From beb9c3d1b14b1b15b901a01cdb3024325dafa954 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 9 Jan 2020 15:37:01 -0500 Subject: [PATCH] fixes for 4.4 Signed-off-by: Sasha Levin --- ...37x-gp-epos-evm-fix-panel-compatible.patch | 54 +++++++ ...-up-shared-opp-table-instead-of-indi.patch | 70 +++++++++ queue-4.4/asoc-wm8962-fix-lambda-value.patch | 47 ++++++ ...andle-requests-from-vfs-after-parity.patch | 88 +++++++++++ ...c-to-get-total-no.-of-pfs-per-engine.patch | 39 +++++ ...crash-on-null-expressions-in-expr_eq.patch | 42 +++++ ...statement-of-llc_stat_ev_rx_null_dsa.patch | 53 +++++++ ...pinlock-debug-fix-various-data-races.patch | 145 ++++++++++++++++++ ...x-fix-error-message-format-specifier.patch | 35 +++++ ...ink-netns-exit-must-wait-for-callbac.patch | 79 ++++++++++ ...void-undefined-left-shift-in-xt_sctp.patch | 50 ++++++ ...ix-compiler-warnings-in-debug_core.c.patch | 53 +++++++ ...hat-swiotlb-buffer-is-allocated-from.patch | 49 ++++++ ...regulator-rn5t618-fix-module-aliases.patch | 36 +++++ ...rect-check-to-avoid-null-pointer-der.patch | 44 ++++++ queue-4.4/series | 15 ++ 16 files changed, 899 insertions(+) create mode 100644 queue-4.4/arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch create mode 100644 queue-4.4/arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch create mode 100644 queue-4.4/asoc-wm8962-fix-lambda-value.patch create mode 100644 queue-4.4/bnx2x-do-not-handle-requests-from-vfs-after-parity.patch create mode 100644 queue-4.4/bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch create mode 100644 queue-4.4/kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch create mode 100644 queue-4.4/llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch create mode 100644 queue-4.4/locking-spinlock-debug-fix-various-data-races.patch create mode 100644 queue-4.4/net-usb-lan78xx-fix-error-message-format-specifier.patch create mode 100644 queue-4.4/netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch create mode 100644 queue-4.4/netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch create mode 100644 queue-4.4/parisc-fix-compiler-warnings-in-debug_core.c.patch create mode 100644 queue-4.4/powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch create mode 100644 queue-4.4/regulator-rn5t618-fix-module-aliases.patch create mode 100644 queue-4.4/rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch diff --git a/queue-4.4/arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch b/queue-4.4/arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch new file mode 100644 index 00000000000..876f8845c59 --- /dev/null +++ b/queue-4.4/arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch @@ -0,0 +1,54 @@ +From b9d09409b3f7d8023776dbe2bdbf4c461010ec46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 11:39:48 +0200 +Subject: ARM: dts: am437x-gp/epos-evm: fix panel compatible + +From: Tomi Valkeinen + +[ Upstream commit c6b16761c6908d3dc167a0a566578b4b0b972905 ] + +The LCD panel on AM4 GP EVMs and ePOS boards seems to be +osd070t1718-19ts. The current dts files say osd057T0559-34ts. Possibly +the panel has changed since the early EVMs, or there has been a mistake +with the panel type. + +Update the DT files accordingly. + +Acked-by: Laurent Pinchart +Signed-off-by: Tomi Valkeinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am437x-gp-evm.dts | 2 +- + arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/am437x-gp-evm.dts b/arch/arm/boot/dts/am437x-gp-evm.dts +index d2450ab0a380..3293484028ad 100644 +--- a/arch/arm/boot/dts/am437x-gp-evm.dts ++++ b/arch/arm/boot/dts/am437x-gp-evm.dts +@@ -79,7 +79,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + panel-timing { +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 00707aac72fc..a74b09f17a1a 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -41,7 +41,7 @@ + }; + + lcd0: display { +- compatible = "osddisplays,osd057T0559-34ts", "panel-dpi"; ++ compatible = "osddisplays,osd070t1718-19ts", "panel-dpi"; + label = "lcd"; + + panel-timing { +-- +2.20.1 + diff --git a/queue-4.4/arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch b/queue-4.4/arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch new file mode 100644 index 00000000000..776696b8fbc --- /dev/null +++ b/queue-4.4/arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch @@ -0,0 +1,70 @@ +From 5760010f47909e2ebfc00711c8f35eb40bab63cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Nov 2019 15:56:40 +0000 +Subject: ARM: vexpress: Set-up shared OPP table instead of individual for each + CPU + +From: Sudeep Holla + +[ Upstream commit 2a76352ad2cc6b78e58f737714879cc860903802 ] + +Currently we add individual copy of same OPP table for each CPU within +the cluster. This is redundant and doesn't reflect the reality. + +We can't use core cpumask to set policy->cpus in ve_spc_cpufreq_init() +anymore as it gets called via cpuhp_cpufreq_online()->cpufreq_online() +->cpufreq_driver->init() and the cpumask gets updated upon CPU hotplug +operations. It also may cause issues when the vexpress_spc_cpufreq +driver is built as a module. + +Since ve_spc_clk_init is built-in device initcall, we should be able to +use the same topology_core_cpumask to set the opp sharing cpumask via +dev_pm_opp_set_sharing_cpus and use the same later in the driver via +dev_pm_opp_get_sharing_cpus. + +Cc: Liviu Dudau +Cc: Lorenzo Pieralisi +Acked-by: Viresh Kumar +Tested-by: Dietmar Eggemann +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + arch/arm/mach-vexpress/spc.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-vexpress/spc.c b/arch/arm/mach-vexpress/spc.c +index 5766ce2be32b..29eb945075e3 100644 +--- a/arch/arm/mach-vexpress/spc.c ++++ b/arch/arm/mach-vexpress/spc.c +@@ -555,8 +555,9 @@ static struct clk *ve_spc_clk_register(struct device *cpu_dev) + + static int __init ve_spc_clk_init(void) + { +- int cpu; ++ int cpu, cluster; + struct clk *clk; ++ bool init_opp_table[MAX_CLUSTERS] = { false }; + + if (!info) + return 0; /* Continue only if SPC is initialised */ +@@ -582,8 +583,17 @@ static int __init ve_spc_clk_init(void) + continue; + } + ++ cluster = topology_physical_package_id(cpu_dev->id); ++ if (init_opp_table[cluster]) ++ continue; ++ + if (ve_init_opp_table(cpu_dev)) + pr_warn("failed to initialise cpu%d opp table\n", cpu); ++ else if (dev_pm_opp_set_sharing_cpus(cpu_dev, ++ topology_core_cpumask(cpu_dev->id))) ++ pr_warn("failed to mark OPPs shared for cpu%d\n", cpu); ++ else ++ init_opp_table[cluster] = true; + } + + platform_device_register_simple("vexpress-spc-cpufreq", -1, NULL, 0); +-- +2.20.1 + diff --git a/queue-4.4/asoc-wm8962-fix-lambda-value.patch b/queue-4.4/asoc-wm8962-fix-lambda-value.patch new file mode 100644 index 00000000000..c5426a0b74c --- /dev/null +++ b/queue-4.4/asoc-wm8962-fix-lambda-value.patch @@ -0,0 +1,47 @@ +From 631d4f2c755f241ccb622a3e07d98024d28faea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 19:57:22 +0800 +Subject: ASoC: wm8962: fix lambda value + +From: Shengjiu Wang + +[ Upstream commit 556672d75ff486e0b6786056da624131679e0576 ] + +According to user manual, it is required that FLL_LAMBDA > 0 +in all cases (Integer and Franctional modes). + +Fixes: 9a76f1ff6e29 ("ASoC: Add initial WM8962 CODEC driver") +Signed-off-by: Shengjiu Wang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/1576065442-19763-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8962.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c +index a7e79784fc16..4a3ce9b85253 100644 +--- a/sound/soc/codecs/wm8962.c ++++ b/sound/soc/codecs/wm8962.c +@@ -2792,7 +2792,7 @@ static int fll_factors(struct _fll_div *fll_div, unsigned int Fref, + + if (target % Fref == 0) { + fll_div->theta = 0; +- fll_div->lambda = 0; ++ fll_div->lambda = 1; + } else { + gcd_fll = gcd(target, fratio * Fref); + +@@ -2862,7 +2862,7 @@ static int wm8962_set_fll(struct snd_soc_codec *codec, int fll_id, int source, + return -EINVAL; + } + +- if (fll_div.theta || fll_div.lambda) ++ if (fll_div.theta) + fll1 |= WM8962_FLL_FRAC; + + /* Stop the FLL while we reconfigure */ +-- +2.20.1 + diff --git a/queue-4.4/bnx2x-do-not-handle-requests-from-vfs-after-parity.patch b/queue-4.4/bnx2x-do-not-handle-requests-from-vfs-after-parity.patch new file mode 100644 index 00000000000..68a5380025e --- /dev/null +++ b/queue-4.4/bnx2x-do-not-handle-requests-from-vfs-after-parity.patch @@ -0,0 +1,88 @@ +From 9d26fcd79b709d5c78cd42bad3235c275f5b2317 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 09:59:55 -0800 +Subject: bnx2x: Do not handle requests from VFs after parity + +From: Manish Chopra + +[ Upstream commit 7113f796bbbced2470cd6d7379d50d7a7a78bf34 ] + +Parity error from the hardware will cause PF to lose the state +of their VFs due to PF's internal reload and hardware reset following +the parity error. Restrict any configuration request from the VFs after +the parity as it could cause unexpected hardware behavior, only way +for VFs to recover would be to trigger FLR on VFs and reload them. + +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 12 ++++++++++-- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 + + drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 12 ++++++++++++ + 3 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 82960603da33..026c72e62c18 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9942,10 +9942,18 @@ static void bnx2x_recovery_failed(struct bnx2x *bp) + */ + static void bnx2x_parity_recover(struct bnx2x *bp) + { +- bool global = false; + u32 error_recovered, error_unrecovered; +- bool is_parity; ++ bool is_parity, global = false; ++#ifdef CONFIG_BNX2X_SRIOV ++ int vf_idx; ++ ++ for (vf_idx = 0; vf_idx < bp->requested_nr_virtfn; vf_idx++) { ++ struct bnx2x_virtf *vf = BP_VF(bp, vf_idx); + ++ if (vf) ++ vf->state = VF_LOST; ++ } ++#endif + DP(NETIF_MSG_HW, "Handling parity\n"); + while (1) { + switch (bp->recovery_state) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +index 6f6f13dc2be3..ab8339594cd3 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h +@@ -139,6 +139,7 @@ struct bnx2x_virtf { + #define VF_ACQUIRED 1 /* VF acquired, but not initialized */ + #define VF_ENABLED 2 /* VF Enabled */ + #define VF_RESET 3 /* VF FLR'd, pending cleanup */ ++#define VF_LOST 4 /* Recovery while VFs are loaded */ + + bool flr_clnup_stage; /* true during flr cleanup */ + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index a12a4236b143..e9fc3b09dba8 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -2095,6 +2095,18 @@ static void bnx2x_vf_mbx_request(struct bnx2x *bp, struct bnx2x_virtf *vf, + { + int i; + ++ if (vf->state == VF_LOST) { ++ /* Just ack the FW and return if VFs are lost ++ * in case of parity error. VFs are supposed to be timedout ++ * on waiting for PF response. ++ */ ++ DP(BNX2X_MSG_IOV, ++ "VF 0x%x lost, not handling the request\n", vf->abs_vfid); ++ ++ storm_memset_vf_mbx_ack(bp, vf->abs_vfid); ++ return; ++ } ++ + /* check if tlv type is known */ + if (bnx2x_tlv_supported(mbx->first_tlv.tl.type)) { + /* Lock the per vf op mutex and note the locker's identity. +-- +2.20.1 + diff --git a/queue-4.4/bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch b/queue-4.4/bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch new file mode 100644 index 00000000000..a42016c7fc1 --- /dev/null +++ b/queue-4.4/bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch @@ -0,0 +1,39 @@ +From b7eae752f1943e27646dc4b8da99a8c219731a0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 09:59:56 -0800 +Subject: bnx2x: Fix logic to get total no. of PFs per engine + +From: Manish Chopra + +[ Upstream commit ee699f89bdbaa19c399804504241b5c531b48888 ] + +Driver doesn't calculate total number of PFs configured on a +given engine correctly which messed up resources in the PFs +loaded on that engine, leading driver to exceed configuration +of resources (like vlan filters etc.) beyond the limit per +engine, which ended up with asserts from the firmware. + +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +index b7d32e8412f1..ec2122acc3c1 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h +@@ -1107,7 +1107,7 @@ static inline u8 bnx2x_get_path_func_num(struct bnx2x *bp) + for (i = 0; i < E1H_FUNC_MAX / 2; i++) { + u32 func_config = + MF_CFG_RD(bp, +- func_mf_config[BP_PORT(bp) + 2 * i]. ++ func_mf_config[BP_PATH(bp) + 2 * i]. + config); + func_num += + ((func_config & FUNC_MF_CFG_FUNC_HIDE) ? 0 : 1); +-- +2.20.1 + diff --git a/queue-4.4/kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch b/queue-4.4/kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch new file mode 100644 index 00000000000..516f50faf06 --- /dev/null +++ b/queue-4.4/kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch @@ -0,0 +1,42 @@ +From ced83f23c29e8ebc67158136c52203a30805c832 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Dec 2019 00:19:17 -0800 +Subject: kconfig: don't crash on NULL expressions in expr_eq() + +From: Thomas Hebb + +[ Upstream commit 272a72103012862e3a24ea06635253ead0b6e808 ] + +NULL expressions are taken to always be true, as implemented by the +expr_is_yes() macro and by several other functions in expr.c. As such, +they ought to be valid inputs to expr_eq(), which compares two +expressions. + +Signed-off-by: Thomas Hebb +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/expr.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index ed29bad1f03a..96420b620963 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -201,6 +201,13 @@ static int expr_eq(struct expr *e1, struct expr *e2) + { + int res, old_count; + ++ /* ++ * A NULL expr is taken to be yes, but there's also a different way to ++ * represent yes. expr_is_yes() checks for either representation. ++ */ ++ if (!e1 || !e2) ++ return expr_is_yes(e1) && expr_is_yes(e2); ++ + if (e1->type != e2->type) + return 0; + switch (e1->type) { +-- +2.20.1 + diff --git a/queue-4.4/llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch b/queue-4.4/llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch new file mode 100644 index 00000000000..6fb89c9e57b --- /dev/null +++ b/queue-4.4/llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch @@ -0,0 +1,53 @@ +From ae512cadc1be4056f9cd27e1b2fea81e3ef1df96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Dec 2019 14:16:18 +0800 +Subject: llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and + _test_c) + +From: Chan Shu Tak, Alex + +[ Upstream commit af1c0e4e00f3cc76cb136ebf2e2c04e8b6446285 ] + +When a frame with NULL DSAP is received, llc_station_rcv is called. +In turn, llc_stat_ev_rx_null_dsap_xid_c is called to check if it is a NULL +XID frame. The return statement of llc_stat_ev_rx_null_dsap_xid_c returns 1 +when the incoming frame is not a NULL XID frame and 0 otherwise. Hence, a +NULL XID response is returned unexpectedly, e.g. when the incoming frame is +a NULL TEST command. + +To fix the error, simply remove the conditional operator. + +A similar error in llc_stat_ev_rx_null_dsap_test_c is also fixed. + +Signed-off-by: Chan Shu Tak, Alex +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/llc/llc_station.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/llc/llc_station.c b/net/llc/llc_station.c +index 204a8351efff..c29170e767a8 100644 +--- a/net/llc/llc_station.c ++++ b/net/llc/llc_station.c +@@ -32,7 +32,7 @@ static int llc_stat_ev_rx_null_dsap_xid_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_XID && +- !pdu->dsap ? 0 : 1; /* NULL DSAP value */ ++ !pdu->dsap; /* NULL DSAP value */ + } + + static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) +@@ -42,7 +42,7 @@ static int llc_stat_ev_rx_null_dsap_test_c(struct sk_buff *skb) + return LLC_PDU_IS_CMD(pdu) && /* command PDU */ + LLC_PDU_TYPE_IS_U(pdu) && /* U type PDU */ + LLC_U_PDU_CMD(pdu) == LLC_1_PDU_CMD_TEST && +- !pdu->dsap ? 0 : 1; /* NULL DSAP */ ++ !pdu->dsap; /* NULL DSAP */ + } + + static int llc_station_ac_send_xid_r(struct sk_buff *skb) +-- +2.20.1 + diff --git a/queue-4.4/locking-spinlock-debug-fix-various-data-races.patch b/queue-4.4/locking-spinlock-debug-fix-various-data-races.patch new file mode 100644 index 00000000000..ad10559765f --- /dev/null +++ b/queue-4.4/locking-spinlock-debug-fix-various-data-races.patch @@ -0,0 +1,145 @@ +From 94d2d936ddddc296f89867b4100b2af480d96b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 16:57:15 +0100 +Subject: locking/spinlock/debug: Fix various data races + +From: Marco Elver + +[ Upstream commit 1a365e822372ba24c9da0822bc583894f6f3d821 ] + +This fixes various data races in spinlock_debug. By testing with KCSAN, +it is observable that the console gets spammed with data races reports, +suggesting these are extremely frequent. + +Example data race report: + + read to 0xffff8ab24f403c48 of 4 bytes by task 221 on cpu 2: + debug_spin_lock_before kernel/locking/spinlock_debug.c:85 [inline] + do_raw_spin_lock+0x9b/0x210 kernel/locking/spinlock_debug.c:112 + __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] + _raw_spin_lock+0x39/0x40 kernel/locking/spinlock.c:151 + spin_lock include/linux/spinlock.h:338 [inline] + get_partial_node.isra.0.part.0+0x32/0x2f0 mm/slub.c:1873 + get_partial_node mm/slub.c:1870 [inline] + + + write to 0xffff8ab24f403c48 of 4 bytes by task 167 on cpu 3: + debug_spin_unlock kernel/locking/spinlock_debug.c:103 [inline] + do_raw_spin_unlock+0xc9/0x1a0 kernel/locking/spinlock_debug.c:138 + __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:159 [inline] + _raw_spin_unlock_irqrestore+0x2d/0x50 kernel/locking/spinlock.c:191 + spin_unlock_irqrestore include/linux/spinlock.h:393 [inline] + free_debug_processing+0x1b3/0x210 mm/slub.c:1214 + __slab_free+0x292/0x400 mm/slub.c:2864 + + +As a side-effect, with KCSAN, this eventually locks up the console, most +likely due to deadlock, e.g. .. -> printk lock -> spinlock_debug -> +KCSAN detects data race -> kcsan_print_report() -> printk lock -> +deadlock. + +This fix will 1) avoid the data races, and 2) allow using lock debugging +together with KCSAN. + +Reported-by: Qian Cai +Signed-off-by: Marco Elver +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Paul E. McKenney +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Link: https://lkml.kernel.org/r/20191120155715.28089-1-elver@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/locking/spinlock_debug.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/kernel/locking/spinlock_debug.c b/kernel/locking/spinlock_debug.c +index 0374a596cffa..95e610e3f7ef 100644 +--- a/kernel/locking/spinlock_debug.c ++++ b/kernel/locking/spinlock_debug.c +@@ -51,19 +51,19 @@ EXPORT_SYMBOL(__rwlock_init); + + static void spin_dump(raw_spinlock_t *lock, const char *msg) + { +- struct task_struct *owner = NULL; ++ struct task_struct *owner = READ_ONCE(lock->owner); + +- if (lock->owner && lock->owner != SPINLOCK_OWNER_INIT) +- owner = lock->owner; ++ if (owner == SPINLOCK_OWNER_INIT) ++ owner = NULL; + printk(KERN_EMERG "BUG: spinlock %s on CPU#%d, %s/%d\n", + msg, raw_smp_processor_id(), + current->comm, task_pid_nr(current)); + printk(KERN_EMERG " lock: %pS, .magic: %08x, .owner: %s/%d, " + ".owner_cpu: %d\n", +- lock, lock->magic, ++ lock, READ_ONCE(lock->magic), + owner ? owner->comm : "", + owner ? task_pid_nr(owner) : -1, +- lock->owner_cpu); ++ READ_ONCE(lock->owner_cpu)); + dump_stack(); + } + +@@ -80,16 +80,16 @@ static void spin_bug(raw_spinlock_t *lock, const char *msg) + static inline void + debug_spin_lock_before(raw_spinlock_t *lock) + { +- SPIN_BUG_ON(lock->magic != SPINLOCK_MAGIC, lock, "bad magic"); +- SPIN_BUG_ON(lock->owner == current, lock, "recursion"); +- SPIN_BUG_ON(lock->owner_cpu == raw_smp_processor_id(), ++ SPIN_BUG_ON(READ_ONCE(lock->magic) != SPINLOCK_MAGIC, lock, "bad magic"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner) == current, lock, "recursion"); ++ SPIN_BUG_ON(READ_ONCE(lock->owner_cpu) == raw_smp_processor_id(), + lock, "cpu recursion"); + } + + static inline void debug_spin_lock_after(raw_spinlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_spin_unlock(raw_spinlock_t *lock) +@@ -99,8 +99,8 @@ static inline void debug_spin_unlock(raw_spinlock_t *lock) + SPIN_BUG_ON(lock->owner != current, lock, "wrong owner"); + SPIN_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + static void __spin_lock_debug(raw_spinlock_t *lock) +@@ -233,8 +233,8 @@ static inline void debug_write_lock_before(rwlock_t *lock) + + static inline void debug_write_lock_after(rwlock_t *lock) + { +- lock->owner_cpu = raw_smp_processor_id(); +- lock->owner = current; ++ WRITE_ONCE(lock->owner_cpu, raw_smp_processor_id()); ++ WRITE_ONCE(lock->owner, current); + } + + static inline void debug_write_unlock(rwlock_t *lock) +@@ -243,8 +243,8 @@ static inline void debug_write_unlock(rwlock_t *lock) + RWLOCK_BUG_ON(lock->owner != current, lock, "wrong owner"); + RWLOCK_BUG_ON(lock->owner_cpu != raw_smp_processor_id(), + lock, "wrong CPU"); +- lock->owner = SPINLOCK_OWNER_INIT; +- lock->owner_cpu = -1; ++ WRITE_ONCE(lock->owner, SPINLOCK_OWNER_INIT); ++ WRITE_ONCE(lock->owner_cpu, -1); + } + + #if 0 /* This can cause lockups */ +-- +2.20.1 + diff --git a/queue-4.4/net-usb-lan78xx-fix-error-message-format-specifier.patch b/queue-4.4/net-usb-lan78xx-fix-error-message-format-specifier.patch new file mode 100644 index 00000000000..786016f9f39 --- /dev/null +++ b/queue-4.4/net-usb-lan78xx-fix-error-message-format-specifier.patch @@ -0,0 +1,35 @@ +From 445c7ef86635710801de98e3bae3b3fd4d80b0ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Dec 2019 18:33:11 +0200 +Subject: net: usb: lan78xx: Fix error message format specifier + +From: Cristian Birsan + +[ Upstream commit 858ce8ca62ea1530f2779d0e3f934b0176e663c3 ] + +Display the return code as decimal integer. + +Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") +Signed-off-by: Cristian Birsan +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index c813c5345a52..2340c61073de 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -370,7 +370,7 @@ static int lan78xx_read_stats(struct lan78xx_net *dev, + } + } else { + netdev_warn(dev->net, +- "Failed to read stat ret = 0x%x", ret); ++ "Failed to read stat ret = %d", ret); + } + + kfree(stats); +-- +2.20.1 + diff --git a/queue-4.4/netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch b/queue-4.4/netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch new file mode 100644 index 00000000000..f55decea486 --- /dev/null +++ b/queue-4.4/netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch @@ -0,0 +1,79 @@ +From 2c2d572291a3ee9493c67a1f7c5c3325cb25d0df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2019 12:39:23 +0100 +Subject: netfilter: ctnetlink: netns exit must wait for callbacks + +From: Florian Westphal + +[ Upstream commit 18a110b022a5c02e7dc9f6109d0bd93e58ac6ebb ] + +Curtis Taylor and Jon Maxwell reported and debugged a crash on 3.10 +based kernel. + +Crash occurs in ctnetlink_conntrack_events because net->nfnl socket is +NULL. The nfnl socket was set to NULL by netns destruction running on +another cpu. + +The exiting network namespace calls the relevant destructors in the +following order: + +1. ctnetlink_net_exit_batch + +This nulls out the event callback pointer in struct netns. + +2. nfnetlink_net_exit_batch + +This nulls net->nfnl socket and frees it. + +3. nf_conntrack_cleanup_net_list + +This removes all remaining conntrack entries. + +This is order is correct. The only explanation for the crash so ar is: + +cpu1: conntrack is dying, eviction occurs: + -> nf_ct_delete() + -> nf_conntrack_event_report \ + -> nf_conntrack_eventmask_report + -> notify->fcn() (== ctnetlink_conntrack_events). + +cpu1: a. fetches rcu protected pointer to obtain ctnetlink event callback. + b. gets interrupted. + cpu2: runs netns exit handlers: + a runs ctnetlink destructor, event cb pointer set to NULL. + b runs nfnetlink destructor, nfnl socket is closed and set to NULL. +cpu1: c. resumes and trips over NULL net->nfnl. + +Problem appears to be that ctnetlink_net_exit_batch only prevents future +callers of nf_conntrack_eventmask_report() from obtaining the callback. +It doesn't wait of other cpus that might have already obtained the +callbacks address. + +I don't see anything in upstream kernels that would prevent similar +crash: We need to wait for all cpus to have exited the event callback. + +Fixes: 9592a5c01e79dbc59eb56fa ("netfilter: ctnetlink: netns support") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_netlink.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 3a24c01cb909..f324a1124418 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3390,6 +3390,9 @@ static void __net_exit ctnetlink_net_exit_batch(struct list_head *net_exit_list) + + list_for_each_entry(net, net_exit_list, exit_list) + ctnetlink_net_exit(net); ++ ++ /* wait for other cpus until they are done with ctnl_notifiers */ ++ synchronize_rcu(); + } + + static struct pernet_operations ctnetlink_net_ops = { +-- +2.20.1 + diff --git a/queue-4.4/netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch b/queue-4.4/netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch new file mode 100644 index 00000000000..0028c9dabab --- /dev/null +++ b/queue-4.4/netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch @@ -0,0 +1,50 @@ +From 60dc790a261af2b19688c014562482c490ec11ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2019 13:35:11 +0100 +Subject: netfilter: uapi: Avoid undefined left-shift in xt_sctp.h + +From: Phil Sutter + +[ Upstream commit 164166558aacea01b99c8c8ffb710d930405ba69 ] + +With 'bytes(__u32)' being 32, a left-shift of 31 may happen which is +undefined for the signed 32-bit value 1. Avoid this by declaring 1 as +unsigned. + +Signed-off-by: Phil Sutter +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/xt_sctp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/uapi/linux/netfilter/xt_sctp.h b/include/uapi/linux/netfilter/xt_sctp.h +index 29287be696a2..788b77c347a0 100644 +--- a/include/uapi/linux/netfilter/xt_sctp.h ++++ b/include/uapi/linux/netfilter/xt_sctp.h +@@ -40,19 +40,19 @@ struct xt_sctp_info { + #define SCTP_CHUNKMAP_SET(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] |= \ +- 1 << (type % bytes(__u32)); \ ++ 1u << (type % bytes(__u32)); \ + } while (0) + + #define SCTP_CHUNKMAP_CLEAR(chunkmap, type) \ + do { \ + (chunkmap)[type / bytes(__u32)] &= \ +- ~(1 << (type % bytes(__u32))); \ ++ ~(1u << (type % bytes(__u32))); \ + } while (0) + + #define SCTP_CHUNKMAP_IS_SET(chunkmap, type) \ + ({ \ + ((chunkmap)[type / bytes (__u32)] & \ +- (1 << (type % bytes (__u32)))) ? 1: 0; \ ++ (1u << (type % bytes (__u32)))) ? 1: 0; \ + }) + + #define SCTP_CHUNKMAP_RESET(chunkmap) \ +-- +2.20.1 + diff --git a/queue-4.4/parisc-fix-compiler-warnings-in-debug_core.c.patch b/queue-4.4/parisc-fix-compiler-warnings-in-debug_core.c.patch new file mode 100644 index 00000000000..da86077f02d --- /dev/null +++ b/queue-4.4/parisc-fix-compiler-warnings-in-debug_core.c.patch @@ -0,0 +1,53 @@ +From 2e7398729798194be9dc651688c7c43594ee7bec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Dec 2019 21:00:19 +0100 +Subject: parisc: Fix compiler warnings in debug_core.c +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Helge Deller + +[ Upstream commit 75cf9797006a3a9f29a3a25c1febd6842a4a9eb2 ] + +Fix this compiler warning: +kernel/debug/debug_core.c: In function ‘kgdb_cpu_enter’: +arch/parisc/include/asm/cmpxchg.h:48:3: warning: value computed is not used [-Wunused-value] + 48 | ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) +arch/parisc/include/asm/atomic.h:78:30: note: in expansion of macro ‘xchg’ + 78 | #define atomic_xchg(v, new) (xchg(&((v)->counter), new)) + | ^~~~ +kernel/debug/debug_core.c:596:4: note: in expansion of macro ‘atomic_xchg’ + 596 | atomic_xchg(&kgdb_active, cpu); + | ^~~~~~~~~~~ + +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/cmpxchg.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/parisc/include/asm/cmpxchg.h b/arch/parisc/include/asm/cmpxchg.h +index 0a90b965cccb..9849bef2a766 100644 +--- a/arch/parisc/include/asm/cmpxchg.h ++++ b/arch/parisc/include/asm/cmpxchg.h +@@ -43,8 +43,14 @@ __xchg(unsigned long x, __volatile__ void *ptr, int size) + ** if (((unsigned long)p & 0xf) == 0) + ** return __ldcw(p); + */ +-#define xchg(ptr, x) \ +- ((__typeof__(*(ptr)))__xchg((unsigned long)(x), (ptr), sizeof(*(ptr)))) ++#define xchg(ptr, x) \ ++({ \ ++ __typeof__(*(ptr)) __ret; \ ++ __typeof__(*(ptr)) _x_ = (x); \ ++ __ret = (__typeof__(*(ptr))) \ ++ __xchg((unsigned long)_x_, (ptr), sizeof(*(ptr))); \ ++ __ret; \ ++}) + + /* bug catcher for when unsupported size is used - won't link */ + extern void __cmpxchg_called_with_bad_pointer(void); +-- +2.20.1 + diff --git a/queue-4.4/powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch b/queue-4.4/powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch new file mode 100644 index 00000000000..0373409743b --- /dev/null +++ b/queue-4.4/powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch @@ -0,0 +1,49 @@ +From c5db76c8b989866e636c89c3d2e91e47141fe875 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Dec 2019 14:35:24 +0200 +Subject: powerpc: Ensure that swiotlb buffer is allocated from low memory + +From: Mike Rapoport + +[ Upstream commit 8fabc623238e68b3ac63c0dd1657bf86c1fa33af ] + +Some powerpc platforms (e.g. 85xx) limit DMA-able memory way below 4G. +If a system has more physical memory than this limit, the swiotlb +buffer is not addressable because it is allocated from memblock using +top-down mode. + +Force memblock to bottom-up mode before calling swiotlb_init() to +ensure that the swiotlb buffer is DMA-able. + +Reported-by: Christian Zigotzky +Signed-off-by: Mike Rapoport +Reviewed-by: Christoph Hellwig +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191204123524.22919-1-rppt@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/mem.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 1efe5ca5c3bc..5bb2c89d55c8 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -330,6 +330,14 @@ void __init mem_init(void) + BUILD_BUG_ON(MMU_PAGE_COUNT > 16); + + #ifdef CONFIG_SWIOTLB ++ /* ++ * Some platforms (e.g. 85xx) limit DMA-able memory way below ++ * 4G. We force memblock to bottom-up mode to ensure that the ++ * memory allocated in swiotlb_init() is DMA-able. ++ * As it's the last memblock allocation, no need to reset it ++ * back to to-down. ++ */ ++ memblock_set_bottom_up(true); + swiotlb_init(0); + #endif + +-- +2.20.1 + diff --git a/queue-4.4/regulator-rn5t618-fix-module-aliases.patch b/queue-4.4/regulator-rn5t618-fix-module-aliases.patch new file mode 100644 index 00000000000..80f2c682148 --- /dev/null +++ b/queue-4.4/regulator-rn5t618-fix-module-aliases.patch @@ -0,0 +1,36 @@ +From 6fd9484eb5df78b8521f2f389fda02d89e938f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 23:16:00 +0100 +Subject: regulator: rn5t618: fix module aliases + +From: Andreas Kemnade + +[ Upstream commit 62a1923cc8fe095912e6213ed5de27abbf1de77e ] + +platform device aliases were missing, preventing +autoloading of module. + +Fixes: 811b700630ff ("regulator: rn5t618: add driver for Ricoh RN5T618 regulators") +Signed-off-by: Andreas Kemnade +Link: https://lore.kernel.org/r/20191211221600.29438-1-andreas@kemnade.info +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/rn5t618-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/rn5t618-regulator.c b/drivers/regulator/rn5t618-regulator.c +index b85ceb8ff911..eccdddcf5315 100644 +--- a/drivers/regulator/rn5t618-regulator.c ++++ b/drivers/regulator/rn5t618-regulator.c +@@ -95,6 +95,7 @@ static struct platform_driver rn5t618_regulator_driver = { + + module_platform_driver(rn5t618_regulator_driver); + ++MODULE_ALIAS("platform:rn5t618-regulator"); + MODULE_AUTHOR("Beniamino Galvani "); + MODULE_DESCRIPTION("RN5T618 regulator driver"); + MODULE_LICENSE("GPL v2"); +-- +2.20.1 + diff --git a/queue-4.4/rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch b/queue-4.4/rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch new file mode 100644 index 00000000000..b63f714f6a1 --- /dev/null +++ b/queue-4.4/rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch @@ -0,0 +1,44 @@ +From 76f7cf8163d71e502c9901eee6eb4c45a466a70c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Dec 2019 09:34:08 -0600 +Subject: rfkill: Fix incorrect check to avoid NULL pointer dereference + +From: Aditya Pakki + +[ Upstream commit 6fc232db9e8cd50b9b83534de9cd91ace711b2d7 ] + +In rfkill_register, the struct rfkill pointer is first derefernced +and then checked for NULL. This patch removes the BUG_ON and returns +an error to the caller in case rfkill is NULL. + +Signed-off-by: Aditya Pakki +Link: https://lore.kernel.org/r/20191215153409.21696-1-pakki001@umn.edu +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/rfkill/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/rfkill/core.c b/net/rfkill/core.c +index cf5b69ab1829..ad927a6ca2a1 100644 +--- a/net/rfkill/core.c ++++ b/net/rfkill/core.c +@@ -941,10 +941,13 @@ static void rfkill_sync_work(struct work_struct *work) + int __must_check rfkill_register(struct rfkill *rfkill) + { + static unsigned long rfkill_no; +- struct device *dev = &rfkill->dev; ++ struct device *dev; + int error; + +- BUG_ON(!rfkill); ++ if (!rfkill) ++ return -EINVAL; ++ ++ dev = &rfkill->dev; + + mutex_lock(&rfkill_global_mutex); + +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 131b318dc6d..56cd76d465a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -32,3 +32,18 @@ net-add-annotations-on-hh-hh_len-lockless-accesses.patch s390-smp-fix-physical-to-logical-cpu-map-for-smt.patch locking-x86-remove-the-unused-atomic_inc_short-methd.patch pstore-ram-write-new-dumps-to-start-of-recycled-zone.patch +locking-spinlock-debug-fix-various-data-races.patch +netfilter-ctnetlink-netns-exit-must-wait-for-callbac.patch +arm-vexpress-set-up-shared-opp-table-instead-of-indi.patch +netfilter-uapi-avoid-undefined-left-shift-in-xt_sctp.patch +arm-dts-am437x-gp-epos-evm-fix-panel-compatible.patch +powerpc-ensure-that-swiotlb-buffer-is-allocated-from.patch +bnx2x-do-not-handle-requests-from-vfs-after-parity.patch +bnx2x-fix-logic-to-get-total-no.-of-pfs-per-engine.patch +net-usb-lan78xx-fix-error-message-format-specifier.patch +rfkill-fix-incorrect-check-to-avoid-null-pointer-der.patch +asoc-wm8962-fix-lambda-value.patch +regulator-rn5t618-fix-module-aliases.patch +kconfig-don-t-crash-on-null-expressions-in-expr_eq.patch +parisc-fix-compiler-warnings-in-debug_core.c.patch +llc2-fix-return-statement-of-llc_stat_ev_rx_null_dsa.patch -- 2.47.3