--- /dev/null
+From 0f739fdfe9e5ce668bd6d3210f310df282321837 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 8 Apr 2020 11:09:26 +0200
+Subject: ARM: dts: r8a73a4: Add missing CMT1 interrupts
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 0f739fdfe9e5ce668bd6d3210f310df282321837 upstream.
+
+The R-Mobile APE6 Compare Match Timer 1 generates 8 interrupts, one for
+each channel, but currently only 1 is described.
+Fix this by adding the missing interrupts.
+
+Fixes: f7b65230019b9dac ("ARM: shmobile: r8a73a4: Add CMT1 node")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Link: https://lore.kernel.org/r/20200408090926.25201-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/r8a73a4.dtsi | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a73a4.dtsi
++++ b/arch/arm/boot/dts/r8a73a4.dtsi
+@@ -131,7 +131,14 @@
+ cmt1: timer@e6130000 {
+ compatible = "renesas,r8a73a4-cmt1", "renesas,rcar-gen2-cmt1";
+ reg = <0 0xe6130000 0 0x1004>;
+- interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
++ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&mstp3_clks R8A73A4_CLK_CMT1>;
+ clock-names = "fck";
+ power-domains = <&pd_c5>;
--- /dev/null
+From e47cb97f153193d4b41ca8d48127da14513d54c7 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Fri, 8 May 2020 11:59:18 +0200
+Subject: ARM: dts: r8a7740: Add missing extal2 to CPG node
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit e47cb97f153193d4b41ca8d48127da14513d54c7 upstream.
+
+The Clock Pulse Generator (CPG) device node lacks the extal2 clock.
+This may lead to a failure registering the "r" clock, or to a wrong
+parent for the "usb24s" clock, depending on MD_CK2 pin configuration and
+boot loader CPG_USBCKCR register configuration.
+
+This went unnoticed, as this does not affect the single upstream board
+configuration, which relies on the first clock input only.
+
+Fixes: d9ffd583bf345e2e ("ARM: shmobile: r8a7740: add SoC clocks to DTS")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Ulrich Hecht <uli+renesas@fpond.eu>
+Link: https://lore.kernel.org/r/20200508095918.6061-1-geert+renesas@glider.be
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/r8a7740.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/r8a7740.dtsi
++++ b/arch/arm/boot/dts/r8a7740.dtsi
+@@ -479,7 +479,7 @@
+ cpg_clocks: cpg_clocks@e6150000 {
+ compatible = "renesas,r8a7740-cpg-clocks";
+ reg = <0xe6150000 0x10000>;
+- clocks = <&extal1_clk>, <&extalr_clk>;
++ clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>;
+ #clock-cells = <1>;
+ clock-output-names = "system", "pllc0", "pllc1",
+ "pllc2", "r",
--- /dev/null
+From 15ddc3e17aec0de4c69d595b873e184432b9791d Mon Sep 17 00:00:00 2001
+From: Adam Ford <aford173@gmail.com>
+Date: Fri, 27 Mar 2020 21:33:53 -0500
+Subject: arm64: dts: imx8mn: Change SDMA1 ahb clock for imx8mn
+
+From: Adam Ford <aford173@gmail.com>
+
+commit 15ddc3e17aec0de4c69d595b873e184432b9791d upstream.
+
+Using SDMA1 with UART1 is causing a "Timeout waiting for CH0" error.
+This patch changes to ahb clock from SDMA1_ROOT to AHB which fixes the
+timeout error.
+
+Fixes: 6c3debcbae47 ("arm64: dts: freescale: Add i.MX8MN dtsi support")
+
+Signed-off-by: Adam Ford <aford173@gmail.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/freescale/imx8mn.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mn.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mn.dtsi
+@@ -661,7 +661,7 @@
+ reg = <0x30bd0000 0x10000>;
+ interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clk IMX8MN_CLK_SDMA1_ROOT>,
+- <&clk IMX8MN_CLK_SDMA1_ROOT>;
++ <&clk IMX8MN_CLK_AHB>;
+ clock-names = "ipg", "ahb";
+ #dma-cells = <3>;
+ fsl,sdma-ram-script-name = "imx/sdma/sdma-imx7d.bin";
--- /dev/null
+From e4f634d812634067b0c661af2e3cecfd629c89b8 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Thu, 26 Mar 2020 17:08:57 +0100
+Subject: arm64: dts: meson-g12-common: fix dwc2 clock names
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit e4f634d812634067b0c661af2e3cecfd629c89b8 upstream.
+
+Use the correct dwc2 clock name.
+
+Fixes: 9baf7d6be730 ("arm64: dts: meson: g12a: Add G12A USB nodes")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20200326160857.11929-3-narmstrong@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi
+@@ -2204,7 +2204,7 @@
+ reg = <0x0 0xff400000 0x0 0x40000>;
+ interrupts = <GIC_SPI 31 IRQ_TYPE_LEVEL_HIGH>;
+ clocks = <&clkc CLKID_USB1_DDR_BRIDGE>;
+- clock-names = "ddr";
++ clock-names = "otg";
+ phys = <&usb2_phy1>;
+ phy-names = "usb2-phy";
+ dr_mode = "peripheral";
--- /dev/null
+From 5ac0869fb39b1c1ba84d4d75c550f82e0bf44c96 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Fri, 18 Oct 2019 14:02:16 +0000
+Subject: arm64: dts: meson-g12b-khadas-vim3: add missing frddr_a status property
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 5ac0869fb39b1c1ba84d4d75c550f82e0bf44c96 upstream.
+
+In the process of moving the VIM3 audio nodes to a G12B specific dtsi
+for enabling the SM1 based VIM3L, the frddr_a status = "okay" property
+got dropped.
+This re-enables the frddr_a node to fix audio support.
+
+Fixes: 4f26cc1c96c9 ("arm64: dts: khadas-vim3: move common nodes into meson-khadas-vim3.dtsi")
+Reported-by: Christian Hewitt <christianshewitt@gmail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
+Tested-by: Jerome Brunet <jbrunet@baylibre.com>
+Link: https://lore.kernel.org/r/20191018140216.4257-1-narmstrong@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-khadas-vim3.dtsi
+@@ -152,6 +152,10 @@
+ clock-latency = <50000>;
+ };
+
++&frddr_a {
++ status = "okay";
++};
++
+ &frddr_b {
+ status = "okay";
+ };
--- /dev/null
+From 4e025fd91ba32a16ed8131158aa63cd37d141cbb Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Thu, 26 Mar 2020 17:08:56 +0100
+Subject: arm64: dts: meson-g12b-ugoos-am6: fix usb vbus-supply
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 4e025fd91ba32a16ed8131158aa63cd37d141cbb upstream.
+
+The USB supply used the wrong property, fixing:
+meson-g12b-ugoos-am6.dt.yaml: usb@ffe09000: 'vbus-regulator' does not match any of the regexes: '^usb@[0-9a-f]+$', 'pinctrl-[0-9]+'
+
+Fixes: 2cd2310fca4c ("arm64: dts: meson-g12b-ugoos-am6: add initial device-tree")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: Kevin Hilman <khilman@baylibre.com>
+Reviewed-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
+Link: https://lore.kernel.org/r/20200326160857.11929-2-narmstrong@baylibre.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
++++ b/arch/arm64/boot/dts/amlogic/meson-g12b-ugoos-am6.dts
+@@ -545,7 +545,7 @@
+ &usb {
+ status = "okay";
+ dr_mode = "host";
+- vbus-regulator = <&usb_pwr_en>;
++ vbus-supply = <&usb_pwr_en>;
+ };
+
+ &usb2_phy0 {
--- /dev/null
+From 28810eecae08f9458a44831978e36f14ed182c80 Mon Sep 17 00:00:00 2001
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+Date: Tue, 17 Mar 2020 22:44:42 -0700
+Subject: arm64: dts: qcom: msm8996: Reduce vdd_apc voltage
+
+From: Bjorn Andersson <bjorn.andersson@linaro.org>
+
+commit 28810eecae08f9458a44831978e36f14ed182c80 upstream.
+
+Some msm8996 based devices are unstable when run with VDD_APC of 1.23V,
+which is listed as the maximum voltage in "Turbo" mode. Given that the
+CPU cluster is not run in "Turbo" mode, reduce this to 0.98V - the
+maximum voltage for nominal operation.
+
+Tested-by: Loic Poulain <loic.poulain@linaro.org>
+Fixes: 7a2a2231ef22 ("arm64: dts: apq8096-db820c: Fix VDD core voltage")
+Cc: Loic Poulain <loic.poulain@linaro.org>
+Link: https://lore.kernel.org/r/20200318054442.3066726-1-bjorn.andersson@linaro.org
+Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi
+@@ -658,8 +658,8 @@
+ s11 {
+ qcom,saw-leader;
+ regulator-always-on;
+- regulator-min-microvolt = <1230000>;
+- regulator-max-microvolt = <1230000>;
++ regulator-min-microvolt = <980000>;
++ regulator-max-microvolt = <980000>;
+ };
+ };
+
--- /dev/null
+From f4d71c6ea9e58c07dd4d02d09c5dd9bb780ec4b1 Mon Sep 17 00:00:00 2001
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Date: Fri, 17 Apr 2020 16:29:03 +0900
+Subject: arm64: dts: renesas: r8a77980: Fix IPMMU VIP[01] nodes
+
+From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+
+commit f4d71c6ea9e58c07dd4d02d09c5dd9bb780ec4b1 upstream.
+
+Missing the renesas,ipmmu-main property on ipmmu_vip[01] nodes.
+
+Fixes: 55697cbb44e4 ("arm64: dts: renesas: r8a779{65,80,90}: Add IPMMU devices nodes)
+Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
+Link: https://lore.kernel.org/r/1587108543-23786-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/renesas/r8a77980.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/renesas/r8a77980.dtsi
++++ b/arch/arm64/boot/dts/renesas/r8a77980.dtsi
+@@ -1318,6 +1318,7 @@
+ ipmmu_vip0: mmu@e7b00000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7b00000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 4>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
+@@ -1325,6 +1326,7 @@
+ ipmmu_vip1: mmu@e7960000 {
+ compatible = "renesas,ipmmu-r8a77980";
+ reg = <0 0xe7960000 0 0x1000>;
++ renesas,ipmmu-main = <&ipmmu_mm 11>;
+ power-domains = <&sysc R8A77980_PD_ALWAYS_ON>;
+ #iommu-cells = <1>;
+ };
--- /dev/null
+From 190c7f6fd43a776d4a6da1dac44408104649e9b7 Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 27 Mar 2020 11:04:14 +0800
+Subject: arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 190c7f6fd43a776d4a6da1dac44408104649e9b7 upstream.
+
+The device tree compiler complains that the dwc3 nodes have regs
+properties but no matching unit addresses.
+
+Add the unit addresses to the device node name. While at it, also rename
+the nodes from "dwc3" to "usb", as guidelines require device nodes have
+generic names.
+
+Fixes: 7144224f2c2b ("arm64: dts: rockchip: support dwc3 USB for rk3399")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20200327030414.5903-7-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/rockchip/rk3399.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3399.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399.dtsi
+@@ -410,7 +410,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_0: dwc3 {
++ usbdrd_dwc3_0: usb@fe800000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe800000 0x0 0x100000>;
+ interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
+@@ -446,7 +446,7 @@
+ reset-names = "usb3-otg";
+ status = "disabled";
+
+- usbdrd_dwc3_1: dwc3 {
++ usbdrd_dwc3_1: usb@fe900000 {
+ compatible = "snps,dwc3";
+ reg = <0x0 0xfe900000 0x0 0x100000>;
+ interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
--- /dev/null
+From 83b994129fb4c18a8460fd395864a28740e5e7fb Mon Sep 17 00:00:00 2001
+From: Chen-Yu Tsai <wens@csie.org>
+Date: Fri, 27 Mar 2020 11:04:10 +0800
+Subject: arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards
+
+From: Chen-Yu Tsai <wens@csie.org>
+
+commit 83b994129fb4c18a8460fd395864a28740e5e7fb upstream.
+
+In some board device tree files, "rk805" was used for the RK805 PMIC's
+node name. However the policy for device trees is that generic names
+should be used.
+
+Replace the "rk805" node name with the generic "pmic" name.
+
+Fixes: 1e28037ec88e ("arm64: dts: rockchip: add rk805 node for rk3328-evb")
+Fixes: 955bebde057e ("arm64: dts: rockchip: add rk3328-rock64 board")
+Signed-off-by: Chen-Yu Tsai <wens@csie.org>
+Link: https://lore.kernel.org/r/20200327030414.5903-3-wens@kernel.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/rockchip/rk3328-evb.dts | 2 +-
+ arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-evb.dts
+@@ -92,7 +92,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
+--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts
+@@ -169,7 +169,7 @@
+ &i2c1 {
+ status = "okay";
+
+- rk805: rk805@18 {
++ rk805: pmic@18 {
+ compatible = "rockchip,rk805";
+ reg = <0x18>;
+ interrupt-parent = <&gpio2>;
--- /dev/null
+From e92888c72fbdc6f9d07b3b0604c012e81d7c0da7 Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yhs@fb.com>
+Date: Wed, 13 May 2020 22:32:05 -0700
+Subject: bpf: Enforce returning 0 for fentry/fexit progs
+
+From: Yonghong Song <yhs@fb.com>
+
+commit e92888c72fbdc6f9d07b3b0604c012e81d7c0da7 upstream.
+
+Currently, tracing/fentry and tracing/fexit prog
+return values are not enforced. In trampoline codes,
+the fentry/fexit prog return values are ignored.
+Let us enforce it to be 0 to avoid confusion and
+allows potential future extension.
+
+This patch also explicitly added return value
+checking for tracing/raw_tp, tracing/fmod_ret,
+and freplace programs such that these program
+return values can be anything. The purpose are
+two folds:
+ 1. to make it explicit about return value expectations
+ for these programs in verifier.
+ 2. for tracing prog_type, if a future attach type
+ is added, the default is -ENOTSUPP which will
+ enforce to specify return value ranges explicitly.
+
+Fixes: fec56f5890d9 ("bpf: Introduce BPF trampoline")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200514053206.1298415-1-yhs@fb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/bpf/verifier.c | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -6498,6 +6498,23 @@ static int check_return_code(struct bpf_
+ return 0;
+ range = tnum_const(0);
+ break;
++ case BPF_PROG_TYPE_TRACING:
++ switch (env->prog->expected_attach_type) {
++ case BPF_TRACE_FENTRY:
++ case BPF_TRACE_FEXIT:
++ range = tnum_const(0);
++ break;
++ case BPF_TRACE_RAW_TP:
++ case BPF_MODIFY_RETURN:
++ return 0;
++ default:
++ return -ENOTSUPP;
++ }
++ break;
++ case BPF_PROG_TYPE_EXT:
++ /* freplace program can return anything as its return value
++ * depends on the to-be-replaced kernel func or bpf program.
++ */
+ default:
+ return 0;
+ }
--- /dev/null
+From 18f02ad19e2c2a1d9e1d55a4e1c0cbf51419151c Mon Sep 17 00:00:00 2001
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Date: Sun, 26 Apr 2020 11:35:15 +0800
+Subject: bpf: Fix sk_psock refcnt leak when receiving message
+
+From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+
+commit 18f02ad19e2c2a1d9e1d55a4e1c0cbf51419151c upstream.
+
+tcp_bpf_recvmsg() invokes sk_psock_get(), which returns a reference of
+the specified sk_psock object to "psock" with increased refcnt.
+
+When tcp_bpf_recvmsg() returns, local variable "psock" becomes invalid,
+so the refcount should be decreased to keep refcount balanced.
+
+The reference counting issue happens in several exception handling paths
+of tcp_bpf_recvmsg(). When those error scenarios occur such as "flags"
+includes MSG_ERRQUEUE, the function forgets to decrease the refcnt
+increased by sk_psock_get(), causing a refcnt leak.
+
+Fix this issue by calling sk_psock_put() or pulling up the error queue
+read handling when those error scenarios occur.
+
+Fixes: e7a5f1f1cd000 ("bpf/sockmap: Read psock ingress_msg before sk_receive_queue")
+Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
+Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
+Link: https://lore.kernel.org/bpf/1587872115-42805-1-git-send-email-xiyuyang19@fudan.edu.cn
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/tcp_bpf.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_bpf.c
++++ b/net/ipv4/tcp_bpf.c
+@@ -121,14 +121,17 @@ int tcp_bpf_recvmsg(struct sock *sk, str
+ struct sk_psock *psock;
+ int copied, ret;
+
++ if (unlikely(flags & MSG_ERRQUEUE))
++ return inet_recv_error(sk, msg, len, addr_len);
++
+ psock = sk_psock_get(sk);
+ if (unlikely(!psock))
+ return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
+- if (unlikely(flags & MSG_ERRQUEUE))
+- return inet_recv_error(sk, msg, len, addr_len);
+ if (!skb_queue_empty(&sk->sk_receive_queue) &&
+- sk_psock_queue_empty(psock))
++ sk_psock_queue_empty(psock)) {
++ sk_psock_put(sk, psock);
+ return tcp_recvmsg(sk, msg, len, nonblock, flags, addr_len);
++ }
+ lock_sock(sk);
+ msg_bytes_ready:
+ copied = __tcp_bpf_recvmsg(sk, psock, msg, len, flags);
--- /dev/null
+From b2a5212fb634561bb734c6356904e37f6665b955 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 15 May 2020 12:11:18 +0200
+Subject: bpf: Restrict bpf_trace_printk()'s %s usage and add %pks, %pus specifier
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit b2a5212fb634561bb734c6356904e37f6665b955 upstream.
+
+Usage of plain %s conversion specifier in bpf_trace_printk() suffers from the
+very same issue as bpf_probe_read{,str}() helpers, that is, it is broken on
+archs with overlapping address ranges.
+
+While the helpers have been addressed through work in 6ae08ae3dea2 ("bpf: Add
+probe_read_{user, kernel} and probe_read_{user, kernel}_str helpers"), we need
+an option for bpf_trace_printk() as well to fix it.
+
+Similarly as with the helpers, force users to make an explicit choice by adding
+%pks and %pus specifier to bpf_trace_printk() which will then pick the corresponding
+strncpy_from_unsafe*() variant to perform the access under KERNEL_DS or USER_DS.
+The %pk* (kernel specifier) and %pu* (user specifier) can later also be extended
+for other objects aside strings that are probed and printed under tracing, and
+reused out of other facilities like bpf_seq_printf() or BTF based type printing.
+
+Existing behavior of %s for current users is still kept working for archs where it
+is not broken and therefore gated through CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE.
+For archs not having this property we fall-back to pick probing under KERNEL_DS as
+a sensible default.
+
+Fixes: 8d3b7dce8622 ("bpf: add support for %s specifier to bpf_trace_printk()")
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Reported-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Cc: Masami Hiramatsu <mhiramat@kernel.org>
+Cc: Brendan Gregg <brendan.d.gregg@gmail.com>
+Link: https://lore.kernel.org/bpf/20200515101118.6508-4-daniel@iogearbox.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/core-api/printk-formats.rst | 14 ++++
+ kernel/trace/bpf_trace.c | 94 +++++++++++++++++++-----------
+ lib/vsprintf.c | 12 +++
+ 3 files changed, 88 insertions(+), 32 deletions(-)
+
+--- a/Documentation/core-api/printk-formats.rst
++++ b/Documentation/core-api/printk-formats.rst
+@@ -112,6 +112,20 @@ used when printing stack backtraces. The
+ consideration the effect of compiler optimisations which may occur
+ when tail-calls are used and marked with the noreturn GCC attribute.
+
++Probed Pointers from BPF / tracing
++----------------------------------
++
++::
++
++ %pks kernel string
++ %pus user string
++
++The ``k`` and ``u`` specifiers are used for printing prior probed memory from
++either kernel memory (k) or user memory (u). The subsequent ``s`` specifier
++results in printing a string. For direct use in regular vsnprintf() the (k)
++and (u) annotation is ignored, however, when used out of BPF's bpf_trace_printk(),
++for example, it reads the memory it is pointing to without faulting.
++
+ Kernel Pointers
+ ---------------
+
+--- a/kernel/trace/bpf_trace.c
++++ b/kernel/trace/bpf_trace.c
+@@ -325,17 +325,15 @@ static const struct bpf_func_proto *bpf_
+
+ /*
+ * Only limited trace_printk() conversion specifiers allowed:
+- * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %s
++ * %d %i %u %x %ld %li %lu %lx %lld %lli %llu %llx %p %pks %pus %s
+ */
+ BPF_CALL_5(bpf_trace_printk, char *, fmt, u32, fmt_size, u64, arg1,
+ u64, arg2, u64, arg3)
+ {
++ int i, mod[3] = {}, fmt_cnt = 0;
++ char buf[64], fmt_ptype;
++ void *unsafe_ptr = NULL;
+ bool str_seen = false;
+- int mod[3] = {};
+- int fmt_cnt = 0;
+- u64 unsafe_addr;
+- char buf[64];
+- int i;
+
+ /*
+ * bpf_check()->check_func_arg()->check_stack_boundary()
+@@ -361,40 +359,71 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
+ if (fmt[i] == 'l') {
+ mod[fmt_cnt]++;
+ i++;
+- } else if (fmt[i] == 'p' || fmt[i] == 's') {
++ } else if (fmt[i] == 'p') {
+ mod[fmt_cnt]++;
++ if ((fmt[i + 1] == 'k' ||
++ fmt[i + 1] == 'u') &&
++ fmt[i + 2] == 's') {
++ fmt_ptype = fmt[i + 1];
++ i += 2;
++ goto fmt_str;
++ }
++
+ /* disallow any further format extensions */
+ if (fmt[i + 1] != 0 &&
+ !isspace(fmt[i + 1]) &&
+ !ispunct(fmt[i + 1]))
+ return -EINVAL;
+- fmt_cnt++;
+- if (fmt[i] == 's') {
+- if (str_seen)
+- /* allow only one '%s' per fmt string */
+- return -EINVAL;
+- str_seen = true;
+-
+- switch (fmt_cnt) {
+- case 1:
+- unsafe_addr = arg1;
+- arg1 = (long) buf;
+- break;
+- case 2:
+- unsafe_addr = arg2;
+- arg2 = (long) buf;
+- break;
+- case 3:
+- unsafe_addr = arg3;
+- arg3 = (long) buf;
+- break;
+- }
+- buf[0] = 0;
+- strncpy_from_unsafe(buf,
+- (void *) (long) unsafe_addr,
++
++ goto fmt_next;
++ } else if (fmt[i] == 's') {
++ mod[fmt_cnt]++;
++ fmt_ptype = fmt[i];
++fmt_str:
++ if (str_seen)
++ /* allow only one '%s' per fmt string */
++ return -EINVAL;
++ str_seen = true;
++
++ if (fmt[i + 1] != 0 &&
++ !isspace(fmt[i + 1]) &&
++ !ispunct(fmt[i + 1]))
++ return -EINVAL;
++
++ switch (fmt_cnt) {
++ case 0:
++ unsafe_ptr = (void *)(long)arg1;
++ arg1 = (long)buf;
++ break;
++ case 1:
++ unsafe_ptr = (void *)(long)arg2;
++ arg2 = (long)buf;
++ break;
++ case 2:
++ unsafe_ptr = (void *)(long)arg3;
++ arg3 = (long)buf;
++ break;
++ }
++
++ buf[0] = 0;
++ switch (fmt_ptype) {
++ case 's':
++#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
++ strncpy_from_unsafe(buf, unsafe_ptr,
+ sizeof(buf));
++ break;
++#endif
++ case 'k':
++ strncpy_from_unsafe_strict(buf, unsafe_ptr,
++ sizeof(buf));
++ break;
++ case 'u':
++ strncpy_from_unsafe_user(buf,
++ (__force void __user *)unsafe_ptr,
++ sizeof(buf));
++ break;
+ }
+- continue;
++ goto fmt_next;
+ }
+
+ if (fmt[i] == 'l') {
+@@ -405,6 +434,7 @@ BPF_CALL_5(bpf_trace_printk, char *, fmt
+ if (fmt[i] != 'i' && fmt[i] != 'd' &&
+ fmt[i] != 'u' && fmt[i] != 'x')
+ return -EINVAL;
++fmt_next:
+ fmt_cnt++;
+ }
+
+--- a/lib/vsprintf.c
++++ b/lib/vsprintf.c
+@@ -2168,6 +2168,10 @@ char *fwnode_string(char *buf, char *end
+ * f full name
+ * P node name, including a possible unit address
+ * - 'x' For printing the address. Equivalent to "%lx".
++ * - '[ku]s' For a BPF/tracing related format specifier, e.g. used out of
++ * bpf_trace_printk() where [ku] prefix specifies either kernel (k)
++ * or user (u) memory to probe, and:
++ * s a string, equivalent to "%s" on direct vsnprintf() use
+ *
+ * ** When making changes please also update:
+ * Documentation/core-api/printk-formats.rst
+@@ -2251,6 +2255,14 @@ char *pointer(const char *fmt, char *buf
+ if (!IS_ERR(ptr))
+ break;
+ return err_ptr(buf, end, ptr, spec);
++ case 'u':
++ case 'k':
++ switch (fmt[1]) {
++ case 's':
++ return string(buf, end, ptr, spec);
++ default:
++ return error_string(buf, end, "(einval)", spec);
++ }
+ }
+
+ /* default is to _not_ leak addresses, hash before printing */
--- /dev/null
+From e1f9e0d28ff025564dfdb1001a7839b4af5db2e2 Mon Sep 17 00:00:00 2001
+From: Tero Kristo <t-kristo@ti.com>
+Date: Fri, 24 Apr 2020 15:47:25 +0300
+Subject: clk: ti: clkctrl: Fix Bad of_node_put within clkctrl_get_name
+
+From: Tero Kristo <t-kristo@ti.com>
+
+commit e1f9e0d28ff025564dfdb1001a7839b4af5db2e2 upstream.
+
+clkctrl_get_name incorrectly calls of_node_put when it is not really
+doing of_node_get. This causes a boot time warning later on:
+
+[ 0.000000] OF: ERROR: Bad of_node_put() on /ocp/interconnect@4a000000/segmen
+t@0/target-module@5000/cm_core_aon@0/ipu-cm@500/ipu1-clkctrl@20
+
+Fix by dropping the of_node_put from the function.
+
+Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
+Fixes: 6c3090520554 ("clk: ti: clkctrl: Fix hidden dependency to node name")
+Signed-off-by: Tero Kristo <t-kristo@ti.com>
+Link: https://lkml.kernel.org/r/20200424124725.9895-1-t-kristo@ti.com
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/ti/clkctrl.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/clk/ti/clkctrl.c
++++ b/drivers/clk/ti/clkctrl.c
+@@ -461,7 +461,6 @@ static char * __init clkctrl_get_name(st
+ return name;
+ }
+ }
+- of_node_put(np);
+
+ return NULL;
+ }
--- /dev/null
+From 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <maz@kernel.org>
+Date: Tue, 5 May 2020 15:09:53 +0100
+Subject: clk: Unlink clock if failed to prepare or enable
+
+From: Marc Zyngier <maz@kernel.org>
+
+commit 018d4671b9bbd4a5c55cf6eab3e1dbc70a50b66e upstream.
+
+On failing to prepare or enable a clock, remove the core structure
+from the list it has been inserted as it is about to be freed.
+
+This otherwise leads to random crashes when subsequent clocks get
+registered, during which parsing of the clock tree becomes adventurous.
+
+Observed with QEMU's RPi-3 emulation.
+
+Fixes: 12ead77432f2 ("clk: Don't try to enable critical clocks if prepare failed")
+Signed-off-by: Marc Zyngier <maz@kernel.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Cc: Stephen Boyd <sboyd@kernel.org>
+Cc: Michael Turquette <mturquette@baylibre.com>
+Link: https://lkml.kernel.org/r/20200505140953.409430-1-maz@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/clk/clk.c
++++ b/drivers/clk/clk.c
+@@ -3512,6 +3512,9 @@ static int __clk_core_init(struct clk_co
+ out:
+ clk_pm_runtime_put(core);
+ unlock:
++ if (ret)
++ hlist_del_init(&core->child_node);
++
+ clk_prepare_unlock();
+
+ if (!ret)
--- /dev/null
+From d94a05f87327143f94f67dd256932163ac2bcd65 Mon Sep 17 00:00:00 2001
+From: Michael Walle <michael@walle.cc>
+Date: Fri, 6 Mar 2020 21:54:02 +0100
+Subject: dt-bindings: dma: fsl-edma: fix ls1028a-edma compatible
+
+From: Michael Walle <michael@walle.cc>
+
+commit d94a05f87327143f94f67dd256932163ac2bcd65 upstream.
+
+The bootloader will fix up the IOMMU entries only on nodes with the
+compatible "fsl,vf610-edma". Thus make this compatible string mandatory
+for the ls1028a-edma.
+
+While at it, fix the "fsl,fsl," typo.
+
+Signed-off-by: Michael Walle <michael@walle.cc>
+Fixes: d8c1bdb5288d ("dt-bindings: dma: fsl-edma: add new fsl,fsl,ls1028a-edma")
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/dma/fsl-edma.txt | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/dma/fsl-edma.txt
++++ b/Documentation/devicetree/bindings/dma/fsl-edma.txt
+@@ -10,7 +10,8 @@ Required properties:
+ - compatible :
+ - "fsl,vf610-edma" for eDMA used similar to that on Vybrid vf610 SoC
+ - "fsl,imx7ulp-edma" for eDMA2 used similar to that on i.mx7ulp
+- - "fsl,fsl,ls1028a-edma" for eDMA used similar to that on Vybrid vf610 SoC
++ - "fsl,ls1028a-edma" followed by "fsl,vf610-edma" for eDMA used on the
++ LS1028A SoC.
+ - reg : Specifies base physical address(s) and size of the eDMA registers.
+ The 1st region is eDMA control register's address and size.
+ The 2nd and the 3rd regions are programmable channel multiplexing
--- /dev/null
+From 55bf882c7f13dda8bbe624040c6d5b4fbb812d16 Mon Sep 17 00:00:00 2001
+From: Amir Goldstein <amir73il@gmail.com>
+Date: Thu, 19 Mar 2020 17:10:17 +0200
+Subject: fanotify: fix merging marks masks with FAN_ONDIR
+
+From: Amir Goldstein <amir73il@gmail.com>
+
+commit 55bf882c7f13dda8bbe624040c6d5b4fbb812d16 upstream.
+
+Change the logic of FAN_ONDIR in two ways that are similar to the logic
+of FAN_EVENT_ON_CHILD, that was fixed in commit 54a307ba8d3c ("fanotify:
+fix logic of events on child"):
+
+1. The flag is meaningless in ignore mask
+2. The flag refers only to events in the mask of the mark where it is set
+
+This is what the fanotify_mark.2 man page says about FAN_ONDIR:
+"Without this flag, only events for files are created." It doesn't
+say anything about setting this flag in ignore mask to stop getting
+events on directories nor can I think of any setup where this capability
+would be useful.
+
+Currently, when marks masks are merged, the FAN_ONDIR flag set in one
+mark affects the events that are set in another mark's mask and this
+behavior causes unexpected results. For example, a user adds a mark on a
+directory with mask FAN_ATTRIB | FAN_ONDIR and a mount mark with mask
+FAN_OPEN (without FAN_ONDIR). An opendir() of that directory (which is
+inside that mount) generates a FAN_OPEN event even though neither of the
+marks requested to get open events on directories.
+
+Link: https://lore.kernel.org/r/20200319151022.31456-10-amir73il@gmail.com
+Signed-off-by: Amir Goldstein <amir73il@gmail.com>
+Signed-off-by: Jan Kara <jack@suse.cz>
+Cc: Rachel Sibley <rasibley@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/notify/fanotify/fanotify.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/fs/notify/fanotify/fanotify.c
++++ b/fs/notify/fanotify/fanotify.c
+@@ -172,6 +172,13 @@ static u32 fanotify_group_event_mask(str
+ continue;
+ mark = iter_info->marks[type];
+ /*
++ * If the event is on dir and this mark doesn't care about
++ * events on dir, don't send it!
++ */
++ if (event_mask & FS_ISDIR && !(mark->mask & FS_ISDIR))
++ continue;
++
++ /*
+ * If the event is for a child and this mark doesn't care about
+ * events on a child, don't send it!
+ */
+@@ -203,10 +210,6 @@ static u32 fanotify_group_event_mask(str
+ user_mask &= ~FAN_ONDIR;
+ }
+
+- if (event_mask & FS_ISDIR &&
+- !(marks_mask & FS_ISDIR & ~marks_ignored_mask))
+- return 0;
+-
+ return test_mask & user_mask;
+ }
+
--- /dev/null
+From c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 Mon Sep 17 00:00:00 2001
+From: Jim Mattson <jmattson@google.com>
+Date: Mon, 11 May 2020 15:56:16 -0700
+Subject: KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
+
+From: Jim Mattson <jmattson@google.com>
+
+commit c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 upstream.
+
+Bank_num is a one-based count of banks, not a zero-based index. It
+overflows the allocated space only when strictly greater than
+KVM_MAX_MCE_BANKS.
+
+Fixes: a9e38c3e01ad ("KVM: x86: Catch potential overrun in MCE setup")
+Signed-off-by: Jue Wang <juew@google.com>
+Signed-off-by: Jim Mattson <jmattson@google.com>
+Reviewed-by: Peter Shier <pshier@google.com>
+Message-Id: <20200511225616.19557-1-jmattson@google.com>
+Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -3739,7 +3739,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(
+ unsigned bank_num = mcg_cap & 0xff, bank;
+
+ r = -EINVAL;
+- if (!bank_num || bank_num >= KVM_MAX_MCE_BANKS)
++ if (!bank_num || bank_num > KVM_MAX_MCE_BANKS)
+ goto out;
+ if (mcg_cap & ~(kvm_mce_cap_supported | 0xff | 0xff0000))
+ goto out;
--- /dev/null
+From b1112139a103b4b1101d0d2d72931f2d33d8c978 Mon Sep 17 00:00:00 2001
+From: Sergei Trofimovich <slyfox@gentoo.org>
+Date: Tue, 17 Mar 2020 00:07:18 +0000
+Subject: Makefile: disallow data races on gcc-10 as well
+
+From: Sergei Trofimovich <slyfox@gentoo.org>
+
+commit b1112139a103b4b1101d0d2d72931f2d33d8c978 upstream.
+
+gcc-10 will rename --param=allow-store-data-races=0
+to -fno-allow-store-data-races.
+
+The flag change happened at https://gcc.gnu.org/PR92046.
+
+Signed-off-by: Sergei Trofimovich <slyfox@gentoo.org>
+Acked-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
+Cc: Thomas Backlund <tmb@mageia.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Makefile
++++ b/Makefile
+@@ -710,6 +710,7 @@ endif
+
+ # Tell gcc to never replace conditional load with a non-conditional one
+ KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
++KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races)
+
+ include scripts/Makefile.kcov
+ include scripts/Makefile.gcc-plugins
--- /dev/null
+From fa4f3f56ccd28ac031ab275e673ed4098855fed4 Mon Sep 17 00:00:00 2001
+From: Nayna Jain <nayna@linux.ibm.com>
+Date: Fri, 1 May 2020 10:16:52 -0400
+Subject: powerpc/ima: Fix secure boot rules in ima arch policy
+
+From: Nayna Jain <nayna@linux.ibm.com>
+
+commit fa4f3f56ccd28ac031ab275e673ed4098855fed4 upstream.
+
+To prevent verifying the kernel module appended signature
+twice (finit_module), once by the module_sig_check() and again by IMA,
+powerpc secure boot rules define an IMA architecture specific policy
+rule only if CONFIG_MODULE_SIG_FORCE is not enabled. This,
+unfortunately, does not take into account the ability of enabling
+"sig_enforce" on the boot command line (module.sig_enforce=1).
+
+Including the IMA module appraise rule results in failing the
+finit_module syscall, unless the module signing public key is loaded
+onto the IMA keyring.
+
+This patch fixes secure boot policy rules to be based on
+CONFIG_MODULE_SIG instead.
+
+Fixes: 4238fad366a6 ("powerpc/ima: Add support to initialize ima policy rules")
+Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
+Link: https://lore.kernel.org/r/1588342612-14532-1-git-send-email-nayna@linux.ibm.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/ima_arch.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/powerpc/kernel/ima_arch.c
++++ b/arch/powerpc/kernel/ima_arch.c
+@@ -19,12 +19,12 @@ bool arch_ima_get_secureboot(void)
+ * to be stored as an xattr or as an appended signature.
+ *
+ * To avoid duplicate signature verification as much as possible, the IMA
+- * policy rule for module appraisal is added only if CONFIG_MODULE_SIG_FORCE
++ * policy rule for module appraisal is added only if CONFIG_MODULE_SIG
+ * is not enabled.
+ */
+ static const char *const secure_rules[] = {
+ "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+-#ifndef CONFIG_MODULE_SIG_FORCE
++#ifndef CONFIG_MODULE_SIG
+ "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+ #endif
+ NULL
+@@ -50,7 +50,7 @@ static const char *const secure_and_trus
+ "measure func=KEXEC_KERNEL_CHECK template=ima-modsig",
+ "measure func=MODULE_CHECK template=ima-modsig",
+ "appraise func=KEXEC_KERNEL_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+-#ifndef CONFIG_MODULE_SIG_FORCE
++#ifndef CONFIG_MODULE_SIG
+ "appraise func=MODULE_CHECK appraise_flag=check_blacklist appraise_type=imasig|modsig",
+ #endif
+ NULL
--- /dev/null
+From d02f6b7dab8228487268298ea1f21081c0b4b3eb Mon Sep 17 00:00:00 2001
+From: Nicholas Piggin <npiggin@gmail.com>
+Date: Tue, 7 Apr 2020 14:12:45 +1000
+Subject: powerpc/uaccess: Evaluate macro arguments once, before user access is allowed
+
+From: Nicholas Piggin <npiggin@gmail.com>
+
+commit d02f6b7dab8228487268298ea1f21081c0b4b3eb upstream.
+
+get/put_user() can be called with nontrivial arguments. fs/proc/page.c
+has a good example:
+
+ if (put_user(stable_page_flags(ppage), out)) {
+
+stable_page_flags() is quite a lot of code, including spin locks in
+the page allocator.
+
+Ensure these arguments are evaluated before user access is allowed.
+
+This improves security by reducing code with access to userspace, but
+it also fixes a PREEMPT bug with KUAP on powerpc/64s:
+stable_page_flags() is currently called with AMR set to allow writes,
+it ends up calling spin_unlock(), which can call preempt_schedule. But
+the task switch code can not be called with AMR set (it relies on
+interrupts saving the register), so this blows up.
+
+It's fine if the code inside allow_user_access() is preemptible,
+because a timer or IPI will save the AMR, but it's not okay to
+explicitly cause a reschedule.
+
+Fixes: de78a9c42a79 ("powerpc: Add a framework for Kernel Userspace Access Protection")
+Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Link: https://lore.kernel.org/r/20200407041245.600651-1-npiggin@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/include/asm/uaccess.h | 49 ++++++++++++++++++++++++++-----------
+ 1 file changed, 35 insertions(+), 14 deletions(-)
+
+--- a/arch/powerpc/include/asm/uaccess.h
++++ b/arch/powerpc/include/asm/uaccess.h
+@@ -166,13 +166,17 @@ do { \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ if (!is_kernel_addr((unsigned long)__pu_addr)) \
+ might_fault(); \
+- __chk_user_ptr(ptr); \
++ __chk_user_ptr(__pu_addr); \
+ if (do_allow) \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
+ else \
+- __put_user_size_allowed((x), __pu_addr, (size), __pu_err); \
++ __put_user_size_allowed(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -180,9 +184,13 @@ do { \
+ ({ \
+ long __pu_err = -EFAULT; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(__pu_addr, size)) \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ if (access_ok(__pu_addr, __pu_size)) \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -190,8 +198,12 @@ do { \
+ ({ \
+ long __pu_err; \
+ __typeof__(*(ptr)) __user *__pu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
+- __put_user_size((x), __pu_addr, (size), __pu_err); \
++ __typeof__(*(ptr)) __pu_val = (x); \
++ __typeof__(size) __pu_size = (size); \
++ \
++ __chk_user_ptr(__pu_addr); \
++ __put_user_size(__pu_val, __pu_addr, __pu_size, __pu_err); \
++ \
+ __pu_err; \
+ })
+
+@@ -283,15 +295,18 @@ do { \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ if (!is_kernel_addr((unsigned long)__gu_addr)) \
+ might_fault(); \
+ barrier_nospec(); \
+ if (do_allow) \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ else \
+- __get_user_size_allowed(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -300,12 +315,15 @@ do { \
+ long __gu_err = -EFAULT; \
+ __long_type(*(ptr)) __gu_val = 0; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
+ might_fault(); \
+- if (access_ok(__gu_addr, (size))) { \
++ if (access_ok(__gu_addr, __gu_size)) { \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ } \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
+@@ -314,10 +332,13 @@ do { \
+ long __gu_err; \
+ __long_type(*(ptr)) __gu_val; \
+ __typeof__(*(ptr)) __user *__gu_addr = (ptr); \
+- __chk_user_ptr(ptr); \
++ __typeof__(size) __gu_size = (size); \
++ \
++ __chk_user_ptr(__gu_addr); \
+ barrier_nospec(); \
+- __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
++ __get_user_size(__gu_val, __gu_addr, __gu_size, __gu_err); \
+ (x) = (__force __typeof__(*(ptr)))__gu_val; \
++ \
+ __gu_err; \
+ })
+
--- /dev/null
+From c485b19d52c4ba269dfd027945dee81755fdd530 Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Thu, 7 May 2020 09:33:47 +0300
+Subject: RDMA/uverbs: Do not discard the IB_EVENT_DEVICE_FATAL event
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit c485b19d52c4ba269dfd027945dee81755fdd530 upstream.
+
+The commit below moved all of the destruction to the disassociate step and
+cleaned up the event channel during destroy_uobj.
+
+However, when ib_uverbs_free_hw_resources() pushes IB_EVENT_DEVICE_FATAL
+and then immediately goes to destroy all uobjects this causes
+ib_uverbs_free_event_queue() to discard the queued event if userspace
+hasn't already read() it.
+
+Unlike all other event queues async FD needs to defer the
+ib_uverbs_free_event_queue() until FD release. This still unregisters the
+handler from the IB device during disassociation.
+
+Fixes: 3e032c0e92aa ("RDMA/core: Make ib_uverbs_async_event_file into a uobject")
+Link: https://lore.kernel.org/r/20200507063348.98713-2-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/rdma_core.c | 3 +-
+ drivers/infiniband/core/uverbs.h | 1
+ drivers/infiniband/core/uverbs_main.c | 2 -
+ drivers/infiniband/core/uverbs_std_types_async_fd.c | 26 +++++++++++++++++++-
+ 4 files changed, 29 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/core/rdma_core.c
++++ b/drivers/infiniband/core/rdma_core.c
+@@ -459,7 +459,8 @@ alloc_begin_fd_uobject(const struct uver
+ struct ib_uobject *uobj;
+ struct file *filp;
+
+- if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release))
++ if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release &&
++ fd_type->fops->release != &uverbs_async_event_release))
+ return ERR_PTR(-EINVAL);
+
+ new_fd = get_unused_fd_flags(O_CLOEXEC);
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -219,6 +219,7 @@ void ib_uverbs_init_event_queue(struct i
+ void ib_uverbs_init_async_event_file(struct ib_uverbs_async_event_file *ev_file);
+ void ib_uverbs_free_event_queue(struct ib_uverbs_event_queue *event_queue);
+ void ib_uverbs_flow_resources_free(struct ib_uflow_resources *uflow_res);
++int uverbs_async_event_release(struct inode *inode, struct file *filp);
+
+ int ib_alloc_ucontext(struct uverbs_attr_bundle *attrs);
+ int ib_init_ucontext(struct uverbs_attr_bundle *attrs);
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -346,7 +346,7 @@ const struct file_operations uverbs_asyn
+ .owner = THIS_MODULE,
+ .read = ib_uverbs_async_event_read,
+ .poll = ib_uverbs_async_event_poll,
+- .release = uverbs_uobject_fd_release,
++ .release = uverbs_async_event_release,
+ .fasync = ib_uverbs_async_event_fasync,
+ .llseek = no_llseek,
+ };
+--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c
++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c
+@@ -26,10 +26,34 @@ static int uverbs_async_event_destroy_uo
+ container_of(uobj, struct ib_uverbs_async_event_file, uobj);
+
+ ib_unregister_event_handler(&event_file->event_handler);
+- ib_uverbs_free_event_queue(&event_file->ev_queue);
+ return 0;
+ }
+
++int uverbs_async_event_release(struct inode *inode, struct file *filp)
++{
++ struct ib_uverbs_async_event_file *event_file;
++ struct ib_uobject *uobj = filp->private_data;
++ int ret;
++
++ if (!uobj)
++ return uverbs_uobject_fd_release(inode, filp);
++
++ event_file =
++ container_of(uobj, struct ib_uverbs_async_event_file, uobj);
++
++ /*
++ * The async event FD has to deliver IB_EVENT_DEVICE_FATAL even after
++ * disassociation, so cleaning the event list must only happen after
++ * release. The user knows it has reached the end of the event stream
++ * when it sees IB_EVENT_DEVICE_FATAL.
++ */
++ uverbs_uobject_get(uobj);
++ ret = uverbs_uobject_fd_release(inode, filp);
++ ib_uverbs_free_event_queue(&event_file->ev_queue);
++ uverbs_uobject_put(uobj);
++ return ret;
++}
++
+ DECLARE_UVERBS_NAMED_METHOD(
+ UVERBS_METHOD_ASYNC_EVENT_ALLOC,
+ UVERBS_ATTR_FD(UVERBS_ATTR_ASYNC_EVENT_ALLOC_FD_HANDLE,
--- /dev/null
+From ccfdbaa5cf4601b9b71601893029dcc9245c002b Mon Sep 17 00:00:00 2001
+From: Jason Gunthorpe <jgg@ziepe.ca>
+Date: Thu, 7 May 2020 09:33:48 +0300
+Subject: RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj
+
+From: Jason Gunthorpe <jgg@mellanox.com>
+
+commit ccfdbaa5cf4601b9b71601893029dcc9245c002b upstream.
+
+When multiple async FDs were allowed to exist the idea was for all
+broadcast events to be delivered to all async FDs, however
+IB_EVENT_DEVICE_FATAL was missed.
+
+Instead of having ib_uverbs_free_hw_resources() special case the global
+async_fd, have it cause the event during the uobject destruction. Every
+async fd is now a uobject so simply generate the IB_EVENT_DEVICE_FATAL
+while destroying the async fd uobject. This ensures every async FD gets a
+copy of the event.
+
+Fixes: d680e88e2013 ("RDMA/core: Add UVERBS_METHOD_ASYNC_EVENT_ALLOC")
+Link: https://lore.kernel.org/r/20200507063348.98713-3-leon@kernel.org
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/core/uverbs.h | 3 +++
+ drivers/infiniband/core/uverbs_main.c | 10 +++-------
+ drivers/infiniband/core/uverbs_std_types_async_fd.c | 4 ++++
+ 3 files changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -228,6 +228,9 @@ void ib_uverbs_release_ucq(struct ib_uve
+ struct ib_ucq_object *uobj);
+ void ib_uverbs_release_uevent(struct ib_uevent_object *uobj);
+ void ib_uverbs_release_file(struct kref *ref);
++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
++ __u64 element, __u64 event,
++ struct list_head *obj_list, u32 *counter);
+
+ void ib_uverbs_comp_handler(struct ib_cq *cq, void *cq_context);
+ void ib_uverbs_cq_event_handler(struct ib_event *event, void *context_ptr);
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -386,10 +386,9 @@ void ib_uverbs_comp_handler(struct ib_cq
+ kill_fasync(&ev_queue->async_queue, SIGIO, POLL_IN);
+ }
+
+-static void
+-ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
+- __u64 element, __u64 event, struct list_head *obj_list,
+- u32 *counter)
++void ib_uverbs_async_handler(struct ib_uverbs_async_event_file *async_file,
++ __u64 element, __u64 event,
++ struct list_head *obj_list, u32 *counter)
+ {
+ struct ib_uverbs_event *entry;
+ unsigned long flags;
+@@ -1187,9 +1186,6 @@ static void ib_uverbs_free_hw_resources(
+ */
+ mutex_unlock(&uverbs_dev->lists_mutex);
+
+- ib_uverbs_async_handler(READ_ONCE(file->async_file), 0,
+- IB_EVENT_DEVICE_FATAL, NULL, NULL);
+-
+ uverbs_destroy_ufile_hw(file, RDMA_REMOVE_DRIVER_REMOVE);
+ kref_put(&file->ref, ib_uverbs_release_file);
+
+--- a/drivers/infiniband/core/uverbs_std_types_async_fd.c
++++ b/drivers/infiniband/core/uverbs_std_types_async_fd.c
+@@ -26,6 +26,10 @@ static int uverbs_async_event_destroy_uo
+ container_of(uobj, struct ib_uverbs_async_event_file, uobj);
+
+ ib_unregister_event_handler(&event_file->event_handler);
++
++ if (why == RDMA_REMOVE_DRIVER_REMOVE)
++ ib_uverbs_async_handler(event_file, 0, IB_EVENT_DEVICE_FATAL,
++ NULL, NULL);
+ return 0;
+ }
+
--- /dev/null
+From f41224efcf8aafe80ea47ac870c5e32f3209ffc8 Mon Sep 17 00:00:00 2001
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Date: Sun, 3 May 2020 23:24:46 +0800
+Subject: Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
+
+From: Kai-Heng Feng <kai.heng.feng@canonical.com>
+
+commit f41224efcf8aafe80ea47ac870c5e32f3209ffc8 upstream.
+
+This reverts commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757.
+
+Enable power save node breaks some systems with ACL225. Revert the patch
+and use a platform specific quirk for the original issue isntead.
+
+Fixes: 3b36b13d5e69 ("ALSA: hda/realtek: Fix pop noise on ALC225")
+BugLink: https://bugs.launchpad.net/bugs/1875916
+Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
+Link: https://lore.kernel.org/r/20200503152449.22761-1-kai.heng.feng@canonical.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -8121,8 +8121,6 @@ static int patch_alc269(struct hda_codec
+ spec->gen.mixer_nid = 0;
+ break;
+ case 0x10ec0225:
+- codec->power_save_node = 1;
+- /* fall through */
+ case 0x10ec0295:
+ case 0x10ec0299:
+ spec->codec_variant = ALC269_TYPE_ALC225;
--- /dev/null
+From 48084c3595cb7429f6ba734cfea1313573b9a7fa Mon Sep 17 00:00:00 2001
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+Date: Thu, 7 May 2020 23:04:45 +0800
+Subject: riscv: perf: RISCV_BASE_PMU should be independent
+
+From: Kefeng Wang <wangkefeng.wang@huawei.com>
+
+commit 48084c3595cb7429f6ba734cfea1313573b9a7fa upstream.
+
+Selecting PERF_EVENTS without selecting RISCV_BASE_PMU results in a build
+error.
+
+Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
+[Palmer: commit text]
+Fixes: 178e9fc47aae("perf: riscv: preliminary RISC-V support")
+Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/riscv/include/asm/perf_event.h | 8 ++------
+ arch/riscv/kernel/Makefile | 2 +-
+ 2 files changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/riscv/include/asm/perf_event.h
++++ b/arch/riscv/include/asm/perf_event.h
+@@ -12,19 +12,14 @@
+ #include <linux/ptrace.h>
+ #include <linux/interrupt.h>
+
++#ifdef CONFIG_RISCV_BASE_PMU
+ #define RISCV_BASE_COUNTERS 2
+
+ /*
+ * The RISCV_MAX_COUNTERS parameter should be specified.
+ */
+
+-#ifdef CONFIG_RISCV_BASE_PMU
+ #define RISCV_MAX_COUNTERS 2
+-#endif
+-
+-#ifndef RISCV_MAX_COUNTERS
+-#error "Please provide a valid RISCV_MAX_COUNTERS for the PMU."
+-#endif
+
+ /*
+ * These are the indexes of bits in counteren register *minus* 1,
+@@ -82,6 +77,7 @@ struct riscv_pmu {
+ int irq;
+ };
+
++#endif
+ #ifdef CONFIG_PERF_EVENTS
+ #define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs
+ #endif
+--- a/arch/riscv/kernel/Makefile
++++ b/arch/riscv/kernel/Makefile
+@@ -38,7 +38,7 @@ obj-$(CONFIG_MODULE_SECTIONS) += module-
+ obj-$(CONFIG_FUNCTION_TRACER) += mcount.o ftrace.o
+ obj-$(CONFIG_DYNAMIC_FTRACE) += mcount-dyn.o
+
+-obj-$(CONFIG_PERF_EVENTS) += perf_event.o
++obj-$(CONFIG_RISCV_BASE_PMU) += perf_event.o
+ obj-$(CONFIG_PERF_EVENTS) += perf_callchain.o
+ obj-$(CONFIG_HAVE_PERF_REGS) += perf_regs.o
+ obj-$(CONFIG_RISCV_SBI) += sbi.o
--- /dev/null
+From 6d74f64b922b8394dccc52576659cb0dc0a1da7b Mon Sep 17 00:00:00 2001
+From: Yonghong Song <yhs@fb.com>
+Date: Wed, 13 May 2020 22:32:07 -0700
+Subject: selftests/bpf: Enforce returning 0 for fentry/fexit programs
+
+From: Yonghong Song <yhs@fb.com>
+
+commit 6d74f64b922b8394dccc52576659cb0dc0a1da7b upstream.
+
+There are a few fentry/fexit programs returning non-0.
+The tests with these programs will break with the previous
+patch which enfoced return-0 rules. Fix them properly.
+
+Fixes: ac065870d928 ("selftests/bpf: Add BPF_PROG, BPF_KPROBE, and BPF_KRETPROBE macros")
+Signed-off-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Acked-by: Andrii Nakryiko <andriin@fb.com>
+Link: https://lore.kernel.org/bpf/20200514053207.1298479-1-yhs@fb.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/testing/selftests/bpf/progs/test_overhead.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/tools/testing/selftests/bpf/progs/test_overhead.c
++++ b/tools/testing/selftests/bpf/progs/test_overhead.c
+@@ -33,13 +33,13 @@ int prog3(struct bpf_raw_tracepoint_args
+ SEC("fentry/__set_task_comm")
+ int BPF_PROG(prog4, struct task_struct *tsk, const char *buf, bool exec)
+ {
+- return !tsk;
++ return 0;
+ }
+
+ SEC("fexit/__set_task_comm")
+ int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec)
+ {
+- return !tsk;
++ return 0;
+ }
+
+ char _license[] SEC("license") = "GPL";
exec-move-would_dump-into-flush_old_exec.patch
clk-rockchip-fix-incorrect-configuration-of-rk3228-aclk_gpu-clocks.patch
dwc3-remove-check-for-hwo-flag-in-dwc3_gadget_ep_reclaim_trb_sg.patch
+fanotify-fix-merging-marks-masks-with-fan_ondir.patch
+arm64-dts-meson-g12b-ugoos-am6-fix-usb-vbus-supply.patch
+usb-gadget-tegra-xudc-fix-idle-suspend-resume.patch
+usb-gadget-net2272-fix-a-memory-leak-in-an-error-handling-path-in-net2272_plat_probe.patch
+usb-gadget-audio-fix-a-missing-error-return-value-in-audio_bind.patch
+usb-gadget-legacy-fix-error-return-code-in-gncm_bind.patch
+usb-gadget-legacy-fix-error-return-code-in-cdc_bind.patch
+revert-alsa-hda-realtek-fix-pop-noise-on-alc225.patch
+clk-ti-clkctrl-fix-bad-of_node_put-within-clkctrl_get_name.patch
+clk-unlink-clock-if-failed-to-prepare-or-enable.patch
+arm64-dts-meson-g12b-khadas-vim3-add-missing-frddr_a-status-property.patch
+arm64-dts-qcom-msm8996-reduce-vdd_apc-voltage.patch
+arm64-dts-meson-g12-common-fix-dwc2-clock-names.patch
+arm64-dts-rockchip-replace-rk805-pmic-node-name-with-pmic-on-rk3328-boards.patch
+arm64-dts-rockchip-rename-dwc3-device-nodes-on-rk3399-to-make-dtc-happy.patch
+arm64-dts-imx8mn-change-sdma1-ahb-clock-for-imx8mn.patch
+arm-dts-r8a73a4-add-missing-cmt1-interrupts.patch
+arm64-dts-renesas-r8a77980-fix-ipmmu-vip-nodes.patch
+arm-dts-r8a7740-add-missing-extal2-to-cpg-node.patch
+dt-bindings-dma-fsl-edma-fix-ls1028a-edma-compatible.patch
+sunrpc-revert-241b1f419f0e-sunrpc-remove-xdr_buf_trim.patch
+bpf-fix-sk_psock-refcnt-leak-when-receiving-message.patch
+powerpc-uaccess-evaluate-macro-arguments-once-before-user-access-is-allowed.patch
+powerpc-ima-fix-secure-boot-rules-in-ima-arch-policy.patch
+rdma-uverbs-do-not-discard-the-ib_event_device_fatal-event.patch
+rdma-uverbs-move-ib_event_device_fatal-to-destroy_uobj.patch
+riscv-perf-riscv_base_pmu-should-be-independent.patch
+kvm-x86-fix-off-by-one-error-in-kvm_vcpu_ioctl_x86_setup_mce.patch
+bpf-enforce-returning-0-for-fentry-fexit-progs.patch
+selftests-bpf-enforce-returning-0-for-fentry-fexit-programs.patch
+bpf-restrict-bpf_trace_printk-s-s-usage-and-add-pks-pus-specifier.patch
+makefile-disallow-data-races-on-gcc-10-as-well.patch
--- /dev/null
+From 0a8e7b7d08466b5fc52f8e96070acc116d82a8bb Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 15 Apr 2020 17:36:22 -0400
+Subject: SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()")
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 0a8e7b7d08466b5fc52f8e96070acc116d82a8bb upstream.
+
+I've noticed that when krb5i or krb5p security is in use,
+retransmitted requests are missing the server's duplicate reply
+cache. The computed checksum on the retransmitted request does not
+match the cached checksum, resulting in the server performing the
+retransmitted request again instead of returning the cached reply.
+
+The assumptions made when removing xdr_buf_trim() were not correct.
+In the send paths, the upper layer has already set the segment
+lengths correctly, and shorting the buffer's content is simply a
+matter of reducing buf->len.
+
+xdr_buf_trim() is the right answer in the receive/unwrap path on
+both the client and the server. The buffer segment lengths have to
+be shortened one-by-one.
+
+On the server side in particular, head.iov_len needs to be updated
+correctly to enable nfsd_cache_csum() to work correctly. The simple
+buf->len computation doesn't do that, and that results in
+checksumming stale data in the buffer.
+
+The problem isn't noticed until there's significant instability of
+the RPC transport. At that point, the reliability of retransmit
+detection on the server becomes crucial.
+
+Fixes: 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()")
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/linux/sunrpc/xdr.h | 1
+ net/sunrpc/auth_gss/gss_krb5_wrap.c | 7 ++----
+ net/sunrpc/auth_gss/svcauth_gss.c | 2 -
+ net/sunrpc/xdr.c | 41 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 46 insertions(+), 5 deletions(-)
+
+--- a/include/linux/sunrpc/xdr.h
++++ b/include/linux/sunrpc/xdr.h
+@@ -184,6 +184,7 @@ xdr_adjust_iovec(struct kvec *iov, __be3
+ extern void xdr_shift_buf(struct xdr_buf *, size_t);
+ extern void xdr_buf_from_iov(struct kvec *, struct xdr_buf *);
+ extern int xdr_buf_subsegment(struct xdr_buf *, struct xdr_buf *, unsigned int, unsigned int);
++extern void xdr_buf_trim(struct xdr_buf *, unsigned int);
+ extern int xdr_buf_read_mic(struct xdr_buf *, struct xdr_netobj *, unsigned int);
+ extern int read_bytes_from_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
+ extern int write_bytes_to_xdr_buf(struct xdr_buf *, unsigned int, void *, unsigned int);
+--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+@@ -580,15 +580,14 @@ gss_unwrap_kerberos_v2(struct krb5_ctx *
+ */
+ movelen = min_t(unsigned int, buf->head[0].iov_len, len);
+ movelen -= offset + GSS_KRB5_TOK_HDR_LEN + headskip;
+- if (offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
+- buf->head[0].iov_len)
+- return GSS_S_FAILURE;
++ BUG_ON(offset + GSS_KRB5_TOK_HDR_LEN + headskip + movelen >
++ buf->head[0].iov_len);
+ memmove(ptr, ptr + GSS_KRB5_TOK_HDR_LEN + headskip, movelen);
+ buf->head[0].iov_len -= GSS_KRB5_TOK_HDR_LEN + headskip;
+ buf->len = len - GSS_KRB5_TOK_HDR_LEN + headskip;
+
+ /* Trim off the trailing "extra count" and checksum blob */
+- buf->len -= ec + GSS_KRB5_TOK_HDR_LEN + tailskip;
++ xdr_buf_trim(buf, ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
+
+ *align = XDR_QUADLEN(GSS_KRB5_TOK_HDR_LEN + headskip);
+ *slack = *align + XDR_QUADLEN(ec + GSS_KRB5_TOK_HDR_LEN + tailskip);
+--- a/net/sunrpc/auth_gss/svcauth_gss.c
++++ b/net/sunrpc/auth_gss/svcauth_gss.c
+@@ -900,7 +900,7 @@ unwrap_integ_data(struct svc_rqst *rqstp
+ if (svc_getnl(&buf->head[0]) != seq)
+ goto out;
+ /* trim off the mic and padding at the end before returning */
+- buf->len -= 4 + round_up_to_quad(mic.len);
++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
+ stat = 0;
+ out:
+ kfree(mic.data);
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -1150,6 +1150,47 @@ xdr_buf_subsegment(struct xdr_buf *buf,
+ }
+ EXPORT_SYMBOL_GPL(xdr_buf_subsegment);
+
++/**
++ * xdr_buf_trim - lop at most "len" bytes off the end of "buf"
++ * @buf: buf to be trimmed
++ * @len: number of bytes to reduce "buf" by
++ *
++ * Trim an xdr_buf by the given number of bytes by fixing up the lengths. Note
++ * that it's possible that we'll trim less than that amount if the xdr_buf is
++ * too small, or if (for instance) it's all in the head and the parser has
++ * already read too far into it.
++ */
++void xdr_buf_trim(struct xdr_buf *buf, unsigned int len)
++{
++ size_t cur;
++ unsigned int trim = len;
++
++ if (buf->tail[0].iov_len) {
++ cur = min_t(size_t, buf->tail[0].iov_len, trim);
++ buf->tail[0].iov_len -= cur;
++ trim -= cur;
++ if (!trim)
++ goto fix_len;
++ }
++
++ if (buf->page_len) {
++ cur = min_t(unsigned int, buf->page_len, trim);
++ buf->page_len -= cur;
++ trim -= cur;
++ if (!trim)
++ goto fix_len;
++ }
++
++ if (buf->head[0].iov_len) {
++ cur = min_t(size_t, buf->head[0].iov_len, trim);
++ buf->head[0].iov_len -= cur;
++ trim -= cur;
++ }
++fix_len:
++ buf->len -= (len - trim);
++}
++EXPORT_SYMBOL_GPL(xdr_buf_trim);
++
+ static void __read_bytes_from_xdr_buf(struct xdr_buf *subbuf, void *obj, unsigned int len)
+ {
+ unsigned int this_len;
--- /dev/null
+From 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Sun, 3 May 2020 12:47:07 +0200
+Subject: usb: gadget: audio: Fix a missing error return value in audio_bind()
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf upstream.
+
+If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0.
+
+Fixes: 56023ce0fd70 ("usb: gadget: audio: allocate and init otg descriptor by otg capabilities")
+Reviewed-by: Peter Chen <peter.chen@nxp.com>
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/audio.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/legacy/audio.c
++++ b/drivers/usb/gadget/legacy/audio.c
+@@ -300,8 +300,10 @@ static int audio_bind(struct usb_composi
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(cdev->gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(cdev->gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
--- /dev/null
+From e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 7 May 2020 05:13:32 +0000
+Subject: usb: gadget: legacy: fix error return code in cdc_bind()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b upstream.
+
+If 'usb_otg_descriptor_alloc()' fails, we must return a
+negative error code -ENOMEM, not 0.
+
+Fixes: ab6796ae9833 ("usb: gadget: cdc2: allocate and init otg descriptor by otg capabilities")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/cdc2.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/legacy/cdc2.c
++++ b/drivers/usb/gadget/legacy/cdc2.c
+@@ -179,8 +179,10 @@ static int cdc_bind(struct usb_composite
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail1;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
--- /dev/null
+From e27d4b30b71c66986196d8a1eb93cba9f602904a Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Thu, 7 May 2020 05:13:23 +0000
+Subject: usb: gadget: legacy: fix error return code in gncm_bind()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit e27d4b30b71c66986196d8a1eb93cba9f602904a upstream.
+
+If 'usb_otg_descriptor_alloc()' fails, we must return a
+negative error code -ENOMEM, not 0.
+
+Fixes: 1156e91dd7cc ("usb: gadget: ncm: allocate and init otg descriptor by otg capabilities")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/legacy/ncm.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/gadget/legacy/ncm.c
++++ b/drivers/usb/gadget/legacy/ncm.c
+@@ -156,8 +156,10 @@ static int gncm_bind(struct usb_composit
+ struct usb_descriptor_header *usb_desc;
+
+ usb_desc = usb_otg_descriptor_alloc(gadget);
+- if (!usb_desc)
++ if (!usb_desc) {
++ status = -ENOMEM;
+ goto fail;
++ }
+ usb_otg_descriptor_init(gadget, usb_desc);
+ otg_desc[0] = usb_desc;
+ otg_desc[1] = NULL;
--- /dev/null
+From ccaef7e6e354fb65758eaddd3eae8065a8b3e295 Mon Sep 17 00:00:00 2001
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Date: Mon, 27 Apr 2020 20:04:23 +0200
+Subject: usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+commit ccaef7e6e354fb65758eaddd3eae8065a8b3e295 upstream.
+
+'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error
+handling path, as already done in the remove function (i.e.
+'net2272_plat_remove()')
+
+Fixes: 90fccb529d24 ("usb: gadget: Gadget directory cleanup - group UDC drivers")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/net2272.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/udc/net2272.c
++++ b/drivers/usb/gadget/udc/net2272.c
+@@ -2647,6 +2647,8 @@ net2272_plat_probe(struct platform_devic
+ err_req:
+ release_mem_region(base, len);
+ err:
++ kfree(dev);
++
+ return ret;
+ }
+
--- /dev/null
+From 0534d40160cb9505073b0ecf5e7210daee319a66 Mon Sep 17 00:00:00 2001
+From: Thierry Reding <treding@nvidia.com>
+Date: Fri, 17 Apr 2020 19:05:37 +0200
+Subject: usb: gadget: tegra-xudc: Fix idle suspend/resume
+
+From: Thierry Reding <treding@nvidia.com>
+
+commit 0534d40160cb9505073b0ecf5e7210daee319a66 upstream.
+
+When the XUDC device is idle (i.e. powergated), care must be taken not
+to access any registers because that would lead to a crash.
+
+Move the call to tegra_xudc_device_mode_off() into the same conditional
+as the tegra_xudc_powergate() call to make sure we only force device
+mode off if the XUDC is actually powered up.
+
+Fixes: 49db427232fe ("usb: gadget: Add UDC driver for tegra XUSB device mode controller")
+Acked-by: Jon Hunter <jonathanh@nvidia.com>
+Tested-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Felipe Balbi <balbi@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/udc/tegra-xudc.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/tegra-xudc.c
++++ b/drivers/usb/gadget/udc/tegra-xudc.c
+@@ -3740,11 +3740,11 @@ static int __maybe_unused tegra_xudc_sus
+
+ flush_work(&xudc->usb_role_sw_work);
+
+- /* Forcibly disconnect before powergating. */
+- tegra_xudc_device_mode_off(xudc);
+-
+- if (!pm_runtime_status_suspended(dev))
++ if (!pm_runtime_status_suspended(dev)) {
++ /* Forcibly disconnect before powergating. */
++ tegra_xudc_device_mode_off(xudc);
+ tegra_xudc_powergate(xudc);
++ }
+
+ pm_runtime_disable(dev);
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
