]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.4
authorSasha Levin <sashal@kernel.org>
Thu, 7 May 2020 01:32:48 +0000 (21:32 -0400)
committerSasha Levin <sashal@kernel.org>
Thu, 7 May 2020 01:32:48 +0000 (21:32 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-4.4/cifs-protect-updating-server-dstaddr-with-a-spinlock.patch [new file with mode: 0644]
queue-4.4/iio-ad7797-use-correct-attribute_group.patch [new file with mode: 0644]
queue-4.4/lib-mpi-fix-building-for-powerpc-with-clang.patch [new file with mode: 0644]
queue-4.4/net-bcmgenet-suppress-warnings-on-failed-rx-skb-allo.patch [new file with mode: 0644]
queue-4.4/net-systemport-suppress-warnings-on-failed-rx-skb-al.patch [new file with mode: 0644]
queue-4.4/scripts-config-allow-colons-in-option-strings-for-se.patch [new file with mode: 0644]
queue-4.4/selftests-ipc-fix-test-failure-seen-after-initial-te.patch [new file with mode: 0644]
queue-4.4/series
queue-4.4/wimax-i2400m-fix-potential-urb-refcnt-leak.patch [new file with mode: 0644]

diff --git a/queue-4.4/cifs-protect-updating-server-dstaddr-with-a-spinlock.patch b/queue-4.4/cifs-protect-updating-server-dstaddr-with-a-spinlock.patch
new file mode 100644 (file)
index 0000000..36afb3d
--- /dev/null
@@ -0,0 +1,39 @@
+From ff0cd55c4b032b8653d8c7ccb0a509f312db31ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 21 Apr 2020 12:37:39 +1000
+Subject: cifs: protect updating server->dstaddr with a spinlock
+
+From: Ronnie Sahlberg <lsahlber@redhat.com>
+
+[ Upstream commit fada37f6f62995cc449b36ebba1220594bfe55fe ]
+
+We use a spinlock while we are reading and accessing the destination address for a server.
+We need to also use this spinlock to protect when we are modifying this address from
+reconn_set_ipaddr().
+
+Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/connect.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index cf104bbe30a14..c9793ce0d3368 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -338,8 +338,10 @@ static int reconn_set_ipaddr(struct TCP_Server_Info *server)
+               return rc;
+       }
++      spin_lock(&cifs_tcp_ses_lock);
+       rc = cifs_convert_address((struct sockaddr *)&server->dstaddr, ipaddr,
+                                 strlen(ipaddr));
++      spin_unlock(&cifs_tcp_ses_lock);
+       kfree(ipaddr);
+       return !rc ? -1 : 0;
+-- 
+2.20.1
+
diff --git a/queue-4.4/iio-ad7797-use-correct-attribute_group.patch b/queue-4.4/iio-ad7797-use-correct-attribute_group.patch
new file mode 100644 (file)
index 0000000..415c370
--- /dev/null
@@ -0,0 +1,40 @@
+From 385e0ca9d26cb335fa411db7f1451f920a7df6eb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 10 Mar 2020 22:16:54 +0800
+Subject: iio:ad7797: Use correct attribute_group
+
+From: YueHaibing <yuehaibing@huawei.com>
+
+[ Upstream commit 28535877ac5b2b84f0d394fd67a5ec71c0c48b10 ]
+
+It should use ad7797_attribute_group in ad7797_info,
+according to commit ("iio:ad7793: Add support for the ad7796 and ad7797").
+
+Scale is fixed for the ad7796 and not programmable, hence
+should not have the scale_available attribute.
+
+Fixes: fd1a8b912841 ("iio:ad7793: Add support for the ad7796 and ad7797")
+Signed-off-by: YueHaibing <yuehaibing@huawei.com>
+Reviewed-by: Lars-Peter Clausen <lars@metafoo.de>
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/adc/ad7793.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c
+index 91d34ed756eaf..fe0c5a155e211 100644
+--- a/drivers/iio/adc/ad7793.c
++++ b/drivers/iio/adc/ad7793.c
+@@ -579,7 +579,7 @@ static const struct iio_info ad7797_info = {
+       .read_raw = &ad7793_read_raw,
+       .write_raw = &ad7793_write_raw,
+       .write_raw_get_fmt = &ad7793_write_raw_get_fmt,
+-      .attrs = &ad7793_attribute_group,
++      .attrs = &ad7797_attribute_group,
+       .validate_trigger = ad_sd_validate_trigger,
+       .driver_module = THIS_MODULE,
+ };
+-- 
+2.20.1
+
diff --git a/queue-4.4/lib-mpi-fix-building-for-powerpc-with-clang.patch b/queue-4.4/lib-mpi-fix-building-for-powerpc-with-clang.patch
new file mode 100644 (file)
index 0000000..3bc0d35
--- /dev/null
@@ -0,0 +1,123 @@
+From f961c3cd38a590ccd4ea33c2eb198cb89879a443 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 12:50:42 -0700
+Subject: lib/mpi: Fix building for powerpc with clang
+
+From: Nathan Chancellor <natechancellor@gmail.com>
+
+[ Upstream commit 5990cdee689c6885b27c6d969a3d58b09002b0bc ]
+
+0day reports over and over on an powerpc randconfig with clang:
+
+lib/mpi/generic_mpih-mul1.c:37:13: error: invalid use of a cast in a
+inline asm context requiring an l-value: remove the cast or build with
+-fheinous-gnu-extensions
+
+Remove the superfluous casts, which have been done previously for x86
+and arm32 in commit dea632cadd12 ("lib/mpi: fix build with clang") and
+commit 7b7c1df2883d ("lib/mpi/longlong.h: fix building with 32-bit
+x86").
+
+Reported-by: kbuild test robot <lkp@intel.com>
+Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://github.com/ClangBuiltLinux/linux/issues/991
+Link: https://lore.kernel.org/r/20200413195041.24064-1-natechancellor@gmail.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ lib/mpi/longlong.h | 34 +++++++++++++++++-----------------
+ 1 file changed, 17 insertions(+), 17 deletions(-)
+
+diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
+index d2ecf0a09180c..f1f31c754b3e6 100644
+--- a/lib/mpi/longlong.h
++++ b/lib/mpi/longlong.h
+@@ -756,22 +756,22 @@ do {                                                                     \
+ do { \
+       if (__builtin_constant_p(bh) && (bh) == 0) \
+               __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "%r" ((USItype)(ah)), \
+               "%r" ((USItype)(al)), \
+               "rI" ((USItype)(bl))); \
+       else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+               __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "%r" ((USItype)(ah)), \
+               "%r" ((USItype)(al)), \
+               "rI" ((USItype)(bl))); \
+       else \
+               __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "%r" ((USItype)(ah)), \
+               "r" ((USItype)(bh)), \
+               "%r" ((USItype)(al)), \
+@@ -781,36 +781,36 @@ do { \
+ do { \
+       if (__builtin_constant_p(ah) && (ah) == 0) \
+               __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "r" ((USItype)(bh)), \
+               "rI" ((USItype)(al)), \
+               "r" ((USItype)(bl))); \
+       else if (__builtin_constant_p(ah) && (ah) == ~(USItype) 0) \
+               __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "r" ((USItype)(bh)), \
+               "rI" ((USItype)(al)), \
+               "r" ((USItype)(bl))); \
+       else if (__builtin_constant_p(bh) && (bh) == 0) \
+               __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "r" ((USItype)(ah)), \
+               "rI" ((USItype)(al)), \
+               "r" ((USItype)(bl))); \
+       else if (__builtin_constant_p(bh) && (bh) == ~(USItype) 0) \
+               __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "r" ((USItype)(ah)), \
+               "rI" ((USItype)(al)), \
+               "r" ((USItype)(bl))); \
+       else \
+               __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \
+-              : "=r" ((USItype)(sh)), \
+-              "=&r" ((USItype)(sl)) \
++              : "=r" (sh), \
++              "=&r" (sl) \
+               : "r" ((USItype)(ah)), \
+               "r" ((USItype)(bh)), \
+               "rI" ((USItype)(al)), \
+@@ -821,7 +821,7 @@ do { \
+ do { \
+       USItype __m0 = (m0), __m1 = (m1); \
+       __asm__ ("mulhwu %0,%1,%2" \
+-      : "=r" ((USItype) ph) \
++      : "=r" (ph) \
+       : "%r" (__m0), \
+       "r" (__m1)); \
+       (pl) = __m0 * __m1; \
+-- 
+2.20.1
+
diff --git a/queue-4.4/net-bcmgenet-suppress-warnings-on-failed-rx-skb-allo.patch b/queue-4.4/net-bcmgenet-suppress-warnings-on-failed-rx-skb-allo.patch
new file mode 100644 (file)
index 0000000..0cb1406
--- /dev/null
@@ -0,0 +1,47 @@
+From cf5549c71ef5a8b004a52bb1ba5a913b30a4ebfa Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 16:02:11 -0700
+Subject: net: bcmgenet: suppress warnings on failed Rx SKB allocations
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit ecaeceb8a8a145d93c7e136f170238229165348f ]
+
+The driver is designed to drop Rx packets and reclaim the buffers
+when an allocation fails, and the network interface needs to safely
+handle this packet loss. Therefore, an allocation failure of Rx
+SKBs is relatively benign.
+
+However, the output of the warning message occurs with a high
+scheduling priority that can cause excessive jitter/latency for
+other high priority processing.
+
+This commit suppresses the warning messages to prevent scheduling
+problems while retaining the failure count in the statistics of
+the network interface.
+
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 34fae5576b603..4b3b396bd8ebe 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1575,7 +1575,8 @@ static struct sk_buff *bcmgenet_rx_refill(struct bcmgenet_priv *priv,
+       dma_addr_t mapping;
+       /* Allocate a new Rx skb */
+-      skb = netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT);
++      skb = __netdev_alloc_skb(priv->dev, priv->rx_buf_len + SKB_ALIGNMENT,
++                               GFP_ATOMIC | __GFP_NOWARN);
+       if (!skb) {
+               priv->mib.alloc_rx_buff_failed++;
+               netif_err(priv, rx_err, priv->dev,
+-- 
+2.20.1
+
diff --git a/queue-4.4/net-systemport-suppress-warnings-on-failed-rx-skb-al.patch b/queue-4.4/net-systemport-suppress-warnings-on-failed-rx-skb-al.patch
new file mode 100644 (file)
index 0000000..e760910
--- /dev/null
@@ -0,0 +1,47 @@
+From dc3404dbf77ea7679e8e6de92eedc1bede4c4b2c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 23 Apr 2020 16:13:30 -0700
+Subject: net: systemport: suppress warnings on failed Rx SKB allocations
+
+From: Doug Berger <opendmb@gmail.com>
+
+[ Upstream commit 3554e54a46125030c534820c297ed7f6c3907e24 ]
+
+The driver is designed to drop Rx packets and reclaim the buffers
+when an allocation fails, and the network interface needs to safely
+handle this packet loss. Therefore, an allocation failure of Rx
+SKBs is relatively benign.
+
+However, the output of the warning message occurs with a high
+scheduling priority that can cause excessive jitter/latency for
+other high priority processing.
+
+This commit suppresses the warning messages to prevent scheduling
+problems while retaining the failure count in the statistics of
+the network interface.
+
+Signed-off-by: Doug Berger <opendmb@gmail.com>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
+index 3cb99ce7325b7..d46ea7a5e0886 100644
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -526,7 +526,8 @@ static struct sk_buff *bcm_sysport_rx_refill(struct bcm_sysport_priv *priv,
+       dma_addr_t mapping;
+       /* Allocate a new SKB for a new packet */
+-      skb = netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH);
++      skb = __netdev_alloc_skb(priv->netdev, RX_BUF_LENGTH,
++                               GFP_ATOMIC | __GFP_NOWARN);
+       if (!skb) {
+               priv->mib.alloc_rx_buff_failed++;
+               netif_err(priv, rx_err, ndev, "SKB alloc failed\n");
+-- 
+2.20.1
+
diff --git a/queue-4.4/scripts-config-allow-colons-in-option-strings-for-se.patch b/queue-4.4/scripts-config-allow-colons-in-option-strings-for-se.patch
new file mode 100644 (file)
index 0000000..79f1cb7
--- /dev/null
@@ -0,0 +1,48 @@
+From 346943efb99f66679c142fd96d44a6bfa19eedd3 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 Apr 2020 18:57:40 +0200
+Subject: scripts/config: allow colons in option strings for sed
+
+From: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
+
+[ Upstream commit e461bc9f9ab105637b86065d24b0b83f182d477c ]
+
+Sed broke on some strings as it used colon as a separator.
+I made it more robust by using \001, which is legit POSIX AFAIK.
+
+E.g. ./config --set-str CONFIG_USBNET_DEVADDR "de:ad:be:ef:00:01"
+failed with: sed: -e expression #1, char 55: unknown option to `s'
+
+Signed-off-by: Jeremie Francois (on alpha) <jeremie.francois@gmail.com>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ scripts/config | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/config b/scripts/config
+index 026aeb4f32ee3..73de17d396987 100755
+--- a/scripts/config
++++ b/scripts/config
+@@ -6,6 +6,9 @@ myname=${0##*/}
+ # If no prefix forced, use the default CONFIG_
+ CONFIG_="${CONFIG_-CONFIG_}"
++# We use an uncommon delimiter for sed substitutions
++SED_DELIM=$(echo -en "\001")
++
+ usage() {
+       cat >&2 <<EOL
+ Manipulate options in a .config file from the command line.
+@@ -82,7 +85,7 @@ txt_subst() {
+       local infile="$3"
+       local tmpfile="$infile.swp"
+-      sed -e "s:$before:$after:" "$infile" >"$tmpfile"
++      sed -e "s$SED_DELIM$before$SED_DELIM$after$SED_DELIM" "$infile" >"$tmpfile"
+       # replace original file with the edited one
+       mv "$tmpfile" "$infile"
+ }
+-- 
+2.20.1
+
diff --git a/queue-4.4/selftests-ipc-fix-test-failure-seen-after-initial-te.patch b/queue-4.4/selftests-ipc-fix-test-failure-seen-after-initial-te.patch
new file mode 100644 (file)
index 0000000..587c089
--- /dev/null
@@ -0,0 +1,61 @@
+From 57d0e17dc67a555b9cc25434264fe25001d0d727 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Apr 2020 15:21:45 -0500
+Subject: selftests/ipc: Fix test failure seen after initial test run
+
+From: Tyler Hicks <tyhicks@linux.microsoft.com>
+
+[ Upstream commit b87080eab4c1377706c113fc9c0157f19ea8fed1 ]
+
+After successfully running the IPC msgque test once, subsequent runs
+result in a test failure:
+
+  $ sudo ./run_kselftest.sh
+  TAP version 13
+  1..1
+  # selftests: ipc: msgque
+  # Failed to get stats for IPC queue with id 0
+  # Failed to dump queue: -22
+  # Bail out!
+  # # Pass 0 Fail 0 Xfail 0 Xpass 0 Skip 0 Error 0
+  not ok 1 selftests: ipc: msgque # exit=1
+
+The dump_queue() function loops through the possible message queue index
+values using calls to msgctl(kern_id, MSG_STAT, ...) where kern_id
+represents the index value. The first time the test is ran, the initial
+index value of 0 is valid and the test is able to complete. The index
+value of 0 is not valid in subsequent test runs and the loop attempts to
+try index values of 1, 2, 3, and so on until a valid index value is
+found that corresponds to the message queue created earlier in the test.
+
+The msgctl() syscall returns -1 and sets errno to EINVAL when invalid
+index values are used. The test failure is caused by incorrectly
+comparing errno to -EINVAL when cycling through possible index values.
+
+Fix invalid test failures on subsequent runs of the msgque test by
+correctly comparing errno values to a non-negated EINVAL.
+
+Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test")
+Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/testing/selftests/ipc/msgque.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c
+index 1b2ce334bb3f0..47c074d73e610 100644
+--- a/tools/testing/selftests/ipc/msgque.c
++++ b/tools/testing/selftests/ipc/msgque.c
+@@ -135,7 +135,7 @@ int dump_queue(struct msgque_data *msgque)
+       for (kern_id = 0; kern_id < 256; kern_id++) {
+               ret = msgctl(kern_id, MSG_STAT, &ds);
+               if (ret < 0) {
+-                      if (errno == -EINVAL)
++                      if (errno == EINVAL)
+                               continue;
+                       printf("Failed to get stats for IPC queue with id %d\n",
+                                       kern_id);
+-- 
+2.20.1
+
index 21fea87aea78d035fb5677bc1529a381816e01ed..da98e61e41210b294dbc42745b03036de10498ac 100644 (file)
@@ -163,3 +163,11 @@ net-dsa-slave-fix-of-node-leak-and-phy-priority.patch
 drivers-net-cpsw-don-t-ignore-phy-mode-if-phy-handle-is-used.patch
 iommu-dma-respect-iommu-aperture-when-allocating.patch
 mdio-sun4i-oops-in-error-handling-in-probe.patch
+iio-ad7797-use-correct-attribute_group.patch
+selftests-ipc-fix-test-failure-seen-after-initial-te.patch
+wimax-i2400m-fix-potential-urb-refcnt-leak.patch
+cifs-protect-updating-server-dstaddr-with-a-spinlock.patch
+scripts-config-allow-colons-in-option-strings-for-se.patch
+lib-mpi-fix-building-for-powerpc-with-clang.patch
+net-bcmgenet-suppress-warnings-on-failed-rx-skb-allo.patch
+net-systemport-suppress-warnings-on-failed-rx-skb-al.patch
diff --git a/queue-4.4/wimax-i2400m-fix-potential-urb-refcnt-leak.patch b/queue-4.4/wimax-i2400m-fix-potential-urb-refcnt-leak.patch
new file mode 100644 (file)
index 0000000..183b04c
--- /dev/null
@@ -0,0 +1,46 @@
+From 5e027e4bbfc73b3cce34c4437fa470c6197a8f77 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Apr 2020 16:41:20 +0800
+Subject: wimax/i2400m: Fix potential urb refcnt leak
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]
+
+i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
+refcount of the "notif_urb".
+
+When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
+becomes invalid, so the refcount should be decreased to keep refcount
+balanced.
+
+The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
+forget to decrease the refcnt increased by usb_get_urb(), causing a
+refcnt leak.
+
+Fix this issue by calling usb_put_urb() before the
+i2400mu_bus_bm_wait_for_ack() returns.
+
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/wimax/i2400m/usb-fw.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
+index e74664b84925e..4e4167976acf6 100644
+--- a/drivers/net/wimax/i2400m/usb-fw.c
++++ b/drivers/net/wimax/i2400m/usb-fw.c
+@@ -354,6 +354,7 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
+               usb_autopm_put_interface(i2400mu->usb_iface);
+       d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
+               i2400m, ack, ack_size, (long) result);
++      usb_put_urb(&notif_urb);
+       return result;
+ error_exceeded:
+-- 
+2.20.1
+