From a40a1dbacb8b5b792f390e487f9b2a0a07c9b6d7 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 11 Aug 2019 17:03:23 +0200 Subject: [PATCH] 5.2-stable patches added patches: bdev-fixup-error-handling-in-blkdev_get.patch crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch driver-core-platform-return-enxio-for-missing-gpioint.patch iio-adc-gyroadc-fix-uninitialized-return-code.patch iio-adc-max9611-fix-misuse-of-genmask-macro.patch iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch iio-imu-mpu6050-add-missing-available-scan-masks.patch iio-ingenic-jz47xx-set-clock-divider-on-probe.patch input-elantech-enable-smbus-on-new-2018-systems.patch input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch loop-set-pf_memalloc_noio-for-the-worker-thread.patch mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch revert-usb-rio500-simplify-locking.patch sound-fix-a-memory-leak-bug.patch staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch staging-fbtft-fix-probing-of-gpio-descriptor.patch staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch staging-gasket-apex-fix-copy-paste-typo.patch staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch usb-iowarrior-fix-deadlock-on-disconnect.patch usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch --- ...v-fixup-error-handling-in-blkdev_get.patch | 44 ++++ ...r-valid-authsize-values-less-than-16.patch | 131 ++++++++++ ...operly-managing-allocated-structures.patch | 39 +++ ...ength-when-decrypting-gcm-ciphertext.patch | 34 +++ ...orm-return-enxio-for-missing-gpioint.patch | 70 ++++++ ...yroadc-fix-uninitialized-return-code.patch | 48 ++++ ...-max9611-fix-misuse-of-genmask-macro.patch | 32 +++ ...legacy-fix-incorrect-channel-setting.patch | 31 +++ ...050-add-missing-available-scan-masks.patch | 95 ++++++++ ...ic-jz47xx-set-clock-divider-on-probe.patch | 153 ++++++++++++ ...ech-enable-smbus-on-new-2018-systems.patch | 107 +++++++++ ...-enable-rmi-mode-for-hp-spectre-x360.patch | 33 +++ ...-initialize-pm-mutex-before-using-it.patch | 33 +++ ..._memalloc_noio-for-the-worker-thread.patch | 82 +++++++ ...-dma-unmap-when-the-dma-has-finished.patch | 71 ++++++ ...ct-dma-max-segment-size-for-mmc_host.patch | 80 +++++++ .../revert-usb-rio500-simplify-locking.patch | 225 ++++++++++++++++++ queue-5.2/series | 25 ++ queue-5.2/sound-fix-a-memory-leak-bug.patch | 39 +++ ...-upon-sigkill-when-allocating-memory.patch | 44 ++++ ...fbtft-fix-probing-of-gpio-descriptor.patch | 113 +++++++++ ...assertion-when-using-gpio-descriptor.patch | 50 ++++ ...ging-gasket-apex-fix-copy-paste-typo.patch | 33 +++ ...the-workqueue-before-deinit-the-host.patch | 31 +++ ...iowarrior-fix-deadlock-on-disconnect.patch | 50 ++++ ...e-of-usb-memory-upon-submiturb-error.patch | 34 +++ 26 files changed, 1727 insertions(+) create mode 100644 queue-5.2/bdev-fixup-error-handling-in-blkdev_get.patch create mode 100644 queue-5.2/crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch create mode 100644 queue-5.2/crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch create mode 100644 queue-5.2/crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch create mode 100644 queue-5.2/driver-core-platform-return-enxio-for-missing-gpioint.patch create mode 100644 queue-5.2/iio-adc-gyroadc-fix-uninitialized-return-code.patch create mode 100644 queue-5.2/iio-adc-max9611-fix-misuse-of-genmask-macro.patch create mode 100644 queue-5.2/iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch create mode 100644 queue-5.2/iio-imu-mpu6050-add-missing-available-scan-masks.patch create mode 100644 queue-5.2/iio-ingenic-jz47xx-set-clock-divider-on-probe.patch create mode 100644 queue-5.2/input-elantech-enable-smbus-on-new-2018-systems.patch create mode 100644 queue-5.2/input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch create mode 100644 queue-5.2/input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch create mode 100644 queue-5.2/loop-set-pf_memalloc_noio-for-the-worker-thread.patch create mode 100644 queue-5.2/mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch create mode 100644 queue-5.2/mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch create mode 100644 queue-5.2/revert-usb-rio500-simplify-locking.patch create mode 100644 queue-5.2/sound-fix-a-memory-leak-bug.patch create mode 100644 queue-5.2/staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch create mode 100644 queue-5.2/staging-fbtft-fix-probing-of-gpio-descriptor.patch create mode 100644 queue-5.2/staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch create mode 100644 queue-5.2/staging-gasket-apex-fix-copy-paste-typo.patch create mode 100644 queue-5.2/staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch create mode 100644 queue-5.2/usb-iowarrior-fix-deadlock-on-disconnect.patch create mode 100644 queue-5.2/usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch diff --git a/queue-5.2/bdev-fixup-error-handling-in-blkdev_get.patch b/queue-5.2/bdev-fixup-error-handling-in-blkdev_get.patch new file mode 100644 index 00000000000..7a685ac5f29 --- /dev/null +++ b/queue-5.2/bdev-fixup-error-handling-in-blkdev_get.patch @@ -0,0 +1,44 @@ +From e91455bad5cff40a8c232f2204a5104127e3fec2 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 7 Aug 2019 11:36:47 +0200 +Subject: bdev: Fixup error handling in blkdev_get() + +From: Jan Kara + +commit e91455bad5cff40a8c232f2204a5104127e3fec2 upstream. + +Commit 89e524c04fa9 ("loop: Fix mount(2) failure due to race with +LOOP_SET_FD") converted blkdev_get() to use the new helpers for +finishing claiming of a block device. However the conversion botched the +error handling in blkdev_get() and thus the bdev has been marked as held +even in case __blkdev_get() returned error. This led to occasional +warnings with block/001 test from blktests like: + +kernel: WARNING: CPU: 5 PID: 907 at fs/block_dev.c:1899 __blkdev_put+0x396/0x3a0 + +Correct the error handling. + +CC: stable@vger.kernel.org +Fixes: 89e524c04fa9 ("loop: Fix mount(2) failure due to race with LOOP_SET_FD") +Signed-off-by: Jan Kara +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/block_dev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -1723,7 +1723,10 @@ int blkdev_get(struct block_device *bdev + + /* finish claiming */ + mutex_lock(&bdev->bd_mutex); +- bd_finish_claiming(bdev, whole, holder); ++ if (!res) ++ bd_finish_claiming(bdev, whole, holder); ++ else ++ bd_abort_claiming(bdev, whole, holder); + /* + * Block event polling for write claims if requested. Any + * write holder makes the write_holder state stick until diff --git a/queue-5.2/crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch b/queue-5.2/crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch new file mode 100644 index 00000000000..62c0a16bdfd --- /dev/null +++ b/queue-5.2/crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch @@ -0,0 +1,131 @@ +From 9f00baf74e4b6f79a3a3dfab44fb7bb2e797b551 Mon Sep 17 00:00:00 2001 +From: Gary R Hook +Date: Tue, 30 Jul 2019 16:05:24 +0000 +Subject: crypto: ccp - Add support for valid authsize values less than 16 + +From: Gary R Hook + +commit 9f00baf74e4b6f79a3a3dfab44fb7bb2e797b551 upstream. + +AES GCM encryption allows for authsize values of 4, 8, and 12-16 bytes. +Validate the requested authsize, and retain it to save in the request +context. + +Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") +Cc: +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccp/ccp-crypto-aes-galois.c | 14 ++++++++++++++ + drivers/crypto/ccp/ccp-ops.c | 26 +++++++++++++++++++++----- + include/linux/ccp.h | 2 ++ + 3 files changed, 37 insertions(+), 5 deletions(-) + +--- a/drivers/crypto/ccp/ccp-crypto-aes-galois.c ++++ b/drivers/crypto/ccp/ccp-crypto-aes-galois.c +@@ -58,6 +58,19 @@ static int ccp_aes_gcm_setkey(struct cry + static int ccp_aes_gcm_setauthsize(struct crypto_aead *tfm, + unsigned int authsize) + { ++ switch (authsize) { ++ case 16: ++ case 15: ++ case 14: ++ case 13: ++ case 12: ++ case 8: ++ case 4: ++ break; ++ default: ++ return -EINVAL; ++ } ++ + return 0; + } + +@@ -104,6 +117,7 @@ static int ccp_aes_gcm_crypt(struct aead + memset(&rctx->cmd, 0, sizeof(rctx->cmd)); + INIT_LIST_HEAD(&rctx->cmd.entry); + rctx->cmd.engine = CCP_ENGINE_AES; ++ rctx->cmd.u.aes.authsize = crypto_aead_authsize(tfm); + rctx->cmd.u.aes.type = ctx->u.aes.type; + rctx->cmd.u.aes.mode = ctx->u.aes.mode; + rctx->cmd.u.aes.action = encrypt; +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -622,6 +622,7 @@ static int ccp_run_aes_gcm_cmd(struct cc + + unsigned long long *final; + unsigned int dm_offset; ++ unsigned int authsize; + unsigned int jobid; + unsigned int ilen; + bool in_place = true; /* Default value */ +@@ -643,6 +644,21 @@ static int ccp_run_aes_gcm_cmd(struct cc + if (!aes->key) /* Gotta have a key SGL */ + return -EINVAL; + ++ /* Zero defaults to 16 bytes, the maximum size */ ++ authsize = aes->authsize ? aes->authsize : AES_BLOCK_SIZE; ++ switch (authsize) { ++ case 16: ++ case 15: ++ case 14: ++ case 13: ++ case 12: ++ case 8: ++ case 4: ++ break; ++ default: ++ return -EINVAL; ++ } ++ + /* First, decompose the source buffer into AAD & PT, + * and the destination buffer into AAD, CT & tag, or + * the input into CT & tag. +@@ -657,7 +673,7 @@ static int ccp_run_aes_gcm_cmd(struct cc + p_tag = scatterwalk_ffwd(sg_tag, p_outp, ilen); + } else { + /* Input length for decryption includes tag */ +- ilen = aes->src_len - AES_BLOCK_SIZE; ++ ilen = aes->src_len - authsize; + p_tag = scatterwalk_ffwd(sg_tag, p_inp, ilen); + } + +@@ -839,19 +855,19 @@ static int ccp_run_aes_gcm_cmd(struct cc + + if (aes->action == CCP_AES_ACTION_ENCRYPT) { + /* Put the ciphered tag after the ciphertext. */ +- ccp_get_dm_area(&final_wa, 0, p_tag, 0, AES_BLOCK_SIZE); ++ ccp_get_dm_area(&final_wa, 0, p_tag, 0, authsize); + } else { + /* Does this ciphered tag match the input? */ +- ret = ccp_init_dm_workarea(&tag, cmd_q, AES_BLOCK_SIZE, ++ ret = ccp_init_dm_workarea(&tag, cmd_q, authsize, + DMA_BIDIRECTIONAL); + if (ret) + goto e_tag; +- ret = ccp_set_dm_area(&tag, 0, p_tag, 0, AES_BLOCK_SIZE); ++ ret = ccp_set_dm_area(&tag, 0, p_tag, 0, authsize); + if (ret) + goto e_tag; + + ret = crypto_memneq(tag.address, final_wa.address, +- AES_BLOCK_SIZE) ? -EBADMSG : 0; ++ authsize) ? -EBADMSG : 0; + ccp_dm_free(&tag); + } + +--- a/include/linux/ccp.h ++++ b/include/linux/ccp.h +@@ -170,6 +170,8 @@ struct ccp_aes_engine { + enum ccp_aes_mode mode; + enum ccp_aes_action action; + ++ u32 authsize; ++ + struct scatterlist *key; + u32 key_len; /* In bytes */ + diff --git a/queue-5.2/crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch b/queue-5.2/crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch new file mode 100644 index 00000000000..4639c5adcca --- /dev/null +++ b/queue-5.2/crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch @@ -0,0 +1,39 @@ +From 25e44338321af545ab34243a6081c3f0fc6107d0 Mon Sep 17 00:00:00 2001 +From: Gary R Hook +Date: Tue, 30 Jul 2019 16:05:22 +0000 +Subject: crypto: ccp - Fix oops by properly managing allocated structures + +From: Gary R Hook + +commit 25e44338321af545ab34243a6081c3f0fc6107d0 upstream. + +A plaintext or ciphertext length of 0 is allowed in AES, in which case +no encryption occurs. Ensure that we don't clean up data structures +that were never allocated. + +Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") +Cc: +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccp/ccp-ops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -859,11 +859,11 @@ e_tag: + ccp_dm_free(&final_wa); + + e_dst: +- if (aes->src_len && !in_place) ++ if (ilen > 0 && !in_place) + ccp_free_data(&dst, cmd_q); + + e_src: +- if (aes->src_len) ++ if (ilen > 0) + ccp_free_data(&src, cmd_q); + + e_aad: diff --git a/queue-5.2/crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch b/queue-5.2/crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch new file mode 100644 index 00000000000..03a597cf9e6 --- /dev/null +++ b/queue-5.2/crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch @@ -0,0 +1,34 @@ +From e2664ecbb2f26225ac6646876f2899558ffb2604 Mon Sep 17 00:00:00 2001 +From: Gary R Hook +Date: Tue, 30 Jul 2019 16:05:26 +0000 +Subject: crypto: ccp - Ignore tag length when decrypting GCM ciphertext + +From: Gary R Hook + +commit e2664ecbb2f26225ac6646876f2899558ffb2604 upstream. + +AES GCM input buffers for decryption contain AAD+CTEXT+TAG. Only +decrypt the ciphertext, and use the tag for comparison. + +Fixes: 36cf515b9bbe2 ("crypto: ccp - Enable support for AES GCM on v5 CCPs") +Cc: +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/ccp/ccp-ops.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -782,8 +782,7 @@ static int ccp_run_aes_gcm_cmd(struct cc + while (src.sg_wa.bytes_left) { + ccp_prepare_data(&src, &dst, &op, AES_BLOCK_SIZE, true); + if (!src.sg_wa.bytes_left) { +- unsigned int nbytes = aes->src_len +- % AES_BLOCK_SIZE; ++ unsigned int nbytes = ilen % AES_BLOCK_SIZE; + + if (nbytes) { + op.eom = 1; diff --git a/queue-5.2/driver-core-platform-return-enxio-for-missing-gpioint.patch b/queue-5.2/driver-core-platform-return-enxio-for-missing-gpioint.patch new file mode 100644 index 00000000000..711a153eeee --- /dev/null +++ b/queue-5.2/driver-core-platform-return-enxio-for-missing-gpioint.patch @@ -0,0 +1,70 @@ +From 46c42d844211ef5902e32aa507beac0817c585e9 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 29 Jul 2019 13:49:54 -0700 +Subject: driver core: platform: return -ENXIO for missing GpioInt + +From: Brian Norris + +commit 46c42d844211ef5902e32aa507beac0817c585e9 upstream. + +Commit daaef255dc96 ("driver: platform: Support parsing GpioInt 0 in +platform_get_irq()") broke the Embedded Controller driver on most LPC +Chromebooks (i.e., most x86 Chromebooks), because cros_ec_lpc expects +platform_get_irq() to return -ENXIO for non-existent IRQs. +Unfortunately, acpi_dev_gpio_irq_get() doesn't follow this convention +and returns -ENOENT instead. So we get this error from cros_ec_lpc: + + couldn't retrieve IRQ number (-2) + +I see a variety of drivers that treat -ENXIO specially, so rather than +fix all of them, let's fix up the API to restore its previous behavior. + +I reported this on v2 of this patch: + +https://lore.kernel.org/lkml/20190220180538.GA42642@google.com/ + +but apparently the patch had already been merged before v3 got sent out: + +https://lore.kernel.org/lkml/20190221193429.161300-1-egranata@chromium.org/ + +and the result is that the bug landed and remains unfixed. + +I differ from the v3 patch by: + * allowing for ret==0, even though acpi_dev_gpio_irq_get() specifically + documents (and enforces) that 0 is not a valid return value (noted on + the v3 review) + * adding a small comment + +Reported-by: Brian Norris +Reported-by: Salvatore Bellizzi +Cc: Enrico Granata +Cc: +Fixes: daaef255dc96 ("driver: platform: Support parsing GpioInt 0 in platform_get_irq()") +Signed-off-by: Brian Norris +Reviewed-by: Andy Shevchenko +Acked-by: Enrico Granata +Link: https://lore.kernel.org/r/20190729204954.25510-1-briannorris@chromium.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/platform.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/base/platform.c ++++ b/drivers/base/platform.c +@@ -157,8 +157,13 @@ int platform_get_irq(struct platform_dev + * the device will only expose one IRQ, and this fallback + * allows a common code path across either kind of resource. + */ +- if (num == 0 && has_acpi_companion(&dev->dev)) +- return acpi_dev_gpio_irq_get(ACPI_COMPANION(&dev->dev), num); ++ if (num == 0 && has_acpi_companion(&dev->dev)) { ++ int ret = acpi_dev_gpio_irq_get(ACPI_COMPANION(&dev->dev), num); ++ ++ /* Our callers expect -ENXIO for missing IRQs. */ ++ if (ret >= 0 || ret == -EPROBE_DEFER) ++ return ret; ++ } + + return -ENXIO; + #endif diff --git a/queue-5.2/iio-adc-gyroadc-fix-uninitialized-return-code.patch b/queue-5.2/iio-adc-gyroadc-fix-uninitialized-return-code.patch new file mode 100644 index 00000000000..70ede1e9d26 --- /dev/null +++ b/queue-5.2/iio-adc-gyroadc-fix-uninitialized-return-code.patch @@ -0,0 +1,48 @@ +From 90c6260c1905a68fb596844087f2223bd4657fee Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 18 Jul 2019 15:57:49 +0200 +Subject: iio: adc: gyroadc: fix uninitialized return code + +From: Arnd Bergmann + +commit 90c6260c1905a68fb596844087f2223bd4657fee upstream. + +gcc-9 complains about a blatant uninitialized variable use that +all earlier compiler versions missed: + +drivers/iio/adc/rcar-gyroadc.c:510:5: warning: 'ret' may be used uninitialized in this function [-Wmaybe-uninitialized] + +Return -EINVAL instead here and a few lines above it where +we accidentally return 0 on failure. + +Cc: stable@vger.kernel.org +Fixes: 059c53b32329 ("iio: adc: Add Renesas GyroADC driver") +Signed-off-by: Arnd Bergmann +Reviewed-by: Wolfram Sang +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/rcar-gyroadc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/rcar-gyroadc.c ++++ b/drivers/iio/adc/rcar-gyroadc.c +@@ -382,7 +382,7 @@ static int rcar_gyroadc_parse_subdevs(st + dev_err(dev, + "Only %i channels supported with %pOFn, but reg = <%i>.\n", + num_channels, child, reg); +- return ret; ++ return -EINVAL; + } + } + +@@ -391,7 +391,7 @@ static int rcar_gyroadc_parse_subdevs(st + dev_err(dev, + "Channel %i uses different ADC mode than the rest.\n", + reg); +- return ret; ++ return -EINVAL; + } + + /* Channel is valid, grab the regulator. */ diff --git a/queue-5.2/iio-adc-max9611-fix-misuse-of-genmask-macro.patch b/queue-5.2/iio-adc-max9611-fix-misuse-of-genmask-macro.patch new file mode 100644 index 00000000000..13a42cd6ee1 --- /dev/null +++ b/queue-5.2/iio-adc-max9611-fix-misuse-of-genmask-macro.patch @@ -0,0 +1,32 @@ +From ae8cc91a7d85e018c0c267f580820b2bb558cd48 Mon Sep 17 00:00:00 2001 +From: Joe Perches +Date: Tue, 9 Jul 2019 22:04:17 -0700 +Subject: iio: adc: max9611: Fix misuse of GENMASK macro + +From: Joe Perches + +commit ae8cc91a7d85e018c0c267f580820b2bb558cd48 upstream. + +Arguments are supposed to be ordered high then low. + +Signed-off-by: Joe Perches +Fixes: 69780a3bbc0b ("iio: adc: Add Maxim max9611 ADC driver") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/max9611.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/adc/max9611.c ++++ b/drivers/iio/adc/max9611.c +@@ -83,7 +83,7 @@ + #define MAX9611_TEMP_MAX_POS 0x7f80 + #define MAX9611_TEMP_MAX_NEG 0xff80 + #define MAX9611_TEMP_MIN_NEG 0xd980 +-#define MAX9611_TEMP_MASK GENMASK(7, 15) ++#define MAX9611_TEMP_MASK GENMASK(15, 7) + #define MAX9611_TEMP_SHIFT 0x07 + #define MAX9611_TEMP_RAW(_r) ((_r) >> MAX9611_TEMP_SHIFT) + #define MAX9611_TEMP_SCALE_NUM 1000000 diff --git a/queue-5.2/iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch b/queue-5.2/iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch new file mode 100644 index 00000000000..78c3b8a44c2 --- /dev/null +++ b/queue-5.2/iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch @@ -0,0 +1,31 @@ +From 6cdff99c9f7d7d28b87cf05dd464f7c7736332ae Mon Sep 17 00:00:00 2001 +From: Gwendal Grignou +Date: Fri, 28 Jun 2019 12:17:09 -0700 +Subject: iio: cros_ec_accel_legacy: Fix incorrect channel setting + +From: Gwendal Grignou + +commit 6cdff99c9f7d7d28b87cf05dd464f7c7736332ae upstream. + +INFO_SCALE is set both for each channel and all channels. +iio is using all channel setting, so the error was not user visible. + +Signed-off-by: Gwendal Grignou +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/cros_ec_accel_legacy.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/iio/accel/cros_ec_accel_legacy.c ++++ b/drivers/iio/accel/cros_ec_accel_legacy.c +@@ -319,7 +319,6 @@ static const struct iio_chan_spec_ext_in + .modified = 1, \ + .info_mask_separate = \ + BIT(IIO_CHAN_INFO_RAW) | \ +- BIT(IIO_CHAN_INFO_SCALE) | \ + BIT(IIO_CHAN_INFO_CALIBBIAS), \ + .info_mask_shared_by_all = BIT(IIO_CHAN_INFO_SCALE), \ + .ext_info = cros_ec_accel_legacy_ext_info, \ diff --git a/queue-5.2/iio-imu-mpu6050-add-missing-available-scan-masks.patch b/queue-5.2/iio-imu-mpu6050-add-missing-available-scan-masks.patch new file mode 100644 index 00000000000..1c282604dae --- /dev/null +++ b/queue-5.2/iio-imu-mpu6050-add-missing-available-scan-masks.patch @@ -0,0 +1,95 @@ +From 1244a720572fd1680ac8d6b8a4235f2e8557b810 Mon Sep 17 00:00:00 2001 +From: Jean-Baptiste Maneyrol +Date: Thu, 27 Jun 2019 13:19:53 +0000 +Subject: iio: imu: mpu6050: add missing available scan masks + +From: Jean-Baptiste Maneyrol + +commit 1244a720572fd1680ac8d6b8a4235f2e8557b810 upstream. + +Driver only supports 3-axis gyro and/or 3-axis accel. +For icm20602, temp data is mandatory for all configurations. + +Fix all single and double axis configurations (almost never used) and more +importantly fix 3-axis gyro and 6-axis accel+gyro buffer on icm20602 when +temp data is not enabled. + +Signed-off-by: Jean-Baptiste Maneyrol +Fixes: 1615fe41a195 ("iio: imu: mpu6050: Fix FIFO layout for ICM20602") +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 43 +++++++++++++++++++++++++++++ + 1 file changed, 43 insertions(+) + +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -845,6 +845,25 @@ static const struct iio_chan_spec inv_mp + INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_MPU6050_SCAN_ACCL_Z), + }; + ++static const unsigned long inv_mpu_scan_masks[] = { ++ /* 3-axis accel */ ++ BIT(INV_MPU6050_SCAN_ACCL_X) ++ | BIT(INV_MPU6050_SCAN_ACCL_Y) ++ | BIT(INV_MPU6050_SCAN_ACCL_Z), ++ /* 3-axis gyro */ ++ BIT(INV_MPU6050_SCAN_GYRO_X) ++ | BIT(INV_MPU6050_SCAN_GYRO_Y) ++ | BIT(INV_MPU6050_SCAN_GYRO_Z), ++ /* 6-axis accel + gyro */ ++ BIT(INV_MPU6050_SCAN_ACCL_X) ++ | BIT(INV_MPU6050_SCAN_ACCL_Y) ++ | BIT(INV_MPU6050_SCAN_ACCL_Z) ++ | BIT(INV_MPU6050_SCAN_GYRO_X) ++ | BIT(INV_MPU6050_SCAN_GYRO_Y) ++ | BIT(INV_MPU6050_SCAN_GYRO_Z), ++ 0, ++}; ++ + static const struct iio_chan_spec inv_icm20602_channels[] = { + IIO_CHAN_SOFT_TIMESTAMP(INV_ICM20602_SCAN_TIMESTAMP), + { +@@ -871,6 +890,28 @@ static const struct iio_chan_spec inv_ic + INV_MPU6050_CHAN(IIO_ACCEL, IIO_MOD_Z, INV_ICM20602_SCAN_ACCL_Z), + }; + ++static const unsigned long inv_icm20602_scan_masks[] = { ++ /* 3-axis accel + temp (mandatory) */ ++ BIT(INV_ICM20602_SCAN_ACCL_X) ++ | BIT(INV_ICM20602_SCAN_ACCL_Y) ++ | BIT(INV_ICM20602_SCAN_ACCL_Z) ++ | BIT(INV_ICM20602_SCAN_TEMP), ++ /* 3-axis gyro + temp (mandatory) */ ++ BIT(INV_ICM20602_SCAN_GYRO_X) ++ | BIT(INV_ICM20602_SCAN_GYRO_Y) ++ | BIT(INV_ICM20602_SCAN_GYRO_Z) ++ | BIT(INV_ICM20602_SCAN_TEMP), ++ /* 6-axis accel + gyro + temp (mandatory) */ ++ BIT(INV_ICM20602_SCAN_ACCL_X) ++ | BIT(INV_ICM20602_SCAN_ACCL_Y) ++ | BIT(INV_ICM20602_SCAN_ACCL_Z) ++ | BIT(INV_ICM20602_SCAN_GYRO_X) ++ | BIT(INV_ICM20602_SCAN_GYRO_Y) ++ | BIT(INV_ICM20602_SCAN_GYRO_Z) ++ | BIT(INV_ICM20602_SCAN_TEMP), ++ 0, ++}; ++ + /* + * The user can choose any frequency between INV_MPU6050_MIN_FIFO_RATE and + * INV_MPU6050_MAX_FIFO_RATE, but only these frequencies are matched by the +@@ -1130,9 +1171,11 @@ int inv_mpu_core_probe(struct regmap *re + if (chip_type == INV_ICM20602) { + indio_dev->channels = inv_icm20602_channels; + indio_dev->num_channels = ARRAY_SIZE(inv_icm20602_channels); ++ indio_dev->available_scan_masks = inv_icm20602_scan_masks; + } else { + indio_dev->channels = inv_mpu_channels; + indio_dev->num_channels = ARRAY_SIZE(inv_mpu_channels); ++ indio_dev->available_scan_masks = inv_mpu_scan_masks; + } + + indio_dev->info = &mpu_info; diff --git a/queue-5.2/iio-ingenic-jz47xx-set-clock-divider-on-probe.patch b/queue-5.2/iio-ingenic-jz47xx-set-clock-divider-on-probe.patch new file mode 100644 index 00000000000..c769fc8ac72 --- /dev/null +++ b/queue-5.2/iio-ingenic-jz47xx-set-clock-divider-on-probe.patch @@ -0,0 +1,153 @@ +From 5a304e1a4ea000177cf25f5ecf26e786dda25b98 Mon Sep 17 00:00:00 2001 +From: Maarten ter Huurne +Date: Thu, 4 Jul 2019 19:36:56 +0200 +Subject: IIO: Ingenic JZ47xx: Set clock divider on probe + +From: Maarten ter Huurne + +commit 5a304e1a4ea000177cf25f5ecf26e786dda25b98 upstream. + +The SADC component can run at up to 8 MHz on JZ4725B, but is fed +a 12 MHz input clock (EXT). Divide it by two to get 6 MHz, then +set up another divider to match, to produce a 10us clock. + +If the clock dividers are left on their power-on defaults (a divider +of 1), the SADC mostly works, but will occasionally produce erroneous +readings. This led to button presses being detected out of nowhere on +the RS90 every few minutes. With this change, no ghost button presses +were logged in almost a day worth of testing. + +The ADCLK register for configuring clock dividers doesn't exist on +JZ4740, so avoid writing it there. + +A function has been introduced rather than a flag because there is a lot +of variation between the ADCLK registers on JZ47xx SoCs, both in +the internal layout of the register and in the frequency range +supported by the SADC. So this solution should make it easier +to add support for other JZ47xx SoCs later. + +Fixes: 1a78daea107d ("iio: adc: probe should set clock divider") +Signed-off-by: Maarten ter Huurne +Signed-off-by: Artur Rojek +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ingenic-adc.c | 54 ++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 54 insertions(+) + +--- a/drivers/iio/adc/ingenic-adc.c ++++ b/drivers/iio/adc/ingenic-adc.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -22,8 +23,11 @@ + #define JZ_ADC_REG_ADTCH 0x18 + #define JZ_ADC_REG_ADBDAT 0x1c + #define JZ_ADC_REG_ADSDAT 0x20 ++#define JZ_ADC_REG_ADCLK 0x28 + + #define JZ_ADC_REG_CFG_BAT_MD BIT(4) ++#define JZ_ADC_REG_ADCLK_CLKDIV_LSB 0 ++#define JZ_ADC_REG_ADCLK_CLKDIV10US_LSB 16 + + #define JZ_ADC_AUX_VREF 3300 + #define JZ_ADC_AUX_VREF_BITS 12 +@@ -34,6 +38,8 @@ + #define JZ4740_ADC_BATTERY_HIGH_VREF (7500 * 0.986) + #define JZ4740_ADC_BATTERY_HIGH_VREF_BITS 12 + ++struct ingenic_adc; ++ + struct ingenic_adc_soc_data { + unsigned int battery_high_vref; + unsigned int battery_high_vref_bits; +@@ -41,6 +47,7 @@ struct ingenic_adc_soc_data { + size_t battery_raw_avail_size; + const int *battery_scale_avail; + size_t battery_scale_avail_size; ++ int (*init_clk_div)(struct device *dev, struct ingenic_adc *adc); + }; + + struct ingenic_adc { +@@ -151,6 +158,42 @@ static const int jz4740_adc_battery_scal + JZ_ADC_BATTERY_LOW_VREF, JZ_ADC_BATTERY_LOW_VREF_BITS, + }; + ++static int jz4725b_adc_init_clk_div(struct device *dev, struct ingenic_adc *adc) ++{ ++ struct clk *parent_clk; ++ unsigned long parent_rate, rate; ++ unsigned int div_main, div_10us; ++ ++ parent_clk = clk_get_parent(adc->clk); ++ if (!parent_clk) { ++ dev_err(dev, "ADC clock has no parent\n"); ++ return -ENODEV; ++ } ++ parent_rate = clk_get_rate(parent_clk); ++ ++ /* ++ * The JZ4725B ADC works at 500 kHz to 8 MHz. ++ * We pick the highest rate possible. ++ * In practice we typically get 6 MHz, half of the 12 MHz EXT clock. ++ */ ++ div_main = DIV_ROUND_UP(parent_rate, 8000000); ++ div_main = clamp(div_main, 1u, 64u); ++ rate = parent_rate / div_main; ++ if (rate < 500000 || rate > 8000000) { ++ dev_err(dev, "No valid divider for ADC main clock\n"); ++ return -EINVAL; ++ } ++ ++ /* We also need a divider that produces a 10us clock. */ ++ div_10us = DIV_ROUND_UP(rate, 100000); ++ ++ writel(((div_10us - 1) << JZ_ADC_REG_ADCLK_CLKDIV10US_LSB) | ++ (div_main - 1) << JZ_ADC_REG_ADCLK_CLKDIV_LSB, ++ adc->base + JZ_ADC_REG_ADCLK); ++ ++ return 0; ++} ++ + static const struct ingenic_adc_soc_data jz4725b_adc_soc_data = { + .battery_high_vref = JZ4725B_ADC_BATTERY_HIGH_VREF, + .battery_high_vref_bits = JZ4725B_ADC_BATTERY_HIGH_VREF_BITS, +@@ -158,6 +201,7 @@ static const struct ingenic_adc_soc_data + .battery_raw_avail_size = ARRAY_SIZE(jz4725b_adc_battery_raw_avail), + .battery_scale_avail = jz4725b_adc_battery_scale_avail, + .battery_scale_avail_size = ARRAY_SIZE(jz4725b_adc_battery_scale_avail), ++ .init_clk_div = jz4725b_adc_init_clk_div, + }; + + static const struct ingenic_adc_soc_data jz4740_adc_soc_data = { +@@ -167,6 +211,7 @@ static const struct ingenic_adc_soc_data + .battery_raw_avail_size = ARRAY_SIZE(jz4740_adc_battery_raw_avail), + .battery_scale_avail = jz4740_adc_battery_scale_avail, + .battery_scale_avail_size = ARRAY_SIZE(jz4740_adc_battery_scale_avail), ++ .init_clk_div = NULL, /* no ADCLK register on JZ4740 */ + }; + + static int ingenic_adc_read_avail(struct iio_dev *iio_dev, +@@ -317,6 +362,15 @@ static int ingenic_adc_probe(struct plat + return ret; + } + ++ /* Set clock dividers. */ ++ if (soc_data->init_clk_div) { ++ ret = soc_data->init_clk_div(dev, adc); ++ if (ret) { ++ clk_disable_unprepare(adc->clk); ++ return ret; ++ } ++ } ++ + /* Put hardware in a known passive state. */ + writeb(0x00, adc->base + JZ_ADC_REG_ENABLE); + writeb(0xff, adc->base + JZ_ADC_REG_CTRL); diff --git a/queue-5.2/input-elantech-enable-smbus-on-new-2018-systems.patch b/queue-5.2/input-elantech-enable-smbus-on-new-2018-systems.patch new file mode 100644 index 00000000000..351689c8f0d --- /dev/null +++ b/queue-5.2/input-elantech-enable-smbus-on-new-2018-systems.patch @@ -0,0 +1,107 @@ +From 883a2a80f79ca5c0c105605fafabd1f3df99b34c Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 22 Jul 2019 10:56:55 +0300 +Subject: Input: elantech - enable SMBus on new (2018+) systems + +From: Kai-Heng Feng + +commit 883a2a80f79ca5c0c105605fafabd1f3df99b34c upstream. + +There are some new HP laptops with Elantech touchpad that don't support +multitouch. + +Currently we use ETP_NEW_IC_SMBUS_HOST_NOTIFY() to check if SMBus is supported, +but in addition to firmware version, the bus type also informs us whether the IC +can support SMBus. To avoid breaking old ICs, we will only enable SMbus support +based the bus type on systems manufactured after 2018. + +Lastly, let's consolidate all checks into elantech_use_host_notify() and use it +to determine whether to use PS/2 or SMBus. + +Signed-off-by: Kai-Heng Feng +Acked-by: Benjamin Tissoires +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/elantech.c | 54 ++++++++++++++++++----------------------- + 1 file changed, 25 insertions(+), 29 deletions(-) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1807,6 +1807,30 @@ static int elantech_create_smbus(struct + leave_breadcrumbs); + } + ++static bool elantech_use_host_notify(struct psmouse *psmouse, ++ struct elantech_device_info *info) ++{ ++ if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version)) ++ return true; ++ ++ switch (info->bus) { ++ case ETP_BUS_PS2_ONLY: ++ /* expected case */ ++ break; ++ case ETP_BUS_SMB_HST_NTFY_ONLY: ++ case ETP_BUS_PS2_SMB_HST_NTFY: ++ /* SMbus implementation is stable since 2018 */ ++ if (dmi_get_bios_year() >= 2018) ++ return true; ++ default: ++ psmouse_dbg(psmouse, ++ "Ignoring SMBus bus provider %d\n", info->bus); ++ break; ++ } ++ ++ return false; ++} ++ + /** + * elantech_setup_smbus - called once the PS/2 devices are enumerated + * and decides to instantiate a SMBus InterTouch device. +@@ -1826,7 +1850,7 @@ static int elantech_setup_smbus(struct p + * i2c_blacklist_pnp_ids. + * Old ICs are up to the user to decide. + */ +- if (!ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version) || ++ if (!elantech_use_host_notify(psmouse, info) || + psmouse_matches_pnp_id(psmouse, i2c_blacklist_pnp_ids)) + return -ENXIO; + } +@@ -1846,34 +1870,6 @@ static int elantech_setup_smbus(struct p + return 0; + } + +-static bool elantech_use_host_notify(struct psmouse *psmouse, +- struct elantech_device_info *info) +-{ +- if (ETP_NEW_IC_SMBUS_HOST_NOTIFY(info->fw_version)) +- return true; +- +- switch (info->bus) { +- case ETP_BUS_PS2_ONLY: +- /* expected case */ +- break; +- case ETP_BUS_SMB_ALERT_ONLY: +- /* fall-through */ +- case ETP_BUS_PS2_SMB_ALERT: +- psmouse_dbg(psmouse, "Ignoring SMBus provider through alert protocol.\n"); +- break; +- case ETP_BUS_SMB_HST_NTFY_ONLY: +- /* fall-through */ +- case ETP_BUS_PS2_SMB_HST_NTFY: +- return true; +- default: +- psmouse_dbg(psmouse, +- "Ignoring SMBus bus provider %d.\n", +- info->bus); +- } +- +- return false; +-} +- + int elantech_init_smbus(struct psmouse *psmouse) + { + struct elantech_device_info info; diff --git a/queue-5.2/input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch b/queue-5.2/input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch new file mode 100644 index 00000000000..353f83d8723 --- /dev/null +++ b/queue-5.2/input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch @@ -0,0 +1,33 @@ +From 25f8c834e2a6871920cc1ca113f02fb301d007c3 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Fri, 12 Jul 2019 11:37:17 -0700 +Subject: Input: synaptics - enable RMI mode for HP Spectre X360 + +From: Dmitry Torokhov + +commit 25f8c834e2a6871920cc1ca113f02fb301d007c3 upstream. + +The 2016 kabylake HP Spectre X360 (model number 13-w013dx) works much better +with psmouse.synaptics_intertouch=1 kernel parameter, so let's enable RMI4 +mode automatically. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204115 +Reported-by: Nate Graham +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -182,6 +182,7 @@ static const char * const smbus_pnp_ids[ + "LEN2055", /* E580 */ + "SYN3052", /* HP EliteBook 840 G4 */ + "SYN3221", /* HP 15-ay000 */ ++ "SYN323d", /* HP Spectre X360 13-w013dx */ + NULL + }; + diff --git a/queue-5.2/input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch b/queue-5.2/input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch new file mode 100644 index 00000000000..5c1fdc284ed --- /dev/null +++ b/queue-5.2/input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch @@ -0,0 +1,33 @@ +From b55d996f057bf2e7ba9422a80b5e17e99860cb0b Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 1 Aug 2019 09:40:26 -0700 +Subject: Input: usbtouchscreen - initialize PM mutex before using it + +From: Oliver Neukum + +commit b55d996f057bf2e7ba9422a80b5e17e99860cb0b upstream. + +Mutexes shall be initialized before they are used. + +Fixes: 12e510dbc57b2 ("Input: usbtouchscreen - fix deadlock in autosuspend") +Reported-by: syzbot+199ea16c7f26418b4365@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/touchscreen/usbtouchscreen.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/input/touchscreen/usbtouchscreen.c ++++ b/drivers/input/touchscreen/usbtouchscreen.c +@@ -1659,6 +1659,8 @@ static int usbtouch_probe(struct usb_int + if (!usbtouch || !input_dev) + goto out_free; + ++ mutex_init(&usbtouch->pm_mutex); ++ + type = &usbtouch_dev_info[id->driver_info]; + usbtouch->type = type; + if (!type->process_pkt) diff --git a/queue-5.2/loop-set-pf_memalloc_noio-for-the-worker-thread.patch b/queue-5.2/loop-set-pf_memalloc_noio-for-the-worker-thread.patch new file mode 100644 index 00000000000..a8c9e77ab97 --- /dev/null +++ b/queue-5.2/loop-set-pf_memalloc_noio-for-the-worker-thread.patch @@ -0,0 +1,82 @@ +From d0a255e795ab976481565f6ac178314b34fbf891 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Thu, 8 Aug 2019 11:17:01 -0400 +Subject: loop: set PF_MEMALLOC_NOIO for the worker thread + +From: Mikulas Patocka + +commit d0a255e795ab976481565f6ac178314b34fbf891 upstream. + +A deadlock with this stacktrace was observed. + +The loop thread does a GFP_KERNEL allocation, it calls into dm-bufio +shrinker and the shrinker depends on I/O completion in the dm-bufio +subsystem. + +In order to fix the deadlock (and other similar ones), we set the flag +PF_MEMALLOC_NOIO at loop thread entry. + +PID: 474 TASK: ffff8813e11f4600 CPU: 10 COMMAND: "kswapd0" + #0 [ffff8813dedfb938] __schedule at ffffffff8173f405 + #1 [ffff8813dedfb990] schedule at ffffffff8173fa27 + #2 [ffff8813dedfb9b0] schedule_timeout at ffffffff81742fec + #3 [ffff8813dedfba60] io_schedule_timeout at ffffffff8173f186 + #4 [ffff8813dedfbaa0] bit_wait_io at ffffffff8174034f + #5 [ffff8813dedfbac0] __wait_on_bit at ffffffff8173fec8 + #6 [ffff8813dedfbb10] out_of_line_wait_on_bit at ffffffff8173ff81 + #7 [ffff8813dedfbb90] __make_buffer_clean at ffffffffa038736f [dm_bufio] + #8 [ffff8813dedfbbb0] __try_evict_buffer at ffffffffa0387bb8 [dm_bufio] + #9 [ffff8813dedfbbd0] dm_bufio_shrink_scan at ffffffffa0387cc3 [dm_bufio] + #10 [ffff8813dedfbc40] shrink_slab at ffffffff811a87ce + #11 [ffff8813dedfbd30] shrink_zone at ffffffff811ad778 + #12 [ffff8813dedfbdc0] kswapd at ffffffff811ae92f + #13 [ffff8813dedfbec0] kthread at ffffffff810a8428 + #14 [ffff8813dedfbf50] ret_from_fork at ffffffff81745242 + + PID: 14127 TASK: ffff881455749c00 CPU: 11 COMMAND: "loop1" + #0 [ffff88272f5af228] __schedule at ffffffff8173f405 + #1 [ffff88272f5af280] schedule at ffffffff8173fa27 + #2 [ffff88272f5af2a0] schedule_preempt_disabled at ffffffff8173fd5e + #3 [ffff88272f5af2b0] __mutex_lock_slowpath at ffffffff81741fb5 + #4 [ffff88272f5af330] mutex_lock at ffffffff81742133 + #5 [ffff88272f5af350] dm_bufio_shrink_count at ffffffffa03865f9 [dm_bufio] + #6 [ffff88272f5af380] shrink_slab at ffffffff811a86bd + #7 [ffff88272f5af470] shrink_zone at ffffffff811ad778 + #8 [ffff88272f5af500] do_try_to_free_pages at ffffffff811adb34 + #9 [ffff88272f5af590] try_to_free_pages at ffffffff811adef8 + #10 [ffff88272f5af610] __alloc_pages_nodemask at ffffffff811a09c3 + #11 [ffff88272f5af710] alloc_pages_current at ffffffff811e8b71 + #12 [ffff88272f5af760] new_slab at ffffffff811f4523 + #13 [ffff88272f5af7b0] __slab_alloc at ffffffff8173a1b5 + #14 [ffff88272f5af880] kmem_cache_alloc at ffffffff811f484b + #15 [ffff88272f5af8d0] do_blockdev_direct_IO at ffffffff812535b3 + #16 [ffff88272f5afb00] __blockdev_direct_IO at ffffffff81255dc3 + #17 [ffff88272f5afb30] xfs_vm_direct_IO at ffffffffa01fe3fc [xfs] + #18 [ffff88272f5afb90] generic_file_read_iter at ffffffff81198994 + #19 [ffff88272f5afc50] __dta_xfs_file_read_iter_2398 at ffffffffa020c970 [xfs] + #20 [ffff88272f5afcc0] lo_rw_aio at ffffffffa0377042 [loop] + #21 [ffff88272f5afd70] loop_queue_work at ffffffffa0377c3b [loop] + #22 [ffff88272f5afe60] kthread_worker_fn at ffffffff810a8a0c + #23 [ffff88272f5afec0] kthread at ffffffff810a8428 + #24 [ffff88272f5aff50] ret_from_fork at ffffffff81745242 + +Signed-off-by: Mikulas Patocka +Cc: stable@vger.kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/loop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -893,7 +893,7 @@ static void loop_unprepare_queue(struct + + static int loop_kthread_worker_fn(void *worker_ptr) + { +- current->flags |= PF_LESS_THROTTLE; ++ current->flags |= PF_LESS_THROTTLE | PF_MEMALLOC_NOIO; + return kthread_worker_fn(worker_ptr); + } + diff --git a/queue-5.2/mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch b/queue-5.2/mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch new file mode 100644 index 00000000000..7fad437b857 --- /dev/null +++ b/queue-5.2/mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch @@ -0,0 +1,71 @@ +From b803974a86039913d5280add083d730b2b9ed8ec Mon Sep 17 00:00:00 2001 +From: Kevin Hao +Date: Fri, 26 Jul 2019 10:30:49 +0800 +Subject: mmc: cavium: Add the missing dma unmap when the dma has finished. + +From: Kevin Hao + +commit b803974a86039913d5280add083d730b2b9ed8ec upstream. + +This fixes the below calltrace when the CONFIG_DMA_API_DEBUG is enabled. + DMA-API: thunderx_mmc 0000:01:01.4: cpu touching an active dma mapped cacheline [cln=0x000000002fdf9800] + WARNING: CPU: 21 PID: 1 at kernel/dma/debug.c:596 debug_dma_assert_idle+0x1f8/0x270 + Modules linked in: + CPU: 21 PID: 1 Comm: init Not tainted 5.3.0-rc1-next-20190725-yocto-standard+ #64 + Hardware name: Marvell OcteonTX CN96XX board (DT) + pstate: 80400009 (Nzcv daif +PAN -UAO) + pc : debug_dma_assert_idle+0x1f8/0x270 + lr : debug_dma_assert_idle+0x1f8/0x270 + sp : ffff0000113cfc10 + x29: ffff0000113cfc10 x28: 0000ffff8c880000 + x27: ffff800bc72a0000 x26: ffff000010ff8000 + x25: ffff000010ff8940 x24: ffff000010ff8968 + x23: 0000000000000000 x22: ffff000010e83700 + x21: ffff000010ea2000 x20: ffff000010e835c8 + x19: ffff800bc2c73300 x18: ffffffffffffffff + x17: 0000000000000000 x16: 0000000000000000 + x15: ffff000010e835c8 x14: 6d20616d64206576 + x13: 69746361206e6120 x12: 676e696863756f74 + x11: 20757063203a342e x10: 31303a31303a3030 + x9 : 303020636d6d5f78 x8 : 3230303030303030 + x7 : 00000000000002fd x6 : ffff000010fd57d0 + x5 : 0000000000000000 x4 : ffff0000106c5210 + x3 : 00000000ffffffff x2 : 0000800bee9c0000 + x1 : 57d5843f4aa62800 x0 : 0000000000000000 + Call trace: + debug_dma_assert_idle+0x1f8/0x270 + wp_page_copy+0xb0/0x688 + do_wp_page+0xa8/0x5b8 + __handle_mm_fault+0x600/0xd00 + handle_mm_fault+0x118/0x1e8 + do_page_fault+0x200/0x500 + do_mem_abort+0x50/0xb0 + el0_da+0x20/0x24 + ---[ end trace a005534bd23e109f ]--- + DMA-API: Mapped at: + debug_dma_map_sg+0x94/0x350 + cvm_mmc_request+0x3c4/0x988 + __mmc_start_request+0x9c/0x1f8 + mmc_start_request+0x7c/0xb0 + mmc_blk_mq_issue_rq+0x5c4/0x7b8 + +Signed-off-by: Kevin Hao +Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/cavium.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/cavium.c ++++ b/drivers/mmc/host/cavium.c +@@ -374,6 +374,7 @@ static int finish_dma_single(struct cvm_ + { + data->bytes_xfered = data->blocks * data->blksz; + data->error = 0; ++ dma_unmap_sg(host->dev, data->sg, data->sg_len, get_dma_dir(data)); + return 1; + } + diff --git a/queue-5.2/mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch b/queue-5.2/mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch new file mode 100644 index 00000000000..f18e96e6b32 --- /dev/null +++ b/queue-5.2/mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch @@ -0,0 +1,80 @@ +From fa25eba6993b3750f417baabba169afaba076178 Mon Sep 17 00:00:00 2001 +From: Kevin Hao +Date: Fri, 26 Jul 2019 10:30:48 +0800 +Subject: mmc: cavium: Set the correct dma max segment size for mmc_host + +From: Kevin Hao + +commit fa25eba6993b3750f417baabba169afaba076178 upstream. + +We have set the mmc_host.max_seg_size to 8M, but the dma max segment +size of PCI device is set to 64K by default in function pci_device_add(). +The mmc_host.max_seg_size is used to set the max segment size of +the blk queue. Then this mismatch will trigger a calltrace like below +when a bigger than 64K segment request arrives at mmc dev. So we should +consider the limitation of the cvm_mmc_host when setting the +mmc_host.max_seg_size. + DMA-API: thunderx_mmc 0000:01:01.4: mapping sg segment longer than device claims to support [len=131072] [max=65536] + WARNING: CPU: 6 PID: 238 at kernel/dma/debug.c:1221 debug_dma_map_sg+0x2b8/0x350 + Modules linked in: + CPU: 6 PID: 238 Comm: kworker/6:1H Not tainted 5.3.0-rc1-next-20190724-yocto-standard+ #62 + Hardware name: Marvell OcteonTX CN96XX board (DT) + Workqueue: kblockd blk_mq_run_work_fn + pstate: 80c00009 (Nzcv daif +PAN +UAO) + pc : debug_dma_map_sg+0x2b8/0x350 + lr : debug_dma_map_sg+0x2b8/0x350 + sp : ffff00001770f9e0 + x29: ffff00001770f9e0 x28: ffffffff00000000 + x27: 00000000ffffffff x26: ffff800bc2c73180 + x25: ffff000010e83700 x24: 0000000000000002 + x23: 0000000000000001 x22: 0000000000000001 + x21: 0000000000000000 x20: ffff800bc48ba0b0 + x19: ffff800bc97e8c00 x18: ffffffffffffffff + x17: 0000000000000000 x16: 0000000000000000 + x15: ffff000010e835c8 x14: 6874207265676e6f + x13: 6c20746e656d6765 x12: 7320677320676e69 + x11: 7070616d203a342e x10: 31303a31303a3030 + x9 : 303020636d6d5f78 x8 : 35363d78616d5b20 + x7 : 00000000000002fd x6 : ffff000010fd57dc + x5 : 0000000000000000 x4 : ffff0000106c61f0 + x3 : 00000000ffffffff x2 : 0000800bee060000 + x1 : 7010678df3041a00 x0 : 0000000000000000 + Call trace: + debug_dma_map_sg+0x2b8/0x350 + cvm_mmc_request+0x3c4/0x988 + __mmc_start_request+0x9c/0x1f8 + mmc_start_request+0x7c/0xb0 + mmc_blk_mq_issue_rq+0x5c4/0x7b8 + mmc_mq_queue_rq+0x11c/0x278 + blk_mq_dispatch_rq_list+0xb0/0x568 + blk_mq_do_dispatch_sched+0x6c/0x108 + blk_mq_sched_dispatch_requests+0x110/0x1b8 + __blk_mq_run_hw_queue+0xb0/0x118 + blk_mq_run_work_fn+0x28/0x38 + process_one_work+0x210/0x490 + worker_thread+0x48/0x458 + kthread+0x130/0x138 + ret_from_fork+0x10/0x1c + +Signed-off-by: Kevin Hao +Fixes: ba3869ff32e4 ("mmc: cavium: Add core MMC driver for Cavium SOCs") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/cavium.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/cavium.c ++++ b/drivers/mmc/host/cavium.c +@@ -1046,7 +1046,8 @@ int cvm_mmc_of_slot_probe(struct device + mmc->max_segs = 1; + + /* DMA size field can address up to 8 MB */ +- mmc->max_seg_size = 8 * 1024 * 1024; ++ mmc->max_seg_size = min_t(unsigned int, 8 * 1024 * 1024, ++ dma_get_max_seg_size(host->dev)); + mmc->max_req_size = mmc->max_seg_size; + /* External DMA is in 512 byte blocks */ + mmc->max_blk_size = 512; diff --git a/queue-5.2/revert-usb-rio500-simplify-locking.patch b/queue-5.2/revert-usb-rio500-simplify-locking.patch new file mode 100644 index 00000000000..8876a081ddc --- /dev/null +++ b/queue-5.2/revert-usb-rio500-simplify-locking.patch @@ -0,0 +1,225 @@ +From 2ca359f4f8b954b3a9d15a89f22a8b7283e7669f Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 8 Aug 2019 11:28:54 +0200 +Subject: Revert "USB: rio500: simplify locking" + +From: Oliver Neukum + +commit 2ca359f4f8b954b3a9d15a89f22a8b7283e7669f upstream. + +This reverts commit d710734b06770814de2bfa2819420fb5df7f3a81. +This simplification causes a deadlock. + +Reported-by: syzbot+7bbcbe9c9ff0cd49592a@syzkaller.appspotmail.com +Fixes: d710734b0677 ("USB: rio500: simplify locking") +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20190808092854.23519-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/rio500.c | 43 +++++++++++++++++++++++++++---------------- + 1 file changed, 27 insertions(+), 16 deletions(-) + +--- a/drivers/usb/misc/rio500.c ++++ b/drivers/usb/misc/rio500.c +@@ -51,6 +51,7 @@ struct rio_usb_data { + char *obuf, *ibuf; /* transfer buffers */ + char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */ + wait_queue_head_t wait_q; /* for timeouts */ ++ struct mutex lock; /* general race avoidance */ + }; + + static DEFINE_MUTEX(rio500_mutex); +@@ -62,8 +63,10 @@ static int open_rio(struct inode *inode, + + /* against disconnect() */ + mutex_lock(&rio500_mutex); ++ mutex_lock(&(rio->lock)); + + if (rio->isopen || !rio->present) { ++ mutex_unlock(&(rio->lock)); + mutex_unlock(&rio500_mutex); + return -EBUSY; + } +@@ -71,6 +74,7 @@ static int open_rio(struct inode *inode, + + init_waitqueue_head(&rio->wait_q); + ++ mutex_unlock(&(rio->lock)); + + dev_info(&rio->rio_dev->dev, "Rio opened.\n"); + mutex_unlock(&rio500_mutex); +@@ -84,6 +88,7 @@ static int close_rio(struct inode *inode + + /* against disconnect() */ + mutex_lock(&rio500_mutex); ++ mutex_lock(&(rio->lock)); + + rio->isopen = 0; + if (!rio->present) { +@@ -95,6 +100,7 @@ static int close_rio(struct inode *inode + } else { + dev_info(&rio->rio_dev->dev, "Rio closed.\n"); + } ++ mutex_unlock(&(rio->lock)); + mutex_unlock(&rio500_mutex); + return 0; + } +@@ -109,7 +115,7 @@ static long ioctl_rio(struct file *file, + int retries; + int retval=0; + +- mutex_lock(&rio500_mutex); ++ mutex_lock(&(rio->lock)); + /* Sanity check to make sure rio is connected, powered, etc */ + if (rio->present == 0 || rio->rio_dev == NULL) { + retval = -ENODEV; +@@ -253,7 +259,7 @@ static long ioctl_rio(struct file *file, + + + err_out: +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return retval; + } + +@@ -273,12 +279,12 @@ write_rio(struct file *file, const char + int errn = 0; + int intr; + +- intr = mutex_lock_interruptible(&rio500_mutex); ++ intr = mutex_lock_interruptible(&(rio->lock)); + if (intr) + return -EINTR; + /* Sanity check to make sure rio is connected, powered, etc */ + if (rio->present == 0 || rio->rio_dev == NULL) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return -ENODEV; + } + +@@ -301,7 +307,7 @@ write_rio(struct file *file, const char + goto error; + } + if (signal_pending(current)) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return bytes_written ? bytes_written : -EINTR; + } + +@@ -339,12 +345,12 @@ write_rio(struct file *file, const char + buffer += copy_size; + } while (count > 0); + +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + + return bytes_written ? bytes_written : -EIO; + + error: +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return errn; + } + +@@ -361,12 +367,12 @@ read_rio(struct file *file, char __user + char *ibuf; + int intr; + +- intr = mutex_lock_interruptible(&rio500_mutex); ++ intr = mutex_lock_interruptible(&(rio->lock)); + if (intr) + return -EINTR; + /* Sanity check to make sure rio is connected, powered, etc */ + if (rio->present == 0 || rio->rio_dev == NULL) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return -ENODEV; + } + +@@ -377,11 +383,11 @@ read_rio(struct file *file, char __user + + while (count > 0) { + if (signal_pending(current)) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return read_count ? read_count : -EINTR; + } + if (!rio->rio_dev) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return -ENODEV; + } + this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count; +@@ -399,7 +405,7 @@ read_rio(struct file *file, char __user + count = this_read = partial; + } else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */ + if (!maxretry--) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + dev_err(&rio->rio_dev->dev, + "read_rio: maxretry timeout\n"); + return -ETIME; +@@ -409,19 +415,19 @@ read_rio(struct file *file, char __user + finish_wait(&rio->wait_q, &wait); + continue; + } else if (result != -EREMOTEIO) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + dev_err(&rio->rio_dev->dev, + "Read Whoops - result:%d partial:%u this_read:%u\n", + result, partial, this_read); + return -EIO; + } else { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return (0); + } + + if (this_read) { + if (copy_to_user(buffer, ibuf, this_read)) { +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return -EFAULT; + } + count -= this_read; +@@ -429,7 +435,7 @@ read_rio(struct file *file, char __user + buffer += this_read; + } + } +- mutex_unlock(&rio500_mutex); ++ mutex_unlock(&(rio->lock)); + return read_count; + } + +@@ -494,6 +500,8 @@ static int probe_rio(struct usb_interfac + } + dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf); + ++ mutex_init(&(rio->lock)); ++ + usb_set_intfdata (intf, rio); + rio->present = 1; + bail_out: +@@ -511,10 +519,12 @@ static void disconnect_rio(struct usb_in + if (rio) { + usb_deregister_dev(intf, &usb_rio_class); + ++ mutex_lock(&(rio->lock)); + if (rio->isopen) { + rio->isopen = 0; + /* better let it finish - the release will do whats needed */ + rio->rio_dev = NULL; ++ mutex_unlock(&(rio->lock)); + mutex_unlock(&rio500_mutex); + return; + } +@@ -524,6 +534,7 @@ static void disconnect_rio(struct usb_in + dev_info(&intf->dev, "USB Rio disconnected.\n"); + + rio->present = 0; ++ mutex_unlock(&(rio->lock)); + } + mutex_unlock(&rio500_mutex); + } diff --git a/queue-5.2/series b/queue-5.2/series index 3449179f121..62258ba2e91 100644 --- a/queue-5.2/series +++ b/queue-5.2/series @@ -1 +1,26 @@ revert-pci-add-missing-link-delays-required-by-the-pcie-spec.patch +iio-ingenic-jz47xx-set-clock-divider-on-probe.patch +iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch +iio-imu-mpu6050-add-missing-available-scan-masks.patch +iio-adc-gyroadc-fix-uninitialized-return-code.patch +iio-adc-max9611-fix-misuse-of-genmask-macro.patch +staging-gasket-apex-fix-copy-paste-typo.patch +staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch +staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch +staging-fbtft-fix-probing-of-gpio-descriptor.patch +staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch +crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch +crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch +crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch +driver-core-platform-return-enxio-for-missing-gpioint.patch +usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch +revert-usb-rio500-simplify-locking.patch +usb-iowarrior-fix-deadlock-on-disconnect.patch +sound-fix-a-memory-leak-bug.patch +mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch +mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch +loop-set-pf_memalloc_noio-for-the-worker-thread.patch +bdev-fixup-error-handling-in-blkdev_get.patch +input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch +input-elantech-enable-smbus-on-new-2018-systems.patch +input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch diff --git a/queue-5.2/sound-fix-a-memory-leak-bug.patch b/queue-5.2/sound-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..1b88b118a1e --- /dev/null +++ b/queue-5.2/sound-fix-a-memory-leak-bug.patch @@ -0,0 +1,39 @@ +From c7cd7c748a3250ca33509f9235efab9c803aca09 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Thu, 8 Aug 2019 00:15:21 -0500 +Subject: sound: fix a memory leak bug + +From: Wenwen Wang + +commit c7cd7c748a3250ca33509f9235efab9c803aca09 upstream. + +In sound_insert_unit(), the controlling structure 's' is allocated through +kmalloc(). Then it is added to the sound driver list by invoking +__sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is +removed from the list through __sound_remove_unit(). If 'index' is not less +than 0, -EBUSY is returned to indicate the error. However, 's' is not +deallocated on this execution path, leading to a memory leak bug. + +To fix the above issue, free 's' before -EBUSY is returned. + +Signed-off-by: Wenwen Wang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/sound_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/sound_core.c ++++ b/sound/sound_core.c +@@ -275,7 +275,8 @@ retry: + goto retry; + } + spin_unlock(&sound_loader_lock); +- return -EBUSY; ++ r = -EBUSY; ++ goto fail; + } + } + diff --git a/queue-5.2/staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch b/queue-5.2/staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch new file mode 100644 index 00000000000..8e28a1f3f1f --- /dev/null +++ b/queue-5.2/staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch @@ -0,0 +1,44 @@ +From 8f9e86ee795971eabbf372e6d804d6b8578287a7 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Mon, 1 Jul 2019 19:55:19 +0900 +Subject: staging: android: ion: Bail out upon SIGKILL when allocating memory. + +From: Tetsuo Handa + +commit 8f9e86ee795971eabbf372e6d804d6b8578287a7 upstream. + +syzbot found that a thread can stall for minutes inside +ion_system_heap_allocate() after that thread was killed by SIGKILL [1]. +Let's check for SIGKILL before doing memory allocation. + +[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e + +Signed-off-by: Tetsuo Handa +Cc: stable +Reported-by: syzbot +Acked-by: Laura Abbott +Acked-by: Sumit Semwal +Link: https://lore.kernel.org/r/d088f188-5f32-d8fc-b9a0-0b404f7501cc@I-love.SAKURA.ne.jp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/ion/ion_page_pool.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/android/ion/ion_page_pool.c ++++ b/drivers/staging/android/ion/ion_page_pool.c +@@ -8,11 +8,14 @@ + #include + #include + #include ++#include + + #include "ion.h" + + static inline struct page *ion_page_pool_alloc_pages(struct ion_page_pool *pool) + { ++ if (fatal_signal_pending(current)) ++ return NULL; + return alloc_pages(pool->gfp_mask, pool->order); + } + diff --git a/queue-5.2/staging-fbtft-fix-probing-of-gpio-descriptor.patch b/queue-5.2/staging-fbtft-fix-probing-of-gpio-descriptor.patch new file mode 100644 index 00000000000..57f1f826b7e --- /dev/null +++ b/queue-5.2/staging-fbtft-fix-probing-of-gpio-descriptor.patch @@ -0,0 +1,113 @@ +From dbc4f989c878fe101fb7920e9609e8ec44e097cd Mon Sep 17 00:00:00 2001 +From: Phil Reid +Date: Tue, 16 Jul 2019 08:24:36 +0800 +Subject: Staging: fbtft: Fix probing of gpio descriptor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Phil Reid + +commit dbc4f989c878fe101fb7920e9609e8ec44e097cd upstream. + +Conversion to use gpio descriptors broke all gpio lookups as +devm_gpiod_get_index was converted to use dev->driver->name for +the gpio name lookup. Fix this by using the name param. In +addition gpiod_get post-fixes the -gpios to the name so that +shouldn't be included in the call. However this then breaks the +of_find_property call to see if the gpio entry exists as all +fbtft treats all gpios as optional. So use devm_gpiod_get_index_optional +instead which achieves the same thing and is simpler. + +Nishad confirmed the changes where only ever compile tested. + +Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") +Reviewed-by: Nicolas Saenz Julienne +Tested-by: Nicolas Saenz Julienne +Tested-by: Jan Sebastian Götte +Signed-off-by: Phil Reid +Cc: stable +Link: https://lore.kernel.org/r/1563236677-5045-2-git-send-email-preid@electromag.com.au +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/fbtft/fbtft-core.c | 39 +++++++++++++++++-------------------- + 1 file changed, 18 insertions(+), 21 deletions(-) + +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -76,21 +76,18 @@ static int fbtft_request_one_gpio(struct + struct gpio_desc **gpiop) + { + struct device *dev = par->info->device; +- struct device_node *node = dev->of_node; + int ret = 0; + +- if (of_find_property(node, name, NULL)) { +- *gpiop = devm_gpiod_get_index(dev, dev->driver->name, index, +- GPIOD_OUT_HIGH); +- if (IS_ERR(*gpiop)) { +- ret = PTR_ERR(*gpiop); +- dev_err(dev, +- "Failed to request %s GPIO:%d\n", name, ret); +- return ret; +- } +- fbtft_par_dbg(DEBUG_REQUEST_GPIOS, par, "%s: '%s' GPIO\n", +- __func__, name); ++ *gpiop = devm_gpiod_get_index_optional(dev, name, index, ++ GPIOD_OUT_HIGH); ++ if (IS_ERR(*gpiop)) { ++ ret = PTR_ERR(*gpiop); ++ dev_err(dev, ++ "Failed to request %s GPIO: %d\n", name, ret); ++ return ret; + } ++ fbtft_par_dbg(DEBUG_REQUEST_GPIOS, par, "%s: '%s' GPIO\n", ++ __func__, name); + + return ret; + } +@@ -103,34 +100,34 @@ static int fbtft_request_gpios_dt(struct + if (!par->info->device->of_node) + return -EINVAL; + +- ret = fbtft_request_one_gpio(par, "reset-gpios", 0, &par->gpio.reset); ++ ret = fbtft_request_one_gpio(par, "reset", 0, &par->gpio.reset); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "dc-gpios", 0, &par->gpio.dc); ++ ret = fbtft_request_one_gpio(par, "dc", 0, &par->gpio.dc); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "rd-gpios", 0, &par->gpio.rd); ++ ret = fbtft_request_one_gpio(par, "rd", 0, &par->gpio.rd); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "wr-gpios", 0, &par->gpio.wr); ++ ret = fbtft_request_one_gpio(par, "wr", 0, &par->gpio.wr); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "cs-gpios", 0, &par->gpio.cs); ++ ret = fbtft_request_one_gpio(par, "cs", 0, &par->gpio.cs); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "latch-gpios", 0, &par->gpio.latch); ++ ret = fbtft_request_one_gpio(par, "latch", 0, &par->gpio.latch); + if (ret) + return ret; + for (i = 0; i < 16; i++) { +- ret = fbtft_request_one_gpio(par, "db-gpios", i, ++ ret = fbtft_request_one_gpio(par, "db", i, + &par->gpio.db[i]); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "led-gpios", i, ++ ret = fbtft_request_one_gpio(par, "led", i, + &par->gpio.led[i]); + if (ret) + return ret; +- ret = fbtft_request_one_gpio(par, "aux-gpios", i, ++ ret = fbtft_request_one_gpio(par, "aux", i, + &par->gpio.aux[i]); + if (ret) + return ret; diff --git a/queue-5.2/staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch b/queue-5.2/staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch new file mode 100644 index 00000000000..d7a04d403a4 --- /dev/null +++ b/queue-5.2/staging-fbtft-fix-reset-assertion-when-using-gpio-descriptor.patch @@ -0,0 +1,50 @@ +From b918d1c2706619cb0712a61cc8c05148b68b24b2 Mon Sep 17 00:00:00 2001 +From: Phil Reid +Date: Tue, 16 Jul 2019 08:24:37 +0800 +Subject: Staging: fbtft: Fix reset assertion when using gpio descriptor +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Phil Reid + +commit b918d1c2706619cb0712a61cc8c05148b68b24b2 upstream. + +Typically gpiod_set_value calls would assert the reset line and +then release it using the symantics of: + gpiod_set_value(par->gpio.reset, 0); + ... delay + gpiod_set_value(par->gpio.reset, 1); +And the gpio binding would specify the polarity. + +Prior to conversion to gpiod calls the polarity in the DT +was ignored and assumed to be active low. Fix it so that +DT polarity is respected. + +Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") +Reviewed-by: Nicolas Saenz Julienne +Tested-by: Nicolas Saenz Julienne +Tested-by: Jan Sebastian Götte +Signed-off-by: Phil Reid +Cc: stable +Link: https://lore.kernel.org/r/1563236677-5045-3-git-send-email-preid@electromag.com.au +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/fbtft/fbtft-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -231,9 +231,9 @@ static void fbtft_reset(struct fbtft_par + if (!par->gpio.reset) + return; + fbtft_par_dbg(DEBUG_RESET, par, "%s()\n", __func__); +- gpiod_set_value_cansleep(par->gpio.reset, 0); +- usleep_range(20, 40); + gpiod_set_value_cansleep(par->gpio.reset, 1); ++ usleep_range(20, 40); ++ gpiod_set_value_cansleep(par->gpio.reset, 0); + msleep(120); + } + diff --git a/queue-5.2/staging-gasket-apex-fix-copy-paste-typo.patch b/queue-5.2/staging-gasket-apex-fix-copy-paste-typo.patch new file mode 100644 index 00000000000..16c0d1b9acc --- /dev/null +++ b/queue-5.2/staging-gasket-apex-fix-copy-paste-typo.patch @@ -0,0 +1,33 @@ +From 66665bb9979246729562a09fcdbb101c83127989 Mon Sep 17 00:00:00 2001 +From: Ivan Bornyakov +Date: Wed, 10 Jul 2019 23:45:18 +0300 +Subject: staging: gasket: apex: fix copy-paste typo + +From: Ivan Bornyakov + +commit 66665bb9979246729562a09fcdbb101c83127989 upstream. + +In sysfs_show() case-branches ATTR_KERNEL_HIB_PAGE_TABLE_SIZE and +ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE do the same. It looks like +copy-paste mistake. + +Signed-off-by: Ivan Bornyakov +Cc: stable +Link: https://lore.kernel.org/r/20190710204518.16814-1-brnkv.i1@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/gasket/apex_driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/gasket/apex_driver.c ++++ b/drivers/staging/gasket/apex_driver.c +@@ -532,7 +532,7 @@ static ssize_t sysfs_show(struct device + break; + case ATTR_KERNEL_HIB_SIMPLE_PAGE_TABLE_SIZE: + ret = scnprintf(buf, PAGE_SIZE, "%u\n", +- gasket_page_table_num_entries( ++ gasket_page_table_num_simple_entries( + gasket_dev->page_table[0])); + break; + case ATTR_KERNEL_HIB_NUM_ACTIVE_PAGES: diff --git a/queue-5.2/staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch b/queue-5.2/staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch new file mode 100644 index 00000000000..4e1acb7158c --- /dev/null +++ b/queue-5.2/staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch @@ -0,0 +1,31 @@ +From fb2b055b7e6e44efda737c7c92f46c0868bb04e5 Mon Sep 17 00:00:00 2001 +From: Adham Abozaeid +Date: Mon, 22 Jul 2019 21:38:44 +0000 +Subject: staging: wilc1000: flush the workqueue before deinit the host + +From: Adham Abozaeid + +commit fb2b055b7e6e44efda737c7c92f46c0868bb04e5 upstream. + +Before deinitializing the host interface, the workqueue should be flushed +to handle any pending deferred work + +Signed-off-by: Adham Abozaeid +Cc: stable +Link: https://lore.kernel.org/r/20190722213837.21952-1-adham.abozaeid@microchip.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wilc1000/wilc_wfi_cfgoperations.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c ++++ b/drivers/staging/wilc1000/wilc_wfi_cfgoperations.c +@@ -1789,6 +1789,7 @@ void wilc_deinit_host_int(struct net_dev + + priv->p2p_listen_state = false; + ++ flush_workqueue(vif->wilc->hif_workqueue); + mutex_destroy(&priv->scan_req_lock); + ret = wilc_deinit(vif); + diff --git a/queue-5.2/usb-iowarrior-fix-deadlock-on-disconnect.patch b/queue-5.2/usb-iowarrior-fix-deadlock-on-disconnect.patch new file mode 100644 index 00000000000..dbff6f158b2 --- /dev/null +++ b/queue-5.2/usb-iowarrior-fix-deadlock-on-disconnect.patch @@ -0,0 +1,50 @@ +From c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 8 Aug 2019 11:27:28 +0200 +Subject: usb: iowarrior: fix deadlock on disconnect + +From: Oliver Neukum + +commit c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 upstream. + +We have to drop the mutex before we close() upon disconnect() +as close() needs the lock. This is safe to do by dropping the +mutex as intfdata is already set to NULL, so open() will fail. + +Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior") +Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/iowarrior.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -866,19 +866,20 @@ static void iowarrior_disconnect(struct + dev = usb_get_intfdata(interface); + mutex_lock(&iowarrior_open_disc_lock); + usb_set_intfdata(interface, NULL); ++ /* prevent device read, write and ioctl */ ++ dev->present = 0; + + minor = dev->minor; ++ mutex_unlock(&iowarrior_open_disc_lock); ++ /* give back our minor - this will call close() locks need to be dropped at this point*/ + +- /* give back our minor */ + usb_deregister_dev(interface, &iowarrior_class); + + mutex_lock(&dev->mutex); + + /* prevent device read, write and ioctl */ +- dev->present = 0; + + mutex_unlock(&dev->mutex); +- mutex_unlock(&iowarrior_open_disc_lock); + + if (dev->opened) { + /* There is a process that holds a filedescriptor to the device , diff --git a/queue-5.2/usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch b/queue-5.2/usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch new file mode 100644 index 00000000000..c65327e2bc3 --- /dev/null +++ b/queue-5.2/usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch @@ -0,0 +1,34 @@ +From c43f28dfdc4654e738aa6d3fd08a105b2bee758d Mon Sep 17 00:00:00 2001 +From: Gavin Li +Date: Sun, 4 Aug 2019 16:50:44 -0700 +Subject: usb: usbfs: fix double-free of usb memory upon submiturb error + +From: Gavin Li + +commit c43f28dfdc4654e738aa6d3fd08a105b2bee758d upstream. + +Upon an error within proc_do_submiturb(), dec_usb_memory_use_count() +gets called once by the error handling tail and again by free_async(). +Remove the first call. + +Signed-off-by: Gavin Li +Acked-by: Alan Stern +Cc: stable +Link: https://lore.kernel.org/r/20190804235044.22327-1-gavinli@thegavinli.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/devio.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1788,8 +1788,6 @@ static int proc_do_submiturb(struct usb_ + return 0; + + error: +- if (as && as->usbm) +- dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count); + kfree(isopkt); + kfree(dr); + if (as) -- 2.47.3