __init cgroup_init_early(void) + return 0; + } + +-static u16 cgroup_disable_mask __initdata; +- + /** + * cgroup_init - cgroup initialization + * +@@ -5408,12 +5406,8 @@ int __init cgroup_init(void) + * disabled flag and cftype registration needs kmalloc, + * both of which aren't available during early_init. + */ +- if (cgroup_disable_mask & (1 << ssid)) { +- static_branch_disable(cgroup_subsys_enabled_key[ssid]); +- printk(KERN_INFO "Disabling %s control group subsystem\n", +- ss->name); ++ if (!cgroup_ssid_enabled(ssid)) + continue; +- } + + if (cgroup1_ssid_disabled(ssid)) + printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n", +@@ -5772,7 +5766,10 @@ static int __init cgroup_disable(char *str) + if (strcmp(token, ss->name) && + strcmp(token, ss->legacy_name)) + continue; +- cgroup_disable_mask |= 1 << i; ++ ++ static_branch_disable(cgroup_subsys_enabled_key[i]); ++ pr_info("Disabling %s control group subsystem\n", ++ ss->name); + } + } + return 1; +-- +2.30.2 + diff --git a/queue-4.19/i2c-mpc-implement-erratum-a-004447-workaround.patch b/queue-4.19/i2c-mpc-implement-erratum-a-004447-workaround.patch new file mode 100644 index 00000000000..c89ac0bbe03 --- /dev/null +++ b/queue-4.19/i2c-mpc-implement-erratum-a-004447-workaround.patch @@ -0,0 +1,148 @@ +From 408a211480471dc326a532d9b39313d3d0ed541d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:52 +1200 +Subject: i2c: mpc: implement erratum A-004447 workaround + +From: Chris Packham + +[ Upstream commit 8f0cdec8b5fd94135d643662506ee94ae9e98785 ] + +The P2040/P2041 has an erratum where the normal i2c recovery mechanism +does not work. Implement the alternative recovery mechanism documented +in the P2040 Chip Errata Rev Q. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++- + 1 file changed, 78 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index 6a0d55e9e8e3..af349661fd76 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -23,6 +23,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -49,6 +50,7 @@ + #define CCR_MTX 0x10 + #define CCR_TXAK 0x08 + #define CCR_RSTA 0x04 ++#define CCR_RSVD 0x02 + + #define CSR_MCF 0x80 + #define CSR_MAAS 0x40 +@@ -70,6 +72,7 @@ struct mpc_i2c { + u8 fdr, dfsrr; + #endif + struct clk *clk_per; ++ bool has_errata_A004447; + }; + + struct mpc_i2c_divider { +@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) + return 0; + } + ++static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask) ++{ ++ void __iomem *addr = i2c->base + MPC_I2C_SR; ++ u8 val; ++ ++ return readb_poll_timeout(addr, val, val & mask, 0, 100); ++} ++ ++/* ++ * Workaround for Erratum A004447. From the P2040CE Rev Q ++ * ++ * 1. Set up the frequency divider and sampling rate. ++ * 2. I2CCR - a0h ++ * 3. Poll for I2CSR[MBB] to get set. ++ * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to ++ * step 5. If MAL is not set, then go to step 13. ++ * 5. I2CCR - 00h ++ * 6. I2CCR - 22h ++ * 7. I2CCR - a2h ++ * 8. Poll for I2CSR[MBB] to get set. ++ * 9. Issue read to I2CDR. ++ * 10. Poll for I2CSR[MIF] to be set. ++ * 11. I2CCR - 82h ++ * 12. Workaround complete. Skip the next steps. ++ * 13. Issue read to I2CDR. ++ * 14. Poll for I2CSR[MIF] to be set. ++ * 15. I2CCR - 80h ++ */ ++static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c) ++{ ++ int ret; ++ u32 val; ++ ++ writeccr(i2c, CCR_MEN | CCR_MSTA); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ ++ val = readb(i2c->base + MPC_I2C_SR); ++ ++ if (val & CSR_MAL) { ++ writeccr(i2c, 0x00); ++ writeccr(i2c, CCR_MSTA | CCR_RSVD); ++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN | CCR_RSVD); ++ } else { ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN); ++ } ++} ++ + #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x) + static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = { + {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23}, +@@ -641,7 +713,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) + { + struct mpc_i2c *i2c = i2c_get_adapdata(adap); + +- mpc_i2c_fixup(i2c); ++ if (i2c->has_errata_A004447) ++ mpc_i2c_fixup_A004447(i2c); ++ else ++ mpc_i2c_fixup(i2c); + + return 0; + } +@@ -745,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op) + dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ); + + platform_set_drvdata(op, i2c); ++ if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447")) ++ i2c->has_errata_A004447 = true; + + i2c->adap = mpc_ops; + of_address_to_resource(op->dev.of_node, 0, &res); +-- +2.30.2 + diff --git a/queue-4.19/i2c-mpc-make-use-of-i2c_recover_bus.patch b/queue-4.19/i2c-mpc-make-use-of-i2c_recover_bus.patch new file mode 100644 index 00000000000..4465f6d9f0a --- /dev/null +++ b/queue-4.19/i2c-mpc-make-use-of-i2c_recover_bus.patch @@ -0,0 +1,81 @@ +From 6006edaf6f5ad77f892d156bd02f7b500846509d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 14:52:03 +1300 +Subject: i2c: mpc: Make use of i2c_recover_bus() + +From: Chris Packham + +[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ] + +Move the existing calls of mpc_i2c_fixup() to a recovery function +registered via bus_recovery_info. This makes it more obvious that +recovery is supported and allows for a future where recovery is +triggered by the i2c core. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index d94f05c8b8b7..6a0d55e9e8e3 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -586,7 +586,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -622,7 +622,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -637,6 +637,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap) + | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL; + } + ++static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) ++{ ++ struct mpc_i2c *i2c = i2c_get_adapdata(adap); ++ ++ mpc_i2c_fixup(i2c); ++ ++ return 0; ++} ++ + static const struct i2c_algorithm mpc_algo = { + .master_xfer = mpc_xfer, + .functionality = mpc_functionality, +@@ -648,6 +657,10 @@ static struct i2c_adapter mpc_ops = { + .timeout = HZ, + }; + ++static struct i2c_bus_recovery_info fsl_i2c_recovery_info = { ++ .recover_bus = fsl_i2c_bus_recovery, ++}; ++ + static const struct of_device_id mpc_i2c_of_match[]; + static int fsl_i2c_probe(struct platform_device *op) + { +@@ -740,6 +753,7 @@ static int fsl_i2c_probe(struct platform_device *op) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &op->dev; + i2c->adap.dev.of_node = of_node_get(op->dev.of_node); ++ i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info; + + result = i2c_add_adapter(&i2c->adap); + if (result < 0) +-- +2.30.2 + diff --git a/queue-4.19/isdn-misdn-netjet-fix-crash-in-nj_probe.patch b/queue-4.19/isdn-misdn-netjet-fix-crash-in-nj_probe.patch new file mode 100644 index 00000000000..e486a365c6c --- /dev/null +++ b/queue-4.19/isdn-misdn-netjet-fix-crash-in-nj_probe.patch @@ -0,0 +1,168 @@ +From ea2e0dfc1227d4054da887ccc1e769fc80b11690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 07:11:40 +0000 +Subject: isdn: mISDN: netjet: Fix crash in nj_probe: + +From: Zheyu Ma + +[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ] + +'nj_setup' in netjet.c might fail with -EIO and in this case +'card->irq' is initialized and is bigger than zero. A subsequent call to +'nj_release' will free the irq that has not been requested. + +Fix this bug by deleting the previous assignment to 'card->irq' and just +keep the assignment before 'request_irq'. + +The KASAN's log reveals it: + +[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 +free_irq+0x100/0x480 +[ 3.355112 ] Modules linked in: +[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) +knlGS:0000000000000000 +[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: +00000000000006f0 +[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: +0000000000000400 +[ 3.362175 ] Call Trace: +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... +[ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.362175 ] Call Trace: +[ 3.362175 ] dump_stack+0xba/0xf5 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] panic+0x15a/0x3f2 +[ 3.362175 ] ? __warn+0xf2/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] __warn+0x108/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] report_bug+0x119/0x1c0 +[ 3.362175 ] handle_bug+0x3b/0x80 +[ 3.362175 ] exc_invalid_op+0x18/0x70 +[ 3.362175 ] asm_exc_invalid_op+0x12/0x20 +[ 3.362175 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.362175 ] ? vprintk+0x76/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Dumping ftrace buffer: +[ 3.362175 ] (ftrace buffer empty) +[ 3.362175 ] Kernel Offset: disabled +[ 3.362175 ] Rebooting in 1 seconds.. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/netjet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c +index 2b317cb63d06..448370da2c3f 100644 +--- a/drivers/isdn/hardware/mISDN/netjet.c ++++ b/drivers/isdn/hardware/mISDN/netjet.c +@@ -1114,7 +1114,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + card->typ = NETJET_S_TJ300; + + card->base = pci_resource_start(pdev, 0); +- card->irq = pdev->irq; + pci_set_drvdata(pdev, card); + err = setup_instance(card); + if (err) +-- +2.30.2 + diff --git a/queue-4.19/mips-fix-kernel-hang-under-function_graph_tracer-and.patch b/queue-4.19/mips-fix-kernel-hang-under-function_graph_tracer-and.patch new file mode 100644 index 00000000000..e89841e4fdd --- /dev/null +++ b/queue-4.19/mips-fix-kernel-hang-under-function_graph_tracer-and.patch @@ -0,0 +1,105 @@ +From a00ebe0ec29299fee4c6633e93c9de81268582a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 19:02:01 +0800 +Subject: MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER + +From: Tiezhu Yang + +[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ] + +When update the latest mainline kernel with the following three configs, +the kernel hangs during startup: + +(1) CONFIG_FUNCTION_GRAPH_TRACER=y +(2) CONFIG_PREEMPT_TRACER=y +(3) CONFIG_FTRACE_STARTUP_TEST=y + +When update the latest mainline kernel with the above two configs (1) +and (2), the kernel starts normally, but it still hangs when execute +the following command: + +echo "function_graph" > /sys/kernel/debug/tracing/current_tracer + +Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs +disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences +with function_graph tracer at the first glance. + +I use ejtag to find out the epc address is related with preempt_enable() +in the file arch/mips/lib/mips-atomic.c, because function tracing can +trace the preempt_{enable,disable} calls that are traced, replace them +with preempt_{enable,disable}_notrace to prevent function tracing from +going into an infinite loop, and then it can fix the kernel hang issue. + +By the way, it seems that this commit is a complement and improvement of +commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing +is enabled"). + +Signed-off-by: Tiezhu Yang +Cc: Steven Rostedt +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lib/mips-atomic.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c +index 5530070e0d05..57497a26e79c 100644 +--- a/arch/mips/lib/mips-atomic.c ++++ b/arch/mips/lib/mips-atomic.c +@@ -37,7 +37,7 @@ + */ + notrace void arch_local_irq_disable(void) + { +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_disable); + +@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) + { + unsigned long flags; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + + return flags; + } +@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + { + unsigned long __tmp1; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + : "0" (flags) + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_restore); + +-- +2.30.2 + diff --git a/queue-4.19/net-appletalk-cops-fix-data-race-in-cops_probe1.patch b/queue-4.19/net-appletalk-cops-fix-data-race-in-cops_probe1.patch new file mode 100644 index 00000000000..1e6d75f6f4f --- /dev/null +++ b/queue-4.19/net-appletalk-cops-fix-data-race-in-cops_probe1.patch @@ -0,0 +1,49 @@ +From 9b3784f9496d921b95c43fc16d14494a7556286b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 19:07:12 +0530 +Subject: net: appletalk: cops: Fix data race in cops_probe1 + +From: Saubhik Mukherjee + +[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ] + +In cops_probe1(), there is a write to dev->base_addr after requesting an +interrupt line and registering the interrupt handler cops_interrupt(). +The handler might be called in parallel to handle an interrupt. +cops_interrupt() tries to read dev->base_addr leading to a potential +data race. So write to dev->base_addr before calling request_irq(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Saubhik Mukherjee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/appletalk/cops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c +index bb49f6e40a19..0a7889abf2b2 100644 +--- a/drivers/net/appletalk/cops.c ++++ b/drivers/net/appletalk/cops.c +@@ -325,6 +325,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + break; + } + ++ dev->base_addr = ioaddr; ++ + /* Reserve any actual interrupt. */ + if (dev->irq) { + retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev); +@@ -332,8 +334,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + goto err_out; + } + +- dev->base_addr = ioaddr; +- + lp = netdev_priv(dev); + spin_lock_init(&lp->lock); + +-- +2.30.2 + diff --git a/queue-4.19/net-macb-ensure-the-device-is-available-before-acces.patch b/queue-4.19/net-macb-ensure-the-device-is-available-before-acces.patch new file mode 100644 index 00000000000..7284b411a24 --- /dev/null +++ b/queue-4.19/net-macb-ensure-the-device-is-available-before-acces.patch @@ -0,0 +1,46 @@ +From 527c710c52e86c4df47f7a69f1348ccf918d3f5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 17:16:11 +0800 +Subject: net: macb: ensure the device is available before accessing GEMGXL + control registers + +From: Zong Li + +[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ] + +If runtime power menagement is enabled, the gigabit ethernet PLL would +be disabled after macb_probe(). During this period of time, the system +would hang up if we try to access GEMGXL control registers. + +We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of +sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping +function called from invalid context"). Add netif_running checking to +ensure the device is available before accessing GEMGXL device. + +Changed in v2: + - Use netif_running instead of its own flag + +Signed-off-by: Zong Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 0374a1ba1010..d110aa616a95 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2513,6 +2513,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) + struct gem_stats *hwstat = &bp->hw_stats.gem; + struct net_device_stats *nstat = &bp->dev->stats; + ++ if (!netif_running(bp->dev)) ++ return nstat; ++ + gem_update_stats(bp); + + nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors + +-- +2.30.2 + diff --git a/queue-4.19/net-mdiobus-get-rid-of-a-bug_on.patch b/queue-4.19/net-mdiobus-get-rid-of-a-bug_on.patch new file mode 100644 index 00000000000..050ea16a41a --- /dev/null +++ b/queue-4.19/net-mdiobus-get-rid-of-a-bug_on.patch @@ -0,0 +1,41 @@ +From 33c6725d417810f832fa0ffce1b03c3b7e6b18d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:04:13 +0300 +Subject: net: mdiobus: get rid of a BUG_ON() + +From: Dan Carpenter + +[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] + +We spotted a bug recently during a review where a driver was +unregistering a bus that wasn't registered, which would trigger this +BUG_ON(). Let's handle that situation more gracefully, and just print +a warning and return. + +Reported-by: Russell King (Oracle) +Signed-off-by: Dan Carpenter +Reviewed-by: Russell King (Oracle) +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 5c89a310359d..08c81d4cfca8 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -446,7 +446,8 @@ void mdiobus_unregister(struct mii_bus *bus) + struct mdio_device *mdiodev; + int i; + +- BUG_ON(bus->state != MDIOBUS_REGISTERED); ++ if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) ++ return; + bus->state = MDIOBUS_UNREGISTERED; + + for (i = 0; i < PHY_MAX_ADDR; i++) { +-- +2.30.2 + diff --git a/queue-4.19/net-nfc-rawsock.c-fix-a-permission-check-bug.patch b/queue-4.19/net-nfc-rawsock.c-fix-a-permission-check-bug.patch new file mode 100644 index 00000000000..f5f74674153 --- /dev/null +++ b/queue-4.19/net-nfc-rawsock.c-fix-a-permission-check-bug.patch @@ -0,0 +1,34 @@ +From 16a45968e3a92471f91e14e067ecc51591693d34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:52:30 +0800 +Subject: net/nfc/rawsock.c: fix a permission check bug + +From: Jeimon + +[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ] + +The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable(). + +Signed-off-by: Jeimon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/rawsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index 57a07ab80d92..bdc72737fe24 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -345,7 +345,7 @@ static int rawsock_create(struct net *net, struct socket *sock, + return -ESOCKTNOSUPPORT; + + if (sock->type == SOCK_RAW) { +- if (!capable(CAP_NET_RAW)) ++ if (!ns_capable(net->user_ns, CAP_NET_RAW)) + return -EPERM; + sock->ops = &rawsock_raw_ops; + } else { +-- +2.30.2 + diff --git a/queue-4.19/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch b/queue-4.19/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch new file mode 100644 index 00000000000..86f66907fa4 --- /dev/null +++ b/queue-4.19/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch @@ -0,0 +1,108 @@ +From a2b4cc6efe812257d2227e8474ab19e84342fdf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 12:32:36 +0000 +Subject: net/qla3xxx: fix schedule while atomic in ql_sem_spinlock + +From: Zheyu Ma + +[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ] + +When calling the 'ql_sem_spinlock', the driver has already acquired the +spin lock, so the driver should not call 'ssleep' in atomic context. + +This bug can be fixed by using 'mdelay' instead of 'ssleep'. + +The KASAN's log reveals it: + +[ 3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002 +[ 3.238748 ] 2 locks held by swapper/0/1: +[ 3.239151 ] #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at: +__device_driver_lock+0x41/0x60 +[ 3.240026 ] #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at: +ql3xxx_probe+0x2aa/0xea0 +[ 3.240873 ] Modules linked in: +[ 3.241187 ] irq event stamp: 460854 +[ 3.241541 ] hardirqs last enabled at (460853): [] +_raw_spin_unlock_irqrestore+0x4f/0x70 +[ 3.242245 ] hardirqs last disabled at (460854): [] +_raw_spin_lock_irqsave+0x2a/0x70 +[ 3.242245 ] softirqs last enabled at (446076): [] +__do_softirq+0x2e4/0x4b1 +[ 3.242245 ] softirqs last disabled at (446069): [] +irq_exit_rcu+0x100/0x110 +[ 3.242245 ] Preemption disabled at: +[ 3.242245 ] [] ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] Kernel panic - not syncing: scheduling while atomic +[ 3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00145 +-gee7dc339169-dirty #16 +[ 3.242245 ] Call Trace: +[ 3.242245 ] dump_stack+0xba/0xf5 +[ 3.242245 ] ? ql3xxx_probe+0x1f0/0xea0 +[ 3.242245 ] panic+0x15a/0x3f2 +[ 3.242245 ] ? vprintk+0x76/0x150 +[ 3.242245 ] ? ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] __schedule_bug+0xae/0xe0 +[ 3.242245 ] __schedule+0x72e/0xa00 +[ 3.242245 ] schedule+0x43/0xf0 +[ 3.242245 ] schedule_timeout+0x28b/0x500 +[ 3.242245 ] ? del_timer_sync+0xf0/0xf0 +[ 3.242245 ] ? msleep+0x2f/0x70 +[ 3.242245 ] msleep+0x59/0x70 +[ 3.242245 ] ql3xxx_probe+0x307/0xea0 +[ 3.242245 ] ? _raw_spin_unlock_irqrestore+0x3a/0x70 +[ 3.242245 ] ? pci_device_remove+0x110/0x110 +[ 3.242245 ] local_pci_probe+0x45/0xa0 +[ 3.242245 ] pci_device_probe+0x12b/0x1d0 +[ 3.242245 ] really_probe+0x2a9/0x610 +[ 3.242245 ] driver_probe_device+0x90/0x1d0 +[ 3.242245 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.242245 ] device_driver_attach+0x68/0x70 +[ 3.242245 ] __driver_attach+0x124/0x1b0 +[ 3.242245 ] ? device_driver_attach+0x70/0x70 +[ 3.242245 ] bus_for_each_dev+0xbb/0x110 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] driver_attach+0x27/0x30 +[ 3.242245 ] bus_add_driver+0x1eb/0x2a0 +[ 3.242245 ] driver_register+0xa9/0x180 +[ 3.242245 ] __pci_register_driver+0x82/0x90 +[ 3.242245 ] ? yellowfin_init+0x25/0x25 +[ 3.242245 ] ql3xxx_driver_init+0x23/0x25 +[ 3.242245 ] do_one_initcall+0x7f/0x3d0 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.242245 ] kernel_init_freeable+0x2aa/0x301 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] kernel_init+0x18/0x190 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ret_from_fork+0x1f/0x30 +[ 3.242245 ] Dumping ftrace buffer: +[ 3.242245 ] (ftrace buffer empty) +[ 3.242245 ] Kernel Offset: disabled +[ 3.242245 ] Rebooting in 1 seconds. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 1b5e098b2367..2d71646640ac 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, + value = readl(&port_regs->CommonRegs.semaphoreReg); + if ((value & (sem_mask >> 16)) == sem_bits) + return 0; +- ssleep(1); ++ mdelay(1000); + } while (--seconds); + return -1; + } +-- +2.30.2 + diff --git a/queue-4.19/netlink-disable-irqs-for-netlink_lock_table.patch b/queue-4.19/netlink-disable-irqs-for-netlink_lock_table.patch new file mode 100644 index 00000000000..a0a49132e4d --- /dev/null +++ b/queue-4.19/netlink-disable-irqs-for-netlink_lock_table.patch @@ -0,0 +1,75 @@ +From 84914d453c59ce8461248ffd1e828c61fdad790f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:38:09 +0200 +Subject: netlink: disable IRQs for netlink_lock_table() + +From: Johannes Berg + +[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ] + +Syzbot reports that in mac80211 we have a potential deadlock +between our "local->stop_queue_reasons_lock" (spinlock) and +netlink's nl_table_lock (rwlock). This is because there's at +least one situation in which we might try to send a netlink +message with this spinlock held while it is also possible to +take the spinlock from a hardirq context, resulting in the +following deadlock scenario reported by lockdep: + + CPU0 CPU1 + ---- ---- + lock(nl_table_lock); + local_irq_disable(); + lock(&local->queue_stop_reason_lock); + lock(nl_table_lock); + + lock(&local->queue_stop_reason_lock); + +This seems valid, we can take the queue_stop_reason_lock in +any kind of context ("CPU0"), and call ieee80211_report_ack_skb() +with the spinlock held and IRQs disabled ("CPU1") in some +code path (ieee80211_do_stop() via ieee80211_free_txskb()). + +Short of disallowing netlink use in scenarios like these +(which would be rather complex in mac80211's case due to +the deep callchain), it seems the only fix for this is to +disable IRQs while nl_table_lock is held to avoid hitting +this scenario, this disallows the "CPU0" portion of the +reported deadlock. + +Note that the writer side (netlink_table_grab()) already +disables IRQs for this lock. + +Unfortunately though, this seems like a huge hammer, and +maybe the whole netlink table locking should be reworked. + +Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 1bb9f219f07d..ac3fe507bc1c 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -461,11 +461,13 @@ void netlink_table_ungrab(void) + static inline void + netlink_lock_table(void) + { ++ unsigned long flags; ++ + /* read_lock() synchronizes us to netlink_table_grab */ + +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + atomic_inc(&nl_table_users); +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + } + + static inline void +-- +2.30.2 + diff --git a/queue-4.19/nvme-fabrics-decode-host-pathing-error-for-connect.patch b/queue-4.19/nvme-fabrics-decode-host-pathing-error-for-connect.patch new file mode 100644 index 00000000000..a15524ee2ab --- /dev/null +++ b/queue-4.19/nvme-fabrics-decode-host-pathing-error-for-connect.patch @@ -0,0 +1,40 @@ +From bf59be4464c41af88e85800ffebc1d7faf70f475 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 10:23:46 +0200 +Subject: nvme-fabrics: decode host pathing error for connect + +From: Hannes Reinecke + +[ Upstream commit 4d9442bf263ac45d495bb7ecf75009e59c0622b2 ] + +Add an additional decoding for 'host pathing error' during connect. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Himanshu Madhani +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 05dd46f98441..3ae800e87999 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -344,6 +344,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl, + cmd->connect.recfmt); + break; + ++ case NVME_SC_HOST_PATH_ERROR: ++ dev_err(ctrl->device, ++ "Connect command failed: host path error\n"); ++ break; ++ + default: + dev_err(ctrl->device, + "Connect command failed, error wo/DNR bit: %d\n", +-- +2.30.2 + diff --git a/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch b/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch new file mode 100644 index 00000000000..176195e85b9 --- /dev/null +++ b/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch @@ -0,0 +1,45 @@ +From 5d5651daaa25a1d740cdbb8a4159ab4226b81211 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:51 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c + controllers + +From: Chris Packham + +[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ] + +The i2c controllers on the P1010 have an erratum where the documented +scheme for i2c bus recovery will not work (A-004447). A different +mechanism is needed which is documented in the P1010 Chip Errata Rev L. + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +index 1b4aafc1f6a2..9716a0484ecf 100644 +--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +@@ -122,7 +122,15 @@ + }; + + /include/ "pq3-i2c-0.dtsi" ++ i2c@3000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-i2c-1.dtsi" ++ i2c@3100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-duart-0.dtsi" + /include/ "pq3-espi-0.dtsi" + spi0: spi@7000 { +-- +2.30.2 + diff --git a/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch b/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch new file mode 100644 index 00000000000..c78bf0d41bb --- /dev/null +++ b/queue-4.19/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch @@ -0,0 +1,54 @@ +From 6d09b812f1dc42e911fe7f5d04ee4d5f3a2e2c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:50 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c + controllers + +From: Chris Packham + +[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ] + +The i2c controllers on the P2040/P2041 have an erratum where the +documented scheme for i2c bus recovery will not work (A-004447). A +different mechanism is needed which is documented in the P2040 Chip +Errata Rev Q (latest available at the time of writing). + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +index 51e975d7631a..8921f17fca42 100644 +--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +@@ -389,7 +389,23 @@ + }; + + /include/ "qoriq-i2c-0.dtsi" ++ i2c@118000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@118100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-i2c-1.dtsi" ++ i2c@119000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@119100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-duart-0.dtsi" + /include/ "qoriq-duart-1.dtsi" + /include/ "qoriq-gpio-0.dtsi" +-- +2.30.2 + diff --git a/queue-4.19/rds-tcp-loopback-connection-can-hang.patch b/queue-4.19/rds-tcp-loopback-connection-can-hang.patch new file mode 100644 index 00000000000..a3f1aabf1e4 --- /dev/null +++ b/queue-4.19/rds-tcp-loopback-connection-can-hang.patch @@ -0,0 +1,121 @@ +From 7435519d654fad0d7f9032efb4680b9f2e727a4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 11:08:06 -0700 +Subject: RDS tcp loopback connection can hang + +From: Rao Shoaib + +[ Upstream commit aced3ce57cd37b5ca332bcacd370d01f5a8c5371 ] + +When TCP is used as transport and a program on the +system connects to RDS port 16385, connection is +accepted but denied per the rules of RDS. However, +RDS connections object is left in the list. Next +loopback connection will select that connection +object as it is at the head of list. The connection +attempt will hang as the connection object is set +to connect over TCP which is not allowed + +The issue can be reproduced easily, use rds-ping +to ping a local IP address. After that use any +program like ncat to connect to the same IP +address and port 16385. This will hang so ctrl-c out. +Now try rds-ping, it will hang. + +To fix the issue this patch adds checks to disallow +the connection object creation and destroys the +connection object. + +Signed-off-by: Rao Shoaib +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 23 +++++++++++++++++------ + net/rds/tcp.c | 4 ++-- + net/rds/tcp.h | 3 ++- + net/rds/tcp_listen.c | 6 ++++++ + 4 files changed, 27 insertions(+), 9 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index 3bd2f4a5a30d..ac3300b204a6 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -237,12 +237,23 @@ static struct rds_connection *__rds_conn_create(struct net *net, + if (loop_trans) { + rds_trans_put(loop_trans); + conn->c_loopback = 1; +- if (is_outgoing && trans->t_prefer_loopback) { +- /* "outgoing" connection - and the transport +- * says it wants the connection handled by the +- * loopback transport. This is what TCP does. +- */ +- trans = &rds_loop_transport; ++ if (trans->t_prefer_loopback) { ++ if (likely(is_outgoing)) { ++ /* "outgoing" connection to local address. ++ * Protocol says it wants the connection ++ * handled by the loopback transport. ++ * This is what TCP does. ++ */ ++ trans = &rds_loop_transport; ++ } else { ++ /* No transport currently in use ++ * should end up here, but if it ++ * does, reset/destroy the connection. ++ */ ++ kmem_cache_free(rds_conn_slab, conn); ++ conn = ERR_PTR(-EOPNOTSUPP); ++ goto out; ++ } + } + } + +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 18bb522df282..d0bce439198f 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -322,8 +322,8 @@ out: + } + #endif + +-static int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, +- __u32 scope_id) ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id) + { + struct net_device *dev = NULL; + #if IS_ENABLED(CONFIG_IPV6) +diff --git a/net/rds/tcp.h b/net/rds/tcp.h +index 3c69361d21c7..4620549ecbeb 100644 +--- a/net/rds/tcp.h ++++ b/net/rds/tcp.h +@@ -60,7 +60,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc); + u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq); + extern struct rds_transport rds_tcp_transport; + void rds_tcp_accept_work(struct sock *sk); +- ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id); + /* tcp_connect.c */ + int rds_tcp_conn_path_connect(struct rds_conn_path *cp); + void rds_tcp_conn_path_shutdown(struct rds_conn_path *conn); +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index c12203f646da..0d095d3f5fee 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -198,6 +198,12 @@ int rds_tcp_accept_one(struct socket *sock) + } + #endif + ++ if (!rds_tcp_laddr_check(sock_net(sock->sk), peer_addr, dev_if)) { ++ /* local address connection is only allowed via loopback */ ++ ret = -EOPNOTSUPP; ++ goto out; ++ } ++ + conn = rds_conn_create(sock_net(sock->sk), + my_addr, peer_addr, + &rds_tcp_transport, GFP_KERNEL, dev_if); +-- +2.30.2 + diff --git a/queue-4.19/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch b/queue-4.19/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch new file mode 100644 index 00000000000..9fd6c1f0775 --- /dev/null +++ b/queue-4.19/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch @@ -0,0 +1,36 @@ +From 41a5cc533c7860e9d88a4c45cd7234c96ab49131 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 23:14:16 -0700 +Subject: scsi: bnx2fc: Return failure if io_req is already in ABTS processing + +From: Javed Hasan + +[ Upstream commit 122c81c563b0c1c6b15ff76a9159af5ee1f21563 ] + +Return failure from bnx2fc_eh_abort() if io_req is already in ABTS +processing. + +Link: https://lore.kernel.org/r/20210519061416.19321-1-jhasan@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c +index bc9f2a2365f4..5d89cc30bf30 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_io.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c +@@ -1218,6 +1218,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd) + was a result from the ABTS request rather than the CLEANUP + request */ + set_bit(BNX2FC_FLAG_IO_CLEANUP, &io_req->req_flags); ++ rc = FAILED; + goto done; + } + +-- +2.30.2 + diff --git a/queue-4.19/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch b/queue-4.19/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch new file mode 100644 index 00000000000..a359cea6a62 --- /dev/null +++ b/queue-4.19/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch @@ -0,0 +1,82 @@ +From 246f3d3100811a8a84dbb0ae3c5b121c4340dd55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 23:35:54 +0300 +Subject: scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal + +From: Dmitry Bogdanov + +[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ] + +Target de-configuration panics at high CPU load because TPGT and WWPN can +be removed on separate threads. + +TPGT removal requests a reset HBA on a separate thread and waits for reset +complete (phase1). Due to high CPU load that HBA reset can be delayed for +some time. + +WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has +already completed and thus tgt.tgt_ops is subsequently cleared. However, +tgt.tgt_ops is needed to process incoming traffic and therefore this will +cause one of the following panics: + +NIP qlt_reset+0x7c/0x220 [qla2xxx] +LR qlt_reset+0x68/0x220 [qla2xxx] +Call Trace: +0xc000003ffff63a78 (unreliable) +qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx] +qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx] +qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx] +LR qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx] +Call Trace: +qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable) +qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_create_sess+0x90/0x4e0 [qla2xxx] +LR qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +Call Trace: +0xc0000000348fba30 (unreliable) +qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +qla2x00_do_work+0x674/0xbf0 [qla2xxx] +qla2x00_iocb_work_fn + +The patch fixes the issue by serializing qlt_stop_phase1() and +qlt_stop_phase2() functions to make WWPN removal wait for phase1 +completion. + +Link: https://lore.kernel.org/r/20210415203554.27890-1-d.bogdanov@yadro.com +Reviewed-by: Roman Bolshakov +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index eb6112eb475e..ec54c8f34bc8 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1571,10 +1571,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt) + return; + } + ++ mutex_lock(&tgt->ha->optrom_mutex); + mutex_lock(&vha->vha_tgt.tgt_mutex); + tgt->tgt_stop = 0; + tgt->tgt_stopped = 1; + mutex_unlock(&vha->vha_tgt.tgt_mutex); ++ mutex_unlock(&tgt->ha->optrom_mutex); + + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished\n", + tgt); +-- +2.30.2 + diff --git a/queue-4.19/scsi-vmw_pvscsi-set-correct-residual-data-length.patch b/queue-4.19/scsi-vmw_pvscsi-set-correct-residual-data-length.patch new file mode 100644 index 00000000000..235c61d1f39 --- /dev/null +++ b/queue-4.19/scsi-vmw_pvscsi-set-correct-residual-data-length.patch @@ -0,0 +1,71 @@ +From a40e0b6167c66df10e93fa785f0a83b34a1846fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 09:49:32 +0000 +Subject: scsi: vmw_pvscsi: Set correct residual data length + +From: Matt Wang + +[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ] + +Some commands (such as INQUIRY) may return less data than the initiator +requested. To avoid conducting useless information, set the right residual +count to make upper layer aware of this. + +Before (INQUIRY PAGE 0xB0 with 128B buffer): + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 128 bytes of data: + 00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ + 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... + 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... + 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +After: + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 64 bytes of data: +00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ +10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... +20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... +30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +[mkp: clarified description] + +Link: https://lore.kernel.org/r/03C41093-B62E-43A2-913E-CFC92F1C70C3@vmware.com +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 64eb8ffb2ddf..2c707b5c7b0b 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -574,7 +574,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + case BTSTAT_SUCCESS: + case BTSTAT_LINKED_COMMAND_COMPLETED: + case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG: +- /* If everything went fine, let's move on.. */ ++ /* ++ * Commands like INQUIRY may transfer less data than ++ * requested by the initiator via bufflen. Set residual ++ * count to make upper layer aware of the actual amount ++ * of data returned. ++ */ ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); + cmd->result = (DID_OK << 16); + break; + +-- +2.30.2 + diff --git a/queue-4.19/series b/queue-4.19/series index daa83a0608c..16a4ded8272 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,2 +1,26 @@ perf-core-fix-endless-multiplex-timer.patch proc-track-proc-pid-attr-opener-mm_struct.patch +net-nfc-rawsock.c-fix-a-permission-check-bug.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch +asoc-sti-sas-add-missing-module_device_table.patch +isdn-misdn-netjet-fix-crash-in-nj_probe.patch +bonding-init-notify_work-earlier-to-avoid-uninitiali.patch +netlink-disable-irqs-for-netlink_lock_table.patch +net-mdiobus-get-rid-of-a-bug_on.patch +cgroup-disable-controllers-at-parse-time.patch +wq-handle-vm-suspension-in-stall-detection.patch +net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch +rds-tcp-loopback-connection-can-hang.patch +scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch +scsi-vmw_pvscsi-set-correct-residual-data-length.patch +scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch +net-macb-ensure-the-device-is-available-before-acces.patch +net-appletalk-cops-fix-data-race-in-cops_probe1.patch +nvme-fabrics-decode-host-pathing-error-for-connect.patch +mips-fix-kernel-hang-under-function_graph_tracer-and.patch +bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch +i2c-mpc-make-use-of-i2c_recover_bus.patch +i2c-mpc-implement-erratum-a-004447-workaround.patch diff --git a/queue-4.19/wq-handle-vm-suspension-in-stall-detection.patch b/queue-4.19/wq-handle-vm-suspension-in-stall-detection.patch new file mode 100644 index 00000000000..bee6af7beb1 --- /dev/null +++ b/queue-4.19/wq-handle-vm-suspension-in-stall-detection.patch @@ -0,0 +1,89 @@ +From 6e189b19b01efa910dc1761975578adfb537e53b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 19:14:22 +0900 +Subject: wq: handle VM suspension in stall detection + +From: Sergey Senozhatsky + +[ Upstream commit 940d71c6462e8151c78f28e4919aa8882ff2054e ] + +If VCPU is suspended (VM suspend) in wq_watchdog_timer_fn() then +once this VCPU resumes it will see the new jiffies value, while it +may take a while before IRQ detects PVCLOCK_GUEST_STOPPED on this +VCPU and updates all the watchdogs via pvclock_touch_watchdogs(). +There is a small chance of misreported WQ stalls in the meantime, +because new jiffies is time_after() old 'ts + thresh'. + +wq_watchdog_timer_fn() +{ + for_each_pool(pool, pi) { + if (time_after(jiffies, ts + thresh)) { + pr_emerg("BUG: workqueue lockup - pool"); + } + } +} + +Save jiffies at the beginning of this function and use that value +for stall detection. If VM gets suspended then we continue using +"old" jiffies value and old WQ touch timestamps. If IRQ at some +point restarts the stall detection cycle (pvclock_touch_watchdogs()) +then old jiffies will always be before new 'ts + thresh'. + +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 1cc49340b68a..f278e2f584fd 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include "workqueue_internal.h" + +@@ -5555,6 +5556,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + { + unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ; + bool lockup_detected = false; ++ unsigned long now = jiffies; + struct worker_pool *pool; + int pi; + +@@ -5569,6 +5571,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + if (list_empty(&pool->worklist)) + continue; + ++ /* ++ * If a virtual machine is stopped by the host it can look to ++ * the watchdog like a stall. ++ */ ++ kvm_check_and_clear_guest_paused(); ++ + /* get the latest of pool and touched timestamps */ + pool_ts = READ_ONCE(pool->watchdog_ts); + touched = READ_ONCE(wq_watchdog_touched); +@@ -5587,12 +5595,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + } + + /* did we stall? */ +- if (time_after(jiffies, ts + thresh)) { ++ if (time_after(now, ts + thresh)) { + lockup_detected = true; + pr_emerg("BUG: workqueue lockup - pool"); + pr_cont_pool_info(pool); + pr_cont(" stuck for %us!\n", +- jiffies_to_msecs(jiffies - pool_ts) / 1000); ++ jiffies_to_msecs(now - pool_ts) / 1000); + } + } + +-- +2.30.2 +