From 69aaf98f41593b95c012d91b3e5adeb8360b4b8d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 19 Mar 2023 18:25:15 -0400 Subject: [PATCH] Fixes for 4.14 Signed-off-by: Sasha Levin --- ...t4_iget-if-special-inode-unallocated.patch | 76 +++++++++++++++ ...task-hung-in-ext4_xattr_delete_inode.patch | 97 +++++++++++++++++++ ...splay-smoothing-attributes-in-correc.patch | 44 +++++++++ ...-fix-masking-of-hysteresis-registers.patch | 42 ++++++++ ...use-after-free-bug-in-xgene_hwmon_re.patch | 52 ++++++++++ ...ix-off-by-one-loop-termination-error.patch | 62 ++++++++++++ ...x-race-between-stop-command-and-star.patch | 58 +++++++++++ ...able-fp-simd-instruction-to-match-x8.patch | 53 ++++++++++ queue-4.14/series | 9 ++ ...-spurious-sizeof-pointer-div-warning.patch | 51 ++++++++++ 10 files changed, 544 insertions(+) create mode 100644 queue-4.14/ext4-fail-ext4_iget-if-special-inode-unallocated.patch create mode 100644 queue-4.14/ext4-fix-task-hung-in-ext4_xattr_delete_inode.patch create mode 100644 queue-4.14/hwmon-adt7475-display-smoothing-attributes-in-correc.patch create mode 100644 queue-4.14/hwmon-adt7475-fix-masking-of-hysteresis-registers.patch create mode 100644 queue-4.14/hwmon-xgene-fix-use-after-free-bug-in-xgene_hwmon_re.patch create mode 100644 queue-4.14/media-m5mols-fix-off-by-one-loop-termination-error.patch create mode 100644 queue-4.14/mmc-atmel-mci-fix-race-between-stop-command-and-star.patch create mode 100644 queue-4.14/rust-arch-um-disable-fp-simd-instruction-to-match-x8.patch create mode 100644 queue-4.14/sh-intc-avoid-spurious-sizeof-pointer-div-warning.patch diff --git a/queue-4.14/ext4-fail-ext4_iget-if-special-inode-unallocated.patch b/queue-4.14/ext4-fail-ext4_iget-if-special-inode-unallocated.patch new file mode 100644 index 00000000000..71146f07614 --- /dev/null +++ b/queue-4.14/ext4-fail-ext4_iget-if-special-inode-unallocated.patch @@ -0,0 +1,76 @@ +From 21d7d4e131e0013ba689dda89e4fb5f7bde12005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Jan 2023 11:21:25 +0800 +Subject: ext4: fail ext4_iget if special inode unallocated +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Baokun Li + +[ Upstream commit 5cd740287ae5e3f9d1c46f5bfe8778972fd6d3fe ] + +In ext4_fill_super(), EXT4_ORPHAN_FS flag is cleared after +ext4_orphan_cleanup() is executed. Therefore, when __ext4_iget() is +called to get an inode whose i_nlink is 0 when the flag exists, no error +is returned. If the inode is a special inode, a null pointer dereference +may occur. If the value of i_nlink is 0 for any inodes (except boot loader +inodes) got by using the EXT4_IGET_SPECIAL flag, the current file system +is corrupted. Therefore, make the ext4_iget() function return an error if +it gets such an abnormal special inode. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199179 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216541 +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216539 +Reported-by: Luís Henriques +Suggested-by: Theodore Ts'o +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230107032126.4165860-2-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 9d6d3cb515140..69360b08db736 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4814,13 +4814,6 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + goto bad_inode; + raw_inode = ext4_raw_inode(&iloc); + +- if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) { +- ext4_error_inode(inode, function, line, 0, +- "iget: root inode unallocated"); +- ret = -EFSCORRUPTED; +- goto bad_inode; +- } +- + if ((flags & EXT4_IGET_HANDLE) && + (raw_inode->i_links_count == 0) && (raw_inode->i_mode == 0)) { + ret = -ESTALE; +@@ -4891,11 +4884,16 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, + * NeilBrown 1999oct15 + */ + if (inode->i_nlink == 0) { +- if ((inode->i_mode == 0 || ++ if ((inode->i_mode == 0 || flags & EXT4_IGET_SPECIAL || + !(EXT4_SB(inode->i_sb)->s_mount_state & EXT4_ORPHAN_FS)) && + ino != EXT4_BOOT_LOADER_INO) { +- /* this inode is deleted */ +- ret = -ESTALE; ++ /* this inode is deleted or unallocated */ ++ if (flags & EXT4_IGET_SPECIAL) { ++ ext4_error_inode(inode, function, line, 0, ++ "iget: special inode unallocated"); ++ ret = -EFSCORRUPTED; ++ } else ++ ret = -ESTALE; + goto bad_inode; + } + /* The only unlinked inodes we let through here have +-- +2.39.2 + diff --git a/queue-4.14/ext4-fix-task-hung-in-ext4_xattr_delete_inode.patch b/queue-4.14/ext4-fix-task-hung-in-ext4_xattr_delete_inode.patch new file mode 100644 index 00000000000..f91efdf7b15 --- /dev/null +++ b/queue-4.14/ext4-fix-task-hung-in-ext4_xattr_delete_inode.patch @@ -0,0 +1,97 @@ +From 130787763116bb2183112fb567e45f08fd0ccb4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Jan 2023 21:34:36 +0800 +Subject: ext4: fix task hung in ext4_xattr_delete_inode + +From: Baokun Li + +[ Upstream commit 0f7bfd6f8164be32dbbdf36aa1e5d00485c53cd7 ] + +Syzbot reported a hung task problem: +================================================================== +INFO: task syz-executor232:5073 blocked for more than 143 seconds. + Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +task:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004 +Call Trace: + + context_switch kernel/sched/core.c:5244 [inline] + __schedule+0x995/0xe20 kernel/sched/core.c:6555 + schedule+0xcb/0x190 kernel/sched/core.c:6631 + __wait_on_freeing_inode fs/inode.c:2196 [inline] + find_inode_fast+0x35a/0x4c0 fs/inode.c:950 + iget_locked+0xb1/0x830 fs/inode.c:1273 + __ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861 + ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389 + ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148 + ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880 + ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296 + evict+0x2a4/0x620 fs/inode.c:664 + ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474 + __ext4_fill_super fs/ext4/super.c:5516 [inline] + ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644 + get_tree_bdev+0x400/0x620 fs/super.c:1282 + vfs_get_tree+0x88/0x270 fs/super.c:1489 + do_new_mount+0x289/0xad0 fs/namespace.c:3145 + do_mount fs/namespace.c:3488 [inline] + __do_sys_mount fs/namespace.c:3697 [inline] + __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7fa5406fd5ea +RSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 +RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea +RDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970 +RBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432 +R10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004 +R13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000 + +================================================================== + +The problem is that the inode contains an xattr entry with ea_inum of 15 +when cleaning up an orphan inode <15>. When evict inode <15>, the reference +counting of the corresponding EA inode is decreased. When EA inode <15> is +found by find_inode_fast() in __ext4_iget(), it is found that the EA inode +holds the I_FREEING flag and waits for the EA inode to complete deletion. +As a result, when inode <15> is being deleted, we wait for inode <15> to +complete the deletion, resulting in an infinite loop and triggering Hung +Task. To solve this problem, we only need to check whether the ino of EA +inode and parent is the same before getting EA inode. + +Link: https://syzkaller.appspot.com/bug?extid=77d6fcc37bbb92f26048 +Reported-by: syzbot+77d6fcc37bbb92f26048@syzkaller.appspotmail.com +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20230110133436.996350-1-libaokun1@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/xattr.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index e1b40bd2f4cf2..3ee3e382015ff 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -383,6 +383,17 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino, + struct inode *inode; + int err; + ++ /* ++ * We have to check for this corruption early as otherwise ++ * iget_locked() could wait indefinitely for the state of our ++ * parent inode. ++ */ ++ if (parent->i_ino == ea_ino) { ++ ext4_error(parent->i_sb, ++ "Parent and EA inode have the same ino %lu", ea_ino); ++ return -EFSCORRUPTED; ++ } ++ + inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); +-- +2.39.2 + diff --git a/queue-4.14/hwmon-adt7475-display-smoothing-attributes-in-correc.patch b/queue-4.14/hwmon-adt7475-display-smoothing-attributes-in-correc.patch new file mode 100644 index 00000000000..055f6724fe5 --- /dev/null +++ b/queue-4.14/hwmon-adt7475-display-smoothing-attributes-in-correc.patch @@ -0,0 +1,44 @@ +From c41d4b5bfb039013b3f485b728ff8d4c8418cc24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 13:52:27 +1300 +Subject: hwmon: (adt7475) Display smoothing attributes in correct order + +From: Tony O'Brien + +[ Upstream commit 5f8d1e3b6f9b5971f9c06d5846ce00c49e3a8d94 ] + +Throughout the ADT7475 driver, attributes relating to the temperature +sensors are displayed in the order Remote 1, Local, Remote 2. Make +temp_st_show() conform to this expectation so that values set by +temp_st_store() can be displayed using the correct attribute. + +Fixes: 8f05bcc33e74 ("hwmon: (adt7475) temperature smoothing") +Signed-off-by: Tony O'Brien +Link: https://lore.kernel.org/r/20230222005228.158661-2-tony.obrien@alliedtelesis.co.nz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7475.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index d7d1f24671009..0b964b40d322b 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -549,11 +549,11 @@ static ssize_t show_temp_st(struct device *dev, struct device_attribute *attr, + val = data->enh_acoustics[0] & 0xf; + break; + case 1: +- val = (data->enh_acoustics[1] >> 4) & 0xf; ++ val = data->enh_acoustics[1] & 0xf; + break; + case 2: + default: +- val = data->enh_acoustics[1] & 0xf; ++ val = (data->enh_acoustics[1] >> 4) & 0xf; + break; + } + +-- +2.39.2 + diff --git a/queue-4.14/hwmon-adt7475-fix-masking-of-hysteresis-registers.patch b/queue-4.14/hwmon-adt7475-fix-masking-of-hysteresis-registers.patch new file mode 100644 index 00000000000..53b1c6ab658 --- /dev/null +++ b/queue-4.14/hwmon-adt7475-fix-masking-of-hysteresis-registers.patch @@ -0,0 +1,42 @@ +From 672e17d7dd61a8de56d243dbd733b8a12de7e28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Feb 2023 13:52:28 +1300 +Subject: hwmon: (adt7475) Fix masking of hysteresis registers + +From: Tony O'Brien + +[ Upstream commit 48e8186870d9d0902e712d601ccb7098cb220688 ] + +The wrong bits are masked in the hysteresis register; indices 0 and 2 +should zero bits [7:4] and preserve bits [3:0], and index 1 should zero +bits [3:0] and preserve bits [7:4]. + +Fixes: 1c301fc5394f ("hwmon: Add a driver for the ADT7475 hardware monitoring chip") +Signed-off-by: Tony O'Brien +Link: https://lore.kernel.org/r/20230222005228.158661-3-tony.obrien@alliedtelesis.co.nz +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/adt7475.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 0b964b40d322b..51bc70e6ec3fe 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -480,10 +480,10 @@ static ssize_t set_temp(struct device *dev, struct device_attribute *attr, + val = (temp - val) / 1000; + + if (sattr->index != 1) { +- data->temp[HYSTERSIS][sattr->index] &= 0xF0; ++ data->temp[HYSTERSIS][sattr->index] &= 0x0F; + data->temp[HYSTERSIS][sattr->index] |= (val & 0xF) << 4; + } else { +- data->temp[HYSTERSIS][sattr->index] &= 0x0F; ++ data->temp[HYSTERSIS][sattr->index] &= 0xF0; + data->temp[HYSTERSIS][sattr->index] |= (val & 0xF); + } + +-- +2.39.2 + diff --git a/queue-4.14/hwmon-xgene-fix-use-after-free-bug-in-xgene_hwmon_re.patch b/queue-4.14/hwmon-xgene-fix-use-after-free-bug-in-xgene_hwmon_re.patch new file mode 100644 index 00000000000..7ced1c96c52 --- /dev/null +++ b/queue-4.14/hwmon-xgene-fix-use-after-free-bug-in-xgene_hwmon_re.patch @@ -0,0 +1,52 @@ +From ba0a1a0db32576c9bb98a36c672a04192e06a2a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Mar 2023 16:40:07 +0800 +Subject: hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to + race condition + +From: Zheng Wang + +[ Upstream commit cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 ] + +In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. +Then it will be started. + +If we remove the driver which will call xgene_hwmon_remove to clean up, +there may be unfinished work. + +The possible sequence is as follows: + +Fix it by finishing the work before cleanup in xgene_hwmon_remove. + +CPU0 CPU1 + + |xgene_hwmon_evt_work +xgene_hwmon_remove | +kfifo_free(&ctx->async_msg_fifo);| + | + |kfifo_out_spinlocked + |//use &ctx->async_msg_fifo +Fixes: 2ca492e22cb7 ("hwmon: (xgene) Fix crash when alarm occurs before driver probe") +Signed-off-by: Zheng Wang +Link: https://lore.kernel.org/r/20230310084007.1403388-1-zyytlz.wz@163.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/xgene-hwmon.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/hwmon/xgene-hwmon.c b/drivers/hwmon/xgene-hwmon.c +index e1be61095532f..4f0d111ba05b6 100644 +--- a/drivers/hwmon/xgene-hwmon.c ++++ b/drivers/hwmon/xgene-hwmon.c +@@ -751,6 +751,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) + { + struct xgene_hwmon_dev *ctx = platform_get_drvdata(pdev); + ++ cancel_work_sync(&ctx->workq); + hwmon_device_unregister(ctx->hwmon_dev); + kfifo_free(&ctx->async_msg_fifo); + if (acpi_disabled) +-- +2.39.2 + diff --git a/queue-4.14/media-m5mols-fix-off-by-one-loop-termination-error.patch b/queue-4.14/media-m5mols-fix-off-by-one-loop-termination-error.patch new file mode 100644 index 00000000000..1e121849aeb --- /dev/null +++ b/queue-4.14/media-m5mols-fix-off-by-one-loop-termination-error.patch @@ -0,0 +1,62 @@ +From a96402005e5b89e1b271f045ec2127872e16e3ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 13:51:17 -0700 +Subject: media: m5mols: fix off-by-one loop termination error + +From: Linus Torvalds + +[ Upstream commit efbcbb12ee99f750c9f25c873b55ad774871de2a ] + +The __find_restype() function loops over the m5mols_default_ffmt[] +array, and the termination condition ends up being wrong: instead of +stopping when the iterator becomes the size of the array it traverses, +it stops after it has already overshot the array. + +Now, in practice this doesn't likely matter, because the code will +always find the entry it looks for, and will thus return early and never +hit that last extra iteration. + +But it turns out that clang will unroll the loop fully, because it has +only two iterations (well, three due to the off-by-one bug), and then +clang will end up just giving up in the middle of the loop unrolling +when it notices that the code walks past the end of the array. + +And that made 'objtool' very unhappy indeed, because the generated code +just falls off the edge of the universe, and ends up falling through to +the next function, causing this warning: + + drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc() + +Fix the loop ending condition. + +Reported-by: Jens Axboe +Analyzed-by: Miguel Ojeda +Analyzed-by: Nick Desaulniers +Link: https://lore.kernel.org/linux-block/CAHk-=wgTSdKYbmB1JYM5vmHMcD9J9UZr0mn7BOYM_LudrP+Xvw@mail.gmail.com/ +Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP") +Cc: HeungJun, Kim +Cc: Sylwester Nawrocki +Cc: Kyungmin Park +Cc: Mauro Carvalho Chehab +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/m5mols/m5mols_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c +index 9015ebc843b4e..e86fb73dbf6ab 100644 +--- a/drivers/media/i2c/m5mols/m5mols_core.c ++++ b/drivers/media/i2c/m5mols/m5mols_core.c +@@ -482,7 +482,7 @@ static enum m5mols_restype __find_restype(u32 code) + do { + if (code == m5mols_default_ffmt[type].code) + return type; +- } while (type++ != SIZE_DEFAULT_FFMT); ++ } while (++type != SIZE_DEFAULT_FFMT); + + return 0; + } +-- +2.39.2 + diff --git a/queue-4.14/mmc-atmel-mci-fix-race-between-stop-command-and-star.patch b/queue-4.14/mmc-atmel-mci-fix-race-between-stop-command-and-star.patch new file mode 100644 index 00000000000..97d3b049639 --- /dev/null +++ b/queue-4.14/mmc-atmel-mci-fix-race-between-stop-command-and-star.patch @@ -0,0 +1,58 @@ +From 475a82578a3293c8dff0ea0318919c7cbd7c8b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Dec 2022 20:43:15 +0100 +Subject: mmc: atmel-mci: fix race between stop command and start of next + command + +From: Tobias Schramm + +[ Upstream commit eca5bd666b0aa7dc0bca63292e4778968241134e ] + +This commit fixes a race between completion of stop command and start of a +new command. +Previously the command ready interrupt was enabled before stop command +was written to the command register. This caused the command ready +interrupt to fire immediately since the CMDRDY flag is asserted constantly +while there is no command in progress. +Consequently the command state machine will immediately advance to the +next state when the tasklet function is executed again, no matter +actual completion state of the stop command. +Thus a new command can then be dispatched immediately, interrupting and +corrupting the stop command on the CMD line. +Fix that by dropping the command ready interrupt enable before calling +atmci_send_stop_cmd. atmci_send_stop_cmd does already enable the +command ready interrupt, no further writes to ATMCI_IER are necessary. + +Signed-off-by: Tobias Schramm +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20221230194315.809903-2-t.schramm@manjaro.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/atmel-mci.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c +index c8a591d8a3d9e..a09c459d62c6a 100644 +--- a/drivers/mmc/host/atmel-mci.c ++++ b/drivers/mmc/host/atmel-mci.c +@@ -1857,7 +1857,6 @@ static void atmci_tasklet_func(unsigned long priv) + atmci_writel(host, ATMCI_IER, ATMCI_NOTBUSY); + state = STATE_WAITING_NOTBUSY; + } else if (host->mrq->stop) { +- atmci_writel(host, ATMCI_IER, ATMCI_CMDRDY); + atmci_send_stop_cmd(host, data); + state = STATE_SENDING_STOP; + } else { +@@ -1890,8 +1889,6 @@ static void atmci_tasklet_func(unsigned long priv) + * command to send. + */ + if (host->mrq->stop) { +- atmci_writel(host, ATMCI_IER, +- ATMCI_CMDRDY); + atmci_send_stop_cmd(host, data); + state = STATE_SENDING_STOP; + } else { +-- +2.39.2 + diff --git a/queue-4.14/rust-arch-um-disable-fp-simd-instruction-to-match-x8.patch b/queue-4.14/rust-arch-um-disable-fp-simd-instruction-to-match-x8.patch new file mode 100644 index 00000000000..c3bdbf77200 --- /dev/null +++ b/queue-4.14/rust-arch-um-disable-fp-simd-instruction-to-match-x8.patch @@ -0,0 +1,53 @@ +From 6b2d3c6518ab3c1a03b9a43627743a0c9641645b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Dec 2022 12:44:35 +0800 +Subject: rust: arch/um: Disable FP/SIMD instruction to match x86 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Gow + +[ Upstream commit 8849818679478933dd1d9718741f4daa3f4e8b86 ] + +The kernel disables all SSE and similar FP/SIMD instructions on +x86-based architectures (partly because we shouldn't be using floats in +the kernel, and partly to avoid the need for stack alignment, see: +https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53383 ) + +UML does not do the same thing, which isn't in itself a problem, but +does add to the list of differences between UML and "normal" x86 builds. + +In addition, there was a crash bug with LLVM < 15 / rustc < 1.65 when +building with SSE, so disabling it fixes rust builds with earlier +compiler versions, see: +https://github.com/Rust-for-Linux/linux/pull/881 + +Signed-off-by: David Gow +Reviewed-by: Sergio González Collado +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile.um | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/x86/Makefile.um b/arch/x86/Makefile.um +index 45af19921ebd2..baaf6852bfb8a 100644 +--- a/arch/x86/Makefile.um ++++ b/arch/x86/Makefile.um +@@ -1,6 +1,12 @@ + # SPDX-License-Identifier: GPL-2.0 + core-y += arch/x86/crypto/ + ++# ++# Disable SSE and other FP/SIMD instructions to match normal x86 ++# ++KBUILD_CFLAGS += -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -mno-avx ++KBUILD_RUSTFLAGS += -Ctarget-feature=-sse,-sse2,-sse3,-ssse3,-sse4.1,-sse4.2,-avx,-avx2 ++ + ifeq ($(CONFIG_X86_32),y) + START := 0x8048000 + +-- +2.39.2 + diff --git a/queue-4.14/series b/queue-4.14/series index 94df7ddb65b..d0704a7e694 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -13,3 +13,12 @@ ipv4-fix-incorrect-table-id-in-ioctl-path.patch net-usb-smsc75xx-move-packet-length-check-to-prevent.patch net-iucv-fix-size-of-interrupt-data.patch ethernet-sun-add-check-for-the-mdesc_grab.patch +hwmon-adt7475-display-smoothing-attributes-in-correc.patch +hwmon-adt7475-fix-masking-of-hysteresis-registers.patch +hwmon-xgene-fix-use-after-free-bug-in-xgene_hwmon_re.patch +media-m5mols-fix-off-by-one-loop-termination-error.patch +mmc-atmel-mci-fix-race-between-stop-command-and-star.patch +rust-arch-um-disable-fp-simd-instruction-to-match-x8.patch +ext4-fail-ext4_iget-if-special-inode-unallocated.patch +ext4-fix-task-hung-in-ext4_xattr_delete_inode.patch +sh-intc-avoid-spurious-sizeof-pointer-div-warning.patch diff --git a/queue-4.14/sh-intc-avoid-spurious-sizeof-pointer-div-warning.patch b/queue-4.14/sh-intc-avoid-spurious-sizeof-pointer-div-warning.patch new file mode 100644 index 00000000000..16c5675018a --- /dev/null +++ b/queue-4.14/sh-intc-avoid-spurious-sizeof-pointer-div-warning.patch @@ -0,0 +1,51 @@ +From f89b7442adfd3d2b295a12fffdb620184dc535d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 22:48:16 +0100 +Subject: sh: intc: Avoid spurious sizeof-pointer-div warning + +From: Michael Karcher + +[ Upstream commit 250870824c1cf199b032b1ef889c8e8d69d9123a ] + +GCC warns about the pattern sizeof(void*)/sizeof(void), as it looks like +the abuse of a pattern to calculate the array size. This pattern appears +in the unevaluated part of the ternary operator in _INTC_ARRAY if the +parameter is NULL. + +The replacement uses an alternate approach to return 0 in case of NULL +which does not generate the pattern sizeof(void*)/sizeof(void), but still +emits the warning if _INTC_ARRAY is called with a nonarray parameter. + +This patch is required for successful compilation with -Werror enabled. + +The idea to use _Generic for type distinction is taken from Comment #7 +in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108483 by Jakub Jelinek + +Signed-off-by: Michael Karcher +Acked-by: Randy Dunlap # build-tested +Link: https://lore.kernel.org/r/619fa552-c988-35e5-b1d7-fe256c46a272@mkarcher.dialup.fu-berlin.de +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + include/linux/sh_intc.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/linux/sh_intc.h b/include/linux/sh_intc.h +index c255273b02810..37ad81058d6ae 100644 +--- a/include/linux/sh_intc.h ++++ b/include/linux/sh_intc.h +@@ -97,7 +97,10 @@ struct intc_hw_desc { + unsigned int nr_subgroups; + }; + +-#define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) ++#define _INTC_SIZEOF_OR_ZERO(a) (_Generic(a, \ ++ typeof(NULL): 0, \ ++ default: sizeof(a))) ++#define _INTC_ARRAY(a) a, _INTC_SIZEOF_OR_ZERO(a)/sizeof(*a) + + #define INTC_HW_DESC(vectors, groups, mask_regs, \ + prio_regs, sense_regs, ack_regs) \ +-- +2.39.2 + -- 2.47.3