From 0dce039f51306efb15ccd3c714009aca31df4ffd Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Jul 2020 21:19:23 -0400 Subject: [PATCH] Fixes for 4.9 Signed-off-by: Sasha Levin --- ...sk_thread_flag-for-checking-tif_sing.patch | 43 ++++++++ ...x88172a-fix-ax88172a_unbind-failures.patch | 36 +++++++ ...x-race-when-modifying-pause-settings.patch | 44 ++++++++ ...etting-ioat-timeout-as-module-parame.patch | 62 +++++++++++ ...10-adma-fix-runtime-pm-imbalance-on-.patch | 49 +++++++++ ...e-fn-key-key-re-mapping-on-clone-key.patch | 100 ++++++++++++++++++ ...mediacom-flexbook-edge13-to-descript.patch | 41 +++++++ ...-used-in-a-pci_free_consistent-in-an.patch | 39 +++++++ ...siocshwtstamp-to-update-the-struct-w.patch | 66 ++++++++++++ ...ossible-memory-leak-in-smc_drv_probe.patch | 47 ++++++++ ...t_regmap_match-fix-string-comparison.patch | 43 ++++++++ ...tacktrace-strip-basepath-from-all-pa.patch | 49 +++++++++ queue-4.9/series | 14 +++ ...r_udc-fix-memleak-on-error-handling-.patch | 45 ++++++++ ...th-emu-fix-up-cmp-insn-for-clang-ias.patch | 43 ++++++++ 15 files changed, 721 insertions(+) create mode 100644 queue-4.9/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch create mode 100644 queue-4.9/ax88172a-fix-ax88172a_unbind-failures.patch create mode 100644 queue-4.9/bnxt_en-fix-race-when-modifying-pause-settings.patch create mode 100644 queue-4.9/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch create mode 100644 queue-4.9/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch create mode 100644 queue-4.9/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch create mode 100644 queue-4.9/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch create mode 100644 queue-4.9/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch create mode 100644 queue-4.9/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch create mode 100644 queue-4.9/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch create mode 100644 queue-4.9/regmap-dev_get_regmap_match-fix-string-comparison.patch create mode 100644 queue-4.9/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch create mode 100644 queue-4.9/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch create mode 100644 queue-4.9/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch diff --git a/queue-4.9/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch b/queue-4.9/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch new file mode 100644 index 00000000000..a1b34a5596a --- /dev/null +++ b/queue-4.9/arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch @@ -0,0 +1,43 @@ +From 4d9e10f706fe8873e2b263e13bec9b2ef3f3c857 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Feb 2020 12:12:26 +0000 +Subject: arm64: Use test_tsk_thread_flag() for checking TIF_SINGLESTEP + +From: Will Deacon + +[ Upstream commit 5afc78551bf5d53279036e0bf63314e35631d79f ] + +Rather than open-code test_tsk_thread_flag() at each callsite, simply +replace the couple of offenders with calls to test_tsk_thread_flag() +directly. + +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/debug-monitors.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c +index a5236a3e52978..3101d1b61713e 100644 +--- a/arch/arm64/kernel/debug-monitors.c ++++ b/arch/arm64/kernel/debug-monitors.c +@@ -380,14 +380,14 @@ void user_rewind_single_step(struct task_struct *task) + * If single step is active for this thread, then set SPSR.SS + * to 1 to avoid returning to the active-pending state. + */ +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + set_regs_spsr_ss(task_pt_regs(task)); + } + NOKPROBE_SYMBOL(user_rewind_single_step); + + void user_fastforward_single_step(struct task_struct *task) + { +- if (test_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP)) ++ if (test_tsk_thread_flag(task, TIF_SINGLESTEP)) + clear_regs_spsr_ss(task_pt_regs(task)); + } + +-- +2.25.1 + diff --git a/queue-4.9/ax88172a-fix-ax88172a_unbind-failures.patch b/queue-4.9/ax88172a-fix-ax88172a_unbind-failures.patch new file mode 100644 index 00000000000..5c4bbbafdbf --- /dev/null +++ b/queue-4.9/ax88172a-fix-ax88172a_unbind-failures.patch @@ -0,0 +1,36 @@ +From 4b24329ec91928e43ede4b3374fdffc9bb8a6023 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 09:59:31 -0400 +Subject: ax88172a: fix ax88172a_unbind() failures + +From: George Kennedy + +[ Upstream commit c28d9a285668c799eeae2f7f93e929a6028a4d6d ] + +If ax88172a_unbind() fails, make sure that the return code is +less than zero so that cleanup is done properly and avoid UAF. + +Fixes: a9a51bd727d1 ("ax88172a: fix information leak on short answers") +Signed-off-by: George Kennedy +Reported-by: syzbot+4cd84f527bf4a10fc9c1@syzkaller.appspotmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88172a.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index 2c50497cc4edc..7ec8992401fb4 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -217,6 +217,7 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0); + if (ret < ETH_ALEN) { + netdev_err(dev->net, "Failed to read MAC address: %d\n", ret); ++ ret = -EIO; + goto free; + } + memcpy(dev->net->dev_addr, buf, ETH_ALEN); +-- +2.25.1 + diff --git a/queue-4.9/bnxt_en-fix-race-when-modifying-pause-settings.patch b/queue-4.9/bnxt_en-fix-race-when-modifying-pause-settings.patch new file mode 100644 index 00000000000..80eeb17a5f9 --- /dev/null +++ b/queue-4.9/bnxt_en-fix-race-when-modifying-pause-settings.patch @@ -0,0 +1,44 @@ +From ec276935422e046b4cff34401cd4e6e5de3e242d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Jul 2020 20:48:23 -0400 +Subject: bnxt_en: Fix race when modifying pause settings. + +From: Vasundhara Volam + +[ Upstream commit 163e9ef63641a02de4c95cd921577265c52e1ce2 ] + +The driver was modified to not rely on rtnl lock to protect link +settings about 2 years ago. The pause setting was missed when +making that change. Fix it by acquiring link_lock mutex before +calling bnxt_hwrm_set_pause(). + +Fixes: e2dc9b6e38fa ("bnxt_en: Don't use rtnl lock to protect link change logic in workqueue.") +Signed-off-by: Vasundhara Volam +Reviewed-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 3a352f76e633c..427d4dbc97354 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1023,8 +1023,11 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (epause->tx_pause) + link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX; + +- if (netif_running(dev)) ++ if (netif_running(dev)) { ++ mutex_lock(&bp->link_lock); + rc = bnxt_hwrm_set_pause(bp); ++ mutex_unlock(&bp->link_lock); ++ } + return rc; + } + +-- +2.25.1 + diff --git a/queue-4.9/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch b/queue-4.9/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch new file mode 100644 index 00000000000..6423c751cf4 --- /dev/null +++ b/queue-4.9/dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch @@ -0,0 +1,62 @@ +From 74df571037947ff5c48270785ea848e27b70cbce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 21:48:12 +0300 +Subject: dmaengine: ioat setting ioat timeout as module parameter + +From: Leonid Ravich + +[ Upstream commit 87730ccbddcb48478b1b88e88b14e73424130764 ] + +DMA transaction time to completion is a function of PCI bandwidth, +transaction size and a queue depth. So hard coded value for timeouts +might be wrong for some scenarios. + +Signed-off-by: Leonid Ravich +Reviewed-by: Dave Jiang +Link: https://lore.kernel.org/r/20200701184816.29138-1-leonid.ravich@dell.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/dma.c | 12 ++++++++++++ + drivers/dma/ioat/dma.h | 2 -- + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index 1389f0582e29b..c5a45c57b8b8d 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -38,6 +38,18 @@ + + #include "../dmaengine.h" + ++int completion_timeout = 200; ++module_param(completion_timeout, int, 0644); ++MODULE_PARM_DESC(completion_timeout, ++ "set ioat completion timeout [msec] (default 200 [msec])"); ++int idle_timeout = 2000; ++module_param(idle_timeout, int, 0644); ++MODULE_PARM_DESC(idle_timeout, ++ "set ioat idel timeout [msec] (default 2000 [msec])"); ++ ++#define IDLE_TIMEOUT msecs_to_jiffies(idle_timeout) ++#define COMPLETION_TIMEOUT msecs_to_jiffies(completion_timeout) ++ + static char *chanerr_str[] = { + "DMA Transfer Destination Address Error", + "Next Descriptor Address Error", +diff --git a/drivers/dma/ioat/dma.h b/drivers/dma/ioat/dma.h +index a9bc1a15b0d16..b0152288983bc 100644 +--- a/drivers/dma/ioat/dma.h ++++ b/drivers/dma/ioat/dma.h +@@ -111,8 +111,6 @@ struct ioatdma_chan { + #define IOAT_RUN 5 + #define IOAT_CHAN_ACTIVE 6 + struct timer_list timer; +- #define COMPLETION_TIMEOUT msecs_to_jiffies(100) +- #define IDLE_TIMEOUT msecs_to_jiffies(2000) + #define RESET_DELAY msecs_to_jiffies(100) + struct ioatdma_device *ioat_dma; + dma_addr_t completion_dma; +-- +2.25.1 + diff --git a/queue-4.9/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch b/queue-4.9/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch new file mode 100644 index 00000000000..8380098f525 --- /dev/null +++ b/queue-4.9/dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch @@ -0,0 +1,49 @@ +From aacb665f20b048561805ed612394dab548085b4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 14:46:26 +0800 +Subject: dmaengine: tegra210-adma: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit 5b78fac4b1ba731cf4177fdbc1e3a4661521bcd0 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Reviewed-by: Jon Hunter +Link: https://lore.kernel.org/r/20200624064626.19855-1-dinghao.liu@zju.edu.cn +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra210-adma.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index c16c06b3dd2f4..54296e262deab 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -583,6 +583,7 @@ static int tegra_adma_alloc_chan_resources(struct dma_chan *dc) + + ret = pm_runtime_get_sync(tdc2dev(tdc)); + if (ret < 0) { ++ pm_runtime_put_noidle(tdc2dev(tdc)); + free_irq(tdc->irq, tdc); + return ret; + } +@@ -764,8 +765,10 @@ static int tegra_adma_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + goto rpm_disable; ++ } + + ret = tegra_adma_init(tdma); + if (ret) +-- +2.25.1 + diff --git a/queue-4.9/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch b/queue-4.9/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch new file mode 100644 index 00000000000..970fb979319 --- /dev/null +++ b/queue-4.9/hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch @@ -0,0 +1,100 @@ +From 8afcc6b89dc37e68ff64c41f76377f687fab7975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 14:32:29 +0200 +Subject: HID: apple: Disable Fn-key key-re-mapping on clone keyboards + +From: Hans de Goede + +[ Upstream commit a5d81646fa294eed57786a9310b06ca48902adf8 ] + +The Maxxter KB-BT-001 Bluetooth keyboard, which looks somewhat like the +Apple Wireless Keyboard, is using the vendor and product IDs (05AC:0239) +of the Apple Wireless Keyboard (2009 ANSI version) . + +But its F1 - F10 keys are marked as sending F1 - F10, not the special +functions hid-apple.c maps them too; and since its descriptors do not +contain the HID_UP_CUSTOM | 0x0003 usage apple-hid looks for for the +Fn-key, apple_setup_input() never gets called, so F1 - F6 are mapped +to key-codes which have not been set in the keybit array causing them +to not send any events at all. + +The lack of a usage code matching the Fn key in the clone is actually +useful as this allows solving this problem in a generic way. + +This commits adds a fn_found flag and it adds a input_configured +callback which checks if this flag is set once all usages have been +mapped. If it is not set, then assume this is a clone and clear the +quirks bitmap so that the hid-apple code does not add any special +handling to this keyboard. + +This fixes F1 - F6 not sending anything at all and F7 - F12 sending +the wrong codes on the Maxxter KB-BT-001 Bluetooth keyboard and on +similar clones. + +Cc: Joao Moreno +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index 197eb75d10ef2..959a9e38b4f54 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -55,6 +55,7 @@ MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") + struct apple_sc { + unsigned long quirks; + unsigned int fn_on; ++ unsigned int fn_found; + DECLARE_BITMAP(pressed_numlock, KEY_CNT); + }; + +@@ -340,12 +341,15 @@ static int apple_input_mapping(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) + { ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ + if (usage->hid == (HID_UP_CUSTOM | 0x0003) || + usage->hid == (HID_UP_MSVENDOR | 0x0003) || + usage->hid == (HID_UP_HPVENDOR2 | 0x0003)) { + /* The fn key on Apple USB keyboards */ + set_bit(EV_REP, hi->input->evbit); + hid_map_usage_clear(hi, usage, bit, max, EV_KEY, KEY_FN); ++ asc->fn_found = true; + apple_setup_input(hi->input); + return 1; + } +@@ -372,6 +376,19 @@ static int apple_input_mapped(struct hid_device *hdev, struct hid_input *hi, + return 0; + } + ++static int apple_input_configured(struct hid_device *hdev, ++ struct hid_input *hidinput) ++{ ++ struct apple_sc *asc = hid_get_drvdata(hdev); ++ ++ if ((asc->quirks & APPLE_HAS_FN) && !asc->fn_found) { ++ hid_info(hdev, "Fn key not found (Apple Wireless Keyboard clone?), disabling Fn key handling\n"); ++ asc->quirks = 0; ++ } ++ ++ return 0; ++} ++ + static int apple_probe(struct hid_device *hdev, + const struct hid_device_id *id) + { +@@ -593,6 +610,7 @@ static struct hid_driver apple_driver = { + .event = apple_event, + .input_mapping = apple_input_mapping, + .input_mapped = apple_input_mapped, ++ .input_configured = apple_input_configured, + }; + module_hid_driver(apple_driver); + +-- +2.25.1 + diff --git a/queue-4.9/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch b/queue-4.9/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch new file mode 100644 index 00000000000..ec047578a02 --- /dev/null +++ b/queue-4.9/hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch @@ -0,0 +1,41 @@ +From 2d40a3280b4002b8fe48dac917e7d38af6af5732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 22:49:11 +0200 +Subject: HID: i2c-hid: add Mediacom FlexBook edge13 to descriptor override + +From: Federico Ricchiuto + +[ Upstream commit 43e666acb79f3d355dd89bf20f4d25d3b15da13e ] + +The Mediacom FlexBook edge13 uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override list. + +Signed-off-by: Federico Ricchiuto +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 681ac9bc68b3d..f98c1e1b1dbdc 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -373,6 +373,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Mediacom FlexBook edge 13", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "MEDIACOM"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook_edge13-M-FBE13"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { + .ident = "Odys Winbook 13", + .matches = { +-- +2.25.1 + diff --git a/queue-4.9/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch b/queue-4.9/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch new file mode 100644 index 00000000000..b9a66eda407 --- /dev/null +++ b/queue-4.9/hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch @@ -0,0 +1,39 @@ +From 5647869fea2d2945adaccd76a6f0ad1b5d401fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 13:00:27 +0200 +Subject: hippi: Fix a size used in a 'pci_free_consistent()' in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit 3195c4706b00106aa82c73acd28340fa8fc2bfc1 ] + +The size used when calling 'pci_alloc_consistent()' and +'pci_free_consistent()' should match. + +Fix it and have it consistent with the corresponding call in 'rr_close()'. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hippi/rrunner.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 313e006f74feb..6f3519123eb66 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1250,7 +1250,7 @@ static int rr_open(struct net_device *dev) + rrpriv->info = NULL; + } + if (rrpriv->rx_ctrl) { +- pci_free_consistent(pdev, sizeof(struct ring_ctrl), ++ pci_free_consistent(pdev, 256 * sizeof(struct ring_ctrl), + rrpriv->rx_ctrl, rrpriv->rx_ctrl_dma); + rrpriv->rx_ctrl = NULL; + } +-- +2.25.1 + diff --git a/queue-4.9/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch b/queue-4.9/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch new file mode 100644 index 00000000000..3e9338cc28d --- /dev/null +++ b/queue-4.9/net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch @@ -0,0 +1,66 @@ +From f48cfe1fa4809e62ccaff53fba1afc49aed53d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 19:10:00 +0300 +Subject: net: dp83640: fix SIOCSHWTSTAMP to update the struct with actual + configuration + +From: Sergey Organov + +[ Upstream commit 473309fb8372365ad211f425bca760af800e10a7 ] + +From Documentation/networking/timestamping.txt: + + A driver which supports hardware time stamping shall update the + struct with the actual, possibly more permissive configuration. + +Do update the struct passed when we upscale the requested time +stamping mode. + +Fixes: cb646e2b02b2 ("ptp: Added a clock driver for the National Semiconductor PHYTER.") +Signed-off-by: Sergey Organov +Acked-by: Richard Cochran +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83640.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index 7e94526de51c3..5649cc075ccbb 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -1337,6 +1337,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V1; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V1_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L4_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L4_SYNC: +@@ -1344,6 +1345,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L4_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_L2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_L2_SYNC: +@@ -1351,6 +1353,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; + break; + case HWTSTAMP_FILTER_PTP_V2_EVENT: + case HWTSTAMP_FILTER_PTP_V2_SYNC: +@@ -1358,6 +1361,7 @@ static int dp83640_hwtstamp(struct phy_device *phydev, struct ifreq *ifr) + dp83640->hwts_rx_en = 1; + dp83640->layer = PTP_CLASS_L4 | PTP_CLASS_L2; + dp83640->version = PTP_CLASS_V2; ++ cfg.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; + break; + default: + return -ERANGE; +-- +2.25.1 + diff --git a/queue-4.9/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch b/queue-4.9/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch new file mode 100644 index 00000000000..9c51562a13a --- /dev/null +++ b/queue-4.9/net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch @@ -0,0 +1,47 @@ +From 688e718a3b83ca605d0a6e83f8e61f74411387ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 11:50:38 +0800 +Subject: net: smc91x: Fix possible memory leak in smc_drv_probe() + +From: Wang Hai + +[ Upstream commit bca9749b1aa23d964d3ab930938af66dbf887f15 ] + +If try_toggle_control_gpio() failed in smc_drv_probe(), free_netdev(ndev) +should be called to free the ndev created earlier. Otherwise, a memleak +will occur. + +Fixes: 7d2911c43815 ("net: smc91x: Fix gpios for device tree based booting") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc91x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c +index b0c72167badec..3c221ca2cc125 100644 +--- a/drivers/net/ethernet/smsc/smc91x.c ++++ b/drivers/net/ethernet/smsc/smc91x.c +@@ -2294,7 +2294,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio, + "power", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Optional reset GPIO configured? Minimum 100 ns reset needed +@@ -2303,7 +2303,7 @@ static int smc_drv_probe(struct platform_device *pdev) + ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio, + "reset", 0, 0, 100); + if (ret) +- return ret; ++ goto out_free_netdev; + + /* + * Need to wait for optional EEPROM to load, max 750 us according +-- +2.25.1 + diff --git a/queue-4.9/regmap-dev_get_regmap_match-fix-string-comparison.patch b/queue-4.9/regmap-dev_get_regmap_match-fix-string-comparison.patch new file mode 100644 index 00000000000..fd70b05080d --- /dev/null +++ b/queue-4.9/regmap-dev_get_regmap_match-fix-string-comparison.patch @@ -0,0 +1,43 @@ +From fa5bdb68842ab13996bd1a2648c1ccfd74b01f81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 12:33:15 +0200 +Subject: regmap: dev_get_regmap_match(): fix string comparison + +From: Marc Kleine-Budde + +[ Upstream commit e84861fec32dee8a2e62bbaa52cded6b05a2a456 ] + +This function is used by dev_get_regmap() to retrieve a regmap for the +specified device. If the device has more than one regmap, the name parameter +can be used to specify one. + +The code here uses a pointer comparison to check for equal strings. This +however will probably always fail, as the regmap->name is allocated via +kstrdup_const() from the regmap's config->name. + +Fix this by using strcmp() instead. + +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20200703103315.267996-1-mkl@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 1799a1dfa46ea..cd984b59a8a16 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1239,7 +1239,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) + + /* If the user didn't specify a name match any */ + if (data) +- return (*r)->name == data; ++ return !strcmp((*r)->name, data); + else + return 1; + } +-- +2.25.1 + diff --git a/queue-4.9/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch b/queue-4.9/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch new file mode 100644 index 00000000000..d3e0b72bf63 --- /dev/null +++ b/queue-4.9/scripts-decode_stacktrace-strip-basepath-from-all-pa.patch @@ -0,0 +1,49 @@ +From 2fbae98efb92ae5572c812ab616758f631c5675b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 21:15:43 -0700 +Subject: scripts/decode_stacktrace: strip basepath from all paths + +From: Pi-Hsun Shih + +[ Upstream commit d178770d8d21489abf5bafefcbb6d5243b482e9a ] + +Currently the basepath is removed only from the beginning of the string. +When the symbol is inlined and there's multiple line outputs of +addr2line, only the first line would have basepath removed. + +Change to remove the basepath prefix from all lines. + +Fixes: 31013836a71e ("scripts/decode_stacktrace: match basepath using shell prefix operator, not regex") +Co-developed-by: Shik Chen +Signed-off-by: Pi-Hsun Shih +Signed-off-by: Shik Chen +Signed-off-by: Andrew Morton +Reviewed-by: Stephen Boyd +Cc: Sasha Levin +Cc: Nicolas Boichat +Cc: Jiri Slaby +Link: http://lkml.kernel.org/r/20200720082709.252805-1-pihsun@chromium.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 98cf6343afcd7..61564e56e3aa3 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -76,8 +76,8 @@ parse_symbol() { + return + fi + +- # Strip out the base of the path +- code=${code#$basepath/} ++ # Strip out the base of the path on each line ++ code=$(while read -r line; do echo "${line#$basepath/}"; done <<< "$code") + + # In the case of inlines, move everything to same line + code=${code//$'\n'/' '} +-- +2.25.1 + diff --git a/queue-4.9/series b/queue-4.9/series index c04df4beb97..8fa9f73c3a4 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -12,3 +12,17 @@ alsa-info-drop-warn_on-from-buffer-null-sanity-check.patch asoc-rt5670-correct-rt5670_ldo_sel_mask.patch btrfs-fix-double-free-on-ulist-after-backref-resolution-failure.patch btrfs-fix-mount-failure-caused-by-race-with-umount.patch +bnxt_en-fix-race-when-modifying-pause-settings.patch +hippi-fix-a-size-used-in-a-pci_free_consistent-in-an.patch +ax88172a-fix-ax88172a_unbind-failures.patch +net-dp83640-fix-siocshwtstamp-to-update-the-struct-w.patch +net-smc91x-fix-possible-memory-leak-in-smc_drv_probe.patch +scripts-decode_stacktrace-strip-basepath-from-all-pa.patch +hid-i2c-hid-add-mediacom-flexbook-edge13-to-descript.patch +hid-apple-disable-fn-key-key-re-mapping-on-clone-key.patch +dmaengine-tegra210-adma-fix-runtime-pm-imbalance-on-.patch +regmap-dev_get_regmap_match-fix-string-comparison.patch +dmaengine-ioat-setting-ioat-timeout-as-module-parame.patch +usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch +arm64-use-test_tsk_thread_flag-for-checking-tif_sing.patch +x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch diff --git a/queue-4.9/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch b/queue-4.9/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch new file mode 100644 index 00000000000..9dc9b7bc4a8 --- /dev/null +++ b/queue-4.9/usb-gadget-udc-gr_udc-fix-memleak-on-error-handling-.patch @@ -0,0 +1,45 @@ +From 9993c42e16d370a4068f914a2497e17938f843a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 16:17:47 +0300 +Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in + gr_ep_init() + +From: Evgeny Novikov + +[ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ] + +gr_ep_init() does not assign the allocated request anywhere if allocation +of memory for the buffer fails. This is a memory leak fixed by the given +patch. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c +index 9e246d2e55ca3..f2b165182b4be 100644 +--- a/drivers/usb/gadget/udc/gr_udc.c ++++ b/drivers/usb/gadget/udc/gr_udc.c +@@ -2000,9 +2000,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) + + if (num == 0) { + _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); ++ if (!_req) ++ return -ENOMEM; ++ + buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); +- if (!_req || !buf) { +- /* possible _req freed by gr_probe via gr_remove */ ++ if (!buf) { ++ gr_free_request(&ep->ep, _req); + return -ENOMEM; + } + +-- +2.25.1 + diff --git a/queue-4.9/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch b/queue-4.9/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch new file mode 100644 index 00000000000..945dabe9d8d --- /dev/null +++ b/queue-4.9/x86-math-emu-fix-up-cmp-insn-for-clang-ias.patch @@ -0,0 +1,43 @@ +From 1fbb0ea4edcdace7f5363154ff1bcd323a4e5221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 15:53:46 +0200 +Subject: x86: math-emu: Fix up 'cmp' insn for clang ias + +From: Arnd Bergmann + +[ Upstream commit 81e96851ea32deb2c921c870eecabf335f598aeb ] + +The clang integrated assembler requires the 'cmp' instruction to +have a length prefix here: + +arch/x86/math-emu/wm_sqrt.S:212:2: error: ambiguous instructions require an explicit suffix (could be 'cmpb', 'cmpw', or 'cmpl') + cmp $0xffffffff,-24(%ebp) + ^ + +Make this a 32-bit comparison, which it was clearly meant to be. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Gleixner +Reviewed-by: Nick Desaulniers +Link: https://lkml.kernel.org/r/20200527135352.1198078-1-arnd@arndb.de +Signed-off-by: Sasha Levin +--- + arch/x86/math-emu/wm_sqrt.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/math-emu/wm_sqrt.S b/arch/x86/math-emu/wm_sqrt.S +index d258f59564e11..3b40c98bbbd40 100644 +--- a/arch/x86/math-emu/wm_sqrt.S ++++ b/arch/x86/math-emu/wm_sqrt.S +@@ -208,7 +208,7 @@ sqrt_stage_2_finish: + + #ifdef PARANOID + /* It should be possible to get here only if the arg is ffff....ffff */ +- cmp $0xffffffff,FPU_fsqrt_arg_1 ++ cmpl $0xffffffff,FPU_fsqrt_arg_1 + jnz sqrt_stage_2_error + #endif /* PARANOID */ + +-- +2.25.1 + -- 2.47.3