]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.10-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 4 Jul 2022 07:45:35 +0000 (09:45 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 4 Jul 2022 07:45:35 +0000 (09:45 +0200)
added patches:
dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch
dm-raid-fix-kasan-warning-in-raid5_add_disks.patch
drm-amdgpu-to-flush-tlb-for-mmhub-of-raven-series.patch
ipv6-take-care-of-disable_policy-when-restoring-routes.patch
nvdimm-fix-badblocks-clear-off-by-one-error.patch
nvme-pci-add-nvme_quirk_bogus_nid-for-adata-xpg-sx6000lnp-aka-spectrix-s40g.patch
powerpc-book3e-fix-pud-allocation-size-in-map_kernel_page.patch
powerpc-bpf-fix-use-of-user_pt_regs-in-uapi.patch
powerpc-prom_init-fix-kernel-config-grep.patch

queue-5.10/dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch [new file with mode: 0644]
queue-5.10/dm-raid-fix-kasan-warning-in-raid5_add_disks.patch [new file with mode: 0644]
queue-5.10/drm-amdgpu-to-flush-tlb-for-mmhub-of-raven-series.patch [new file with mode: 0644]
queue-5.10/ipv6-take-care-of-disable_policy-when-restoring-routes.patch [new file with mode: 0644]
queue-5.10/nvdimm-fix-badblocks-clear-off-by-one-error.patch [new file with mode: 0644]
queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-adata-xpg-sx6000lnp-aka-spectrix-s40g.patch [new file with mode: 0644]
queue-5.10/powerpc-book3e-fix-pud-allocation-size-in-map_kernel_page.patch [new file with mode: 0644]
queue-5.10/powerpc-bpf-fix-use-of-user_pt_regs-in-uapi.patch [new file with mode: 0644]
queue-5.10/powerpc-prom_init-fix-kernel-config-grep.patch [new file with mode: 0644]
queue-5.10/series [new file with mode: 0644]

diff --git a/queue-5.10/dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch b/queue-5.10/dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch
new file mode 100644 (file)
index 0000000..1a1cc5a
--- /dev/null
@@ -0,0 +1,118 @@
+From 332bd0778775d0cf105c4b9e03e460b590749916 Mon Sep 17 00:00:00 2001
+From: Heinz Mauelshagen <heinzm@redhat.com>
+Date: Tue, 28 Jun 2022 00:37:22 +0200
+Subject: dm raid: fix accesses beyond end of raid member array
+
+From: Heinz Mauelshagen <heinzm@redhat.com>
+
+commit 332bd0778775d0cf105c4b9e03e460b590749916 upstream.
+
+On dm-raid table load (using raid_ctr), dm-raid allocates an array
+rs->devs[rs->raid_disks] for the raid device members. rs->raid_disks
+is defined by the number of raid metadata and image tupples passed
+into the target's constructor.
+
+In the case of RAID layout changes being requested, that number can be
+different from the current number of members for existing raid sets as
+defined in their superblocks. Example RAID layout changes include:
+- raid1 legs being added/removed
+- raid4/5/6/10 number of stripes changed (stripe reshaping)
+- takeover to higher raid level (e.g. raid5 -> raid6)
+
+When accessing array members, rs->raid_disks must be used in control
+loops instead of the potentially larger value in rs->md.raid_disks.
+Otherwise it will cause memory access beyond the end of the rs->devs
+array.
+
+Fix this by changing code that is prone to out-of-bounds access.
+Also fix validate_raid_redundancy() to validate all devices that are
+added. Also, use braces to help clean up raid_iterate_devices().
+
+The out-of-bounds memory accesses was discovered using KASAN.
+
+This commit was verified to pass all LVM2 RAID tests (with KASAN
+enabled).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Heinz Mauelshagen <heinzm@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/dm-raid.c |   34 ++++++++++++++++++----------------
+ 1 file changed, 18 insertions(+), 16 deletions(-)
+
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -1002,12 +1002,13 @@ static int validate_region_size(struct r
+ static int validate_raid_redundancy(struct raid_set *rs)
+ {
+       unsigned int i, rebuild_cnt = 0;
+-      unsigned int rebuilds_per_group = 0, copies;
++      unsigned int rebuilds_per_group = 0, copies, raid_disks;
+       unsigned int group_size, last_group_start;
+-      for (i = 0; i < rs->md.raid_disks; i++)
+-              if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
+-                  !rs->dev[i].rdev.sb_page)
++      for (i = 0; i < rs->raid_disks; i++)
++              if (!test_bit(FirstUse, &rs->dev[i].rdev.flags) &&
++                  ((!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
++                    !rs->dev[i].rdev.sb_page)))
+                       rebuild_cnt++;
+       switch (rs->md.level) {
+@@ -1047,8 +1048,9 @@ static int validate_raid_redundancy(stru
+                *          A    A    B    B    C
+                *          C    D    D    E    E
+                */
++              raid_disks = min(rs->raid_disks, rs->md.raid_disks);
+               if (__is_raid10_near(rs->md.new_layout)) {
+-                      for (i = 0; i < rs->md.raid_disks; i++) {
++                      for (i = 0; i < raid_disks; i++) {
+                               if (!(i % copies))
+                                       rebuilds_per_group = 0;
+                               if ((!rs->dev[i].rdev.sb_page ||
+@@ -1071,10 +1073,10 @@ static int validate_raid_redundancy(stru
+                * results in the need to treat the last (potentially larger)
+                * set differently.
+                */
+-              group_size = (rs->md.raid_disks / copies);
+-              last_group_start = (rs->md.raid_disks / group_size) - 1;
++              group_size = (raid_disks / copies);
++              last_group_start = (raid_disks / group_size) - 1;
+               last_group_start *= group_size;
+-              for (i = 0; i < rs->md.raid_disks; i++) {
++              for (i = 0; i < raid_disks; i++) {
+                       if (!(i % copies) && !(i > last_group_start))
+                               rebuilds_per_group = 0;
+                       if ((!rs->dev[i].rdev.sb_page ||
+@@ -1589,7 +1591,7 @@ static sector_t __rdev_sectors(struct ra
+ {
+       int i;
+-      for (i = 0; i < rs->md.raid_disks; i++) {
++      for (i = 0; i < rs->raid_disks; i++) {
+               struct md_rdev *rdev = &rs->dev[i].rdev;
+               if (!test_bit(Journal, &rdev->flags) &&
+@@ -3732,13 +3734,13 @@ static int raid_iterate_devices(struct d
+       unsigned int i;
+       int r = 0;
+-      for (i = 0; !r && i < rs->md.raid_disks; i++)
+-              if (rs->dev[i].data_dev)
+-                      r = fn(ti,
+-                               rs->dev[i].data_dev,
+-                               0, /* No offset on data devs */
+-                               rs->md.dev_sectors,
+-                               data);
++      for (i = 0; !r && i < rs->raid_disks; i++) {
++              if (rs->dev[i].data_dev) {
++                      r = fn(ti, rs->dev[i].data_dev,
++                             0, /* No offset on data devs */
++                             rs->md.dev_sectors, data);
++              }
++      }
+       return r;
+ }
diff --git a/queue-5.10/dm-raid-fix-kasan-warning-in-raid5_add_disks.patch b/queue-5.10/dm-raid-fix-kasan-warning-in-raid5_add_disks.patch
new file mode 100644 (file)
index 0000000..9bc7249
--- /dev/null
@@ -0,0 +1,32 @@
+From 617b365872a247480e9dcd50a32c8d1806b21861 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Wed, 29 Jun 2022 13:40:57 -0400
+Subject: dm raid: fix KASAN warning in raid5_add_disks
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 617b365872a247480e9dcd50a32c8d1806b21861 upstream.
+
+There's a KASAN warning in raid5_add_disk when running the LVM testsuite.
+The warning happens in the test
+lvconvert-raid-reshape-linear_to_raid6-single-type.sh. We fix the warning
+by verifying that rdev->saved_raid_disk is within limits.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/raid5.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -8004,6 +8004,7 @@ static int raid5_add_disk(struct mddev *
+        */
+       if (rdev->saved_raid_disk >= 0 &&
+           rdev->saved_raid_disk >= first &&
++          rdev->saved_raid_disk <= last &&
+           conf->disks[rdev->saved_raid_disk].rdev == NULL)
+               first = rdev->saved_raid_disk;
diff --git a/queue-5.10/drm-amdgpu-to-flush-tlb-for-mmhub-of-raven-series.patch b/queue-5.10/drm-amdgpu-to-flush-tlb-for-mmhub-of-raven-series.patch
new file mode 100644 (file)
index 0000000..3a312f0
--- /dev/null
@@ -0,0 +1,48 @@
+From 5cb0e3fb2c54eabfb3f932a1574bff1774946bc0 Mon Sep 17 00:00:00 2001
+From: Ruili Ji <ruiliji2@amd.com>
+Date: Wed, 22 Jun 2022 14:20:22 +0800
+Subject: drm/amdgpu: To flush tlb for MMHUB of RAVEN series
+
+From: Ruili Ji <ruiliji2@amd.com>
+
+commit 5cb0e3fb2c54eabfb3f932a1574bff1774946bc0 upstream.
+
+amdgpu: [mmhub0] no-retry page fault (src_id:0 ring:40 vmid:8 pasid:32769, for process test_basic pid 3305 thread test_basic pid 3305)
+amdgpu: in page starting at address 0x00007ff990003000 from IH client 0x12 (VMC)
+amdgpu: VM_L2_PROTECTION_FAULT_STATUS:0x00840051
+amdgpu: Faulty UTCL2 client ID: MP1 (0x0)
+amdgpu: MORE_FAULTS: 0x1
+amdgpu: WALKER_ERROR: 0x0
+amdgpu: PERMISSION_FAULTS: 0x5
+amdgpu: MAPPING_ERROR: 0x0
+amdgpu: RW: 0x1
+
+When memory is allocated by kfd, no one triggers the tlb flush for MMHUB0.
+There is page fault from MMHUB0.
+
+v2:fix indentation
+v3:change subject and fix indentation
+
+Signed-off-by: Ruili Ji <ruiliji2@amd.com>
+Reviewed-by: Philip Yang <philip.yang@amd.com>
+Reviewed-by: Aaron Liu <aaron.liu@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c
+@@ -689,7 +689,8 @@ int amdgpu_amdkfd_flush_gpu_tlb_pasid(st
+       const uint32_t flush_type = 0;
+       bool all_hub = false;
+-      if (adev->family == AMDGPU_FAMILY_AI)
++      if (adev->family == AMDGPU_FAMILY_AI ||
++          adev->family == AMDGPU_FAMILY_RV)
+               all_hub = true;
+       return amdgpu_gmc_flush_gpu_tlb_pasid(adev, pasid, flush_type, all_hub);
diff --git a/queue-5.10/ipv6-take-care-of-disable_policy-when-restoring-routes.patch b/queue-5.10/ipv6-take-care-of-disable_policy-when-restoring-routes.patch
new file mode 100644 (file)
index 0000000..0c9f851
--- /dev/null
@@ -0,0 +1,63 @@
+From 3b0dc529f56b5f2328244130683210be98f16f7f Mon Sep 17 00:00:00 2001
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Thu, 23 Jun 2022 14:00:15 +0200
+Subject: ipv6: take care of disable_policy when restoring routes
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+commit 3b0dc529f56b5f2328244130683210be98f16f7f upstream.
+
+When routes corresponding to addresses are restored by
+fixup_permanent_addr(), the dst_nopolicy parameter was not set.
+The typical use case is a user that configures an address on a down
+interface and then put this interface up.
+
+Let's take care of this flag in addrconf_f6i_alloc(), so that every callers
+benefit ont it.
+
+CC: stable@kernel.org
+CC: David Forster <dforster@brocade.com>
+Fixes: df789fe75206 ("ipv6: Provide ipv6 version of "disable_policy" sysctl")
+Reported-by: Siwar Zitouni <siwar.zitouni@6wind.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Reviewed-by: David Ahern <dsahern@kernel.org>
+Link: https://lore.kernel.org/r/20220623120015.32640-1-nicolas.dichtel@6wind.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/addrconf.c |    4 ----
+ net/ipv6/route.c    |    9 ++++++++-
+ 2 files changed, 8 insertions(+), 5 deletions(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1102,10 +1102,6 @@ ipv6_add_addr(struct inet6_dev *idev, st
+               goto out;
+       }
+-      if (net->ipv6.devconf_all->disable_policy ||
+-          idev->cnf.disable_policy)
+-              f6i->dst_nopolicy = true;
+-
+       neigh_parms_data_state_setall(idev->nd_parms);
+       ifa->addr = *cfg->pfx;
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -4479,8 +4479,15 @@ struct fib6_info *addrconf_f6i_alloc(str
+       }
+       f6i = ip6_route_info_create(&cfg, gfp_flags, NULL);
+-      if (!IS_ERR(f6i))
++      if (!IS_ERR(f6i)) {
+               f6i->dst_nocount = true;
++
++              if (!anycast &&
++                  (net->ipv6.devconf_all->disable_policy ||
++                   idev->cnf.disable_policy))
++                      f6i->dst_nopolicy = true;
++      }
++
+       return f6i;
+ }
diff --git a/queue-5.10/nvdimm-fix-badblocks-clear-off-by-one-error.patch b/queue-5.10/nvdimm-fix-badblocks-clear-off-by-one-error.patch
new file mode 100644 (file)
index 0000000..e49092c
--- /dev/null
@@ -0,0 +1,38 @@
+From ef9102004a87cb3f8b26e000a095a261fc0467d3 Mon Sep 17 00:00:00 2001
+From: Chris Ye <chris.ye@intel.com>
+Date: Tue, 31 May 2022 17:09:54 -0700
+Subject: nvdimm: Fix badblocks clear off-by-one error
+
+From: Chris Ye <chris.ye@intel.com>
+
+commit ef9102004a87cb3f8b26e000a095a261fc0467d3 upstream.
+
+nvdimm_clear_badblocks_region() validates badblock clearing requests
+against the span of the region, however it compares the inclusive
+badblock request range to the exclusive region range. Fix up the
+off-by-one error.
+
+Fixes: 23f498448362 ("libnvdimm: rework region badblocks clearing")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Chris Ye <chris.ye@intel.com>
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Link: https://lore.kernel.org/r/165404219489.2445897.9792886413715690399.stgit@dwillia2-xfh
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvdimm/bus.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -187,8 +187,8 @@ static int nvdimm_clear_badblocks_region
+       ndr_end = nd_region->ndr_start + nd_region->ndr_size - 1;
+       /* make sure we are in the region */
+-      if (ctx->phys < nd_region->ndr_start
+-                      || (ctx->phys + ctx->cleared) > ndr_end)
++      if (ctx->phys < nd_region->ndr_start ||
++          (ctx->phys + ctx->cleared - 1) > ndr_end)
+               return 0;
+       sector = (ctx->phys - nd_region->ndr_start) / 512;
diff --git a/queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-adata-xpg-sx6000lnp-aka-spectrix-s40g.patch b/queue-5.10/nvme-pci-add-nvme_quirk_bogus_nid-for-adata-xpg-sx6000lnp-aka-spectrix-s40g.patch
new file mode 100644 (file)
index 0000000..9151f15
--- /dev/null
@@ -0,0 +1,59 @@
+From 1629de0e0373e04d68e88e6d9d3071fbf70b7ea8 Mon Sep 17 00:00:00 2001
+From: Pablo Greco <pgreco@centosproject.org>
+Date: Sat, 25 Jun 2022 09:15:02 -0300
+Subject: nvme-pci: add NVME_QUIRK_BOGUS_NID for ADATA XPG SX6000LNP (AKA SPECTRIX S40G)
+
+From: Pablo Greco <pgreco@centosproject.org>
+
+commit 1629de0e0373e04d68e88e6d9d3071fbf70b7ea8 upstream.
+
+ADATA XPG SPECTRIX S40G drives report bogus eui64 values that appear to
+be the same across drives in one system. Quirk them out so they are
+not marked as "non globally unique" duplicates.
+
+Before:
+[    2.258919] nvme nvme1: pci function 0000:06:00.0
+[    2.264898] nvme nvme2: pci function 0000:05:00.0
+[    2.323235] nvme nvme1: failed to set APST feature (2)
+[    2.326153] nvme nvme2: failed to set APST feature (2)
+[    2.333935] nvme nvme1: allocated 64 MiB host memory buffer.
+[    2.336492] nvme nvme2: allocated 64 MiB host memory buffer.
+[    2.339611] nvme nvme1: 7/0/0 default/read/poll queues
+[    2.341805] nvme nvme2: 7/0/0 default/read/poll queues
+[    2.346114]  nvme1n1: p1
+[    2.347197] nvme nvme2: globally duplicate IDs for nsid 1
+After:
+[    2.427715] nvme nvme1: pci function 0000:06:00.0
+[    2.427771] nvme nvme2: pci function 0000:05:00.0
+[    2.488154] nvme nvme2: failed to set APST feature (2)
+[    2.489895] nvme nvme1: failed to set APST feature (2)
+[    2.498773] nvme nvme2: allocated 64 MiB host memory buffer.
+[    2.500587] nvme nvme1: allocated 64 MiB host memory buffer.
+[    2.504113] nvme nvme2: 7/0/0 default/read/poll queues
+[    2.507026] nvme nvme1: 7/0/0 default/read/poll queues
+[    2.509467] nvme nvme2: Ignoring bogus Namespace Identifiers
+[    2.512804] nvme nvme1: Ignoring bogus Namespace Identifiers
+[    2.513698]  nvme1n1: p1
+
+Signed-off-by: Pablo Greco <pgreco@centosproject.org>
+Reviewed-by: Keith Busch <kbusch@kernel.org>
+Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/host/pci.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3245,7 +3245,8 @@ static const struct pci_device_id nvme_i
+       { PCI_DEVICE(0x1d1d, 0x2601),   /* CNEX Granby */
+               .driver_data = NVME_QUIRK_LIGHTNVM, },
+       { PCI_DEVICE(0x10ec, 0x5762),   /* ADATA SX6000LNP */
+-              .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++              .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN |
++                              NVME_QUIRK_BOGUS_NID, },
+       { PCI_DEVICE(0x1cc1, 0x8201),   /* ADATA SX8200PNP 512GB */
+               .driver_data = NVME_QUIRK_NO_DEEPEST_PS |
+                               NVME_QUIRK_IGNORE_DEV_SUBNQN, },
diff --git a/queue-5.10/powerpc-book3e-fix-pud-allocation-size-in-map_kernel_page.patch b/queue-5.10/powerpc-book3e-fix-pud-allocation-size-in-map_kernel_page.patch
new file mode 100644 (file)
index 0000000..4b1eb2d
--- /dev/null
@@ -0,0 +1,48 @@
+From 986481618023e18e187646b0fff05a3c337531cb Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+Date: Thu, 23 Jun 2022 10:56:17 +0200
+Subject: powerpc/book3e: Fix PUD allocation size in map_kernel_page()
+
+From: Christophe Leroy <christophe.leroy@csgroup.eu>
+
+commit 986481618023e18e187646b0fff05a3c337531cb upstream.
+
+Commit 2fb4706057bc ("powerpc: add support for folded p4d page tables")
+erroneously changed PUD setup to a mix of PMD and PUD. Fix it.
+
+While at it, use PTE_TABLE_SIZE instead of PAGE_SIZE for PTE tables
+in order to avoid any confusion.
+
+Fixes: 2fb4706057bc ("powerpc: add support for folded p4d page tables")
+Cc: stable@vger.kernel.org # v5.8+
+Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
+Acked-by: Mike Rapoport <rppt@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/95ddfd6176d53e6c85e13bd1c358359daa56775f.1655974558.git.christophe.leroy@csgroup.eu
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/mm/nohash/book3e_pgtable.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/mm/nohash/book3e_pgtable.c
++++ b/arch/powerpc/mm/nohash/book3e_pgtable.c
+@@ -95,8 +95,8 @@ int __ref map_kernel_page(unsigned long
+               pgdp = pgd_offset_k(ea);
+               p4dp = p4d_offset(pgdp, ea);
+               if (p4d_none(*p4dp)) {
+-                      pmdp = early_alloc_pgtable(PMD_TABLE_SIZE);
+-                      p4d_populate(&init_mm, p4dp, pmdp);
++                      pudp = early_alloc_pgtable(PUD_TABLE_SIZE);
++                      p4d_populate(&init_mm, p4dp, pudp);
+               }
+               pudp = pud_offset(p4dp, ea);
+               if (pud_none(*pudp)) {
+@@ -105,7 +105,7 @@ int __ref map_kernel_page(unsigned long
+               }
+               pmdp = pmd_offset(pudp, ea);
+               if (!pmd_present(*pmdp)) {
+-                      ptep = early_alloc_pgtable(PAGE_SIZE);
++                      ptep = early_alloc_pgtable(PTE_TABLE_SIZE);
+                       pmd_populate_kernel(&init_mm, pmdp, ptep);
+               }
+               ptep = pte_offset_kernel(pmdp, ea);
diff --git a/queue-5.10/powerpc-bpf-fix-use-of-user_pt_regs-in-uapi.patch b/queue-5.10/powerpc-bpf-fix-use-of-user_pt_regs-in-uapi.patch
new file mode 100644 (file)
index 0000000..49c65db
--- /dev/null
@@ -0,0 +1,81 @@
+From b21bd5a4b130f8370861478d2880985daace5913 Mon Sep 17 00:00:00 2001
+From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
+Date: Tue, 28 Jun 2022 00:41:19 +0530
+Subject: powerpc/bpf: Fix use of user_pt_regs in uapi
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+
+commit b21bd5a4b130f8370861478d2880985daace5913 upstream.
+
+Trying to build a .c file that includes <linux/bpf_perf_event.h>:
+  $ cat test_bpf_headers.c
+  #include <linux/bpf_perf_event.h>
+
+throws the below error:
+  /usr/include/linux/bpf_perf_event.h:14:28: error: field ‘regs’ has incomplete type
+     14 |         bpf_user_pt_regs_t regs;
+       |                            ^~~~
+
+This is because we typedef bpf_user_pt_regs_t to 'struct user_pt_regs'
+in arch/powerpc/include/uaps/asm/bpf_perf_event.h, but 'struct
+user_pt_regs' is not exposed to userspace.
+
+Powerpc has both pt_regs and user_pt_regs structures. However, unlike
+arm64 and s390, we expose user_pt_regs to userspace as just 'pt_regs'.
+As such, we should typedef bpf_user_pt_regs_t to 'struct pt_regs' for
+userspace.
+
+Within the kernel though, we want to typedef bpf_user_pt_regs_t to
+'struct user_pt_regs'.
+
+Remove arch/powerpc/include/uapi/asm/bpf_perf_event.h so that the
+uapi/asm-generic version of the header is exposed to userspace.
+Introduce arch/powerpc/include/asm/bpf_perf_event.h so that we can
+typedef bpf_user_pt_regs_t to 'struct user_pt_regs' for use within the
+kernel.
+
+Note that this was not showing up with the bpf selftest build since
+tools/include/uapi/asm/bpf_perf_event.h didn't include the powerpc
+variant.
+
+Fixes: a6460b03f945ee ("powerpc/bpf: Fix broken uapi for BPF_PROG_TYPE_PERF_EVENT")
+Cc: stable@vger.kernel.org # v4.20+
+Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
+[mpe: Use typical naming for header include guard]
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220627191119.142867-1-naveen.n.rao@linux.vnet.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/include/asm/bpf_perf_event.h      |    9 +++++++++
+ arch/powerpc/include/uapi/asm/bpf_perf_event.h |    9 ---------
+ 2 files changed, 9 insertions(+), 9 deletions(-)
+ create mode 100644 arch/powerpc/include/asm/bpf_perf_event.h
+ delete mode 100644 arch/powerpc/include/uapi/asm/bpf_perf_event.h
+
+--- /dev/null
++++ b/arch/powerpc/include/asm/bpf_perf_event.h
+@@ -0,0 +1,9 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++#ifndef _ASM_POWERPC_BPF_PERF_EVENT_H
++#define _ASM_POWERPC_BPF_PERF_EVENT_H
++
++#include <asm/ptrace.h>
++
++typedef struct user_pt_regs bpf_user_pt_regs_t;
++
++#endif /* _ASM_POWERPC_BPF_PERF_EVENT_H */
+--- a/arch/powerpc/include/uapi/asm/bpf_perf_event.h
++++ /dev/null
+@@ -1,9 +0,0 @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+-#ifndef _UAPI__ASM_BPF_PERF_EVENT_H__
+-#define _UAPI__ASM_BPF_PERF_EVENT_H__
+-
+-#include <asm/ptrace.h>
+-
+-typedef struct user_pt_regs bpf_user_pt_regs_t;
+-
+-#endif /* _UAPI__ASM_BPF_PERF_EVENT_H__ */
diff --git a/queue-5.10/powerpc-prom_init-fix-kernel-config-grep.patch b/queue-5.10/powerpc-prom_init-fix-kernel-config-grep.patch
new file mode 100644 (file)
index 0000000..636dbe1
--- /dev/null
@@ -0,0 +1,33 @@
+From 6886da5f49e6d86aad76807a93f3eef5e4f01b10 Mon Sep 17 00:00:00 2001
+From: Liam Howlett <liam.howlett@oracle.com>
+Date: Fri, 24 Jun 2022 01:17:58 +0000
+Subject: powerpc/prom_init: Fix kernel config grep
+
+From: Liam Howlett <liam.howlett@oracle.com>
+
+commit 6886da5f49e6d86aad76807a93f3eef5e4f01b10 upstream.
+
+When searching for config options, use the KCONFIG_CONFIG shell variable
+so that builds using non-standard config locations work.
+
+Fixes: 26deb04342e3 ("powerpc: prepare string/mem functions for KASAN")
+Cc: stable@vger.kernel.org # v5.2+
+Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20220624011745.4060795-1-Liam.Howlett@oracle.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/powerpc/kernel/prom_init_check.sh |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/prom_init_check.sh
++++ b/arch/powerpc/kernel/prom_init_check.sh
+@@ -13,7 +13,7 @@
+ # If you really need to reference something from prom_init.o add
+ # it to the list below:
+-grep "^CONFIG_KASAN=y$" .config >/dev/null
++grep "^CONFIG_KASAN=y$" ${KCONFIG_CONFIG} >/dev/null
+ if [ $? -eq 0 ]
+ then
+       MEM_FUNCS="__memcpy __memset"
diff --git a/queue-5.10/series b/queue-5.10/series
new file mode 100644 (file)
index 0000000..451b049
--- /dev/null
@@ -0,0 +1,9 @@
+drm-amdgpu-to-flush-tlb-for-mmhub-of-raven-series.patch
+ipv6-take-care-of-disable_policy-when-restoring-routes.patch
+nvme-pci-add-nvme_quirk_bogus_nid-for-adata-xpg-sx6000lnp-aka-spectrix-s40g.patch
+nvdimm-fix-badblocks-clear-off-by-one-error.patch
+powerpc-prom_init-fix-kernel-config-grep.patch
+powerpc-book3e-fix-pud-allocation-size-in-map_kernel_page.patch
+powerpc-bpf-fix-use-of-user_pt_regs-in-uapi.patch
+dm-raid-fix-accesses-beyond-end-of-raid-member-array.patch
+dm-raid-fix-kasan-warning-in-raid5_add_disks.patch