From 457a3eb6defbd8cbcbd6f2af0084eab776cde9f1 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 12 Jul 2020 23:22:00 -0400 Subject: [PATCH] Fixes for 4.14 Signed-off-by: Sasha Levin --- ...s-fix-partial_drain-completion-state.patch | 90 ++++++++++++++ ...-single-step-exception-handling-oops.patch | 115 ++++++++++++++++++ ...-dereference-in-case-sr-iov-configur.patch | 93 ++++++++++++++ ...outer-remove-inappropriate-usage-of-.patch | 49 ++++++++ ...bd-fix-memory-leak-in-nbd_add_socket.patch | 80 ++++++++++++ ...fix-return-error-value-in-t4_prep_fw.patch | 58 +++++++++ ...vice-wake-capable-when-magic-packet-.patch | 50 ++++++++ queue-4.14/series | 9 ++ ...x-avoid-memory-leak-in-smsc95xx_bind.patch | 39 ++++++ ...check-return-value-of-smsc95xx_reset.patch | 48 ++++++++ 10 files changed, 631 insertions(+) create mode 100644 queue-4.14/alsa-compress-fix-partial_drain-completion-state.patch create mode 100644 queue-4.14/arm64-kgdb-fix-single-step-exception-handling-oops.patch create mode 100644 queue-4.14/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch create mode 100644 queue-4.14/mlxsw-spectrum_router-remove-inappropriate-usage-of-.patch create mode 100644 queue-4.14/nbd-fix-memory-leak-in-nbd_add_socket.patch create mode 100644 queue-4.14/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch create mode 100644 queue-4.14/net-macb-mark-device-wake-capable-when-magic-packet-.patch create mode 100644 queue-4.14/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch create mode 100644 queue-4.14/smsc95xx-check-return-value-of-smsc95xx_reset.patch diff --git a/queue-4.14/alsa-compress-fix-partial_drain-completion-state.patch b/queue-4.14/alsa-compress-fix-partial_drain-completion-state.patch new file mode 100644 index 00000000000..fe949d29383 --- /dev/null +++ b/queue-4.14/alsa-compress-fix-partial_drain-completion-state.patch @@ -0,0 +1,90 @@ +From 74c987a24b45be3528da8be7d70034a2e0e1e52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 19:17:37 +0530 +Subject: ALSA: compress: fix partial_drain completion state + +From: Vinod Koul + +[ Upstream commit f79a732a8325dfbd570d87f1435019d7e5501c6d ] + +On partial_drain completion we should be in SNDRV_PCM_STATE_RUNNING +state, so set that for partially draining streams in +snd_compr_drain_notify() and use a flag for partially draining streams + +While at it, add locks for stream state change in +snd_compr_drain_notify() as well. + +Fixes: f44f2a5417b2 ("ALSA: compress: fix drain calls blocking other compress functions (v6)") +Reviewed-by: Srinivas Kandagatla +Tested-by: Srinivas Kandagatla +Reviewed-by: Charles Keepax +Tested-by: Charles Keepax +Signed-off-by: Vinod Koul +Link: https://lore.kernel.org/r/20200629134737.105993-4-vkoul@kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/compress_driver.h | 10 +++++++++- + sound/core/compress_offload.c | 4 ++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h +index 33a07c3badf01..f58b8edf0371b 100644 +--- a/include/sound/compress_driver.h ++++ b/include/sound/compress_driver.h +@@ -72,6 +72,7 @@ struct snd_compr_runtime { + * @direction: stream direction, playback/recording + * @metadata_set: metadata set flag, true when set + * @next_track: has userspace signal next track transition, true when set ++ * @partial_drain: undergoing partial_drain for stream, true when set + * @private_data: pointer to DSP private data + */ + struct snd_compr_stream { +@@ -83,6 +84,7 @@ struct snd_compr_stream { + enum snd_compr_direction direction; + bool metadata_set; + bool next_track; ++ bool partial_drain; + void *private_data; + }; + +@@ -186,7 +188,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) + if (snd_BUG_ON(!stream)) + return; + +- stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ /* for partial_drain case we are back to running state on success */ ++ if (stream->partial_drain) { ++ stream->runtime->state = SNDRV_PCM_STATE_RUNNING; ++ stream->partial_drain = false; /* clear this flag as well */ ++ } else { ++ stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ } + + wake_up(&stream->runtime->sleep); + } +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 7ae8e24dc1e61..81624f6e3f330 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -723,6 +723,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) + + retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); + if (!retval) { ++ /* clear flags and stop any drain wait */ ++ stream->partial_drain = false; ++ stream->metadata_set = false; + snd_compr_drain_notify(stream); + stream->runtime->total_bytes_available = 0; + stream->runtime->total_bytes_transferred = 0; +@@ -880,6 +883,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) + if (stream->next_track == false) + return -EPERM; + ++ stream->partial_drain = true; + retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN); + if (retval) { + pr_debug("Partial drain returned failure\n"); +-- +2.25.1 + diff --git a/queue-4.14/arm64-kgdb-fix-single-step-exception-handling-oops.patch b/queue-4.14/arm64-kgdb-fix-single-step-exception-handling-oops.patch new file mode 100644 index 00000000000..5e4ce594023 --- /dev/null +++ b/queue-4.14/arm64-kgdb-fix-single-step-exception-handling-oops.patch @@ -0,0 +1,115 @@ +From c221f8e85a049f00c96d324335a121201ab61c86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 May 2020 05:41:56 +0800 +Subject: arm64: kgdb: Fix single-step exception handling oops + +From: Wei Li + +[ Upstream commit 8523c006264df65aac7d77284cc69aac46a6f842 ] + +After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will +delay installing breakpoints, do single-step first), it won't work +correctly, and it will enter kdb due to oops. + +It's because the reason gotten in kdb_stub() is not as expected, and it +seems that the ex_vector for single-step should be 0, like what arch +powerpc/sh/parisc has implemented. + +Before the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc +[3]kdb> ss + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null) +due to oops @ 0xffff800010082ab8 +CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6 +Hardware name: linux,dummy-virt (DT) +pstate: 00000085 (nzcv daIf -PAN -UAO) +pc : el1_irq+0x78/0x180 +lr : __handle_sysrq+0x80/0x190 +sp : ffff800015003bf0 +x29: ffff800015003d20 x28: ffff0000fa878040 +x27: 0000000000000000 x26: ffff80001126b1f0 +x25: ffff800011b6a0d8 x24: 0000000000000000 +x23: 0000000080200005 x22: ffff8000101486cc +x21: ffff800015003d30 x20: 0000ffffffffffff +x19: ffff8000119f2000 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000000 x10: 0000000000000000 +x9 : 0000000000000000 x8 : ffff800015003e50 +x7 : 0000000000000002 x6 : 00000000380b9990 +x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0 +x3 : 0000ffffffffffff x2 : ffff800011b6a0d8 +x1 : ffff800011b6a000 x0 : ffff80001130c9d8 +Call trace: + el1_irq+0x78/0x180 + printk+0x0/0x84 + write_sysrq_trigger+0xb0/0x118 + proc_reg_write+0xb4/0xe0 + __vfs_write+0x18/0x40 + vfs_write+0xb0/0x1b8 + ksys_write+0x64/0xf0 + __arm64_sys_write+0x14/0x20 + el0_svc_common.constprop.2+0xb0/0x168 + do_el0_svc+0x20/0x98 + el0_sync_handler+0xec/0x1a8 + el0_sync+0x140/0x180 + +[3]kdb> + +After the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> g + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> ss + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8 +[0]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Signed-off-by: Wei Li +Tested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200509214159.19680-2-liwei391@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/kgdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index 470afb3a04ca9..7fd7a9cd86161 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -258,7 +258,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + if (user_mode(regs) || !kgdb_single_step) + return DBG_HOOK_ERROR; + +- kgdb_handle_exception(1, SIGTRAP, 0, regs); ++ kgdb_handle_exception(0, SIGTRAP, 0, regs); + return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); +-- +2.25.1 + diff --git a/queue-4.14/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch b/queue-4.14/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch new file mode 100644 index 00000000000..a59452e3303 --- /dev/null +++ b/queue-4.14/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch @@ -0,0 +1,93 @@ +From 463c3e1af9275807a520e749563f767874bff7c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 12:55:08 +0200 +Subject: bnxt_en: fix NULL dereference in case SR-IOV configuration fails + +From: Davide Caratti + +[ Upstream commit c8b1d7436045d3599bae56aef1682813ecccaad7 ] + +we need to set 'active_vfs' back to 0, if something goes wrong during the +allocation of SR-IOV resources: otherwise, further VF configurations will +wrongly assume that bp->pf.vf[x] are valid memory locations, and commands +like the ones in the following sequence: + + # echo 2 >/sys/bus/pci/devices/${ADDR}/sriov_numvfs + # ip link set dev ens1f0np0 up + # ip link set dev ens1f0np0 vf 0 trust on + +will cause a kernel crash similar to this: + + bnxt_en 0000:3b:00.0: not enough MMIO resources for SR-IOV + BUG: kernel NULL pointer dereference, address: 0000000000000014 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + CPU: 43 PID: 2059 Comm: ip Tainted: G I 5.8.0-rc2.upstream+ #871 + Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 2.2.11 06/13/2019 + RIP: 0010:bnxt_set_vf_trust+0x5b/0x110 [bnxt_en] + Code: 44 24 58 31 c0 e8 f5 fb ff ff 85 c0 0f 85 b6 00 00 00 48 8d 1c 5b 41 89 c6 b9 0b 00 00 00 48 c1 e3 04 49 03 9c 24 f0 0e 00 00 <8b> 43 14 89 c2 83 c8 10 83 e2 ef 45 84 ed 49 89 e5 0f 44 c2 4c 89 + RSP: 0018:ffffac6246a1f570 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000b + RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff98b28f538900 + RBP: ffff98b28f538900 R08: 0000000000000000 R09: 0000000000000008 + R10: ffffffffb9515be0 R11: ffffac6246a1f678 R12: ffff98b28f538000 + R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffc05451e0 + FS: 00007fde0f688800(0000) GS:ffff98baffd40000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000014 CR3: 000000104bb0a003 CR4: 00000000007606e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + PKRU: 55555554 + Call Trace: + do_setlink+0x994/0xfe0 + __rtnl_newlink+0x544/0x8d0 + rtnl_newlink+0x47/0x70 + rtnetlink_rcv_msg+0x29f/0x350 + netlink_rcv_skb+0x4a/0x110 + netlink_unicast+0x21d/0x300 + netlink_sendmsg+0x329/0x450 + sock_sendmsg+0x5b/0x60 + ____sys_sendmsg+0x204/0x280 + ___sys_sendmsg+0x88/0xd0 + __sys_sendmsg+0x5e/0xa0 + do_syscall_64+0x47/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Fei Liu +CC: Jonathan Toppins +CC: Michael Chan +Signed-off-by: Davide Caratti +Reviewed-by: Michael Chan +Acked-by: Jonathan Toppins +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index cef59b3b77a39..f0bc8f5246c0a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -344,6 +344,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp) + } + } + ++ bp->pf.active_vfs = 0; + kfree(bp->pf.vf); + bp->pf.vf = NULL; + } +@@ -608,7 +609,6 @@ void bnxt_sriov_disable(struct bnxt *bp) + + bnxt_free_vf_resources(bp); + +- bp->pf.active_vfs = 0; + /* Reclaim all resources for the PF. */ + rtnl_lock(); + bnxt_restore_pf_fw_resources(bp); +-- +2.25.1 + diff --git a/queue-4.14/mlxsw-spectrum_router-remove-inappropriate-usage-of-.patch b/queue-4.14/mlxsw-spectrum_router-remove-inappropriate-usage-of-.patch new file mode 100644 index 00000000000..e34dcde4844 --- /dev/null +++ b/queue-4.14/mlxsw-spectrum_router-remove-inappropriate-usage-of-.patch @@ -0,0 +1,49 @@ +From a357b189f7894b3ba9192f54998eded113f0a468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 16:41:38 +0300 +Subject: mlxsw: spectrum_router: Remove inappropriate usage of WARN_ON() + +From: Ido Schimmel + +[ Upstream commit d9d5420273997664a1c09151ca86ac993f2f89c1 ] + +We should not trigger a warning when a memory allocation fails. Remove +the WARN_ON(). + +The warning is constantly triggered by syzkaller when it is injecting +faults: + +[ 2230.758664] FAULT_INJECTION: forcing a failure. +[ 2230.758664] name failslab, interval 1, probability 0, space 0, times 0 +[ 2230.762329] CPU: 3 PID: 1407 Comm: syz-executor.0 Not tainted 5.8.0-rc2+ #28 +... +[ 2230.898175] WARNING: CPU: 3 PID: 1407 at drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:6265 mlxsw_sp_router_fib_event+0xfad/0x13e0 +[ 2230.898179] Kernel panic - not syncing: panic_on_warn set ... +[ 2230.898183] CPU: 3 PID: 1407 Comm: syz-executor.0 Not tainted 5.8.0-rc2+ #28 +[ 2230.898190] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + +Fixes: 3057224e014c ("mlxsw: spectrum_router: Implement FIB offload in deferred work") +Signed-off-by: Ido Schimmel +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 05a2006a20b9b..d9cd86c675569 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -4932,7 +4932,7 @@ static int mlxsw_sp_router_fib_event(struct notifier_block *nb, + return NOTIFY_DONE; + + fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC); +- if (WARN_ON(!fib_work)) ++ if (!fib_work) + return NOTIFY_BAD; + + router = container_of(nb, struct mlxsw_sp_router, fib_nb); +-- +2.25.1 + diff --git a/queue-4.14/nbd-fix-memory-leak-in-nbd_add_socket.patch b/queue-4.14/nbd-fix-memory-leak-in-nbd_add_socket.patch new file mode 100644 index 00000000000..0945db17b07 --- /dev/null +++ b/queue-4.14/nbd-fix-memory-leak-in-nbd_add_socket.patch @@ -0,0 +1,80 @@ +From 6d48d28cac2f3136c140d34686e8a0b970f3566e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 09:23:49 +0800 +Subject: nbd: Fix memory leak in nbd_add_socket + +From: Zheng Bin + +[ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] + +When adding first socket to nbd, if nsock's allocation failed, the data +structure member "config->socks" was reallocated, but the data structure +member "config->num_connections" was not updated. A memory leak will occur +then because the function "nbd_config_put" will free "config->socks" only +when "config->num_connections" is not zero. + +Fixes: 03bf73c315ed ("nbd: prevent memory leak") +Reported-by: syzbot+934037347002901b8d2a@syzkaller.appspotmail.com +Signed-off-by: Zheng Bin +Reviewed-by: Eric Biggers +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 8f56e6b2f114f..f22fad977c913 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -960,25 +960,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + test_bit(NBD_BOUND, &config->runtime_flags))) { + dev_err(disk_to_dev(nbd->disk), + "Device being setup by another task"); +- sockfd_put(sock); +- return -EBUSY; ++ err = -EBUSY; ++ goto put_socket; ++ } ++ ++ nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); ++ if (!nsock) { ++ err = -ENOMEM; ++ goto put_socket; + } + + socks = krealloc(config->socks, (config->num_connections + 1) * + sizeof(struct nbd_sock *), GFP_KERNEL); + if (!socks) { +- sockfd_put(sock); +- return -ENOMEM; ++ kfree(nsock); ++ err = -ENOMEM; ++ goto put_socket; + } + + config->socks = socks; + +- nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); +- if (!nsock) { +- sockfd_put(sock); +- return -ENOMEM; +- } +- + nsock->fallback_index = -1; + nsock->dead = false; + mutex_init(&nsock->tx_lock); +@@ -990,6 +991,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, + atomic_inc(&config->live_connections); + + return 0; ++ ++put_socket: ++ sockfd_put(sock); ++ return err; + } + + static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) +-- +2.25.1 + diff --git a/queue-4.14/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch b/queue-4.14/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch new file mode 100644 index 00000000000..7334826c9df --- /dev/null +++ b/queue-4.14/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch @@ -0,0 +1,58 @@ +From 61478a57d2b573f0dceff5dd27cdef1ed0c05a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 18:49:51 +0800 +Subject: net: cxgb4: fix return error value in t4_prep_fw + +From: Li Heng + +[ Upstream commit 8a259e6b73ad8181b0b2ef338b35043433db1075 ] + +t4_prep_fw goto bye tag with positive return value when something +bad happened and which can not free resource in adap_init0. +so fix it to return negative value. + +Fixes: 16e47624e76b ("cxgb4: Add new scheme to update T4/T5 firmware") +Reported-by: Hulk Robot +Signed-off-by: Li Heng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 0f126ce4645f3..ecb8ef4a756fc 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3361,7 +3361,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + drv_fw = &fw_info->fw_hdr; + + /* Read the header of the firmware on the card */ +- ret = -t4_read_flash(adap, FLASH_FW_START, ++ ret = t4_read_flash(adap, FLASH_FW_START, + sizeof(*card_fw) / sizeof(uint32_t), + (uint32_t *)card_fw, 1); + if (ret == 0) { +@@ -3390,8 +3390,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + should_install_fs_fw(adap, card_fw_usable, + be32_to_cpu(fs_fw->fw_ver), + be32_to_cpu(card_fw->fw_ver))) { +- ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, +- fw_size, 0); ++ ret = t4_fw_upgrade(adap, adap->mbox, fw_data, ++ fw_size, 0); + if (ret != 0) { + dev_err(adap->pdev_dev, + "failed to install firmware: %d\n", ret); +@@ -3422,7 +3422,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); +- ret = EINVAL; ++ ret = -EINVAL; + goto bye; + } + +-- +2.25.1 + diff --git a/queue-4.14/net-macb-mark-device-wake-capable-when-magic-packet-.patch b/queue-4.14/net-macb-mark-device-wake-capable-when-magic-packet-.patch new file mode 100644 index 00000000000..265c96a6256 --- /dev/null +++ b/queue-4.14/net-macb-mark-device-wake-capable-when-magic-packet-.patch @@ -0,0 +1,50 @@ +From 8023f01f83083c1d56fde1b95894d2264e17cad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 14:46:42 +0200 +Subject: net: macb: mark device wake capable when "magic-packet" property + present + +From: Nicolas Ferre + +[ Upstream commit ced4799d06375929e013eea04ba6908207afabbe ] + +Change the way the "magic-packet" DT property is handled in the +macb_probe() function, matching DT binding documentation. +Now we mark the device as "wakeup capable" instead of calling the +device_init_wakeup() function that would enable the wakeup source. + +For Ethernet WoL, enabling the wakeup_source is done by +using ethtool and associated macb_set_wol() function that +already calls device_set_wakeup_enable() for this purpose. + +That would reduce power consumption by cutting more clocks if +"magic-packet" property is set but WoL is not configured by ethtool. + +Fixes: 3e2a5e153906 ("net: macb: add wake-on-lan support via magic packet") +Cc: Claudiu Beznea +Cc: Harini Katakam +Cc: Sergio Prado +Reviewed-by: Florian Fainelli +Signed-off-by: Nicolas Ferre +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index b01b242c2bf00..4d2a996ba4460 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -3516,7 +3516,7 @@ static int macb_probe(struct platform_device *pdev) + bp->wol = 0; + if (of_get_property(np, "magic-packet", NULL)) + bp->wol |= MACB_WOL_HAS_MAGIC_PACKET; +- device_init_wakeup(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET); ++ device_set_wakeup_capable(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET); + + spin_lock_init(&bp->lock); + +-- +2.25.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 5bfa9665431..d79e0bcc6e1 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -15,3 +15,12 @@ arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch scsi-mptscsih-fix-read-sense-data-size.patch nvme-rdma-assign-completion-vector-correctly.patch x86-entry-increase-entry_stack-size-to-a-full-page.patch +net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch +smsc95xx-check-return-value-of-smsc95xx_reset.patch +smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch +alsa-compress-fix-partial_drain-completion-state.patch +arm64-kgdb-fix-single-step-exception-handling-oops.patch +nbd-fix-memory-leak-in-nbd_add_socket.patch +bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch +net-macb-mark-device-wake-capable-when-magic-packet-.patch +mlxsw-spectrum_router-remove-inappropriate-usage-of-.patch diff --git a/queue-4.14/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch b/queue-4.14/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch new file mode 100644 index 00000000000..d5af81b472e --- /dev/null +++ b/queue-4.14/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch @@ -0,0 +1,39 @@ +From 173fd5b76015fb87cbd097cf379a6c787afd97d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 10:39:35 +0200 +Subject: smsc95xx: avoid memory leak in smsc95xx_bind + +From: Andre Edich + +[ Upstream commit 3ed58f96a70b85ef646d5427258f677f1395b62f ] + +In a case where the ID_REV register read is failed, the memory for a +private data structure has to be freed before returning error from the +function smsc95xx_bind. + +Fixes: bbd9f9ee69242 ("smsc95xx: add wol support for more frame types") +Signed-off-by: Andre Edich +Signed-off-by: Parthiban Veerasooran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 859dfb4a9a576..bc6bcea67bff3 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1307,7 +1307,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + /* detect device revision as different features may be available */ + ret = smsc95xx_read_reg(dev, ID_REV, &val); + if (ret < 0) +- return ret; ++ goto free_pdata; ++ + val >>= 16; + pdata->chip_id = val; + pdata->mdix_ctrl = get_mdix_status(dev->net); +-- +2.25.1 + diff --git a/queue-4.14/smsc95xx-check-return-value-of-smsc95xx_reset.patch b/queue-4.14/smsc95xx-check-return-value-of-smsc95xx_reset.patch new file mode 100644 index 00000000000..ed0adb5cfda --- /dev/null +++ b/queue-4.14/smsc95xx-check-return-value-of-smsc95xx_reset.patch @@ -0,0 +1,48 @@ +From caf97cfb6c7d8e325834c931bb93377daecfae10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 10:39:34 +0200 +Subject: smsc95xx: check return value of smsc95xx_reset + +From: Andre Edich + +[ Upstream commit 7c8b1e855f94f88a0c569be6309fc8d5c8844cd1 ] + +The return value of the function smsc95xx_reset() must be checked +to avoid returning false success from the function smsc95xx_bind(). + +Fixes: 2f7ca802bdae2 ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Andre Edich +Signed-off-by: Parthiban Veerasooran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index bcb99bee450a5..859dfb4a9a576 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1301,6 +1301,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + + /* Init all registers */ + ret = smsc95xx_reset(dev); ++ if (ret) ++ goto free_pdata; + + /* detect device revision as different features may be available */ + ret = smsc95xx_read_reg(dev, ID_REV, &val); +@@ -1331,6 +1333,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY); + + return 0; ++ ++free_pdata: ++ kfree(pdata); ++ return ret; + } + + static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) +-- +2.25.1 + -- 2.47.3