From: Greg Kroah-Hartman Date: Fri, 13 Aug 2021 09:04:17 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.4.281~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=336f6a2e112d72711797e162629c5505f4b93bce;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: alsa-hda-add-quirk-for-asus-flow-x13.patch alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch arm64-dts-renesas-beacon-fix-usb-extal-reference.patch arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch bpf-add-lockdown-check-for-probe_write_user-helper.patch mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch --- diff --git a/queue-5.10/alsa-hda-add-quirk-for-asus-flow-x13.patch b/queue-5.10/alsa-hda-add-quirk-for-asus-flow-x13.patch new file mode 100644 index 00000000000..677e40fa4fc --- /dev/null +++ b/queue-5.10/alsa-hda-add-quirk-for-asus-flow-x13.patch @@ -0,0 +1,31 @@ +From 739d0959fbed23838a96c48fbce01dd2f6fb2c5f Mon Sep 17 00:00:00 2001 +From: Luke D Jones +Date: Sat, 7 Aug 2021 14:58:05 +1200 +Subject: ALSA: hda: Add quirk for ASUS Flow x13 + +From: Luke D Jones + +commit 739d0959fbed23838a96c48fbce01dd2f6fb2c5f upstream. + +The ASUS GV301QH sound appears to work well with the quirk for +ALC294_FIXUP_ASUS_DUAL_SPK. + +Signed-off-by: Luke D Jones +Cc: +Link: https://lore.kernel.org/r/20210807025805.27321-1-luke@ljones.dev +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8390,6 +8390,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x1043, 0x1740, "ASUS UX430UA", ALC295_FIXUP_ASUS_DACS), + SND_PCI_QUIRK(0x1043, 0x17d1, "ASUS UX431FL", ALC294_FIXUP_ASUS_DUAL_SPK), ++ SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK), + SND_PCI_QUIRK(0x1043, 0x1881, "ASUS Zephyrus S/M", ALC294_FIXUP_ASUS_GX502_PINS), + SND_PCI_QUIRK(0x1043, 0x18b1, "Asus MJ401TA", ALC256_FIXUP_ASUS_HEADSET_MIC), + SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC), diff --git a/queue-5.10/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch b/queue-5.10/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch new file mode 100644 index 00000000000..fa48bf495a4 --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch @@ -0,0 +1,32 @@ +From d07149aba2ef423eae94a9cc2a6365d0cdf6fd51 Mon Sep 17 00:00:00 2001 +From: Jeremy Szu +Date: Tue, 10 Aug 2021 18:08:45 +0800 +Subject: ALSA: hda/realtek: fix mute/micmute LEDs for HP ProBook 650 G8 Notebook PC + +From: Jeremy Szu + +commit d07149aba2ef423eae94a9cc2a6365d0cdf6fd51 upstream. + +The HP ProBook 650 G8 Notebook PC is using ALC236 codec which is +using 0x02 to control mute LED and 0x01 to control micmute LED. +Therefore, add a quirk to make it works. + +Signed-off-by: Jeremy Szu +Cc: +Link: https://lore.kernel.org/r/20210810100846.65844-1-jeremy.szu@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8357,6 +8357,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP), ++ SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8846, "HP EliteBook 850 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x8847, "HP EliteBook x360 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED), diff --git a/queue-5.10/alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch b/queue-5.10/alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch new file mode 100644 index 00000000000..4c60855768d --- /dev/null +++ b/queue-5.10/alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch @@ -0,0 +1,42 @@ +From dc0dc8a73e8e4dc33fba93dfe23356cc5a500c57 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 8 Aug 2021 09:01:16 +0200 +Subject: ALSA: pcm: Fix mmap breakage without explicit buffer setup + +From: Takashi Iwai + +commit dc0dc8a73e8e4dc33fba93dfe23356cc5a500c57 upstream. + +The recent fix c4824ae7db41 ("ALSA: pcm: Fix mmap capability check") +restricts the mmap capability only to the drivers that properly set up +the buffers, but it caused a regression for a few drivers that manage +the buffer on its own way. + +For those with UNKNOWN buffer type (i.e. the uninitialized / unused +substream->dma_buffer), just assume that the driver handles the mmap +properly and blindly trust the hardware info bit. + +Fixes: c4824ae7db41 ("ALSA: pcm: Fix mmap capability check") +Reported-and-tested-by: Jeff Woods +Cc: +Link: https://lore.kernel.org/r/s5him0gpghv.wl-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/core/pcm_native.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -251,7 +251,10 @@ static bool hw_support_mmap(struct snd_p + + switch (substream->dma_buffer.dev.type) { + case SNDRV_DMA_TYPE_UNKNOWN: +- return false; ++ /* we can't know the device, so just assume that the driver does ++ * everything right ++ */ ++ return true; + case SNDRV_DMA_TYPE_CONTINUOUS: + case SNDRV_DMA_TYPE_VMALLOC: + return true; diff --git a/queue-5.10/arm64-dts-renesas-beacon-fix-usb-extal-reference.patch b/queue-5.10/arm64-dts-renesas-beacon-fix-usb-extal-reference.patch new file mode 100644 index 00000000000..e3cac8eabb5 --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-beacon-fix-usb-extal-reference.patch @@ -0,0 +1,39 @@ +From foo@baz Fri Aug 13 10:46:26 AM CEST 2021 +From: Adam Ford +Date: Thu, 13 May 2021 06:46:15 -0500 +Subject: arm64: dts: renesas: beacon: Fix USB extal reference + +From: Adam Ford + +commit 56bc54496f5d6bc638127bfc9df3742cbf0039e7 upstream + +The USB extal clock reference isn't associated to a crystal, it's +associated to a programmable clock, so remove the extal reference, +add the usb2_clksel. Since usb_extal is referenced by the versaclock, +reference it here so the usb2_clksel can get the proper clock speed +of 50MHz. + +Signed-off-by: Adam Ford +Link: https://lore.kernel.org/r/20210513114617.30191-1-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi ++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-som.dtsi +@@ -295,8 +295,10 @@ + status = "okay"; + }; + +-&usb_extal_clk { +- clock-frequency = <50000000>; ++&usb2_clksel { ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, ++ <&versaclock5 3>, <&usb3s0_clk>; ++ status = "okay"; + }; + + &usb3s0_clk { diff --git a/queue-5.10/arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch b/queue-5.10/arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch new file mode 100644 index 00000000000..5c2d9b1672e --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch @@ -0,0 +1,46 @@ +From foo@baz Fri Aug 13 10:46:26 AM CEST 2021 +From: Adam Ford +Date: Thu, 13 May 2021 06:46:16 -0500 +Subject: arm64: dts: renesas: beacon: Fix USB ref clock references + +From: Adam Ford + +commit ebc666f39ff67a01e748c34d670ddf05a9e45220 upstream + +The RZ/G2 boards expect there to be an external clock reference for +USB2 EHCI controllers. For the Beacon boards, this reference clock +is controlled by a programmable versaclock. Because the RZ/G2 +family has a special clock driver when using an external clock, +the third clock reference in the EHCI node needs to point to this +special clock, called usb2_clksel. + +Since the usb2_clksel does not keep the usb_extal clock enabled, +the 4th clock entry for the EHCI nodes needs to reference it to +keep the clock running and make USB functional. + +Signed-off-by: Adam Ford +Link: https://lore.kernel.org/r/20210513114617.30191-2-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi ++++ b/arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +@@ -271,12 +271,12 @@ + &ehci0 { + dr_mode = "otg"; + status = "okay"; +- clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>; ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, <&usb2_clksel>, <&versaclock5 3>; + }; + + &ehci1 { + status = "okay"; +- clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>; ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, <&usb2_clksel>, <&versaclock5 3>; + }; + + &hdmi0 { diff --git a/queue-5.10/arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch b/queue-5.10/arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch new file mode 100644 index 00000000000..1a09967b2d1 --- /dev/null +++ b/queue-5.10/arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch @@ -0,0 +1,100 @@ +From foo@baz Fri Aug 13 10:46:26 AM CEST 2021 +From: Adam Ford +Date: Mon, 28 Dec 2020 14:22:21 -0600 +Subject: arm64: dts: renesas: rzg2: Add usb2_clksel to RZ/G2 M/N/H + +From: Adam Ford + +commit e1076ce07b7736aed269c5d8154f2442970d9137 upstream + +Per the reference manual for the RZ/G Series, 2nd Generation, +the RZ/G2M, RZ/G2N, and RZ/G2H have a bit that can be set to +choose between a crystal oscillator and an external oscillator. + +Because only boards that need this should enable it, it's marked +as disabled by default for backwards compatibility with existing +boards. + +Signed-off-by: Adam Ford +Link: https://lore.kernel.org/r/20201228202221.2327468-2-aford173@gmail.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/r8a774a1.dtsi | 15 +++++++++++++++ + arch/arm64/boot/dts/renesas/r8a774b1.dtsi | 15 +++++++++++++++ + arch/arm64/boot/dts/renesas/r8a774e1.dtsi | 15 +++++++++++++++ + 3 files changed, 45 insertions(+) + +--- a/arch/arm64/boot/dts/renesas/r8a774a1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774a1.dtsi +@@ -836,6 +836,21 @@ + status = "disabled"; + }; + ++ usb2_clksel: clock-controller@e6590630 { ++ compatible = "renesas,r8a774a1-rcar-usb2-clock-sel", ++ "renesas,rcar-gen3-usb2-clock-sel"; ++ reg = <0 0xe6590630 0 0x02>; ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, ++ <&usb_extal_clk>, <&usb3s0_clk>; ++ clock-names = "ehci_ohci", "hs-usb-if", ++ "usb_extal", "usb_xtal"; ++ #clock-cells = <0>; ++ power-domains = <&sysc R8A774A1_PD_ALWAYS_ON>; ++ resets = <&cpg 703>, <&cpg 704>; ++ reset-names = "ehci_ohci", "hs-usb-if"; ++ status = "disabled"; ++ }; ++ + usb_dmac0: dma-controller@e65a0000 { + compatible = "renesas,r8a774a1-usb-dmac", + "renesas,usb-dmac"; +--- a/arch/arm64/boot/dts/renesas/r8a774b1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774b1.dtsi +@@ -709,6 +709,21 @@ + status = "disabled"; + }; + ++ usb2_clksel: clock-controller@e6590630 { ++ compatible = "renesas,r8a774b1-rcar-usb2-clock-sel", ++ "renesas,rcar-gen3-usb2-clock-sel"; ++ reg = <0 0xe6590630 0 0x02>; ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, ++ <&usb_extal_clk>, <&usb3s0_clk>; ++ clock-names = "ehci_ohci", "hs-usb-if", ++ "usb_extal", "usb_xtal"; ++ #clock-cells = <0>; ++ power-domains = <&sysc R8A774B1_PD_ALWAYS_ON>; ++ resets = <&cpg 703>, <&cpg 704>; ++ reset-names = "ehci_ohci", "hs-usb-if"; ++ status = "disabled"; ++ }; ++ + usb_dmac0: dma-controller@e65a0000 { + compatible = "renesas,r8a774b1-usb-dmac", + "renesas,usb-dmac"; +--- a/arch/arm64/boot/dts/renesas/r8a774e1.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774e1.dtsi +@@ -890,6 +890,21 @@ + status = "disabled"; + }; + ++ usb2_clksel: clock-controller@e6590630 { ++ compatible = "renesas,r8a774e1-rcar-usb2-clock-sel", ++ "renesas,rcar-gen3-usb2-clock-sel"; ++ reg = <0 0xe6590630 0 0x02>; ++ clocks = <&cpg CPG_MOD 703>, <&cpg CPG_MOD 704>, ++ <&usb_extal_clk>, <&usb3s0_clk>; ++ clock-names = "ehci_ohci", "hs-usb-if", ++ "usb_extal", "usb_xtal"; ++ #clock-cells = <0>; ++ power-domains = <&sysc R8A774E1_PD_ALWAYS_ON>; ++ resets = <&cpg 703>, <&cpg 704>; ++ reset-names = "ehci_ohci", "hs-usb-if"; ++ status = "disabled"; ++ }; ++ + usb_dmac0: dma-controller@e65a0000 { + compatible = "renesas,r8a774e1-usb-dmac", + "renesas,usb-dmac"; diff --git a/queue-5.10/bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch b/queue-5.10/bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch new file mode 100644 index 00000000000..05ebbac96aa --- /dev/null +++ b/queue-5.10/bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch @@ -0,0 +1,87 @@ +From 71330842ff93ae67a066c1fa68d75672527312fa Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Mon, 9 Aug 2021 21:45:32 +0200 +Subject: bpf: Add _kernel suffix to internal lockdown_bpf_read + +From: Daniel Borkmann + +commit 71330842ff93ae67a066c1fa68d75672527312fa upstream. + +Rename LOCKDOWN_BPF_READ into LOCKDOWN_BPF_READ_KERNEL so we have naming +more consistent with a LOCKDOWN_BPF_WRITE_USER option that we are adding. + +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/security.h | 2 +- + kernel/bpf/helpers.c | 4 ++-- + kernel/trace/bpf_trace.c | 8 ++++---- + security/security.c | 2 +- + 4 files changed, 8 insertions(+), 8 deletions(-) + +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -123,7 +123,7 @@ enum lockdown_reason { + LOCKDOWN_INTEGRITY_MAX, + LOCKDOWN_KCORE, + LOCKDOWN_KPROBES, +- LOCKDOWN_BPF_READ, ++ LOCKDOWN_BPF_READ_KERNEL, + LOCKDOWN_PERF, + LOCKDOWN_TRACEFS, + LOCKDOWN_XMON_RW, +--- a/kernel/bpf/helpers.c ++++ b/kernel/bpf/helpers.c +@@ -729,12 +729,12 @@ bpf_base_func_proto(enum bpf_func_id fun + case BPF_FUNC_probe_read_user: + return &bpf_probe_read_user_proto; + case BPF_FUNC_probe_read_kernel: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_kernel_proto; + case BPF_FUNC_probe_read_user_str: + return &bpf_probe_read_user_str_proto; + case BPF_FUNC_probe_read_kernel_str: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_kernel_str_proto; + case BPF_FUNC_snprintf_btf: + return &bpf_snprintf_btf_proto; +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1281,19 +1281,19 @@ bpf_tracing_func_proto(enum bpf_func_id + case BPF_FUNC_probe_read_user: + return &bpf_probe_read_user_proto; + case BPF_FUNC_probe_read_kernel: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_kernel_proto; + case BPF_FUNC_probe_read_user_str: + return &bpf_probe_read_user_str_proto; + case BPF_FUNC_probe_read_kernel_str: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_kernel_str_proto; + #ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE + case BPF_FUNC_probe_read: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_compat_proto; + case BPF_FUNC_probe_read_str: +- return security_locked_down(LOCKDOWN_BPF_READ) < 0 ? ++ return security_locked_down(LOCKDOWN_BPF_READ_KERNEL) < 0 ? + NULL : &bpf_probe_read_compat_str_proto; + #endif + #ifdef CONFIG_CGROUPS +--- a/security/security.c ++++ b/security/security.c +@@ -61,7 +61,7 @@ const char *const lockdown_reasons[LOCKD + [LOCKDOWN_INTEGRITY_MAX] = "integrity", + [LOCKDOWN_KCORE] = "/proc/kcore access", + [LOCKDOWN_KPROBES] = "use of kprobes", +- [LOCKDOWN_BPF_READ] = "use of bpf to read kernel RAM", ++ [LOCKDOWN_BPF_READ_KERNEL] = "use of bpf to read kernel RAM", + [LOCKDOWN_PERF] = "unsafe use of perf", + [LOCKDOWN_TRACEFS] = "use of tracefs", + [LOCKDOWN_XMON_RW] = "xmon read and write access", diff --git a/queue-5.10/bpf-add-lockdown-check-for-probe_write_user-helper.patch b/queue-5.10/bpf-add-lockdown-check-for-probe_write_user-helper.patch new file mode 100644 index 00000000000..3292d051e3a --- /dev/null +++ b/queue-5.10/bpf-add-lockdown-check-for-probe_write_user-helper.patch @@ -0,0 +1,82 @@ +From 51e1bb9eeaf7868db56e58f47848e364ab4c4129 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Mon, 9 Aug 2021 12:43:17 +0200 +Subject: bpf: Add lockdown check for probe_write_user helper + +From: Daniel Borkmann + +commit 51e1bb9eeaf7868db56e58f47848e364ab4c4129 upstream. + +Back then, commit 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper +to be called in tracers") added the bpf_probe_write_user() helper in order +to allow to override user space memory. Its original goal was to have a +facility to "debug, divert, and manipulate execution of semi-cooperative +processes" under CAP_SYS_ADMIN. Write to kernel was explicitly disallowed +since it would otherwise tamper with its integrity. + +One use case was shown in cf9b1199de27 ("samples/bpf: Add test/example of +using bpf_probe_write_user bpf helper") where the program DNATs traffic +at the time of connect(2) syscall, meaning, it rewrites the arguments to +a syscall while they're still in userspace, and before the syscall has a +chance to copy the argument into kernel space. These days we have better +mechanisms in BPF for achieving the same (e.g. for load-balancers), but +without having to write to userspace memory. + +Of course the bpf_probe_write_user() helper can also be used to abuse +many other things for both good or bad purpose. Outside of BPF, there is +a similar mechanism for ptrace(2) such as PTRACE_PEEK{TEXT,DATA} and +PTRACE_POKE{TEXT,DATA}, but would likely require some more effort. +Commit 96ae52279594 explicitly dedicated the helper for experimentation +purpose only. Thus, move the helper's availability behind a newly added +LOCKDOWN_BPF_WRITE_USER lockdown knob so that the helper is disabled under +the "integrity" mode. More fine-grained control can be implemented also +from LSM side with this change. + +Fixes: 96ae52279594 ("bpf: Add bpf_probe_write_user BPF helper to be called in tracers") +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/security.h | 1 + + kernel/trace/bpf_trace.c | 5 +++-- + security/security.c | 1 + + 3 files changed, 5 insertions(+), 2 deletions(-) + +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -120,6 +120,7 @@ enum lockdown_reason { + LOCKDOWN_MMIOTRACE, + LOCKDOWN_DEBUGFS, + LOCKDOWN_XMON_WR, ++ LOCKDOWN_BPF_WRITE_USER, + LOCKDOWN_INTEGRITY_MAX, + LOCKDOWN_KCORE, + LOCKDOWN_KPROBES, +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1272,12 +1272,13 @@ bpf_tracing_func_proto(enum bpf_func_id + return &bpf_get_numa_node_id_proto; + case BPF_FUNC_perf_event_read: + return &bpf_perf_event_read_proto; +- case BPF_FUNC_probe_write_user: +- return bpf_get_probe_write_proto(); + case BPF_FUNC_current_task_under_cgroup: + return &bpf_current_task_under_cgroup_proto; + case BPF_FUNC_get_prandom_u32: + return &bpf_get_prandom_u32_proto; ++ case BPF_FUNC_probe_write_user: ++ return security_locked_down(LOCKDOWN_BPF_WRITE_USER) < 0 ? ++ NULL : bpf_get_probe_write_proto(); + case BPF_FUNC_probe_read_user: + return &bpf_probe_read_user_proto; + case BPF_FUNC_probe_read_kernel: +--- a/security/security.c ++++ b/security/security.c +@@ -58,6 +58,7 @@ const char *const lockdown_reasons[LOCKD + [LOCKDOWN_MMIOTRACE] = "unsafe mmio", + [LOCKDOWN_DEBUGFS] = "debugfs access", + [LOCKDOWN_XMON_WR] = "xmon write access", ++ [LOCKDOWN_BPF_WRITE_USER] = "use of bpf to write user RAM", + [LOCKDOWN_INTEGRITY_MAX] = "integrity", + [LOCKDOWN_KCORE] = "/proc/kcore access", + [LOCKDOWN_KPROBES] = "use of kprobes", diff --git a/queue-5.10/mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch b/queue-5.10/mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch new file mode 100644 index 00000000000..6391e3b5b26 --- /dev/null +++ b/queue-5.10/mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch @@ -0,0 +1,99 @@ +From rppt@kernel.org Fri Aug 13 10:41:57 2021 +From: Mike Rapoport +Date: Wed, 11 Aug 2021 16:41:39 +0300 +Subject: mm: make zone_to_nid() and zone_set_nid() available for DISCONTIGMEM +To: stable@vger.kernel.org +Cc: Geert Uytterhoeven , Finn Thain , Mikael Pettersson , Mike Rapoport , Mike Rapoport , linux-kernel@vger.kernel.org, linux-m68k@lists.linux-m68k.org +Message-ID: <20210811134139.5451-1-rppt@kernel.org> + +From: Mike Rapoport + +Since the commit ce6ee46e0f39 ("mm/page_alloc: fix memory map +initialization for descending nodes") initialization of the memory map +relies on availability of zone_to_nid() and zone_set_nid methods to link +struct page to a node. + +But in 5.10 zone_to_nid() is only defined for NUMA, but not for +DISCONTIGMEM which causes crashes on m68k systems with two memory banks. + +For instance on ARAnyM with both ST-RAM and FastRAM atari_defconfig build +produces the following crash: + +Unable to handle kernel access at virtual address (ptrval) +Oops: 00000000 +Modules linked in: +PC: [<0005fbbc>] bpf_prog_alloc_no_stats+0x5c/0xba +SR: 2200 SP: (ptrval) a2: 016daa90 +d0: 0000000c d1: 00000200 d2: 00000001 d3: 00000cc0 +d4: 016d1f80 d5: 00034da6 a0: 305c2800 a1: 305c2a00 +Process swapper (pid: 1, task=(ptrval)) +Frame format=7 eff addr=31800000 ssw=0445 faddr=31800000 +wb 1 stat/addr/data: 0000 00000000 00000000 +wb 2 stat/addr/data: 0000 00000000 00000000 +wb 3 stat/addr/data: 00c5 31800000 00000001 +push data: 00000000 00000000 00000000 00000000 +Stack from 3058fec8: + 00000dc0 00000000 004addc2 3058ff16 0005fc34 00000238 00000000 00000210 + 004addc2 3058ff16 00281ae0 00000238 00000000 00000000 004addc2 004bc7ec + 004aea9e 0048b0c0 3058ff16 00460042 004ba4d2 3058ff8c 004ade6a 0000007e + 0000210e 0000007e 00000002 016d1f80 00034da6 000020b4 00000000 004b4764 + 004bc7ec 00000000 004b4760 004bc7c0 004b4744 001e4cb2 00010001 016d1fe5 + 016d1ff0 004994d2 003e1589 016d1f80 00412b8c 0000007e 00000001 00000001 +Call Trace: [<004addc2>] sock_init+0x0/0xaa + [<0005fc34>] bpf_prog_alloc+0x1a/0x66 + [<004addc2>] sock_init+0x0/0xaa + [<00281ae0>] bpf_prog_create+0x2e/0x7c + [<004addc2>] sock_init+0x0/0xaa + [<004aea9e>] ptp_classifier_init+0x22/0x44 + [<004ade6a>] sock_init+0xa8/0xaa + [<0000210e>] do_one_initcall+0x5a/0x150 + [<00034da6>] parse_args+0x0/0x208 + [<000020b4>] do_one_initcall+0x0/0x150 + [<001e4cb2>] strcpy+0x0/0x1c + [<00010001>] stwotoxd+0x5/0x1c + [<004994d2>] kernel_init_freeable+0x154/0x1a6 + [<001e4cb2>] strcpy+0x0/0x1c + [<0049951a>] kernel_init_freeable+0x19c/0x1a6 + [<004addc2>] sock_init+0x0/0xaa + [<00321510>] kernel_init+0x0/0xd8 + [<00321518>] kernel_init+0x8/0xd8 + [<00321510>] kernel_init+0x0/0xd8 + [<00002890>] ret_from_kernel_thread+0xc/0x14 + +Code: 204b 200b 4cdf 180c 4e75 700c e0aa 3682 <2748> 001c 214b 0140 022b +ffbf 0002 206b 001c 2008 0680 0000 0108 2140 0108 2140 +Disabling lock debugging due to kernel taint +Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b + +Using CONFIG_NEED_MULTIPLE_NODES rather than CONFIG_NUMA to guard +definitions of zone_to_nid() and zone_set_nid() fixes the issue. + +Reported-by: Mikael Pettersson +Fixes: ce6ee46e0f39 ("mm/page_alloc: fix memory map initialization for descending nodes") +Signed-off-by: Mike Rapoport +Tested-by: Mikael Pettersson +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mmzone.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -445,7 +445,7 @@ struct zone { + */ + long lowmem_reserve[MAX_NR_ZONES]; + +-#ifdef CONFIG_NUMA ++#ifdef CONFIG_NEED_MULTIPLE_NODES + int node; + #endif + struct pglist_data *zone_pgdat; +@@ -896,7 +896,7 @@ static inline bool populated_zone(struct + return zone->present_pages; + } + +-#ifdef CONFIG_NUMA ++#ifdef CONFIG_NEED_MULTIPLE_NODES + static inline int zone_to_nid(struct zone *zone) + { + return zone->node; diff --git a/queue-5.10/ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch b/queue-5.10/ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch new file mode 100644 index 00000000000..264a866bc6a --- /dev/null +++ b/queue-5.10/ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch @@ -0,0 +1,100 @@ +From 427215d85e8d1476da1a86b8d67aceb485eb3631 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 9 Aug 2021 10:19:47 +0200 +Subject: ovl: prevent private clone if bind mount is not allowed + +From: Miklos Szeredi + +commit 427215d85e8d1476da1a86b8d67aceb485eb3631 upstream. + +Add the following checks from __do_loopback() to clone_private_mount() as +well: + + - verify that the mount is in the current namespace + + - verify that there are no locked children + +Reported-by: Alois Wohlschlager +Fixes: c771d683a62e ("vfs: introduce clone_private_mount()") +Cc: # v3.18 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/namespace.c | 42 ++++++++++++++++++++++++++++-------------- + 1 file changed, 28 insertions(+), 14 deletions(-) + +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1919,6 +1919,20 @@ void drop_collected_mounts(struct vfsmou + namespace_unlock(); + } + ++static bool has_locked_children(struct mount *mnt, struct dentry *dentry) ++{ ++ struct mount *child; ++ ++ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { ++ if (!is_subdir(child->mnt_mountpoint, dentry)) ++ continue; ++ ++ if (child->mnt.mnt_flags & MNT_LOCKED) ++ return true; ++ } ++ return false; ++} ++ + /** + * clone_private_mount - create a private clone of a path + * +@@ -1933,10 +1947,19 @@ struct vfsmount *clone_private_mount(con + struct mount *old_mnt = real_mount(path->mnt); + struct mount *new_mnt; + ++ down_read(&namespace_sem); + if (IS_MNT_UNBINDABLE(old_mnt)) +- return ERR_PTR(-EINVAL); ++ goto invalid; ++ ++ if (!check_mnt(old_mnt)) ++ goto invalid; ++ ++ if (has_locked_children(old_mnt, path->dentry)) ++ goto invalid; + + new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); ++ up_read(&namespace_sem); ++ + if (IS_ERR(new_mnt)) + return ERR_CAST(new_mnt); + +@@ -1944,6 +1967,10 @@ struct vfsmount *clone_private_mount(con + new_mnt->mnt_ns = MNT_NS_INTERNAL; + + return &new_mnt->mnt; ++ ++invalid: ++ up_read(&namespace_sem); ++ return ERR_PTR(-EINVAL); + } + EXPORT_SYMBOL_GPL(clone_private_mount); + +@@ -2295,19 +2322,6 @@ static int do_change_type(struct path *p + return err; + } + +-static bool has_locked_children(struct mount *mnt, struct dentry *dentry) +-{ +- struct mount *child; +- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { +- if (!is_subdir(child->mnt_mountpoint, dentry)) +- continue; +- +- if (child->mnt.mnt_flags & MNT_LOCKED) +- return true; +- } +- return false; +-} +- + static struct mount *__do_loopback(struct path *old_path, int recurse) + { + struct mount *mnt = ERR_PTR(-EINVAL), *old = real_mount(old_path->mnt); diff --git a/queue-5.10/ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch b/queue-5.10/ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch new file mode 100644 index 00000000000..7d4d2160394 --- /dev/null +++ b/queue-5.10/ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch @@ -0,0 +1,109 @@ +From 3125f26c514826077f2a4490b75e9b1c7a644c42 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pali=20Roh=C3=A1r?= +Date: Sat, 7 Aug 2021 18:00:50 +0200 +Subject: ppp: Fix generating ppp unit id when ifname is not specified +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +commit 3125f26c514826077f2a4490b75e9b1c7a644c42 upstream. + +When registering new ppp interface via PPPIOCNEWUNIT ioctl then kernel has +to choose interface name as this ioctl API does not support specifying it. + +Kernel in this case register new interface with name "ppp" where +is the ppp unit id, which can be obtained via PPPIOCGUNIT ioctl. This +applies also in the case when registering new ppp interface via rtnl +without supplying IFLA_IFNAME. + +PPPIOCNEWUNIT ioctl allows to specify own ppp unit id which will kernel +assign to ppp interface, in case this ppp id is not already used by other +ppp interface. + +In case user does not specify ppp unit id then kernel choose the first free +ppp unit id. This applies also for case when creating ppp interface via +rtnl method as it does not provide a way for specifying own ppp unit id. + +If some network interface (does not have to be ppp) has name "ppp" +with this first free ppp id then PPPIOCNEWUNIT ioctl or rtnl call fails. + +And registering new ppp interface is not possible anymore, until interface +which holds conflicting name is renamed. Or when using rtnl method with +custom interface name in IFLA_IFNAME. + +As list of allocated / used ppp unit ids is not possible to retrieve from +kernel to userspace, userspace has no idea what happens nor which interface +is doing this conflict. + +So change the algorithm how ppp unit id is generated. And choose the first +number which is not neither used as ppp unit id nor in some network +interface with pattern "ppp". + +This issue can be simply reproduced by following pppd call when there is no +ppp interface registered and also no interface with name pattern "ppp": + + pppd ifname ppp1 +ipv6 noip noauth nolock local nodetach pty "pppd +ipv6 noip noauth nolock local nodetach notty" + +Or by creating the one ppp interface (which gets assigned ppp unit id 0), +renaming it to "ppp1" and then trying to create a new ppp interface (which +will always fails as next free ppp unit id is 1, but network interface with +name "ppp1" exists). + +This patch fixes above described issue by generating new and new ppp unit +id until some non-conflicting id with network interfaces is generated. + +Signed-off-by: Pali Rohár +Cc: stable@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/ppp_generic.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -283,7 +283,7 @@ static struct channel *ppp_find_channel( + static int ppp_connect_channel(struct channel *pch, int unit); + static int ppp_disconnect_channel(struct channel *pch); + static void ppp_destroy_channel(struct channel *pch); +-static int unit_get(struct idr *p, void *ptr); ++static int unit_get(struct idr *p, void *ptr, int min); + static int unit_set(struct idr *p, void *ptr, int n); + static void unit_put(struct idr *p, int n); + static void *unit_find(struct idr *p, int n); +@@ -1045,9 +1045,20 @@ static int ppp_unit_register(struct ppp + mutex_lock(&pn->all_ppp_mutex); + + if (unit < 0) { +- ret = unit_get(&pn->units_idr, ppp); ++ ret = unit_get(&pn->units_idr, ppp, 0); + if (ret < 0) + goto err; ++ if (!ifname_is_set) { ++ while (1) { ++ snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ret); ++ if (!__dev_get_by_name(ppp->ppp_net, ppp->dev->name)) ++ break; ++ unit_put(&pn->units_idr, ret); ++ ret = unit_get(&pn->units_idr, ppp, ret + 1); ++ if (ret < 0) ++ goto err; ++ } ++ } + } else { + /* Caller asked for a specific unit number. Fail with -EEXIST + * if unavailable. For backward compatibility, return -EEXIST +@@ -3378,9 +3389,9 @@ static int unit_set(struct idr *p, void + } + + /* get new free unit number and associate pointer with it */ +-static int unit_get(struct idr *p, void *ptr) ++static int unit_get(struct idr *p, void *ptr, int min) + { +- return idr_alloc(p, ptr, 0, 0, GFP_KERNEL); ++ return idr_alloc(p, ptr, min, 0, GFP_KERNEL); + } + + /* put unit number back to a pool */ diff --git a/queue-5.10/revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch b/queue-5.10/revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch new file mode 100644 index 00000000000..3f647953316 --- /dev/null +++ b/queue-5.10/revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch @@ -0,0 +1,115 @@ +From reinette.chatre@intel.com Fri Aug 13 10:41:08 2021 +From: Reinette Chatre +Date: Wed, 11 Aug 2021 16:54:21 -0700 +Subject: Revert "selftests/resctrl: Use resctrl/info for feature detection" +To: stable@vger.kernel.org +Cc: fenghua.yu@intel.com, skhan@linuxfoundation.org, sashal@kernel.org, gregkh@linuxfoundation.org, xiaochen.shen@intel.com, tony.luck@intel.com, Reinette Chatre +Message-ID: + +From: Reinette Chatre + +This reverts commit 19eaad1400eab34e97ec4467cd2ab694d1caf20c which is +ee0415681eb661efa1eb2db7acc263f2c7df1e23 upstream. + +This commit is not a stable candidate and was backported without needed +dependencies that results in the resctrl tests unable to compile. + +Signed-off-by: Reinette Chatre +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/resctrl/resctrl.h | 6 --- + tools/testing/selftests/resctrl/resctrlfs.c | 50 +++++----------------------- + 2 files changed, 11 insertions(+), 45 deletions(-) + +--- a/tools/testing/selftests/resctrl/resctrl.h ++++ b/tools/testing/selftests/resctrl/resctrl.h +@@ -28,10 +28,6 @@ + #define RESCTRL_PATH "/sys/fs/resctrl" + #define PHYS_ID_PATH "/sys/devices/system/cpu/cpu" + #define CBM_MASK_PATH "/sys/fs/resctrl/info" +-#define L3_PATH "/sys/fs/resctrl/info/L3" +-#define MB_PATH "/sys/fs/resctrl/info/MB" +-#define L3_MON_PATH "/sys/fs/resctrl/info/L3_MON" +-#define L3_MON_FEATURES_PATH "/sys/fs/resctrl/info/L3_MON/mon_features" + + #define PARENT_EXIT(err_msg) \ + do { \ +@@ -83,7 +79,7 @@ int remount_resctrlfs(bool mum_resctrlfs + int get_resource_id(int cpu_no, int *resource_id); + int umount_resctrlfs(void); + int validate_bw_report_request(char *bw_report); +-bool validate_resctrl_feature_request(const char *resctrl_val); ++bool validate_resctrl_feature_request(char *resctrl_val); + char *fgrep(FILE *inf, const char *str); + int taskset_benchmark(pid_t bm_pid, int cpu_no); + void run_benchmark(int signum, siginfo_t *info, void *ucontext); +--- a/tools/testing/selftests/resctrl/resctrlfs.c ++++ b/tools/testing/selftests/resctrl/resctrlfs.c +@@ -616,56 +616,26 @@ char *fgrep(FILE *inf, const char *str) + * validate_resctrl_feature_request - Check if requested feature is valid. + * @resctrl_val: Requested feature + * +- * Return: True if the feature is supported, else false ++ * Return: 0 on success, non-zero on failure + */ +-bool validate_resctrl_feature_request(const char *resctrl_val) ++bool validate_resctrl_feature_request(char *resctrl_val) + { +- struct stat statbuf; ++ FILE *inf = fopen("/proc/cpuinfo", "r"); + bool found = false; + char *res; +- FILE *inf; + +- if (!resctrl_val) ++ if (!inf) + return false; + +- if (remount_resctrlfs(false)) +- return false; +- +- if (!strncmp(resctrl_val, CAT_STR, sizeof(CAT_STR))) { +- if (!stat(L3_PATH, &statbuf)) +- return true; +- } else if (!strncmp(resctrl_val, MBA_STR, sizeof(MBA_STR))) { +- if (!stat(MB_PATH, &statbuf)) +- return true; +- } else if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR)) || +- !strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- if (!stat(L3_MON_PATH, &statbuf)) { +- inf = fopen(L3_MON_FEATURES_PATH, "r"); +- if (!inf) +- return false; ++ res = fgrep(inf, "flags"); + +- if (!strncmp(resctrl_val, CMT_STR, sizeof(CMT_STR))) { +- res = fgrep(inf, "llc_occupancy"); +- if (res) { +- found = true; +- free(res); +- } +- } ++ if (res) { ++ char *s = strchr(res, ':'); + +- if (!strncmp(resctrl_val, MBM_STR, sizeof(MBM_STR))) { +- res = fgrep(inf, "mbm_total_bytes"); +- if (res) { +- free(res); +- res = fgrep(inf, "mbm_local_bytes"); +- if (res) { +- found = true; +- free(res); +- } +- } +- } +- fclose(inf); +- } ++ found = s && !strstr(s, resctrl_val); ++ free(res); + } ++ fclose(inf); + + return found; + } diff --git a/queue-5.10/series b/queue-5.10/series index f8481c70ad6..186575d576d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1,4 +1,18 @@ kvm-svm-fix-off-by-one-indexing-when-nullifying-last.patch tee-correct-inappropriate-usage-of-tee_shm_dma_buf-f.patch -usb-dwc3-gadget-use-list_replace_init-before-travers.patch firmware-tee_bnxt-release-tee-shm-session-and-contex.patch +bpf-add-_kernel-suffix-to-internal-lockdown_bpf_read.patch +bpf-add-lockdown-check-for-probe_write_user-helper.patch +revert-selftests-resctrl-use-resctrl-info-for-feature-detection.patch +mm-make-zone_to_nid-and-zone_set_nid-available-for-discontigmem.patch +arm64-dts-renesas-rzg2-add-usb2_clksel-to-rz-g2-m-n-h.patch +arm64-dts-renesas-beacon-fix-usb-extal-reference.patch +arm64-dts-renesas-beacon-fix-usb-ref-clock-references.patch +vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch +vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch +usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch +alsa-pcm-fix-mmap-breakage-without-explicit-buffer-setup.patch +alsa-hda-realtek-fix-mute-micmute-leds-for-hp-probook-650-g8-notebook-pc.patch +alsa-hda-add-quirk-for-asus-flow-x13.patch +ppp-fix-generating-ppp-unit-id-when-ifname-is-not-specified.patch +ovl-prevent-private-clone-if-bind-mount-is-not-allowed.patch diff --git a/queue-5.10/usb-dwc3-gadget-use-list_replace_init-before-travers.patch b/queue-5.10/usb-dwc3-gadget-use-list_replace_init-before-travers.patch deleted file mode 100644 index b5bcbf4ff6b..00000000000 --- a/queue-5.10/usb-dwc3-gadget-use-list_replace_init-before-travers.patch +++ /dev/null @@ -1,117 +0,0 @@ -From c73f9064fdd78a34de47d939739b92cc54257c7c Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 29 Jul 2021 00:33:14 -0700 -Subject: usb: dwc3: gadget: Use list_replace_init() before traversing lists - -From: Wesley Cheng - -[ Upstream commit d25d85061bd856d6be221626605319154f9b5043 ] - -The list_for_each_entry_safe() macro saves the current item (n) and -the item after (n+1), so that n can be safely removed without -corrupting the list. However, when traversing the list and removing -items using gadget giveback, the DWC3 lock is briefly released, -allowing other routines to execute. There is a situation where, while -items are being removed from the cancelled_list using -dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable -routine is running in parallel (due to UDC unbind). As the cleanup -routine removes n, and the pullup disable removes n+1, once the -cleanup retakes the DWC3 lock, it references a request who was already -removed/handled. With list debug enabled, this leads to a panic. -Ensure all instances of the macro are replaced where gadget giveback -is used. - -Example call stack: - -Thread#1: -__dwc3_gadget_ep_set_halt() - CLEAR HALT - -> dwc3_gadget_ep_cleanup_cancelled_requests() - ->list_for_each_entry_safe() - ->dwc3_gadget_giveback(n) - ->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list] - ->spin_unlock - ->Thread#2 executes - ... - ->dwc3_gadget_giveback(n+1) - ->Already removed! - -Thread#2: -dwc3_gadget_pullup() - ->waiting for dwc3 spin_lock - ... - ->Thread#1 released lock - ->dwc3_stop_active_transfers() - ->dwc3_remove_requests() - ->fetches n+1 item from cancelled_list (n removed by Thread#1) - ->dwc3_gadget_giveback() - ->dwc3_gadget_del_and_unmap_request()- n+1 -deleted[cancelled_list] - ->spin_unlock - -Fix this condition by utilizing list_replace_init(), and traversing -through a local copy of the current elements in the endpoint lists. -This will also set the parent list as empty, so if another thread is -also looping through the list, it will be empty on the next iteration. - -Fixes: d4f1afe5e896 ("usb: dwc3: gadget: move requests to cancelled_list") -Cc: stable -Acked-by: Felipe Balbi -Signed-off-by: Wesley Cheng -Link: https://lore.kernel.org/r/1627543994-20327-1-git-send-email-wcheng@codeaurora.org -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/usb/dwc3/gadget.c | 18 ++++++++++++++++-- - 1 file changed, 16 insertions(+), 2 deletions(-) - -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 756839e0e91d..788bbb38cf79 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1733,11 +1733,18 @@ static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep) - { - struct dwc3_request *req; - struct dwc3_request *tmp; -+ struct list_head local; - -- list_for_each_entry_safe(req, tmp, &dep->cancelled_list, list) { -+restart: -+ list_replace_init(&dep->cancelled_list, &local); -+ -+ list_for_each_entry_safe(req, tmp, &local, list) { - dwc3_gadget_ep_skip_trbs(dep, req); - dwc3_gadget_giveback(dep, req, -ECONNRESET); - } -+ -+ if (!list_empty(&dep->cancelled_list)) -+ goto restart; - } - - static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, -@@ -2867,8 +2874,12 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep, - { - struct dwc3_request *req; - struct dwc3_request *tmp; -+ struct list_head local; - -- list_for_each_entry_safe(req, tmp, &dep->started_list, list) { -+restart: -+ list_replace_init(&dep->started_list, &local); -+ -+ list_for_each_entry_safe(req, tmp, &local, list) { - int ret; - - ret = dwc3_gadget_ep_cleanup_completed_request(dep, event, -@@ -2876,6 +2887,9 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep, - if (ret) - break; - } -+ -+ if (!list_empty(&dep->started_list)) -+ goto restart; - } - - static bool dwc3_gadget_ep_should_continue(struct dwc3_ep *dep) --- -2.30.2 - diff --git a/queue-5.10/usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch b/queue-5.10/usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch new file mode 100644 index 00000000000..ce4ba5fc8da --- /dev/null +++ b/queue-5.10/usb-ehci-fix-kunpeng920-ehci-hardware-problem.patch @@ -0,0 +1,42 @@ +From 26b75952ca0b8b4b3050adb9582c8e2f44d49687 Mon Sep 17 00:00:00 2001 +From: Longfang Liu +Date: Fri, 9 Apr 2021 16:48:01 +0800 +Subject: USB:ehci:fix Kunpeng920 ehci hardware problem + +From: Longfang Liu + +commit 26b75952ca0b8b4b3050adb9582c8e2f44d49687 upstream. + +Kunpeng920's EHCI controller does not have SBRN register. +Reading the SBRN register when the controller driver is +initialized will get 0. + +When rebooting the EHCI driver, ehci_shutdown() will be called. +if the sbrn flag is 0, ehci_shutdown() will return directly. +The sbrn flag being 0 will cause the EHCI interrupt signal to +not be turned off after reboot. this interrupt that is not closed +will cause an exception to the device sharing the interrupt. + +Therefore, the EHCI controller of Kunpeng920 needs to skip +the read operation of the SBRN register. + +Acked-by: Alan Stern +Signed-off-by: Longfang Liu +Link: https://lore.kernel.org/r/1617958081-17999-1-git-send-email-liulongfang@huawei.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ehci-pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -297,6 +297,9 @@ static int ehci_pci_setup(struct usb_hcd + if (pdev->vendor == PCI_VENDOR_ID_STMICRO + && pdev->device == PCI_DEVICE_ID_STMICRO_USB_HOST) + ; /* ConneXT has no sbrn register */ ++ else if (pdev->vendor == PCI_VENDOR_ID_HUAWEI ++ && pdev->device == 0xa239) ++ ; /* HUAWEI Kunpeng920 USB EHCI has no sbrn register */ + else + pci_read_config_byte(pdev, 0x60, &ehci->sbrn); + diff --git a/queue-5.10/vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch b/queue-5.10/vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch new file mode 100644 index 00000000000..3dab89322fc --- /dev/null +++ b/queue-5.10/vboxsf-honor-excl-flag-to-the-dir-inode-create-op.patch @@ -0,0 +1,72 @@ +From foo@baz Fri Aug 13 10:47:09 AM CEST 2021 +From: Hans de Goede +Date: Thu, 21 Jan 2021 10:08:59 +0100 +Subject: vboxsf: Honor excl flag to the dir-inode create op + +From: Hans de Goede + +commit cc3ddee97cff034cea4d095de4a484c92a219bf5 upstream + +Honor the excl flag to the dir-inode create op, instead of behaving +as if it is always set. + +Note the old behavior still worked most of the time since a non-exclusive +open only calls the create op, if there is a race and the file is created +between the dentry lookup and the calling of the create call. + +While at it change the type of the is_dir parameter to the +vboxsf_dir_create() helper from an int to a bool, to be consistent with +the use of bool for the excl parameter. + +Fixes: 0fd169576648 ("fs: Add VirtualBox guest shared folder (vboxsf) support") +Signed-off-by: Hans de Goede +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + fs/vboxsf/dir.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +--- a/fs/vboxsf/dir.c ++++ b/fs/vboxsf/dir.c +@@ -253,7 +253,7 @@ static int vboxsf_dir_instantiate(struct + } + + static int vboxsf_dir_create(struct inode *parent, struct dentry *dentry, +- umode_t mode, int is_dir) ++ umode_t mode, bool is_dir, bool excl) + { + struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent); + struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb); +@@ -261,10 +261,12 @@ static int vboxsf_dir_create(struct inod + int err; + + params.handle = SHFL_HANDLE_NIL; +- params.create_flags = SHFL_CF_ACT_CREATE_IF_NEW | +- SHFL_CF_ACT_FAIL_IF_EXISTS | +- SHFL_CF_ACCESS_READWRITE | +- (is_dir ? SHFL_CF_DIRECTORY : 0); ++ params.create_flags = SHFL_CF_ACT_CREATE_IF_NEW | SHFL_CF_ACCESS_READWRITE; ++ if (is_dir) ++ params.create_flags |= SHFL_CF_DIRECTORY; ++ if (excl) ++ params.create_flags |= SHFL_CF_ACT_FAIL_IF_EXISTS; ++ + params.info.attr.mode = (mode & 0777) | + (is_dir ? SHFL_TYPE_DIRECTORY : SHFL_TYPE_FILE); + params.info.attr.additional = SHFLFSOBJATTRADD_NOTHING; +@@ -291,13 +293,13 @@ static int vboxsf_dir_create(struct inod + static int vboxsf_dir_mkfile(struct inode *parent, struct dentry *dentry, + umode_t mode, bool excl) + { +- return vboxsf_dir_create(parent, dentry, mode, 0); ++ return vboxsf_dir_create(parent, dentry, mode, false, excl); + } + + static int vboxsf_dir_mkdir(struct inode *parent, struct dentry *dentry, + umode_t mode) + { +- return vboxsf_dir_create(parent, dentry, mode, 1); ++ return vboxsf_dir_create(parent, dentry, mode, true, true); + } + + static int vboxsf_dir_unlink(struct inode *parent, struct dentry *dentry) diff --git a/queue-5.10/vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch b/queue-5.10/vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch new file mode 100644 index 00000000000..b5641d7341b --- /dev/null +++ b/queue-5.10/vboxsf-make-vboxsf_dir_create-return-the-handle-for-the-created-file.patch @@ -0,0 +1,71 @@ +From foo@baz Fri Aug 13 10:47:09 AM CEST 2021 +From: Hans de Goede +Date: Thu, 21 Jan 2021 10:22:27 +0100 +Subject: vboxsf: Make vboxsf_dir_create() return the handle for the created file + +From: Hans de Goede + +commit ab0c29687bc7a890d1a86ac376b0b0fd78b2d9b6 upstream + +Make vboxsf_dir_create() optionally return the vboxsf-handle for +the created file. This is a preparation patch for adding atomic_open +support. + +Fixes: 0fd169576648 ("fs: Add VirtualBox guest shared folder (vboxsf) support") +Signed-off-by: Hans de Goede +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman +--- + fs/vboxsf/dir.c | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +--- a/fs/vboxsf/dir.c ++++ b/fs/vboxsf/dir.c +@@ -253,7 +253,7 @@ static int vboxsf_dir_instantiate(struct + } + + static int vboxsf_dir_create(struct inode *parent, struct dentry *dentry, +- umode_t mode, bool is_dir, bool excl) ++ umode_t mode, bool is_dir, bool excl, u64 *handle_ret) + { + struct vboxsf_inode *sf_parent_i = VBOXSF_I(parent); + struct vboxsf_sbi *sbi = VBOXSF_SBI(parent->i_sb); +@@ -278,28 +278,32 @@ static int vboxsf_dir_create(struct inod + if (params.result != SHFL_FILE_CREATED) + return -EPERM; + +- vboxsf_close(sbi->root, params.handle); +- + err = vboxsf_dir_instantiate(parent, dentry, ¶ms.info); + if (err) +- return err; ++ goto out; + + /* parent directory access/change time changed */ + sf_parent_i->force_restat = 1; + +- return 0; ++out: ++ if (err == 0 && handle_ret) ++ *handle_ret = params.handle; ++ else ++ vboxsf_close(sbi->root, params.handle); ++ ++ return err; + } + + static int vboxsf_dir_mkfile(struct inode *parent, struct dentry *dentry, + umode_t mode, bool excl) + { +- return vboxsf_dir_create(parent, dentry, mode, false, excl); ++ return vboxsf_dir_create(parent, dentry, mode, false, excl, NULL); + } + + static int vboxsf_dir_mkdir(struct inode *parent, struct dentry *dentry, + umode_t mode) + { +- return vboxsf_dir_create(parent, dentry, mode, true, true); ++ return vboxsf_dir_create(parent, dentry, mode, true, true, NULL); + } + + static int vboxsf_dir_unlink(struct inode *parent, struct dentry *dentry)