--- /dev/null
+From e7c22eeaff8565d9a8374f320238c251ca31480b Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 11 Jan 2021 14:02:50 +0100
+Subject: ALSA: fireface: Fix integer overflow in transmit_midi_msg()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit e7c22eeaff8565d9a8374f320238c251ca31480b upstream.
+
+As snd_ff.rx_bytes[] is unsigned int, and NSEC_PER_SEC is 1000000000L,
+the second multiplication in
+
+ ff->rx_bytes[port] * 8 * NSEC_PER_SEC / 31250
+
+always overflows on 32-bit platforms, truncating the result. Fix this
+by precalculating "NSEC_PER_SEC / 31250", which is an integer constant.
+
+Note that this assumes ff->rx_bytes[port] <= 16777.
+
+Fixes: 19174295788de77d ("ALSA: fireface: add transaction support")
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210111130251.361335-2-geert+renesas@glider.be
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/fireface/ff-transaction.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/fireface/ff-transaction.c
++++ b/sound/firewire/fireface/ff-transaction.c
+@@ -99,7 +99,7 @@ static void transmit_midi_msg(struct snd
+
+ /* Set interval to next transaction. */
+ ff->next_ktime[port] = ktime_add_ns(ktime_get(),
+- len * 8 * NSEC_PER_SEC / 31250);
++ len * 8 * (NSEC_PER_SEC / 31250));
+ ff->rx_bytes[port] = len;
+
+ /*
--- /dev/null
+From 9f65df9c589f249435255da37a5dd11f1bc86f4d Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Mon, 11 Jan 2021 14:02:51 +0100
+Subject: ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 9f65df9c589f249435255da37a5dd11f1bc86f4d upstream.
+
+As snd_fw_async_midi_port.consume_bytes is unsigned int, and
+NSEC_PER_SEC is 1000000000L, the second multiplication in
+
+ port->consume_bytes * 8 * NSEC_PER_SEC / 31250
+
+always overflows on 32-bit platforms, truncating the result. Fix this
+by precalculating "NSEC_PER_SEC / 31250", which is an integer constant.
+
+Note that this assumes port->consume_bytes <= 16777.
+
+Fixes: 531f471834227d03 ("ALSA: firewire-lib/firewire-tascam: localize async midi port")
+Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20210111130251.361335-3-geert+renesas@glider.be
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/firewire/tascam/tascam-transaction.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/firewire/tascam/tascam-transaction.c
++++ b/sound/firewire/tascam/tascam-transaction.c
+@@ -210,7 +210,7 @@ static void midi_port_work(struct work_s
+
+ /* Set interval to next transaction. */
+ port->next_ktime = ktime_add_ns(ktime_get(),
+- port->consume_bytes * 8 * NSEC_PER_SEC / 31250);
++ port->consume_bytes * 8 * (NSEC_PER_SEC / 31250));
+
+ /* Start this transaction. */
+ port->idling = false;
--- /dev/null
+From f373a811fd9a69fc8bafb9bcb41d2cfa36c62665 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 11 Dec 2020 13:06:52 +0300
+Subject: ASoC: Intel: fix error code cnl_set_dsp_D0()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit f373a811fd9a69fc8bafb9bcb41d2cfa36c62665 upstream.
+
+Return -ETIMEDOUT if the dsp boot times out instead of returning
+success.
+
+Fixes: cb6a55284629 ("ASoC: Intel: cnl: Add sst library functions for cnl platform")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com>
+Link: https://lore.kernel.org/r/X9NEvCzuN+IObnTN@mwanda
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/intel/skylake/cnl-sst.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/soc/intel/skylake/cnl-sst.c
++++ b/sound/soc/intel/skylake/cnl-sst.c
+@@ -212,6 +212,7 @@ static int cnl_set_dsp_D0(struct sst_dsp
+ "dsp boot timeout, status=%#x error=%#x\n",
+ sst_dsp_shim_read(ctx, CNL_ADSP_FW_STATUS),
+ sst_dsp_shim_read(ctx, CNL_ADSP_ERROR_CODE));
++ ret = -ETIMEDOUT;
+ goto err;
+ }
+ } else {
--- /dev/null
+From 671ee4db952449acde126965bf76817a3159040d Mon Sep 17 00:00:00 2001
+From: Jerome Brunet <jbrunet@baylibre.com>
+Date: Thu, 17 Dec 2020 16:08:12 +0100
+Subject: ASoC: meson: axg-tdm-interface: fix loopback
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+commit 671ee4db952449acde126965bf76817a3159040d upstream.
+
+When the axg-tdm-interface was introduced, the backend DAI was marked as an
+endpoint when DPCM was walking the DAPM graph to find a its BE.
+
+It is no longer the case since this
+commit 8dd26dff00c0 ("ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks")
+Because of this, when DPCM finds a BE it does everything it needs on the
+DAIs but it won't power up the widgets between the FE and the BE if there
+is no actual endpoint after the BE.
+
+On meson-axg HWs, the loopback is a special DAI of the tdm-interface BE.
+It is only linked to the dummy codec since there no actual HW after it.
+>From the DAPM perspective, the DAI has no endpoint. Because of this, the TDM
+decoder, which is a widget between the FE and BE is not powered up.
+
+>From the user perspective, everything seems fine but no data is produced.
+
+Connecting the Loopback DAI to a dummy DAPM endpoint solves the problem.
+
+Fixes: 8dd26dff00c0 ("ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks")
+Cc: Charles Keepax <ckeepax@opensource.cirrus.com>
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20201217150812.3247405-1-jbrunet@baylibre.com
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/soc/meson/axg-tdm-interface.c | 14 +++++++++++++-
+ 1 file changed, 13 insertions(+), 1 deletion(-)
+
+--- a/sound/soc/meson/axg-tdm-interface.c
++++ b/sound/soc/meson/axg-tdm-interface.c
+@@ -459,8 +459,20 @@ static int axg_tdm_iface_set_bias_level(
+ return ret;
+ }
+
++static const struct snd_soc_dapm_widget axg_tdm_iface_dapm_widgets[] = {
++ SND_SOC_DAPM_SIGGEN("Playback Signal"),
++};
++
++static const struct snd_soc_dapm_route axg_tdm_iface_dapm_routes[] = {
++ { "Loopback", NULL, "Playback Signal" },
++};
++
+ static const struct snd_soc_component_driver axg_tdm_iface_component_drv = {
+- .set_bias_level = axg_tdm_iface_set_bias_level,
++ .dapm_widgets = axg_tdm_iface_dapm_widgets,
++ .num_dapm_widgets = ARRAY_SIZE(axg_tdm_iface_dapm_widgets),
++ .dapm_routes = axg_tdm_iface_dapm_routes,
++ .num_dapm_routes = ARRAY_SIZE(axg_tdm_iface_dapm_routes),
++ .set_bias_level = axg_tdm_iface_set_bias_level,
+ };
+
+ static const struct of_device_id axg_tdm_iface_of_match[] = {
--- /dev/null
+From 0378c625afe80eb3f212adae42cc33c9f6f31abf Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Wed, 6 Jan 2021 18:19:05 -0500
+Subject: dm: eliminate potential source of excessive kernel log noise
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 0378c625afe80eb3f212adae42cc33c9f6f31abf upstream.
+
+There wasn't ever a real need to log an error in the kernel log for
+ioctls issued with insufficient permissions. Simply return an error
+and if an admin/user is sufficiently motivated they can enable DM's
+dynamic debugging to see an explanation for why the ioctls were
+disallowed.
+
+Reported-by: Nir Soffer <nsoffer@redhat.com>
+Fixes: e980f62353c6 ("dm: don't allow ioctls to targets that don't map to whole devices")
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -515,7 +515,7 @@ static int dm_blk_ioctl(struct block_dev
+ * subset of the parent bdev; require extra privileges.
+ */
+ if (!capable(CAP_SYS_RAWIO)) {
+- DMWARN_LIMIT(
++ DMDEBUG_LIMIT(
+ "%s: sending ioctl %x to DM device without required privilege.",
+ current->comm, cmd);
+ r = -ENOIOCTLCMD;
--- /dev/null
+From d36a1dd9f77ae1e72da48f4123ed35627848507d Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 5 Jan 2021 14:43:46 -0500
+Subject: dump_common_audit_data(): fix racy accesses to ->d_name
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit d36a1dd9f77ae1e72da48f4123ed35627848507d upstream.
+
+We are not guaranteed the locking environment that would prevent
+dentry getting renamed right under us. And it's possible for
+old long name to be freed after rename, leading to UAF here.
+
+Cc: stable@kernel.org # v2.6.2+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/lsm_audit.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/security/lsm_audit.c
++++ b/security/lsm_audit.c
+@@ -277,7 +277,9 @@ static void dump_common_audit_data(struc
+ struct inode *inode;
+
+ audit_log_format(ab, " name=");
++ spin_lock(&a->u.dentry->d_lock);
+ audit_log_untrustedstring(ab, a->u.dentry->d_name.name);
++ spin_unlock(&a->u.dentry->d_lock);
+
+ inode = d_backing_inode(a->u.dentry);
+ if (inode) {
+@@ -295,8 +297,9 @@ static void dump_common_audit_data(struc
+ dentry = d_find_alias(inode);
+ if (dentry) {
+ audit_log_format(ab, " name=");
+- audit_log_untrustedstring(ab,
+- dentry->d_name.name);
++ spin_lock(&dentry->d_lock);
++ audit_log_untrustedstring(ab, dentry->d_name.name);
++ spin_unlock(&dentry->d_lock);
+ dput(dentry);
+ }
+ audit_log_format(ab, " dev=");
--- /dev/null
+From dfd56c2c0c0dbb11be939b804ddc8d5395ab3432 Mon Sep 17 00:00:00 2001
+From: Jan Kara <jack@suse.cz>
+Date: Wed, 16 Dec 2020 11:18:43 +0100
+Subject: ext4: fix superblock checksum failure when setting password salt
+
+From: Jan Kara <jack@suse.cz>
+
+commit dfd56c2c0c0dbb11be939b804ddc8d5395ab3432 upstream.
+
+When setting password salt in the superblock, we forget to recompute the
+superblock checksum so it will not match until the next superblock
+modification which recomputes the checksum. Fix it.
+
+CC: Michael Halcrow <mhalcrow@google.com>
+Reported-by: Andreas Dilger <adilger@dilger.ca>
+Fixes: 9bd8212f981e ("ext4 crypto: add encryption policy and password salt support")
+Signed-off-by: Jan Kara <jack@suse.cz>
+Link: https://lore.kernel.org/r/20201216101844.22917-8-jack@suse.cz
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/ioctl.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/fs/ext4/ioctl.c
++++ b/fs/ext4/ioctl.c
+@@ -1092,7 +1092,10 @@ resizefs_out:
+ err = ext4_journal_get_write_access(handle, sbi->s_sbh);
+ if (err)
+ goto pwsalt_err_journal;
++ lock_buffer(sbi->s_sbh);
+ generate_random_uuid(sbi->s_es->s_encrypt_pw_salt);
++ ext4_superblock_csum_set(sb);
++ unlock_buffer(sbi->s_sbh);
+ err = ext4_handle_dirty_metadata(handle, NULL,
+ sbi->s_sbh);
+ pwsalt_err_journal:
--- /dev/null
+From 172aad81a882443eefe1bd860c4eddc81b14dd5b Mon Sep 17 00:00:00 2001
+From: Olaf Hering <olaf@aepfle.de>
+Date: Sun, 11 Oct 2020 20:54:31 +0200
+Subject: kbuild: enforce -Werror=return-type
+
+From: Olaf Hering <olaf@aepfle.de>
+
+commit 172aad81a882443eefe1bd860c4eddc81b14dd5b upstream.
+
+Catch errors which at least gcc tolerates by default:
+ warning: 'return' with no value, in function returning non-void [-Wreturn-type]
+
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/Makefile
++++ b/Makefile
+@@ -438,7 +438,7 @@ KBUILD_AFLAGS := -D__ASSEMBLY__
+ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ -fno-strict-aliasing -fno-common -fshort-wchar \
+ -Werror-implicit-function-declaration \
+- -Wno-format-security \
++ -Werror=return-type -Wno-format-security \
+ -std=gnu89
+ KBUILD_CPPFLAGS := -D__KERNEL__
+ KBUILD_AFLAGS_KERNEL :=
--- /dev/null
+From 8ff60eb052eeba95cfb3efe16b08c9199f8121cf Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 12 Jan 2021 15:49:04 -0800
+Subject: mm, slub: consider rest of partial list if acquire_slab() fails
+
+From: Jann Horn <jannh@google.com>
+
+commit 8ff60eb052eeba95cfb3efe16b08c9199f8121cf upstream.
+
+acquire_slab() fails if there is contention on the freelist of the page
+(probably because some other CPU is concurrently freeing an object from
+the page). In that case, it might make sense to look for a different page
+(since there might be more remote frees to the page from other CPUs, and
+we don't want contention on struct page).
+
+However, the current code accidentally stops looking at the partial list
+completely in that case. Especially on kernels without CONFIG_NUMA set,
+this means that get_partial() fails and new_slab_objects() falls back to
+new_slab(), allocating new pages. This could lead to an unnecessary
+increase in memory fragmentation.
+
+Link: https://lkml.kernel.org/r/20201228130853.1871516-1-jannh@google.com
+Fixes: 7ced37197196 ("slub: Acquire_slab() avoid loop")
+Signed-off-by: Jann Horn <jannh@google.com>
+Acked-by: David Rientjes <rientjes@google.com>
+Acked-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Pekka Enberg <penberg@kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/slub.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1830,7 +1830,7 @@ static void *get_partial_node(struct kme
+
+ t = acquire_slab(s, n, page, object == NULL, &objects);
+ if (!t)
+- break;
++ continue; /* cmpxchg raced */
+
+ available += objects;
+ if (!object) {
--- /dev/null
+From 86b53fbf08f48d353a86a06aef537e78e82ba721 Mon Sep 17 00:00:00 2001
+From: "j.nixdorf@avm.de" <j.nixdorf@avm.de>
+Date: Tue, 5 Jan 2021 15:17:01 +0100
+Subject: net: sunrpc: interpret the return value of kstrtou32 correctly
+
+From: j.nixdorf@avm.de <j.nixdorf@avm.de>
+
+commit 86b53fbf08f48d353a86a06aef537e78e82ba721 upstream.
+
+A return value of 0 means success. This is documented in lib/kstrtox.c.
+
+This was found by trying to mount an NFS share from a link-local IPv6
+address with the interface specified by its index:
+
+ mount("[fe80::1%1]:/srv/nfs", "/mnt", "nfs", 0, "nolock,addr=fe80::1%1")
+
+Before this commit this failed with EINVAL and also caused the following
+message in dmesg:
+
+ [...] NFS: bad IP address specified: addr=fe80::1%1
+
+The syscall using the same address based on the interface name instead
+of its index succeeds.
+
+Credits for this patch go to my colleague Christian Speich, who traced
+the origin of this bug to this line of code.
+
+Signed-off-by: Johannes Nixdorf <j.nixdorf@avm.de>
+Fixes: 00cfaa943ec3 ("replace strict_strto calls")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/addr.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sunrpc/addr.c
++++ b/net/sunrpc/addr.c
+@@ -184,7 +184,7 @@ static int rpc_parse_scope_id(struct net
+ scope_id = dev->ifindex;
+ dev_put(dev);
+ } else {
+- if (kstrtou32(p, 10, &scope_id) == 0) {
++ if (kstrtou32(p, 10, &scope_id) != 0) {
+ kfree(p);
+ return 0;
+ }
--- /dev/null
+From f6351c3f1c27c80535d76cac2299aec44c36291e Mon Sep 17 00:00:00 2001
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+Date: Fri, 8 Jan 2021 12:44:33 +0100
+Subject: netfilter: conntrack: fix reading nf_conntrack_buckets
+
+From: Jesper Dangaard Brouer <brouer@redhat.com>
+
+commit f6351c3f1c27c80535d76cac2299aec44c36291e upstream.
+
+The old way of changing the conntrack hashsize runtime was through changing
+the module param via file /sys/module/nf_conntrack/parameters/hashsize. This
+was extended to sysctl change in commit 3183ab8997a4 ("netfilter: conntrack:
+allow increasing bucket size via sysctl too").
+
+The commit introduced second "user" variable nf_conntrack_htable_size_user
+which shadow actual variable nf_conntrack_htable_size. When hashsize is
+changed via module param this "user" variable isn't updated. This results in
+sysctl net/netfilter/nf_conntrack_buckets shows the wrong value when users
+update via the old way.
+
+This patch fix the issue by always updating "user" variable when reading the
+proc file. This will take care of changes to the actual variable without
+sysctl need to be aware.
+
+Fixes: 3183ab8997a4 ("netfilter: conntrack: allow increasing bucket size via sysctl too")
+Reported-by: Yoel Caspersen <yoel@kviknet.dk>
+Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nf_conntrack_standalone.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/netfilter/nf_conntrack_standalone.c
++++ b/net/netfilter/nf_conntrack_standalone.c
+@@ -500,6 +500,9 @@ nf_conntrack_hash_sysctl(struct ctl_tabl
+ {
+ int ret;
+
++ /* module_param hashsize could have changed value */
++ nf_conntrack_htable_size_user = nf_conntrack_htable_size;
++
+ ret = proc_dointvec(table, write, buffer, lenp, ppos);
+ if (ret < 0 || !write)
+ return ret;
--- /dev/null
+From 869f4fdaf4ca7bb6e0d05caf6fa1108dddc346a7 Mon Sep 17 00:00:00 2001
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Sat, 9 Jan 2021 20:01:21 +0800
+Subject: netfilter: nf_nat: Fix memleak in nf_nat_init
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+commit 869f4fdaf4ca7bb6e0d05caf6fa1108dddc346a7 upstream.
+
+When register_pernet_subsys() fails, nf_nat_bysource
+should be freed just like when nf_ct_extend_register()
+fails.
+
+Fixes: 1cd472bf036ca ("netfilter: nf_nat: add nat hook register functions to nf_nat")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Acked-by: Florian Westphal <fw@strlen.de>
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/nf_nat_core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -1068,6 +1068,7 @@ static int __init nf_nat_init(void)
+ ret = register_pernet_subsys(&nat_net_ops);
+ if (ret < 0) {
+ nf_ct_extend_unregister(&nat_extend);
++ kvfree(nf_nat_bysource);
+ return ret;
+ }
+
--- /dev/null
+From 896567ee7f17a8a736cda8a28cc987228410a2ac Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Sun, 10 Jan 2021 15:58:08 -0500
+Subject: NFS: nfs_igrab_and_active must first reference the superblock
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 896567ee7f17a8a736cda8a28cc987228410a2ac upstream.
+
+Before referencing the inode, we must ensure that the superblock can be
+referenced. Otherwise, we can end up with iput() calling superblock
+operations that are no longer valid or accessible.
+
+Fixes: ea7c38fef0b7 ("NFSv4: Ensure we reference the inode for return-on-close in delegreturn")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/internal.h | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -575,12 +575,14 @@ extern int nfs4_test_session_trunk(struc
+
+ static inline struct inode *nfs_igrab_and_active(struct inode *inode)
+ {
+- inode = igrab(inode);
+- if (inode != NULL && !nfs_sb_active(inode->i_sb)) {
+- iput(inode);
+- inode = NULL;
++ struct super_block *sb = inode->i_sb;
++
++ if (sb && nfs_sb_active(sb)) {
++ if (igrab(inode))
++ return inode;
++ nfs_sb_deactive(sb);
+ }
+- return inode;
++ return NULL;
+ }
+
+ static inline void nfs_iput_and_deactive(struct inode *inode)
--- /dev/null
+From cb2856c5971723910a86b7d1d0cf623d6919cbc4 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Wed, 6 Jan 2021 14:13:22 -0500
+Subject: NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit cb2856c5971723910a86b7d1d0cf623d6919cbc4 upstream.
+
+If we exit _lgopen_prepare_attached() without setting a layout, we will
+currently leak the plh_outstanding counter.
+
+Fixes: 411ae722d10a ("pNFS: Wait for stale layoutget calls to complete in pnfs_update_layout()")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/pnfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2147,6 +2147,7 @@ static void _lgopen_prepare_attached(str
+ &rng, GFP_KERNEL);
+ if (!lgp) {
+ pnfs_clear_first_layoutget(lo);
++ nfs_layoutget_end(lo);
+ pnfs_put_layout_hdr(lo);
+ return;
+ }
--- /dev/null
+From 3d1a90ab0ed93362ec8ac85cf291243c87260c21 Mon Sep 17 00:00:00 2001
+From: Dave Wysochanski <dwysocha@redhat.com>
+Date: Fri, 11 Dec 2020 05:12:51 -0500
+Subject: NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
+
+From: Dave Wysochanski <dwysocha@redhat.com>
+
+commit 3d1a90ab0ed93362ec8ac85cf291243c87260c21 upstream.
+
+It is only safe to call the tracepoint before rpc_put_task() because
+'data' is freed inside nfs4_lock_release (rpc_release).
+
+Fixes: 48c9579a1afe ("Adding stateid information to tracepoints")
+Signed-off-by: Dave Wysochanski <dwysocha@redhat.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4proc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -6721,9 +6721,9 @@ static int _nfs4_do_setlk(struct nfs4_st
+ data->arg.new_lock_owner, ret);
+ } else
+ data->cancelled = true;
++ trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
+ rpc_put_task(task);
+ dprintk("%s: done, ret = %d!\n", __func__, ret);
+- trace_nfs4_set_lock(fl, state, &data->res.stateid, cmd, ret);
+ return ret;
+ }
+
--- /dev/null
+From 67bbceedc9bb8ad48993a8bd6486054756d711f4 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+Date: Mon, 4 Jan 2021 13:35:46 -0500
+Subject: pNFS: Mark layout for return if return-on-close was not sent
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 67bbceedc9bb8ad48993a8bd6486054756d711f4 upstream.
+
+If the layout return-on-close failed because the layoutreturn was never
+sent, then we should mark the layout for return again.
+
+Fixes: 9c47b18cf722 ("pNFS: Ensure we do clear the return-on-close layout stateid on fatal errors")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/pnfs.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1460,12 +1460,18 @@ void pnfs_roc_release(struct nfs4_layout
+ int ret)
+ {
+ struct pnfs_layout_hdr *lo = args->layout;
++ struct inode *inode = args->inode;
+ const nfs4_stateid *arg_stateid = NULL;
+ const nfs4_stateid *res_stateid = NULL;
+ struct nfs4_xdr_opaque_data *ld_private = args->ld_private;
+
+ switch (ret) {
+ case -NFS4ERR_NOMATCHING_LAYOUT:
++ spin_lock(&inode->i_lock);
++ if (pnfs_layout_is_valid(lo) &&
++ nfs4_stateid_match_other(&args->stateid, &lo->plh_stateid))
++ pnfs_set_plh_return_info(lo, args->range.iomode, 0);
++ spin_unlock(&inode->i_lock);
+ break;
+ case 0:
+ if (res->lrs_present)
--- /dev/null
+From 1c3aa6bd0b823105c2030af85d92d158e815d669 Mon Sep 17 00:00:00 2001
+From: Mark Bloch <mbloch@nvidia.com>
+Date: Wed, 13 Jan 2021 14:17:03 +0200
+Subject: RDMA/mlx5: Fix wrong free of blue flame register on error
+
+From: Mark Bloch <mbloch@nvidia.com>
+
+commit 1c3aa6bd0b823105c2030af85d92d158e815d669 upstream.
+
+If the allocation of the fast path blue flame register fails, the driver
+should free the regular blue flame register allocated a statement above,
+not the one that it just failed to allocate.
+
+Fixes: 16c1975f1032 ("IB/mlx5: Create profile infrastructure to add and remove stages")
+Link: https://lore.kernel.org/r/20210113121703.559778-6-leon@kernel.org
+Reported-by: Hans Petter Selasky <hanss@nvidia.com>
+Signed-off-by: Mark Bloch <mbloch@nvidia.com>
+Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -6094,7 +6094,7 @@ int mlx5_ib_stage_bfrag_init(struct mlx5
+
+ err = mlx5_alloc_bfreg(dev->mdev, &dev->fp_bfreg, false, true);
+ if (err)
+- mlx5_free_bfreg(dev->mdev, &dev->fp_bfreg);
++ mlx5_free_bfreg(dev->mdev, &dev->bfreg);
+
+ return err;
+ }
--- /dev/null
+From a306aba9c8d869b1fdfc8ad9237f1ed718ea55e6 Mon Sep 17 00:00:00 2001
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Date: Sat, 26 Dec 2020 15:42:48 +0800
+Subject: RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+commit a306aba9c8d869b1fdfc8ad9237f1ed718ea55e6 upstream.
+
+If usnic_ib_qp_grp_create() fails at the first call, dev_list
+will not be freed on error, which leads to memleak.
+
+Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver")
+Link: https://lore.kernel.org/r/20201226074248.2893-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c
+@@ -212,6 +212,7 @@ find_free_vf_and_create_qp_grp(struct us
+
+ }
+ usnic_uiom_free_dev_list(dev_list);
++ dev_list = NULL;
+ }
+
+ /* Try to find resources on an unused vf */
+@@ -236,6 +237,8 @@ find_free_vf_and_create_qp_grp(struct us
+ qp_grp_check:
+ if (IS_ERR_OR_NULL(qp_grp)) {
+ usnic_err("Failed to allocate qp_grp\n");
++ if (usnic_ib_share_vf)
++ usnic_uiom_free_dev_list(dev_list);
+ return ERR_PTR(qp_grp ? PTR_ERR(qp_grp) : -ENOMEM);
+ }
+ return qp_grp;
drm-msm-call-msm_init_vram-before-binding-the-gpu.patch
arm-picoxcell-fix-missing-interrupt-parent-propertie.patch
ima-remove-__init-annotation-from-ima_pcrread.patch
+dump_common_audit_data-fix-racy-accesses-to-d_name.patch
+asoc-meson-axg-tdm-interface-fix-loopback.patch
+asoc-intel-fix-error-code-cnl_set_dsp_d0.patch
+nfs4-fix-use-after-free-in-trace_event_raw_event_nfs4_set_lock.patch
+pnfs-mark-layout-for-return-if-return-on-close-was-not-sent.patch
+nfs-pnfs-fix-a-leak-of-the-layout-plh_outstanding-counter.patch
+nfs-nfs_igrab_and_active-must-first-reference-the-superblock.patch
+ext4-fix-superblock-checksum-failure-when-setting-password-salt.patch
+rdma-usnic-fix-memleak-in-find_free_vf_and_create_qp_grp.patch
+rdma-mlx5-fix-wrong-free-of-blue-flame-register-on-error.patch
+mm-slub-consider-rest-of-partial-list-if-acquire_slab-fails.patch
+net-sunrpc-interpret-the-return-value-of-kstrtou32-correctly.patch
+dm-eliminate-potential-source-of-excessive-kernel-log-noise.patch
+alsa-firewire-tascam-fix-integer-overflow-in-midi_port_work.patch
+alsa-fireface-fix-integer-overflow-in-transmit_midi_msg.patch
+netfilter-conntrack-fix-reading-nf_conntrack_buckets.patch
+netfilter-nf_nat-fix-memleak-in-nf_nat_init.patch
+kbuild-enforce-werror-return-type.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
