From aa3c5a510fa3897ad4c70f5111b56c2448bc5faa Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 6 Sep 2020 22:55:57 -0400 Subject: [PATCH] Fixes for 4.19 Signed-off-by: Sasha Levin --- ...-uninitialized-chaddr-when-handling-.patch | 52 ++++ ...se-netif_rx_ni-when-not-in-interrupt.patch | 42 ++++ ...fix-own-ogm-check-in-aggregated-ogms.patch | 65 +++++ ...-t-enable-napi-until-rings-are-ready.patch | 86 +++++++ ...-check-for-zero-dir-entries-in-nvram.patch | 39 +++ ...query-fw-when-netif_running-is-false.patch | 40 +++ ...m-error-when-querying-vf-temperature.patch | 60 +++++ ...t_en-fix-pci-aer-error-recovery-flow.patch | 46 ++++ ...ac-check-return-value-of-of_find_dev.patch | 39 +++ ...-fix-of_dma_router_xlate-s-of_dma_xl.patch | 47 ++++ ...fix-burst-length-if-burst-size-is-sm.patch | 48 ++++ ...adeon-prefer-lower-feedback-dividers.patch | 48 ++++ ...n-epoll-keep-a-reference-on-files-ad.patch | 42 ++++ ...a_link-info-to-msg-sent-to-userspace.patch | 36 +++ ...g2.h-add-missing-around-n-in-roundup.patch | 37 +++ ...lize-iommu-gcmd-register-modificatio.patch | 62 +++++ ...call-bmips_cpu_setup-for-secondary-c.patch | 37 +++ ...ps5000-has-inclusive-physical-caches.patch | 41 +++ ...c_emac-fix-memleak-in-arc_mdio_probe.patch | 36 +++ ...4-fix-memory-allocation-in-mlx4_budd.patch | 44 ++++ ...nother-missing-clk_disable_unprepare.patch | 84 +++++++ ...hns-fix-memleak-in-hns_nic_dev_probe.patch | 50 ++++ ...ort-fix-memleak-in-bcm_sysport_probe.patch | 40 +++ ...les-add-nfta_set_userdata-if-not-nul.patch | 36 +++ ...les-fix-destination-register-zeroing.patch | 82 ++++++ ...les-incorrect-enum-nft_list_attribut.patch | 35 +++ ...ink-nfnetlink_unicast-reports-eagain.patch | 238 ++++++++++++++++++ ...issed-_irqsave-version-of-spin_lock-.patch | 44 ++++ ...ents-fix-suspicious-code-in-fixregex.patch | 47 ++++ ...rf-tools-correct-snoopx-field-offset.patch | 51 ++++ ...b-fixed-to-be-able-to-unload-modules.patch | 208 +++++++++++++++ ...pf-fix-massive-output-from-test_maps.patch | 42 ++++ queue-4.19/series | 37 +++ ...oft-lockup-when-tg3_reset_task-fails.patch | 80 ++++++ ...hermal-fix-bogus-thermal-shutdowns-f.patch | 110 ++++++++ ...akenuma-fix-invalid-starting-node-id.patch | 74 ++++++ ...ry-test-in-xfs_attr_shortform_verify.patch | 54 ++++ ..._validate_extent_raw-when-checking-a.patch | 37 +++ 38 files changed, 2296 insertions(+) create mode 100644 queue-4.19/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch create mode 100644 queue-4.19/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch create mode 100644 queue-4.19/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch create mode 100644 queue-4.19/bnxt-don-t-enable-napi-until-rings-are-ready.patch create mode 100644 queue-4.19/bnxt_en-check-for-zero-dir-entries-in-nvram.patch create mode 100644 queue-4.19/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch create mode 100644 queue-4.19/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch create mode 100644 queue-4.19/bnxt_en-fix-pci-aer-error-recovery-flow.patch create mode 100644 queue-4.19/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch create mode 100644 queue-4.19/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch create mode 100644 queue-4.19/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch create mode 100644 queue-4.19/drm-radeon-prefer-lower-feedback-dividers.patch create mode 100644 queue-4.19/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch create mode 100644 queue-4.19/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch create mode 100644 queue-4.19/include-linux-log2.h-add-missing-around-n-in-roundup.patch create mode 100644 queue-4.19/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch create mode 100644 queue-4.19/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch create mode 100644 queue-4.19/mips-mm-bmips5000-has-inclusive-physical-caches.patch create mode 100644 queue-4.19/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch create mode 100644 queue-4.19/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch create mode 100644 queue-4.19/net-gemini-fix-another-missing-clk_disable_unprepare.patch create mode 100644 queue-4.19/net-hns-fix-memleak-in-hns_nic_dev_probe.patch create mode 100644 queue-4.19/net-systemport-fix-memleak-in-bcm_sysport_probe.patch create mode 100644 queue-4.19/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch create mode 100644 queue-4.19/netfilter-nf_tables-fix-destination-register-zeroing.patch create mode 100644 queue-4.19/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch create mode 100644 queue-4.19/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch create mode 100644 queue-4.19/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch create mode 100644 queue-4.19/perf-jevents-fix-suspicious-code-in-fixregex.patch create mode 100644 queue-4.19/perf-tools-correct-snoopx-field-offset.patch create mode 100644 queue-4.19/ravb-fixed-to-be-able-to-unload-modules.patch create mode 100644 queue-4.19/selftests-bpf-fix-massive-output-from-test_maps.patch create mode 100644 queue-4.19/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch create mode 100644 queue-4.19/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch create mode 100644 queue-4.19/x86-fakenuma-fix-invalid-starting-node-id.patch create mode 100644 queue-4.19/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch create mode 100644 queue-4.19/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch diff --git a/queue-4.19/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch b/queue-4.19/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch new file mode 100644 index 00000000000..cabae25690a --- /dev/null +++ b/queue-4.19/batman-adv-avoid-uninitialized-chaddr-when-handling-.patch @@ -0,0 +1,52 @@ +From b3d8eff597ae46c710e194cb5e2e2a3df69f4307 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 20:36:43 +0200 +Subject: batman-adv: Avoid uninitialized chaddr when handling DHCP + +From: Sven Eckelmann + +[ Upstream commit 303216e76dcab6049c9d42390b1032f0649a8206 ] + +The gateway client code can try to optimize the delivery of DHCP packets to +avoid broadcasting them through the whole mesh. But also transmissions to +the client can be optimized by looking up the destination via the chaddr of +the DHCP packet. + +But the chaddr is currently only done when chaddr is fully inside the +non-paged area of the skbuff. Otherwise it will not be initialized and the +unoptimized path should have been taken. + +But the implementation didn't handle this correctly. It didn't retrieve the +correct chaddr but still tried to perform the TT lookup with this +uninitialized memory. + +Reported-by: syzbot+ab16e463b903f5a37036@syzkaller.appspotmail.com +Fixes: 6c413b1c22a2 ("batman-adv: send every DHCP packet as bat-unicast") +Signed-off-by: Sven Eckelmann +Acked-by: Antonio Quartulli +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/gateway_client.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c +index 140c61a3f1ecf..0c59fefc13719 100644 +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -714,8 +714,10 @@ batadv_gw_dhcp_recipient_get(struct sk_buff *skb, unsigned int *header_len, + + chaddr_offset = *header_len + BATADV_DHCP_CHADDR_OFFSET; + /* store the client address if the message is going to a client */ +- if (ret == BATADV_DHCP_TO_CLIENT && +- pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) { ++ if (ret == BATADV_DHCP_TO_CLIENT) { ++ if (!pskb_may_pull(skb, chaddr_offset + ETH_ALEN)) ++ return BATADV_DHCP_NO; ++ + /* check if the DHCP packet carries an Ethernet DHCP */ + p = skb->data + *header_len + BATADV_DHCP_HTYPE_OFFSET; + if (*p != BATADV_DHCP_HTYPE_ETHERNET) +-- +2.25.1 + diff --git a/queue-4.19/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch b/queue-4.19/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch new file mode 100644 index 00000000000..ea63a34086e --- /dev/null +++ b/queue-4.19/batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch @@ -0,0 +1,42 @@ +From 02ece8cecfd4da2348875a8087a84d951c56365e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 17:46:10 +0300 +Subject: batman-adv: bla: use netif_rx_ni when not in interrupt context + +From: Jussi Kivilinna + +[ Upstream commit 279e89b2281af3b1a9f04906e157992c19c9f163 ] + +batadv_bla_send_claim() gets called from worker thread context through +batadv_bla_periodic_work(), thus netif_rx_ni needs to be used in that +case. This fixes "NOHZ: local_softirq_pending 08" log messages seen +when batman-adv is enabled. + +Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code") +Signed-off-by: Jussi Kivilinna +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bridge_loop_avoidance.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index 85faf25c29122..9b8bf06ccb613 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -450,7 +450,10 @@ static void batadv_bla_send_claim(struct batadv_priv *bat_priv, u8 *mac, + batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES, + skb->len + ETH_HLEN); + +- netif_rx(skb); ++ if (in_interrupt()) ++ netif_rx(skb); ++ else ++ netif_rx_ni(skb); + out: + if (primary_if) + batadv_hardif_put(primary_if); +-- +2.25.1 + diff --git a/queue-4.19/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch b/queue-4.19/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch new file mode 100644 index 00000000000..084c5f855d1 --- /dev/null +++ b/queue-4.19/batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch @@ -0,0 +1,65 @@ +From ccce0d1cd1757444f686af76cd984ad20b53a774 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 14:28:08 +0200 +Subject: batman-adv: Fix own OGM check in aggregated OGMs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Lüssing + +[ Upstream commit d8bf0c01642275c7dca1e5d02c34e4199c200b1f ] + +The own OGM check is currently misplaced and can lead to the following +issues: + +For one thing we might receive an aggregated OGM from a neighbor node +which has our own OGM in the first place. We would then not only skip +our own OGM but erroneously also any other, following OGM in the +aggregate. + +For another, we might receive an OGM aggregate which has our own OGM in +a place other then the first one. Then we would wrongly not skip this +OGM, leading to populating the orginator and gateway table with ourself. + +Fixes: 9323158ef9f4 ("batman-adv: OGMv2 - implement originators logic") +Signed-off-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/bat_v_ogm.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index 0458de53cb64b..04a620fd13014 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -716,6 +716,12 @@ static void batadv_v_ogm_process(const struct sk_buff *skb, int ogm_offset, + ntohl(ogm_packet->seqno), ogm_throughput, ogm_packet->ttl, + ogm_packet->version, ntohs(ogm_packet->tvlv_len)); + ++ if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) { ++ batadv_dbg(BATADV_DBG_BATMAN, bat_priv, ++ "Drop packet: originator packet from ourself\n"); ++ return; ++ } ++ + /* If the throughput metric is 0, immediately drop the packet. No need + * to create orig_node / neigh_node for an unusable route. + */ +@@ -843,11 +849,6 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb, + if (batadv_is_my_mac(bat_priv, ethhdr->h_source)) + goto free_skb; + +- ogm_packet = (struct batadv_ogm2_packet *)skb->data; +- +- if (batadv_is_my_mac(bat_priv, ogm_packet->orig)) +- goto free_skb; +- + batadv_inc_counter(bat_priv, BATADV_CNT_MGMT_RX); + batadv_add_counter(bat_priv, BATADV_CNT_MGMT_RX_BYTES, + skb->len + ETH_HLEN); +-- +2.25.1 + diff --git a/queue-4.19/bnxt-don-t-enable-napi-until-rings-are-ready.patch b/queue-4.19/bnxt-don-t-enable-napi-until-rings-are-ready.patch new file mode 100644 index 00000000000..5b0de5722c8 --- /dev/null +++ b/queue-4.19/bnxt-don-t-enable-napi-until-rings-are-ready.patch @@ -0,0 +1,86 @@ +From bfcc202b1ca1d74a5643508b4e3a6258d675bb33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 12:40:07 -0700 +Subject: bnxt: don't enable NAPI until rings are ready + +From: Jakub Kicinski + +[ Upstream commit 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 ] + +Netpoll can try to poll napi as soon as napi_enable() is called. +It crashes trying to access a doorbell which is still NULL: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S 5.9.0-rc1-00469-g5fd99b5d9950-dirty #26 + RIP: 0010:bnxt_poll+0x121/0x1c0 + Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02 +41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a + netpoll_poll_dev+0xbd/0x1a0 + __netpoll_send_skb+0x1b2/0x210 + netpoll_send_udp+0x2c9/0x406 + write_ext_msg+0x1d7/0x1f0 + console_unlock+0x23c/0x520 + vprintk_emit+0xe0/0x1d0 + printk+0x58/0x6f + x86_vector_activate.cold+0xf/0x46 + __irq_domain_activate_irq+0x50/0x80 + __irq_domain_activate_irq+0x32/0x80 + __irq_domain_activate_irq+0x32/0x80 + irq_domain_activate_irq+0x25/0x40 + __setup_irq+0x2d2/0x700 + request_threaded_irq+0xfb/0x160 + __bnxt_open_nic+0x3b1/0x750 + bnxt_open_nic+0x19/0x30 + ethtool_set_channels+0x1ac/0x220 + dev_ethtool+0x11ba/0x2240 + dev_ioctl+0x1cf/0x390 + sock_do_ioctl+0x95/0x130 + +Reported-by: Rob Sherwood +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Jakub Kicinski +Reviewed-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index df3514503dee9..a267380b267d7 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7027,15 +7027,15 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + } + } + +- bnxt_enable_napi(bp); +- bnxt_debug_dev_init(bp); +- + rc = bnxt_init_nic(bp, irq_re_init); + if (rc) { + netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc); +- goto open_err; ++ goto open_err_irq; + } + ++ bnxt_enable_napi(bp); ++ bnxt_debug_dev_init(bp); ++ + if (link_re_init) { + mutex_lock(&bp->link_lock); + rc = bnxt_update_phy_setting(bp); +@@ -7066,10 +7066,6 @@ static int __bnxt_open_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + bnxt_vf_reps_open(bp); + return 0; + +-open_err: +- bnxt_debug_dev_exit(bp); +- bnxt_disable_napi(bp); +- + open_err_irq: + bnxt_del_napi(bp); + +-- +2.25.1 + diff --git a/queue-4.19/bnxt_en-check-for-zero-dir-entries-in-nvram.patch b/queue-4.19/bnxt_en-check-for-zero-dir-entries-in-nvram.patch new file mode 100644 index 00000000000..55f429ed317 --- /dev/null +++ b/queue-4.19/bnxt_en-check-for-zero-dir-entries-in-nvram.patch @@ -0,0 +1,39 @@ +From a827112723bbbfed983c0b017f809760bca7aef4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:33 -0400 +Subject: bnxt_en: Check for zero dir entries in NVRAM. + +From: Vasundhara Volam + +[ Upstream commit dbbfa96ad920c50d58bcaefa57f5f33ceef9d00e ] + +If firmware goes into unstable state, HWRM_NVM_GET_DIR_INFO firmware +command may return zero dir entries. Return error in such case to +avoid zero length dma buffer request. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 14fe4f9f24b88..a1cb99110092d 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1877,6 +1877,9 @@ static int bnxt_get_nvram_directory(struct net_device *dev, u32 len, u8 *data) + if (rc != 0) + return rc; + ++ if (!dir_entries || !entry_length) ++ return -EIO; ++ + /* Insert 2 bytes of directory info (count and size of entries) */ + if (len < 2) + return -EINVAL; +-- +2.25.1 + diff --git a/queue-4.19/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch b/queue-4.19/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch new file mode 100644 index 00000000000..431776bdc44 --- /dev/null +++ b/queue-4.19/bnxt_en-don-t-query-fw-when-netif_running-is-false.patch @@ -0,0 +1,40 @@ +From 6c73170afe440e0642f3d420bd0bb5f175870cf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:32 -0400 +Subject: bnxt_en: Don't query FW when netif_running() is false. + +From: Pavan Chebbi + +[ Upstream commit c1c2d77408022a398a1a7c51cf20488c922629de ] + +In rare conditions like two stage OS installation, the +ethtool's get_channels function may be called when the +device is in D3 state, leading to uncorrectable PCI error. +Check netif_running() first before making any query to FW +which involves writing to BAR. + +Fixes: db4723b3cd2d ("bnxt_en: Check max_tx_scheduler_inputs value from firmware.") +Signed-off-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 63730e449e088..14fe4f9f24b88 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -471,7 +471,7 @@ static void bnxt_get_channels(struct net_device *dev, + int max_tx_sch_inputs; + + /* Get the most up-to-date max_tx_sch_inputs. */ +- if (BNXT_NEW_RM(bp)) ++ if (netif_running(dev) && BNXT_NEW_RM(bp)) + bnxt_hwrm_func_resc_qcaps(bp, false); + max_tx_sch_inputs = hw_resc->max_tx_sch_inputs; + +-- +2.25.1 + diff --git a/queue-4.19/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch b/queue-4.19/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch new file mode 100644 index 00000000000..93bb0aa7d8e --- /dev/null +++ b/queue-4.19/bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch @@ -0,0 +1,60 @@ +From 991ee8927fc8e54d4e2a5a6914a8b6f269ceaa04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:37 -0400 +Subject: bnxt_en: fix HWRM error when querying VF temperature + +From: Edwin Peer + +[ Upstream commit 12cce90b934bf2b0ed9c339b4d5503e69954351a ] + +Firmware returns RESOURCE_ACCESS_DENIED for HWRM_TEMP_MONITORY_QUERY for +VFs. This produces unpleasing error messages in the log when temp1_input +is queried via the hwmon sysfs interface from a VF. + +The error is harmless and expected, so silence it and return unknown as +the value. Since the device temperature is not particularly sensitive +information, provide flexibility to change this policy in future by +silencing the error rather than avoiding the HWRM call entirely for VFs. + +Fixes: cde49a42a9bb ("bnxt_en: Add hwmon sysfs support to read temperature") +Cc: Marc Smith +Reported-by: Marc Smith +Signed-off-by: Edwin Peer +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 7047f4237ceaf..df3514503dee9 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6836,16 +6836,19 @@ static ssize_t bnxt_show_temp(struct device *dev, + struct hwrm_temp_monitor_query_input req = {0}; + struct hwrm_temp_monitor_query_output *resp; + struct bnxt *bp = dev_get_drvdata(dev); +- u32 temp = 0; ++ u32 len = 0; + + resp = bp->hwrm_cmd_resp_addr; + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); + mutex_lock(&bp->hwrm_cmd_lock); +- if (!_hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) +- temp = resp->temp * 1000; /* display millidegree */ ++ if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) ++ len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); + +- return sprintf(buf, "%u\n", temp); ++ if (len) ++ return len; ++ ++ return sprintf(buf, "unknown\n"); + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +-- +2.25.1 + diff --git a/queue-4.19/bnxt_en-fix-pci-aer-error-recovery-flow.patch b/queue-4.19/bnxt_en-fix-pci-aer-error-recovery-flow.patch new file mode 100644 index 00000000000..96ad7f0f573 --- /dev/null +++ b/queue-4.19/bnxt_en-fix-pci-aer-error-recovery-flow.patch @@ -0,0 +1,46 @@ +From ed94c5c71b7bca7bc861eb708d45b9a6ef4c7da1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:08:35 -0400 +Subject: bnxt_en: Fix PCI AER error recovery flow + +From: Vasundhara Volam + +[ Upstream commit df3875ec550396974b1d8a518bd120d034738236 ] + +When a PCI error is detected the PCI state could be corrupt, save +the PCI state after initialization and restore it after the slot +reset. + +Fixes: 6316ea6db93d ("bnxt_en: Enable AER support.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index ab4d1dacb5854..7047f4237ceaf 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9128,6 +9128,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + (long)pci_resource_start(pdev, 0), dev->dev_addr); + pcie_print_link_status(pdev); + ++ pci_save_state(pdev); + return 0; + + init_err_cleanup_tc: +@@ -9289,6 +9290,8 @@ static pci_ers_result_t bnxt_io_slot_reset(struct pci_dev *pdev) + "Cannot re-enable PCI device after reset.\n"); + } else { + pci_set_master(pdev); ++ pci_restore_state(pdev); ++ pci_save_state(pdev); + + err = bnxt_hwrm_func_reset(bp); + if (!err && netif_running(netdev)) +-- +2.25.1 + diff --git a/queue-4.19/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch b/queue-4.19/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch new file mode 100644 index 00000000000..9421239f963 --- /dev/null +++ b/queue-4.19/dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch @@ -0,0 +1,39 @@ +From c0a16d1fcda04c7680bb37fa689d0a697649e99e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 19:57:26 +0800 +Subject: dmaengine: at_hdmac: check return value of of_find_device_by_node() + in at_dma_xlate() + +From: Yu Kuai + +[ Upstream commit 0cef8e2c5a07d482ec907249dbd6687e8697677f ] + +The reurn value of of_find_device_by_node() is not checked, thus null +pointer dereference will be triggered if of_find_device_by_node() +failed. + +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200817115728.1706719-2-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/at_hdmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index dbc51154f1229..86427f6ba78cb 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1677,6 +1677,8 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + return NULL; + + dmac_pdev = of_find_device_by_node(dma_spec->np); ++ if (!dmac_pdev) ++ return NULL; + + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); +-- +2.25.1 + diff --git a/queue-4.19/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch b/queue-4.19/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch new file mode 100644 index 00000000000..0319f187216 --- /dev/null +++ b/queue-4.19/dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch @@ -0,0 +1,47 @@ +From 661cfd6095b7fd14f43a5a54ed1ee71b19dd0588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 13:49:28 +0300 +Subject: dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling + +From: Peter Ujfalusi + +[ Upstream commit 5b2aa9f918f6837ae943557f8cec02c34fcf80e7 ] + +of_dma_xlate callback can return ERR_PTR as well NULL in case of failure. + +If error code is returned (not NULL) then the route should be released and +the router should not be registered for the channel. + +Fixes: 56f13c0d9524c ("dmaengine: of_dma: Support for DMA routers") +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200806104928.25975-1-peter.ujfalusi@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/of-dma.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c +index 91fd395c90c4c..8344a60c2131b 100644 +--- a/drivers/dma/of-dma.c ++++ b/drivers/dma/of-dma.c +@@ -72,12 +72,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + return NULL; + + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); +- if (chan) { +- chan->router = ofdma->dma_router; +- chan->route_data = route_data; +- } else { ++ if (IS_ERR_OR_NULL(chan)) { + ofdma->dma_router->route_free(ofdma->dma_router->dev, + route_data); ++ } else { ++ chan->router = ofdma->dma_router; ++ chan->route_data = route_data; + } + + /* +-- +2.25.1 + diff --git a/queue-4.19/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch b/queue-4.19/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch new file mode 100644 index 00000000000..106bc3095e8 --- /dev/null +++ b/queue-4.19/dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch @@ -0,0 +1,48 @@ +From 42ea083f79db85bba784dd82ee99cefaf26b2784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 08:46:17 +0200 +Subject: dmaengine: pl330: Fix burst length if burst size is smaller than bus + width + +From: Marek Szyprowski + +[ Upstream commit 0661cef675d37e2c4b66a996389ebeae8568e49e ] + +Move the burst len fixup after setting the generic value for it. This +finally enables the fixup introduced by commit 137bd11090d8 ("dmaengine: +pl330: Align DMA memcpy operations to MFIFO width"), which otherwise was +overwritten by the generic value. + +Reported-by: kernel test robot +Fixes: 137bd11090d8 ("dmaengine: pl330: Align DMA memcpy operations to MFIFO width") +Signed-off-by: Marek Szyprowski +Link: https://lore.kernel.org/r/20200825064617.16193-1-m.szyprowski@samsung.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/pl330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index bc8050c025b7b..c564df713efc3 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2769,6 +2769,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + while (burst != (1 << desc->rqcfg.brst_size)) + desc->rqcfg.brst_size++; + ++ desc->rqcfg.brst_len = get_burst_len(desc, len); + /* + * If burst size is smaller than bus width then make sure we only + * transfer one at a time to avoid a burst stradling an MFIFO entry. +@@ -2776,7 +2777,6 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst, + if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width) + desc->rqcfg.brst_len = 1; + +- desc->rqcfg.brst_len = get_burst_len(desc, len); + desc->bytes_requested = len; + + desc->txd.flags = flags; +-- +2.25.1 + diff --git a/queue-4.19/drm-radeon-prefer-lower-feedback-dividers.patch b/queue-4.19/drm-radeon-prefer-lower-feedback-dividers.patch new file mode 100644 index 00000000000..1fe772936bd --- /dev/null +++ b/queue-4.19/drm-radeon-prefer-lower-feedback-dividers.patch @@ -0,0 +1,48 @@ +From e1ef8462b49963180ae5f167f1ede01066ba72be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:33:48 +0800 +Subject: drm/radeon: Prefer lower feedback dividers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit fc8c70526bd30733ea8667adb8b8ffebea30a8ed ] + +Commit 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +fixed screen flicker for HP Compaq nx9420 but breaks other laptops like +Asus X50SL. + +Turns out we also need to favor lower feedback dividers. + +Users confirmed this change fixes the regression and doesn't regress the +original fix. + +Fixes: 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +BugLink: https://bugs.launchpad.net/bugs/1791312 +BugLink: https://bugs.launchpad.net/bugs/1861554 +Reviewed-by: Christian König +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 3f0f3a578ddf0..c28d76d898fdb 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -926,7 +926,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div, + + /* get matching reference and feedback divider */ + *ref_div = min(max(den/post_div, 1u), ref_div_max); +- *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den); ++ *fb_div = max(nom * *ref_div * post_div / den, 1u); + + /* limit fb divider to its maximum */ + if (*fb_div > fb_div_max) { +-- +2.25.1 + diff --git a/queue-4.19/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch b/queue-4.19/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch new file mode 100644 index 00000000000..6034786ca18 --- /dev/null +++ b/queue-4.19/fix-regression-in-epoll-keep-a-reference-on-files-ad.patch @@ -0,0 +1,42 @@ +From 719f9e2926799a6a662634b491798645327dccb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:30:48 -0400 +Subject: fix regression in "epoll: Keep a reference on files added to the + check list" + +From: Al Viro + +[ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ] + +epoll_loop_check_proc() can run into a file already committed to destruction; +we can't grab a reference on those and don't need to add them to the set for +reverse path check anyway. + +Tested-by: Marc Zyngier +Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list") +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index f988ccd064a22..61a52bb26d127 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1891,9 +1891,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) + * during ep_insert(). + */ + if (list_empty(&epi->ffd.file->f_tfile_llink)) { +- get_file(epi->ffd.file); +- list_add(&epi->ffd.file->f_tfile_llink, +- &tfile_check_list); ++ if (get_file_rcu(epi->ffd.file)) ++ list_add(&epi->ffd.file->f_tfile_llink, ++ &tfile_check_list); + } + } + } +-- +2.25.1 + diff --git a/queue-4.19/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch b/queue-4.19/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch new file mode 100644 index 00000000000..23abc4ee838 --- /dev/null +++ b/queue-4.19/gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch @@ -0,0 +1,36 @@ +From 06900c8b286ac0cd992b21f18d8c17ecc2989d33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 14:59:40 +0200 +Subject: gtp: add GTPA_LINK info to msg sent to userspace + +From: Nicolas Dichtel + +[ Upstream commit b274e47d9e3f4dcd4ad4028a316ec22dc4533ac7 ] + +During a dump, this attribute is essential, it enables the userspace to +know on which interface the context is linked to. + +Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)") +Signed-off-by: Nicolas Dichtel +Tested-by: Gabriel Ganne +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index d73850ebb671f..f2fecb6842209 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1187,6 +1187,7 @@ static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, + goto nlmsg_failure; + + if (nla_put_u32(skb, GTPA_VERSION, pctx->gtp_version) || ++ nla_put_u32(skb, GTPA_LINK, pctx->dev->ifindex) || + nla_put_be32(skb, GTPA_PEER_ADDRESS, pctx->peer_addr_ip4.s_addr) || + nla_put_be32(skb, GTPA_MS_ADDRESS, pctx->ms_addr_ip4.s_addr)) + goto nla_put_failure; +-- +2.25.1 + diff --git a/queue-4.19/include-linux-log2.h-add-missing-around-n-in-roundup.patch b/queue-4.19/include-linux-log2.h-add-missing-around-n-in-roundup.patch new file mode 100644 index 00000000000..2f3f6552ba2 --- /dev/null +++ b/queue-4.19/include-linux-log2.h-add-missing-around-n-in-roundup.patch @@ -0,0 +1,37 @@ +From e88fd28048e577e2424fcf6eff3567a91a0446f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 16:36:19 -0700 +Subject: include/linux/log2.h: add missing () around n in roundup_pow_of_two() + +From: Jason Gunthorpe + +[ Upstream commit 428fc0aff4e59399ec719ffcc1f7a5d29a4ee476 ] + +Otherwise gcc generates warnings if the expression is complicated. + +Fixes: 312a0c170945 ("[PATCH] LOG2: Alter roundup_pow_of_two() so that it can use a ilog2() on a constant") +Signed-off-by: Jason Gunthorpe +Signed-off-by: Andrew Morton +Link: https://lkml.kernel.org/r/0-v1-8a2697e3c003+41165-log_brackets_jgg@nvidia.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/log2.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/log2.h b/include/linux/log2.h +index 2af7f77866d03..78496801cddf0 100644 +--- a/include/linux/log2.h ++++ b/include/linux/log2.h +@@ -177,7 +177,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + #define roundup_pow_of_two(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n == 1) ? 1 : \ ++ ((n) == 1) ? 1 : \ + (1UL << (ilog2((n) - 1) + 1)) \ + ) : \ + __roundup_pow_of_two(n) \ +-- +2.25.1 + diff --git a/queue-4.19/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch b/queue-4.19/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch new file mode 100644 index 00000000000..a6caaa56532 --- /dev/null +++ b/queue-4.19/iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch @@ -0,0 +1,62 @@ +From 331e2f956dbb1cffc87ca12905699501ba25c073 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 08:06:15 +0800 +Subject: iommu/vt-d: Serialize IOMMU GCMD register modifications + +From: Lu Baolu + +[ Upstream commit 6e4e9ec65078093165463c13d4eb92b3e8d7b2e8 ] + +The VT-d spec requires (10.4.4 Global Command Register, GCMD_REG General +Description) that: + +If multiple control fields in this register need to be modified, software +must serialize the modifications through multiple writes to this register. + +However, in irq_remapping.c, modifications of IRE and CFI are done in one +write. We need to do two separate writes with STS checking after each. It +also checks the status register before writing command register to avoid +unnecessary register write. + +Fixes: af8d102f999a4 ("x86/intel/irq_remapping: Clean up x2apic opt-out security warning mess") +Signed-off-by: Lu Baolu +Reviewed-by: Kevin Tian +Cc: Andy Lutomirski +Cc: Jacob Pan +Cc: Kevin Tian +Cc: Ashok Raj +Link: https://lore.kernel.org/r/20200828000615.8281-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel_irq_remapping.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c +index 15a4ad31c510a..9d2d03545bb07 100644 +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -479,12 +479,18 @@ static void iommu_enable_irq_remapping(struct intel_iommu *iommu) + + /* Enable interrupt-remapping */ + iommu->gcmd |= DMA_GCMD_IRE; +- iommu->gcmd &= ~DMA_GCMD_CFI; /* Block compatibility-format MSIs */ + writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); +- + IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, + readl, (sts & DMA_GSTS_IRES), sts); + ++ /* Block compatibility-format MSIs */ ++ if (sts & DMA_GSTS_CFIS) { ++ iommu->gcmd &= ~DMA_GCMD_CFI; ++ writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG); ++ IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG, ++ readl, !(sts & DMA_GSTS_CFIS), sts); ++ } ++ + /* + * With CFI clear in the Global Command register, we should be + * protected from dangerous (i.e. compatibility) interrupts +-- +2.25.1 + diff --git a/queue-4.19/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch b/queue-4.19/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch new file mode 100644 index 00000000000..2345ce09e74 --- /dev/null +++ b/queue-4.19/mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch @@ -0,0 +1,37 @@ +From b2fb834a09f90edaa20a734bd44c1dd680af59c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 11:26:45 -0700 +Subject: MIPS: BMIPS: Also call bmips_cpu_setup() for secondary cores + +From: Florian Fainelli + +[ Upstream commit e14f633b66902615cf7faa5d032b45ab8b6fb158 ] + +The initialization done by bmips_cpu_setup() typically affects both +threads of a given core, on 7435 which supports 2 cores and 2 threads, +logical CPU number 2 and 3 would not run this initialization. + +Fixes: 738a3f79027b ("MIPS: BMIPS: Add early CPU initialization code") +Signed-off-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp-bmips.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 5ec546b5eed1c..d16e6654a6555 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -240,6 +240,8 @@ static int bmips_boot_secondary(int cpu, struct task_struct *idle) + */ + static void bmips_init_secondary(void) + { ++ bmips_cpu_setup(); ++ + switch (current_cpu_type()) { + case CPU_BMIPS4350: + case CPU_BMIPS4380: +-- +2.25.1 + diff --git a/queue-4.19/mips-mm-bmips5000-has-inclusive-physical-caches.patch b/queue-4.19/mips-mm-bmips5000-has-inclusive-physical-caches.patch new file mode 100644 index 00000000000..945cb262dba --- /dev/null +++ b/queue-4.19/mips-mm-bmips5000-has-inclusive-physical-caches.patch @@ -0,0 +1,41 @@ +From c6819da41ea30ac09f92e074cc5a560ff66b770e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 11:26:44 -0700 +Subject: MIPS: mm: BMIPS5000 has inclusive physical caches + +From: Florian Fainelli + +[ Upstream commit dbfc95f98f0158958d1f1e6bf06d74be38dbd821 ] + +When the BMIPS generic cpu-feature-overrides.h file was introduced, +cpu_has_inclusive_caches/MIPS_CPU_INCLUSIVE_CACHES was not set for +BMIPS5000 CPUs. Correct this when we have initialized the MIPS secondary +cache successfully. + +Fixes: f337967d6d87 ("MIPS: BMIPS: Add cpu-feature-overrides.h") +Signed-off-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/c-r4k.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 05a539d3a5970..7650edd5cf7ff 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -1789,7 +1789,11 @@ static void setup_scache(void) + printk("MIPS secondary cache %ldkB, %s, linesize %d bytes.\n", + scache_size >> 10, + way_string[c->scache.ways], c->scache.linesz); ++ ++ if (current_cpu_type() == CPU_BMIPS5000) ++ c->options |= MIPS_CPU_INCLUSIVE_CACHES; + } ++ + #else + if (!(c->scache.flags & MIPS_CACHE_NOT_PRESENT)) + panic("Dunno how to handle MIPS32 / MIPS64 second level cache"); +-- +2.25.1 + diff --git a/queue-4.19/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch b/queue-4.19/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch new file mode 100644 index 00000000000..8d48e2d1531 --- /dev/null +++ b/queue-4.19/net-arc_emac-fix-memleak-in-arc_mdio_probe.patch @@ -0,0 +1,36 @@ +From e79ecf63b2f25a616270f788c5e8a2e124768767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 16:56:47 +0800 +Subject: net: arc_emac: Fix memleak in arc_mdio_probe + +From: Dinghao Liu + +[ Upstream commit e2d79cd8875fa8c3cc7defa98a8cc99a1ed0c62f ] + +When devm_gpiod_get_optional() fails, bus should be +freed just like when of_mdiobus_register() fails. + +Fixes: 1bddd96cba03d ("net: arc_emac: support the phy reset for emac driver") +Signed-off-by: Dinghao Liu +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/arc/emac_mdio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/arc/emac_mdio.c b/drivers/net/ethernet/arc/emac_mdio.c +index 0187dbf3b87df..54cdafdd067db 100644 +--- a/drivers/net/ethernet/arc/emac_mdio.c ++++ b/drivers/net/ethernet/arc/emac_mdio.c +@@ -153,6 +153,7 @@ int arc_mdio_probe(struct arc_emac_priv *priv) + if (IS_ERR(data->reset_gpio)) { + error = PTR_ERR(data->reset_gpio); + dev_err(priv->dev, "Failed to request gpio: %d\n", error); ++ mdiobus_free(bus); + return error; + } + +-- +2.25.1 + diff --git a/queue-4.19/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch b/queue-4.19/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch new file mode 100644 index 00000000000..197648b07e3 --- /dev/null +++ b/queue-4.19/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch @@ -0,0 +1,44 @@ +From fd4fd79dabc6f95b452056f085404fe6b5427fb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 22:37:09 +0800 +Subject: net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init() + +From: Shung-Hsi Yu + +[ Upstream commit cbedcb044e9cc4e14bbe6658111224bb923094f4 ] + +On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a +max_order of 31 will be passed to mlx_buddy_init(), which results in +s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to +kvmalloc_array() failure when it is converted to size_t. + + mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting + mlx4_core: probe of 0000:b1:00.0 failed with error -12 + +Fix this issue by changing the left shifting operand from a signed literal to +an unsigned one. + +Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters") +Signed-off-by: Shung-Hsi Yu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index 1a11bc0e16123..cfa0bba3940fb 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_buddy *buddy, int max_order) + goto err_out; + + for (i = 0; i <= buddy->max_order; ++i) { +- s = BITS_TO_LONGS(1 << (buddy->max_order - i)); ++ s = BITS_TO_LONGS(1UL << (buddy->max_order - i)); + buddy->bits[i] = kvmalloc_array(s, sizeof(long), GFP_KERNEL | __GFP_ZERO); + if (!buddy->bits[i]) + goto err_out_free; +-- +2.25.1 + diff --git a/queue-4.19/net-gemini-fix-another-missing-clk_disable_unprepare.patch b/queue-4.19/net-gemini-fix-another-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..5e88adc3c2e --- /dev/null +++ b/queue-4.19/net-gemini-fix-another-missing-clk_disable_unprepare.patch @@ -0,0 +1,84 @@ +From 46259e142e32a8cf2da2223e83966e9dadeb0e01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:56:31 +0300 +Subject: net: gemini: Fix another missing clk_disable_unprepare() in probe + +From: Dan Carpenter + +[ Upstream commit eb0f3bc463d59d86402f19c59aa44e82dc3fab6d ] + +We recently added some calls to clk_disable_unprepare() but we missed +the last error path if register_netdev() fails. + +I made a couple cleanups so we avoid mistakes like this in the future. +First I reversed the "if (!ret)" condition and pulled the code in one +indent level. Also, the "port->netdev = NULL;" is not required because +"port" isn't used again outside this function so I deleted that line. + +Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cortina/gemini.c | 34 +++++++++++++-------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c +index 16de0fa92ab74..5242687060b44 100644 +--- a/drivers/net/ethernet/cortina/gemini.c ++++ b/drivers/net/ethernet/cortina/gemini.c +@@ -2451,8 +2451,8 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + port->reset = devm_reset_control_get_exclusive(dev, NULL); + if (IS_ERR(port->reset)) { + dev_err(dev, "no reset\n"); +- clk_disable_unprepare(port->pclk); +- return PTR_ERR(port->reset); ++ ret = PTR_ERR(port->reset); ++ goto unprepare; + } + reset_control_reset(port->reset); + usleep_range(100, 500); +@@ -2507,25 +2507,25 @@ static int gemini_ethernet_port_probe(struct platform_device *pdev) + IRQF_SHARED, + port_names[port->id], + port); +- if (ret) { +- clk_disable_unprepare(port->pclk); +- return ret; +- } ++ if (ret) ++ goto unprepare; + + ret = register_netdev(netdev); +- if (!ret) { ++ if (ret) ++ goto unprepare; ++ ++ netdev_info(netdev, ++ "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", ++ port->irq, &dmares->start, ++ &gmacres->start); ++ ret = gmac_setup_phy(netdev); ++ if (ret) + netdev_info(netdev, +- "irq %d, DMA @ 0x%pap, GMAC @ 0x%pap\n", +- port->irq, &dmares->start, +- &gmacres->start); +- ret = gmac_setup_phy(netdev); +- if (ret) +- netdev_info(netdev, +- "PHY init failed, deferring to ifup time\n"); +- return 0; +- } ++ "PHY init failed, deferring to ifup time\n"); ++ return 0; + +- port->netdev = NULL; ++unprepare: ++ clk_disable_unprepare(port->pclk); + return ret; + } + +-- +2.25.1 + diff --git a/queue-4.19/net-hns-fix-memleak-in-hns_nic_dev_probe.patch b/queue-4.19/net-hns-fix-memleak-in-hns_nic_dev_probe.patch new file mode 100644 index 00000000000..140b154a45d --- /dev/null +++ b/queue-4.19/net-hns-fix-memleak-in-hns_nic_dev_probe.patch @@ -0,0 +1,50 @@ +From 5e2188d3ab82cc5823334772fb8fde4153796f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 13:44:42 +0800 +Subject: net: hns: Fix memleak in hns_nic_dev_probe + +From: Dinghao Liu + +[ Upstream commit 100e3345c6e719d2291e1efd5de311cc24bb9c0b ] + +hns_nic_dev_probe allocates ndev, but not free it on +two error handling paths, which may lead to memleak. + +Fixes: 63434888aaf1b ("net: hns: net: hns: enet adds support of acpi") +Signed-off-by: Dinghao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_enet.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 024b08fafd3b2..4de65a9de0a63 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -2297,8 +2297,10 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->enet_ver = AE_VERSION_1; + else if (acpi_dev_found(hns_enet_acpi_match[1].id)) + priv->enet_ver = AE_VERSION_2; +- else +- return -ENXIO; ++ else { ++ ret = -ENXIO; ++ goto out_read_prop_fail; ++ } + + /* try to find port-idx-in-ae first */ + ret = acpi_node_get_property_reference(dev->fwnode, +@@ -2314,7 +2316,8 @@ static int hns_nic_dev_probe(struct platform_device *pdev) + priv->fwnode = args.fwnode; + } else { + dev_err(dev, "cannot read cfg data from OF or acpi\n"); +- return -ENXIO; ++ ret = -ENXIO; ++ goto out_read_prop_fail; + } + + ret = device_property_read_u32(dev, "port-idx-in-ae", &port_id); +-- +2.25.1 + diff --git a/queue-4.19/net-systemport-fix-memleak-in-bcm_sysport_probe.patch b/queue-4.19/net-systemport-fix-memleak-in-bcm_sysport_probe.patch new file mode 100644 index 00000000000..73b84e1b70f --- /dev/null +++ b/queue-4.19/net-systemport-fix-memleak-in-bcm_sysport_probe.patch @@ -0,0 +1,40 @@ +From 53a0e1395bfa3e6240faf718d7beb10e47d881a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 13:58:31 +0800 +Subject: net: systemport: Fix memleak in bcm_sysport_probe + +From: Dinghao Liu + +[ Upstream commit 7ef1fc57301f3cef7201497aa27e89ccb91737fe ] + +When devm_kcalloc() fails, dev should be freed just +like what we've done in the subsequent error paths. + +Fixes: 7b78be48a8eb6 ("net: systemport: Dynamically allocate number of TX rings") +Signed-off-by: Dinghao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 6b761f6b8fd56..9a614c5cdfa22 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2441,8 +2441,10 @@ static int bcm_sysport_probe(struct platform_device *pdev) + priv->tx_rings = devm_kcalloc(&pdev->dev, txq, + sizeof(struct bcm_sysport_tx_ring), + GFP_KERNEL); +- if (!priv->tx_rings) +- return -ENOMEM; ++ if (!priv->tx_rings) { ++ ret = -ENOMEM; ++ goto err_free_netdev; ++ } + + priv->is_lite = params->is_lite; + priv->num_rx_desc_words = params->num_rx_desc_words; +-- +2.25.1 + diff --git a/queue-4.19/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch b/queue-4.19/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch new file mode 100644 index 00000000000..77ff0e8dce2 --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch @@ -0,0 +1,36 @@ +From 55509e9753b4a62f847cb3d80c5eec3868c7d067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:12:54 +0200 +Subject: netfilter: nf_tables: add NFTA_SET_USERDATA if not null + +From: Pablo Neira Ayuso + +[ Upstream commit 6f03bf43ee05b31d3822def2a80f11b3591c55b3 ] + +Kernel sends an empty NFTA_SET_USERDATA attribute with no value if +userspace adds a set with no NFTA_SET_USERDATA attribute. + +Fixes: e6d8ecac9e68 ("netfilter: nf_tables: Add new attributes into nft_set to store user data.") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 1b8a53081632f..159ec1533c980 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3204,7 +3204,8 @@ static int nf_tables_fill_set(struct sk_buff *skb, const struct nft_ctx *ctx, + goto nla_put_failure; + } + +- if (nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) ++ if (set->udata && ++ nla_put(skb, NFTA_SET_USERDATA, set->udlen, set->udata)) + goto nla_put_failure; + + desc = nla_nest_start(skb, NFTA_SET_DESC); +-- +2.25.1 + diff --git a/queue-4.19/netfilter-nf_tables-fix-destination-register-zeroing.patch b/queue-4.19/netfilter-nf_tables-fix-destination-register-zeroing.patch new file mode 100644 index 00000000000..73fc0d86384 --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-fix-destination-register-zeroing.patch @@ -0,0 +1,82 @@ +From 24657495c65afe5ea6cba2ae152bf688d991d3b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 21:05:50 +0200 +Subject: netfilter: nf_tables: fix destination register zeroing + +From: Florian Westphal + +[ Upstream commit 1e105e6afa6c3d32bfb52c00ffa393894a525c27 ] + +Following bug was reported via irc: +nft list ruleset + set knock_candidates_ipv4 { + type ipv4_addr . inet_service + size 65535 + elements = { 127.0.0.1 . 123, + 127.0.0.1 . 123 } + } + .. + udp dport 123 add @knock_candidates_ipv4 { ip saddr . 123 } + udp dport 123 add @knock_candidates_ipv4 { ip saddr . udp dport } + +It should not have been possible to add a duplicate set entry. + +After some debugging it turned out that the problem is the immediate +value (123) in the second-to-last rule. + +Concatenations use 32bit registers, i.e. the elements are 8 bytes each, +not 6 and it turns out the kernel inserted + +inet firewall @knock_candidates_ipv4 + element 0100007f ffff7b00 : 0 [end] + element 0100007f 00007b00 : 0 [end] + +Note the non-zero upper bits of the first element. It turns out that +nft_immediate doesn't zero the destination register, but this is needed +when the length isn't a multiple of 4. + +Furthermore, the zeroing in nft_payload is broken. We can't use +[len / 4] = 0 -- if len is a multiple of 4, index is off by one. + +Skip zeroing in this case and use a conditional instead of (len -1) / 4. + +Fixes: 49499c3e6e18 ("netfilter: nf_tables: switch registers to 32 bit addressing") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 2 ++ + net/netfilter/nft_payload.c | 4 +++- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 024636c31adcf..93253ba1eeac3 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -130,6 +130,8 @@ static inline u8 nft_reg_load8(u32 *sreg) + static inline void nft_data_copy(u32 *dst, const struct nft_data *src, + unsigned int len) + { ++ if (len % NFT_REG32_SIZE) ++ dst[len / NFT_REG32_SIZE] = 0; + memcpy(dst, src, len); + } + +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index 19446a89a2a81..b1a9f330a51fe 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -79,7 +79,9 @@ static void nft_payload_eval(const struct nft_expr *expr, + u32 *dest = ®s->data[priv->dreg]; + int offset; + +- dest[priv->len / NFT_REG32_SIZE] = 0; ++ if (priv->len % NFT_REG32_SIZE) ++ dest[priv->len / NFT_REG32_SIZE] = 0; ++ + switch (priv->base) { + case NFT_PAYLOAD_LL_HEADER: + if (!skb_mac_header_was_set(skb)) +-- +2.25.1 + diff --git a/queue-4.19/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch b/queue-4.19/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch new file mode 100644 index 00000000000..c5707da084d --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch @@ -0,0 +1,35 @@ +From 8440435877b05e059fb7da77b633984f3eba7740 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:12:55 +0200 +Subject: netfilter: nf_tables: incorrect enum nft_list_attributes definition + +From: Pablo Neira Ayuso + +[ Upstream commit da9125df854ea48a6240c66e8a67be06e2c12c03 ] + +This should be NFTA_LIST_UNSPEC instead of NFTA_LIST_UNPEC, all other +similar attribute definitions are postfixed with _UNSPEC. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_tables.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index 5eac62e1b68d5..cc00be102b9fb 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -132,7 +132,7 @@ enum nf_tables_msg_types { + * @NFTA_LIST_ELEM: list element (NLA_NESTED) + */ + enum nft_list_attributes { +- NFTA_LIST_UNPEC, ++ NFTA_LIST_UNSPEC, + NFTA_LIST_ELEM, + __NFTA_LIST_MAX + }; +-- +2.25.1 + diff --git a/queue-4.19/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch b/queue-4.19/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch new file mode 100644 index 00000000000..a46230d4423 --- /dev/null +++ b/queue-4.19/netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch @@ -0,0 +1,238 @@ +From b1f9f803389d1e4355639ca1c82b1e95fd044686 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 13:55:36 +0200 +Subject: netfilter: nfnetlink: nfnetlink_unicast() reports EAGAIN instead of + ENOBUFS + +From: Pablo Neira Ayuso + +[ Upstream commit ee921183557af39c1a0475f982d43b0fcac25e2e ] + +Frontend callback reports EAGAIN to nfnetlink to retry a command, this +is used to signal that module autoloading is required. Unfortunately, +nlmsg_unicast() reports EAGAIN in case the receiver socket buffer gets +full, so it enters a busy-loop. + +This patch updates nfnetlink_unicast() to turn EAGAIN into ENOBUFS and +to use nlmsg_unicast(). Remove the flags field in nfnetlink_unicast() +since this is always MSG_DONTWAIT in the existing code which is exactly +what nlmsg_unicast() passes to netlink_unicast() as parameter. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Reported-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/nfnetlink.h | 3 +- + net/netfilter/nf_tables_api.c | 61 ++++++++++++++--------------- + net/netfilter/nfnetlink.c | 11 ++++-- + net/netfilter/nfnetlink_log.c | 3 +- + net/netfilter/nfnetlink_queue.c | 2 +- + 5 files changed, 40 insertions(+), 40 deletions(-) + +diff --git a/include/linux/netfilter/nfnetlink.h b/include/linux/netfilter/nfnetlink.h +index cf09ab37b45b7..e713476ff29db 100644 +--- a/include/linux/netfilter/nfnetlink.h ++++ b/include/linux/netfilter/nfnetlink.h +@@ -43,8 +43,7 @@ int nfnetlink_has_listeners(struct net *net, unsigned int group); + int nfnetlink_send(struct sk_buff *skb, struct net *net, u32 portid, + unsigned int group, int echo, gfp_t flags); + int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error); +-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, +- int flags); ++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid); + + static inline u16 nfnl_msg_type(u8 subsys, u8 msg_type) + { +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 159ec1533c980..5b4632826dc66 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -718,11 +718,11 @@ static int nf_tables_gettable(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWTABLE, 0, + family, table); + if (err < 0) +- goto err; ++ goto err_fill_table_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_table_info: + kfree_skb(skb2); + return err; + } +@@ -1383,11 +1383,11 @@ static int nf_tables_getchain(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWCHAIN, 0, + family, table, chain); + if (err < 0) +- goto err; ++ goto err_fill_chain_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_chain_info: + kfree_skb(skb2); + return err; + } +@@ -2488,11 +2488,11 @@ static int nf_tables_getrule(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, + family, table, chain, rule); + if (err < 0) +- goto err; ++ goto err_fill_rule_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_rule_info: + kfree_skb(skb2); + return err; + } +@@ -3377,11 +3377,11 @@ static int nf_tables_getset(struct net *net, struct sock *nlsk, + + err = nf_tables_fill_set(skb2, &ctx, set, NFT_MSG_NEWSET, 0); + if (err < 0) +- goto err; ++ goto err_fill_set_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); + +-err: ++err_fill_set_info: + kfree_skb(skb2); + return err; + } +@@ -4157,24 +4157,18 @@ static int nft_get_set_elem(struct nft_ctx *ctx, struct nft_set *set, + err = -ENOMEM; + skb = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); + if (skb == NULL) +- goto err1; ++ return err; + + err = nf_tables_fill_setelem_info(skb, ctx, ctx->seq, ctx->portid, + NFT_MSG_NEWSETELEM, 0, set, &elem); + if (err < 0) +- goto err2; ++ goto err_fill_setelem; + +- err = nfnetlink_unicast(skb, ctx->net, ctx->portid, MSG_DONTWAIT); +- /* This avoids a loop in nfnetlink. */ +- if (err < 0) +- goto err1; ++ return nfnetlink_unicast(skb, ctx->net, ctx->portid); + +- return 0; +-err2: ++err_fill_setelem: + kfree_skb(skb); +-err1: +- /* this avoids a loop in nfnetlink. */ +- return err == -EAGAIN ? -ENOBUFS : err; ++ return err; + } + + /* called with rcu_read_lock held */ +@@ -5273,10 +5267,11 @@ static int nf_tables_getobj(struct net *net, struct sock *nlsk, + nlh->nlmsg_seq, NFT_MSG_NEWOBJ, 0, + family, table, obj, reset); + if (err < 0) +- goto err; ++ goto err_fill_obj_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_obj_info: + kfree_skb(skb2); + return err; + } +@@ -5933,10 +5928,11 @@ static int nf_tables_getflowtable(struct net *net, struct sock *nlsk, + NFT_MSG_NEWFLOWTABLE, 0, family, + flowtable); + if (err < 0) +- goto err; ++ goto err_fill_flowtable_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_flowtable_info: + kfree_skb(skb2); + return err; + } +@@ -6097,10 +6093,11 @@ static int nf_tables_getgen(struct net *net, struct sock *nlsk, + err = nf_tables_fill_gen_info(skb2, net, NETLINK_CB(skb).portid, + nlh->nlmsg_seq); + if (err < 0) +- goto err; ++ goto err_fill_gen_info; + +- return nlmsg_unicast(nlsk, skb2, NETLINK_CB(skb).portid); +-err: ++ return nfnetlink_unicast(skb2, net, NETLINK_CB(skb).portid); ++ ++err_fill_gen_info: + kfree_skb(skb2); + return err; + } +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 7f2c1915763f8..9bacddc761ba4 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -148,10 +148,15 @@ int nfnetlink_set_err(struct net *net, u32 portid, u32 group, int error) + } + EXPORT_SYMBOL_GPL(nfnetlink_set_err); + +-int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid, +- int flags) ++int nfnetlink_unicast(struct sk_buff *skb, struct net *net, u32 portid) + { +- return netlink_unicast(net->nfnl, skb, portid, flags); ++ int err; ++ ++ err = nlmsg_unicast(net->nfnl, skb, portid); ++ if (err == -EAGAIN) ++ err = -ENOBUFS; ++ ++ return err; + } + EXPORT_SYMBOL_GPL(nfnetlink_unicast); + +diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c +index 332c69d27b478..25298b3eb8546 100644 +--- a/net/netfilter/nfnetlink_log.c ++++ b/net/netfilter/nfnetlink_log.c +@@ -359,8 +359,7 @@ __nfulnl_send(struct nfulnl_instance *inst) + goto out; + } + } +- nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid, +- MSG_DONTWAIT); ++ nfnetlink_unicast(inst->skb, inst->net, inst->peer_portid); + out: + inst->qlen = 0; + inst->skb = NULL; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index d33094f4ec41e..f81a3ce0fe48e 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -685,7 +685,7 @@ __nfqnl_enqueue_packet(struct net *net, struct nfqnl_instance *queue, + *packet_id_ptr = htonl(entry->id); + + /* nfnetlink_unicast will either free the nskb or add it to a socket */ +- err = nfnetlink_unicast(nskb, net, queue->peer_portid, MSG_DONTWAIT); ++ err = nfnetlink_unicast(nskb, net, queue->peer_portid); + if (err < 0) { + if (queue->flags & NFQA_CFG_F_FAIL_OPEN) { + failopen = 1; +-- +2.25.1 + diff --git a/queue-4.19/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch b/queue-4.19/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch new file mode 100644 index 00000000000..229fdabb8c6 --- /dev/null +++ b/queue-4.19/nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch @@ -0,0 +1,44 @@ +From b731ab4696d1975eb55539f3bcabfdfec81b9a61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 09:58:19 +0200 +Subject: nvmet-fc: Fix a missed _irqsave version of spin_lock in + 'nvmet_fc_fod_op_done()' + +From: Christophe JAILLET + +[ Upstream commit 70e37988db94aba607d5491a94f80ba08e399b6b ] + +The way 'spin_lock()' and 'spin_lock_irqsave()' are used is not consistent +in this function. + +Use 'spin_lock_irqsave()' also here, as there is no guarantee that +interruptions are disabled at that point, according to surrounding code. + +Fixes: a97ec51b37ef ("nvmet_fc: Rework target side abort handling") +Signed-off-by: Christophe JAILLET +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 29b4b236afd85..77e4d184bc995 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -1986,9 +1986,9 @@ nvmet_fc_fod_op_done(struct nvmet_fc_fcp_iod *fod) + return; + if (fcpreq->fcp_error || + fcpreq->transferred_length != fcpreq->transfer_length) { +- spin_lock(&fod->flock); ++ spin_lock_irqsave(&fod->flock, flags); + fod->abort = true; +- spin_unlock(&fod->flock); ++ spin_unlock_irqrestore(&fod->flock, flags); + + nvmet_req_complete(&fod->req, NVME_SC_INTERNAL); + return; +-- +2.25.1 + diff --git a/queue-4.19/perf-jevents-fix-suspicious-code-in-fixregex.patch b/queue-4.19/perf-jevents-fix-suspicious-code-in-fixregex.patch new file mode 100644 index 00000000000..f9631f0e0dc --- /dev/null +++ b/queue-4.19/perf-jevents-fix-suspicious-code-in-fixregex.patch @@ -0,0 +1,47 @@ +From 2014f8691b5af9cede3d1513bce86502237d01f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 00:25:10 +0900 +Subject: perf jevents: Fix suspicious code in fixregex() + +From: Namhyung Kim + +[ Upstream commit e62458e3940eb3dfb009481850e140fbee183b04 ] + +The new string should have enough space for the original string and the +back slashes IMHO. + +Fixes: fbc2844e84038ce3 ("perf vendor events: Use more flexible pattern matching for CPU identification for mapfile.csv") +Signed-off-by: Namhyung Kim +Reviewed-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: John Garry +Cc: Kajol Jain +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: William Cohen +Link: http://lore.kernel.org/lkml/20200903152510.489233-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/jevents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index 38b5888ef7b38..c17e594041712 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -137,7 +137,7 @@ static char *fixregex(char *s) + return s; + + /* allocate space for a new string */ +- fixed = (char *) malloc(len + 1); ++ fixed = (char *) malloc(len + esc_count + 1); + if (!fixed) + return NULL; + +-- +2.25.1 + diff --git a/queue-4.19/perf-tools-correct-snoopx-field-offset.patch b/queue-4.19/perf-tools-correct-snoopx-field-offset.patch new file mode 100644 index 00000000000..e7154a12bf2 --- /dev/null +++ b/queue-4.19/perf-tools-correct-snoopx-field-offset.patch @@ -0,0 +1,51 @@ +From c8281cbe480df2c47b378b20cbee1899eb0861c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 12:10:14 -0300 +Subject: perf tools: Correct SNOOPX field offset + +From: Al Grant + +[ Upstream commit 39c0a53b114d0317e5c4e76b631f41d133af5cb0 ] + +perf_event.h has macros that define the field offsets in the data_src +bitmask in perf records. The SNOOPX and REMOTE offsets were both 37. + +These are distinct fields, and the bitfield layout in perf_mem_data_src +confirms that SNOOPX should be at offset 38. + +Committer notes: + +This was extracted from a larger patch that also contained kernel +changes. + +Fixes: 52839e653b5629bd ("perf tools: Add support for printing new mem_info encodings") +Signed-off-by: Al Grant +Reviewed-by: Andi Kleen +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/9974f2d0-bf7f-518e-d9f7-4520e5ff1bb0@foss.arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/include/uapi/linux/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/include/uapi/linux/perf_event.h b/tools/include/uapi/linux/perf_event.h +index f35eb72739c09..a45e7b4f03163 100644 +--- a/tools/include/uapi/linux/perf_event.h ++++ b/tools/include/uapi/linux/perf_event.h +@@ -1079,7 +1079,7 @@ union perf_mem_data_src { + + #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */ + /* 1 free */ +-#define PERF_MEM_SNOOPX_SHIFT 37 ++#define PERF_MEM_SNOOPX_SHIFT 38 + + /* locked instruction */ + #define PERF_MEM_LOCK_NA 0x01 /* not available */ +-- +2.25.1 + diff --git a/queue-4.19/ravb-fixed-to-be-able-to-unload-modules.patch b/queue-4.19/ravb-fixed-to-be-able-to-unload-modules.patch new file mode 100644 index 00000000000..dc1365936cf --- /dev/null +++ b/queue-4.19/ravb-fixed-to-be-able-to-unload-modules.patch @@ -0,0 +1,208 @@ +From 1c3cad10855f0ce3a0d1ff519bacaed73b957da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:43:07 +0900 +Subject: ravb: Fixed to be able to unload modules + +From: Yuusuke Ashizuka + +[ Upstream commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc ] + +When this driver is built as a module, I cannot rmmod it after insmoding +it. +This is because that this driver calls ravb_mdio_init() at the time of +probe, and module->refcnt is incremented by alloc_mdio_bitbang() called +after that. +Therefore, even if ifup is not performed, the driver is in use and rmmod +cannot be performed. + +$ lsmod +Module Size Used by +ravb 40960 1 +$ rmmod ravb +rmmod: ERROR: Module ravb is in use + +Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby +rmmod is possible in the ifdown state. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Yuusuke Ashizuka +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++------------ + 1 file changed, 55 insertions(+), 55 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 569e698b5c807..b5066cf86c856 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1337,6 +1337,51 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler, + return error; + } + ++/* MDIO bus init function */ ++static int ravb_mdio_init(struct ravb_private *priv) ++{ ++ struct platform_device *pdev = priv->pdev; ++ struct device *dev = &pdev->dev; ++ int error; ++ ++ /* Bitbang init */ ++ priv->mdiobb.ops = &bb_ops; ++ ++ /* MII controller setting */ ++ priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); ++ if (!priv->mii_bus) ++ return -ENOMEM; ++ ++ /* Hook up MII support for ethtool */ ++ priv->mii_bus->name = "ravb_mii"; ++ priv->mii_bus->parent = dev; ++ snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", ++ pdev->name, pdev->id); ++ ++ /* Register MDIO bus */ ++ error = of_mdiobus_register(priv->mii_bus, dev->of_node); ++ if (error) ++ goto out_free_bus; ++ ++ return 0; ++ ++out_free_bus: ++ free_mdio_bitbang(priv->mii_bus); ++ return error; ++} ++ ++/* MDIO bus release function */ ++static int ravb_mdio_release(struct ravb_private *priv) ++{ ++ /* Unregister mdio bus */ ++ mdiobus_unregister(priv->mii_bus); ++ ++ /* Free bitbang info */ ++ free_mdio_bitbang(priv->mii_bus); ++ ++ return 0; ++} ++ + /* Network device open function for Ethernet AVB */ + static int ravb_open(struct net_device *ndev) + { +@@ -1345,6 +1390,13 @@ static int ravb_open(struct net_device *ndev) + struct device *dev = &pdev->dev; + int error; + ++ /* MDIO bus init */ ++ error = ravb_mdio_init(priv); ++ if (error) { ++ netdev_err(ndev, "failed to initialize MDIO\n"); ++ return error; ++ } ++ + napi_enable(&priv->napi[RAVB_BE]); + napi_enable(&priv->napi[RAVB_NC]); + +@@ -1422,6 +1474,7 @@ out_free_irq: + out_napi_off: + napi_disable(&priv->napi[RAVB_NC]); + napi_disable(&priv->napi[RAVB_BE]); ++ ravb_mdio_release(priv); + return error; + } + +@@ -1721,6 +1774,8 @@ static int ravb_close(struct net_device *ndev) + ravb_ring_free(ndev, RAVB_BE); + ravb_ring_free(ndev, RAVB_NC); + ++ ravb_mdio_release(priv); ++ + return 0; + } + +@@ -1867,51 +1922,6 @@ static const struct net_device_ops ravb_netdev_ops = { + .ndo_set_features = ravb_set_features, + }; + +-/* MDIO bus init function */ +-static int ravb_mdio_init(struct ravb_private *priv) +-{ +- struct platform_device *pdev = priv->pdev; +- struct device *dev = &pdev->dev; +- int error; +- +- /* Bitbang init */ +- priv->mdiobb.ops = &bb_ops; +- +- /* MII controller setting */ +- priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); +- if (!priv->mii_bus) +- return -ENOMEM; +- +- /* Hook up MII support for ethtool */ +- priv->mii_bus->name = "ravb_mii"; +- priv->mii_bus->parent = dev; +- snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", +- pdev->name, pdev->id); +- +- /* Register MDIO bus */ +- error = of_mdiobus_register(priv->mii_bus, dev->of_node); +- if (error) +- goto out_free_bus; +- +- return 0; +- +-out_free_bus: +- free_mdio_bitbang(priv->mii_bus); +- return error; +-} +- +-/* MDIO bus release function */ +-static int ravb_mdio_release(struct ravb_private *priv) +-{ +- /* Unregister mdio bus */ +- mdiobus_unregister(priv->mii_bus); +- +- /* Free bitbang info */ +- free_mdio_bitbang(priv->mii_bus); +- +- return 0; +-} +- + static const struct of_device_id ravb_match_table[] = { + { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, + { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, +@@ -2138,13 +2148,6 @@ static int ravb_probe(struct platform_device *pdev) + eth_hw_addr_random(ndev); + } + +- /* MDIO bus init */ +- error = ravb_mdio_init(priv); +- if (error) { +- dev_err(&pdev->dev, "failed to initialize MDIO\n"); +- goto out_dma_free; +- } +- + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); + netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); + +@@ -2166,8 +2169,6 @@ static int ravb_probe(struct platform_device *pdev) + out_napi_del: + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); +-out_dma_free: + dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, + priv->desc_bat_dma); + +@@ -2199,7 +2200,6 @@ static int ravb_remove(struct platform_device *pdev) + unregister_netdev(ndev); + netif_napi_del(&priv->napi[RAVB_NC]); + netif_napi_del(&priv->napi[RAVB_BE]); +- ravb_mdio_release(priv); + pm_runtime_disable(&pdev->dev); + free_netdev(ndev); + platform_set_drvdata(pdev, NULL); +-- +2.25.1 + diff --git a/queue-4.19/selftests-bpf-fix-massive-output-from-test_maps.patch b/queue-4.19/selftests-bpf-fix-massive-output-from-test_maps.patch new file mode 100644 index 00000000000..0615a535688 --- /dev/null +++ b/queue-4.19/selftests-bpf-fix-massive-output-from-test_maps.patch @@ -0,0 +1,42 @@ +From 9475f1df000ed113eea210f2605ed6e0f3fa93b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 10:17:36 +0200 +Subject: selftests/bpf: Fix massive output from test_maps + +From: Jesper Dangaard Brouer + +[ Upstream commit fa4505675e093e895b7ec49a76d44f6b5ad9602e ] + +When stdout output from the selftests tool 'test_maps' gets redirected +into e.g file or pipe, then the output lines increase a lot (from 21 +to 33949 lines). This is caused by the printf that happens before the +fork() call, and there are user-space buffered printf data that seems +to be duplicated into the forked process. + +To fix this fflush() stdout before the fork loop in __run_parallel(). + +Fixes: 1a97cf1fe503 ("selftests/bpf: speedup test_maps") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/159842985651.1050885.2154399297503372406.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_maps.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 9b552c0fc47db..4e202217fae10 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -1017,6 +1017,8 @@ static void __run_parallel(int tasks, void (*fn)(int task, void *data), + pid_t pid[tasks]; + int i; + ++ fflush(stdout); ++ + for (i = 0; i < tasks; i++) { + pid[i] = fork(); + if (pid[i] == 0) { +-- +2.25.1 + diff --git a/queue-4.19/series b/queue-4.19/series index d91686d7d6a..2be51e327ec 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -12,3 +12,40 @@ ceph-don-t-allow-setlease-on-cephfs.patch cpuidle-fixup-irq-state.patch s390-don-t-trace-preemption-in-percpu-macros.patch xen-xenbus-fix-granting-of-vmalloc-d-memory.patch +dmaengine-of-dma-fix-of_dma_router_xlate-s-of_dma_xl.patch +batman-adv-avoid-uninitialized-chaddr-when-handling-.patch +batman-adv-fix-own-ogm-check-in-aggregated-ogms.patch +batman-adv-bla-use-netif_rx_ni-when-not-in-interrupt.patch +dmaengine-at_hdmac-check-return-value-of-of_find_dev.patch +mips-mm-bmips5000-has-inclusive-physical-caches.patch +mips-bmips-also-call-bmips_cpu_setup-for-secondary-c.patch +netfilter-nf_tables-add-nfta_set_userdata-if-not-nul.patch +netfilter-nf_tables-incorrect-enum-nft_list_attribut.patch +netfilter-nf_tables-fix-destination-register-zeroing.patch +net-hns-fix-memleak-in-hns_nic_dev_probe.patch +net-systemport-fix-memleak-in-bcm_sysport_probe.patch +ravb-fixed-to-be-able-to-unload-modules.patch +net-arc_emac-fix-memleak-in-arc_mdio_probe.patch +dmaengine-pl330-fix-burst-length-if-burst-size-is-sm.patch +gtp-add-gtpa_link-info-to-msg-sent-to-userspace.patch +bnxt_en-don-t-query-fw-when-netif_running-is-false.patch +bnxt_en-check-for-zero-dir-entries-in-nvram.patch +bnxt_en-fix-pci-aer-error-recovery-flow.patch +bnxt_en-fix-hwrm-error-when-querying-vf-temperature.patch +xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch +bnxt-don-t-enable-napi-until-rings-are-ready.patch +selftests-bpf-fix-massive-output-from-test_maps.patch +netfilter-nfnetlink-nfnetlink_unicast-reports-eagain.patch +nvmet-fc-fix-a-missed-_irqsave-version-of-spin_lock-.patch +perf-tools-correct-snoopx-field-offset.patch +net-ethernet-mlx4-fix-memory-allocation-in-mlx4_budd.patch +fix-regression-in-epoll-keep-a-reference-on-files-ad.patch +net-gemini-fix-another-missing-clk_disable_unprepare.patch +drm-radeon-prefer-lower-feedback-dividers.patch +xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch +perf-jevents-fix-suspicious-code-in-fixregex.patch +tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch +x86-fakenuma-fix-invalid-starting-node-id.patch +iommu-vt-d-serialize-iommu-gcmd-register-modificatio.patch +thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch +include-linux-log2.h-add-missing-around-n-in-roundup.patch diff --git a/queue-4.19/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch b/queue-4.19/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch new file mode 100644 index 00000000000..edf53894c9d --- /dev/null +++ b/queue-4.19/tg3-fix-soft-lockup-when-tg3_reset_task-fails.patch @@ -0,0 +1,80 @@ +From cd8a228dc5df95fc2d45e95b270964dcf569707a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 14:28:54 -0400 +Subject: tg3: Fix soft lockup when tg3_reset_task() fails. + +From: Michael Chan + +[ Upstream commit 556699341efa98243e08e34401b3f601da91f5a3 ] + +If tg3_reset_task() fails, the device state is left in an inconsistent +state with IFF_RUNNING still set but NAPI state not enabled. A +subsequent operation, such as ifdown or AER error can cause it to +soft lock up when it tries to disable NAPI state. + +Fix it by bringing down the device to !IFF_RUNNING state when +tg3_reset_task() fails. tg3_reset_task() running from workqueue +will now call tg3_close() when the reset fails. We need to +modify tg3_reset_task_cancel() slightly to avoid tg3_close() +calling cancel_work_sync() to cancel tg3_reset_task(). Otherwise +cancel_work_sync() will wait forever for tg3_reset_task() to +finish. + +Reported-by: David Christensen +Reported-by: Baptiste Covolato +Fixes: db2199737990 ("tg3: Schedule at most one tg3_reset_task run") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/tg3.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index be845df050399..6fcf9646d141b 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -7219,8 +7219,8 @@ static inline void tg3_reset_task_schedule(struct tg3 *tp) + + static inline void tg3_reset_task_cancel(struct tg3 *tp) + { +- cancel_work_sync(&tp->reset_task); +- tg3_flag_clear(tp, RESET_TASK_PENDING); ++ if (test_and_clear_bit(TG3_FLAG_RESET_TASK_PENDING, tp->tg3_flags)) ++ cancel_work_sync(&tp->reset_task); + tg3_flag_clear(tp, TX_RECOVERY_PENDING); + } + +@@ -11213,18 +11213,27 @@ static void tg3_reset_task(struct work_struct *work) + + tg3_halt(tp, RESET_KIND_SHUTDOWN, 0); + err = tg3_init_hw(tp, true); +- if (err) ++ if (err) { ++ tg3_full_unlock(tp); ++ tp->irq_sync = 0; ++ tg3_napi_enable(tp); ++ /* Clear this flag so that tg3_reset_task_cancel() will not ++ * call cancel_work_sync() and wait forever. ++ */ ++ tg3_flag_clear(tp, RESET_TASK_PENDING); ++ dev_close(tp->dev); + goto out; ++ } + + tg3_netif_start(tp); + +-out: + tg3_full_unlock(tp); + + if (!err) + tg3_phy_start(tp); + + tg3_flag_clear(tp, RESET_TASK_PENDING); ++out: + rtnl_unlock(); + } + +-- +2.25.1 + diff --git a/queue-4.19/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch b/queue-4.19/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch new file mode 100644 index 00000000000..c69ba996444 --- /dev/null +++ b/queue-4.19/thermal-ti-soc-thermal-fix-bogus-thermal-shutdowns-f.patch @@ -0,0 +1,110 @@ +From 6f34638189486b291c80e79bad66ae1d7de2f55a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 11:33:38 -0700 +Subject: thermal: ti-soc-thermal: Fix bogus thermal shutdowns for omap4430 + +From: Tony Lindgren + +[ Upstream commit 30d24faba0532d6972df79a1bf060601994b5873 ] + +We can sometimes get bogus thermal shutdowns on omap4430 at least with +droid4 running idle with a battery charger connected: + +thermal thermal_zone0: critical temperature reached (143 C), shutting down + +Dumping out the register values shows we can occasionally get a 0x7f value +that is outside the TRM listed values in the ADC conversion table. And then +we get a normal value when reading again after that. Reading the register +multiple times does not seem help avoiding the bogus values as they stay +until the next sample is ready. + +Looking at the TRM chapter "18.4.10.2.3 ADC Codes Versus Temperature", we +should have values from 13 to 107 listed with a total of 95 values. But +looking at the omap4430_adc_to_temp array, the values are off, and the +end values are missing. And it seems that the 4430 ADC table is similar +to omap3630 rather than omap4460. + +Let's fix the issue by using values based on the omap3630 table and just +ignoring invalid values. Compared to the 4430 TRM, the omap3630 table has +the missing values added while the TRM table only shows every second +value. + +Note that sometimes the ADC register values within the valid table can +also be way off for about 1 out of 10 values. But it seems that those +just show about 25 C too low values rather than too high values. So those +do not cause a bogus thermal shutdown. + +Fixes: 1a31270e54d7 ("staging: omap-thermal: add OMAP4 data structures") +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200706183338.25622-1-tony@atomide.com +Signed-off-by: Sasha Levin +--- + .../ti-soc-thermal/omap4-thermal-data.c | 23 ++++++++++--------- + .../thermal/ti-soc-thermal/omap4xxx-bandgap.h | 10 +++++--- + 2 files changed, 19 insertions(+), 14 deletions(-) + +diff --git a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +index c12211eaaac4d..0b9f835d931f0 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c ++++ b/drivers/thermal/ti-soc-thermal/omap4-thermal-data.c +@@ -46,20 +46,21 @@ static struct temp_sensor_data omap4430_mpu_temp_sensor_data = { + + /* + * Temperature values in milli degree celsius +- * ADC code values from 530 to 923 ++ * ADC code values from 13 to 107, see TRM ++ * "18.4.10.2.3 ADC Codes Versus Temperature". + */ + static const int + omap4430_adc_to_temp[OMAP4430_ADC_END_VALUE - OMAP4430_ADC_START_VALUE + 1] = { +- -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, -22000, +- -20000, -18000, -17000, -15000, -13000, -12000, -10000, -8000, -6000, +- -5000, -3000, -1000, 0, 2000, 3000, 5000, 6000, 8000, 10000, 12000, +- 13000, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28000, 30000, +- 32000, 33000, 35000, 37000, 38000, 40000, 42000, 43000, 45000, 47000, +- 48000, 50000, 52000, 53000, 55000, 57000, 58000, 60000, 62000, 64000, +- 66000, 68000, 70000, 71000, 73000, 75000, 77000, 78000, 80000, 82000, +- 83000, 85000, 87000, 88000, 90000, 92000, 93000, 95000, 97000, 98000, +- 100000, 102000, 103000, 105000, 107000, 109000, 111000, 113000, 115000, +- 117000, 118000, 120000, 122000, 123000, ++ -40000, -38000, -35000, -34000, -32000, -30000, -28000, -26000, -24000, ++ -22000, -20000, -18500, -17000, -15000, -13500, -12000, -10000, -8000, ++ -6500, -5000, -3500, -1500, 0, 2000, 3500, 5000, 6500, 8500, 10000, ++ 12000, 13500, 15000, 17000, 19000, 21000, 23000, 25000, 27000, 28500, ++ 30000, 32000, 33500, 35000, 37000, 38500, 40000, 42000, 43500, 45000, ++ 47000, 48500, 50000, 52000, 53500, 55000, 57000, 58500, 60000, 62000, ++ 64000, 66000, 68000, 70000, 71500, 73500, 75000, 77000, 78500, 80000, ++ 82000, 83500, 85000, 87000, 88500, 90000, 92000, 93500, 95000, 97000, ++ 98500, 100000, 102000, 103500, 105000, 107000, 109000, 111000, 113000, ++ 115000, 117000, 118500, 120000, 122000, 123500, 125000, + }; + + /* OMAP4430 data */ +diff --git a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +index b87c8659ec608..8a081abce4b5f 100644 +--- a/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h ++++ b/drivers/thermal/ti-soc-thermal/omap4xxx-bandgap.h +@@ -67,9 +67,13 @@ + * and thresholds for OMAP4430. + */ + +-/* ADC conversion table limits */ +-#define OMAP4430_ADC_START_VALUE 0 +-#define OMAP4430_ADC_END_VALUE 127 ++/* ++ * ADC conversion table limits. Ignore values outside the TRM listed ++ * range to avoid bogus thermal shutdowns. See omap4430 TRM chapter ++ * "18.4.10.2.3 ADC Codes Versus Temperature". ++ */ ++#define OMAP4430_ADC_START_VALUE 13 ++#define OMAP4430_ADC_END_VALUE 107 + /* bandgap clock limits (no control on 4430) */ + #define OMAP4430_MAX_FREQ 32768 + #define OMAP4430_MIN_FREQ 32768 +-- +2.25.1 + diff --git a/queue-4.19/x86-fakenuma-fix-invalid-starting-node-id.patch b/queue-4.19/x86-fakenuma-fix-invalid-starting-node-id.patch new file mode 100644 index 00000000000..816fe1314c2 --- /dev/null +++ b/queue-4.19/x86-fakenuma-fix-invalid-starting-node-id.patch @@ -0,0 +1,74 @@ +From 176b1d9a8e8dcd84ca123cf1319ca898d792b6a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 14:10:47 +0800 +Subject: x86, fakenuma: Fix invalid starting node ID + +From: Huang Ying + +[ Upstream commit ccae0f36d500aef727f98acd8d0601e6b262a513 ] + +Commit: + + cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") + +uses "-1" as the starting node ID, which causes the strange kernel log as +follows, when "numa=fake=32G" is added to the kernel command line: + + Faking node -1 at [mem 0x0000000000000000-0x0000000893ffffff] (35136MB) + Faking node 0 at [mem 0x0000001840000000-0x000000203fffffff] (32768MB) + Faking node 1 at [mem 0x0000000894000000-0x000000183fffffff] (64192MB) + Faking node 2 at [mem 0x0000002040000000-0x000000283fffffff] (32768MB) + Faking node 3 at [mem 0x0000002840000000-0x000000303fffffff] (32768MB) + +And finally the kernel crashes: + + BUG: Bad page state in process swapper pfn:00011 + page:(____ptrval____) refcount:0 mapcount:1 mapping:(____ptrval____) index:0x55cd7e44b270 pfn:0x11 + failed to read mapping contents, not a valid kernel address? + flags: 0x5(locked|uptodate) + raw: 0000000000000005 000055cd7e44af30 000055cd7e44af50 0000000100000006 + raw: 000055cd7e44b270 000055cd7e44b290 0000000000000000 000055cd7e44b510 + page dumped because: page still charged to cgroup + page->mem_cgroup:000055cd7e44b510 + Modules linked in: + CPU: 0 PID: 0 Comm: swapper Not tainted 5.9.0-rc2 #1 + Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 + Call Trace: + dump_stack+0x57/0x80 + bad_page.cold+0x63/0x94 + __free_pages_ok+0x33f/0x360 + memblock_free_all+0x127/0x195 + mem_init+0x23/0x1f5 + start_kernel+0x219/0x4f5 + secondary_startup_64+0xb6/0xc0 + +Fix this bug via using 0 as the starting node ID. This restores the +original behavior before cc9aec03e58f. + +[ mingo: Massaged the changelog. ] + +Fixes: cc9aec03e58f ("x86/numa_emulation: Introduce uniform split capability") +Signed-off-by: "Huang, Ying" +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20200904061047.612950-1-ying.huang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/mm/numa_emulation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c +index d71d72cf6c666..4686757a74d75 100644 +--- a/arch/x86/mm/numa_emulation.c ++++ b/arch/x86/mm/numa_emulation.c +@@ -322,7 +322,7 @@ static int __init split_nodes_size_interleave(struct numa_meminfo *ei, + u64 addr, u64 max_addr, u64 size) + { + return split_nodes_size_interleave_uniform(ei, pi, addr, max_addr, size, +- 0, NULL, NUMA_NO_NODE); ++ 0, NULL, 0); + } + + int __init setup_emu2phys_nid(int *dfl_phys_nid) +-- +2.25.1 + diff --git a/queue-4.19/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch b/queue-4.19/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch new file mode 100644 index 00000000000..886dcdc8fc2 --- /dev/null +++ b/queue-4.19/xfs-fix-boundary-test-in-xfs_attr_shortform_verify.patch @@ -0,0 +1,54 @@ +From 564e1e1e651feff93b64e0003253f39470158384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 14:11:58 -0700 +Subject: xfs: fix boundary test in xfs_attr_shortform_verify + +From: Eric Sandeen + +[ Upstream commit f4020438fab05364018c91f7e02ebdd192085933 ] + +The boundary test for the fixed-offset parts of xfs_attr_sf_entry in +xfs_attr_shortform_verify is off by one, because the variable array +at the end is defined as nameval[1] not nameval[]. +Hence we need to subtract 1 from the calculation. + +This can be shown by: + +# touch file +# setfattr -n root.a file + +and verifications will fail when it's written to disk. + +This only matters for a last attribute which has a single-byte name +and no value, otherwise the combination of namelen & valuelen will +push endp further out and this test won't fail. + +Fixes: 1e1bbd8e7ee06 ("xfs: create structure verifier function for shortform xattrs") +Signed-off-by: Eric Sandeen +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_attr_leaf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c +index 2652d00842d6b..087a5715cf20e 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -935,8 +935,10 @@ xfs_attr_shortform_verify( + * struct xfs_attr_sf_entry has a variable length. + * Check the fixed-offset parts of the structure are + * within the data buffer. ++ * xfs_attr_sf_entry is defined with a 1-byte variable ++ * array at the end, so we must subtract that off. + */ +- if (((char *)sfep + sizeof(*sfep)) >= endp) ++ if (((char *)sfep + sizeof(*sfep) - 1) >= endp) + return __this_address; + + /* Don't allow names with known bad length. */ +-- +2.25.1 + diff --git a/queue-4.19/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch b/queue-4.19/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch new file mode 100644 index 00000000000..b08d4014f30 --- /dev/null +++ b/queue-4.19/xfs-fix-xfs_bmap_validate_extent_raw-when-checking-a.patch @@ -0,0 +1,37 @@ +From b53a3bdf2d01bf35afb850197184e6773fbdb455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 10:47:02 -0700 +Subject: xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt + files + +From: Darrick J. Wong + +[ Upstream commit d0c20d38af135b2b4b90aa59df7878ef0c8fbef4 ] + +The realtime flag only applies to the data fork, so don't use the +realtime block number checks on the attr fork of a realtime file. + +Fixes: 30b0984d9117 ("xfs: refactor bmap record validation") +Signed-off-by: Darrick J. Wong +Reviewed-by: Eric Sandeen +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_bmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 0b7145fdb8aa1..f35e1801f1c90 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -6130,7 +6130,7 @@ xfs_bmap_validate_extent( + + isrt = XFS_IS_REALTIME_INODE(ip); + endfsb = irec->br_startblock + irec->br_blockcount - 1; +- if (isrt) { ++ if (isrt && whichfork == XFS_DATA_FORK) { + if (!xfs_verify_rtbno(mp, irec->br_startblock)) + return __this_address; + if (!xfs_verify_rtbno(mp, endfsb)) +-- +2.25.1 + -- 2.47.3