From: Sasha Levin Date: Mon, 23 Nov 2020 03:05:56 +0000 (-0500) Subject: Fixes for 4.19 X-Git-Tag: v4.4.246~33 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=35c288d4d3b012885620dc169d28908d6a383179;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch b/queue-4.19/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch new file mode 100644 index 00000000000..901d4ba04be --- /dev/null +++ b/queue-4.19/arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch @@ -0,0 +1,43 @@ +From f52aa37bbe7a66ebf410a8cc4b3515481b0612de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:13:20 -0300 +Subject: ARM: dts: imx50-evk: Fix the chip select 1 IOMUX + +From: Fabio Estevam + +[ Upstream commit 33d0d843872c5ddbe28457a92fc6f2487315fb9f ] + +The SPI chip selects are represented as: + +cs-gpios = <&gpio4 11 GPIO_ACTIVE_LOW>, <&gpio4 13 GPIO_ACTIVE_LOW>; + +, which means that they are used in GPIO function instead of native +SPI mode. + +Fix the IOMUX for the chip select 1 to use GPIO4_13 instead of +the native CSPI_SSI function. + +Fixes: c605cbf5e135 ("ARM: dts: imx: add device tree support for Freescale imx50evk board") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx50-evk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx50-evk.dts b/arch/arm/boot/dts/imx50-evk.dts +index a25da415cb02e..907339bc81e54 100644 +--- a/arch/arm/boot/dts/imx50-evk.dts ++++ b/arch/arm/boot/dts/imx50-evk.dts +@@ -59,7 +59,7 @@ + MX50_PAD_CSPI_MISO__CSPI_MISO 0x00 + MX50_PAD_CSPI_MOSI__CSPI_MOSI 0x00 + MX50_PAD_CSPI_SS0__GPIO4_11 0xc4 +- MX50_PAD_ECSPI1_MOSI__CSPI_SS1 0xf4 ++ MX50_PAD_ECSPI1_MOSI__GPIO4_13 0x84 + >; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch b/queue-4.19/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch new file mode 100644 index 00000000000..3c871ba4cff --- /dev/null +++ b/queue-4.19/arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch @@ -0,0 +1,39 @@ +From fda19980b02141dc5e9b0d8ae88fe413aebd5839 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Oct 2020 23:11:20 +0300 +Subject: arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy + +From: Sergey Matyukevich + +[ Upstream commit 7dd8f0ba88fce98e2953267a66af74c6f4792a56 ] + +Commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode support for the +KSZ9031 PHY") fixed micrel phy driver adding proper support for phy +modes. Adapt imx6q-udoo board phy settings : explicitly set required +delay configuration using "rgmii-id". + +Fixes: cbd54fe0b2bc ("ARM: dts: imx6dl-udoo: Add board support based off imx6q-udoo") +Signed-off-by: Sergey Matyukevich +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-udoo.dtsi b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +index 4f27861bbb324..4cc9858f7ff80 100644 +--- a/arch/arm/boot/dts/imx6qdl-udoo.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-udoo.dtsi +@@ -97,7 +97,7 @@ + &fec { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_enet>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch b/queue-4.19/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch new file mode 100644 index 00000000000..dc16669ebc1 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch @@ -0,0 +1,58 @@ +From 73609015e0646105579f40c2f459b28dd2ed77e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:11 +0800 +Subject: ARM: dts: sun8i: a83t: Enable both RGMII RX/TX delay on Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit 57dbe558457bf4042169bc1f334e3b53a8480a1c ] + +The Ethernet PHY on the Bananapi M3 and Cubietruck Plus have the RX +and TX delays enabled on the PHY, using pull-ups on the RXDLY and +TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 039359948a4b ("ARM: dts: sun8i: a83t: Enable Ethernet on two boards") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-6-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts | 2 +- + arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts +index f250b20af4937..9be1c4a3d95fb 100644 +--- a/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts ++++ b/arch/arm/boot/dts/sun8i-a83t-bananapi-m3.dts +@@ -131,7 +131,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_sw>; + phy-handle = <&rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + allwinner,rx-delay-ps = <700>; + allwinner,tx-delay-ps = <700>; + status = "okay"; +diff --git a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +index 7e74ba83f8095..75396993195d1 100644 +--- a/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts ++++ b/arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +@@ -168,7 +168,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_dldo4>; + phy-handle = <&rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch b/queue-4.19/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch new file mode 100644 index 00000000000..a2c0dbf0213 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch @@ -0,0 +1,46 @@ +From 1dd9f4d1a81acd64e95df391d4a59f5972423ca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:10 +0800 +Subject: ARM: dts: sun8i: h3: orangepi-plus2e: Enable RGMII RX/TX delay on + Ethernet PHY + +From: Chen-Yu Tsai + +[ Upstream commit e080ab31a0aa126b0a7e4f67f2b01b371b852c88 ] + +The Ethernet PHY on the Orange Pi Plus 2E has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)") +Fixes: 7a78ef92cdc5 ("ARM: sun8i: h3: Enable EMAC with external PHY on Orange Pi Plus 2E") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Jernej Skrabec +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-5-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts +index 6dbf7b2e0c13c..b6ca45d18e511 100644 +--- a/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts ++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-plus2e.dts +@@ -67,7 +67,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch b/queue-4.19/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch new file mode 100644 index 00000000000..00a043dd312 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch @@ -0,0 +1,37 @@ +From d49f6acdf2b4d116c6f493c35a34371f88d2166f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 09:19:49 +0100 +Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit b3eec3212e66ece33f69be0de98d54e67834e798 ] + +Ethernet PHY on BananaPi M2 Ultra provides RX and TX delays. Fix +ethernet node to reflect that fact. + +Fixes: c36fd5a48bd2 ("ARM: dts: sun8i: r40: bananapi-m2-ultra: Enable GMAC ethernet controller") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201025081949.783443-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +index b2a773a718e16..5e5223a48ac7b 100644 +--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts ++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +@@ -121,7 +121,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_dc1sw>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch b/queue-4.19/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch new file mode 100644 index 00000000000..0bd731bff53 --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch @@ -0,0 +1,46 @@ +From 4df383156b1792671b59cca83a82d46f1d4831cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:15 +0800 +Subject: arm64: dts: allwinner: a64: bananapi-m64: Enable RGMII RX/TX delay on + PHY + +From: Chen-Yu Tsai + +[ Upstream commit 1a9a8910b2153cd3c4f3f2f8defcb853ead3b1fd ] + +The Ethernet PHY on the Bananapi M64 has the RX and TX delays +enabled on the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: e7295499903d ("arm64: allwinner: bananapi-m64: Enable dwmac-sun8i") +Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Corentin Labbe +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-10-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts +index 094cfed13df97..13ce24e922eea 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-bananapi-m64.dts +@@ -97,7 +97,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-handle = <&ext_rgmii_phy>; + phy-supply = <®_dc1sw>; + status = "okay"; +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch b/queue-4.19/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch new file mode 100644 index 00000000000..58a3aab3b88 --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch @@ -0,0 +1,42 @@ +From c7a920e99ec6e4a93d567e2216102c3ac128c375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 23:13:01 +0200 +Subject: arm64: dts: allwinner: a64: Pine64 Plus: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit 927f42fcc1b4f7d04a2ac5cf02f25612aa8923a4 ] + +According to board schematic, PHY provides both, RX and TX delays. +However, according to "fix" Realtek provided for this board, only TX +delay should be provided by PHY. +Tests show that both variants work but TX only PHY delay works +slightly better. + +Update ethernet node to reflect the fact that PHY provides TX delay. + +Fixes: 94f442886711 ("arm64: dts: allwinner: A64: Restore EMAC changes") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201022211301.3548422-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts +index d5b6e8159a335..5d0905f0f1c1d 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pine64-plus.dts +@@ -52,7 +52,7 @@ + &emac { + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-txid"; + phy-handle = <&ext_rgmii_phy>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch b/queue-4.19/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch new file mode 100644 index 00000000000..65b3bdc32fa --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch @@ -0,0 +1,37 @@ +From c27bd453cec9d2356653f52eb230ace2e3345306 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 20:48:58 +0200 +Subject: arm64: dts: allwinner: h5: OrangePi PC2: Fix ethernet node + +From: Jernej Skrabec + +[ Upstream commit b34bf9f6a623ddb82600a5ed5c644224122395e1 ] + +RX and TX delay are provided by ethernet PHY. Reflect that in ethernet +node. + +Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201023184858.3272918-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts +index 3e0d5a9c096d3..5fbfa76daae22 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-pc2.dts +@@ -157,7 +157,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch b/queue-4.19/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch new file mode 100644 index 00000000000..f1442e0bf47 --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch @@ -0,0 +1,38 @@ +From 27a7e5dc3dcf11b9ed25d0b6f585f6a3c47ff7f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 12:58:17 +0100 +Subject: arm64: dts: allwinner: h5: OrangePi Prime: Fix ethernet node + +From: Nenad Peric + +[ Upstream commit 107954afc5df667da438644aa4982606663f9b17 ] + +RX and TX delay are provided by ethernet PHY. Reflect that in ethernet +node. + +Fixes: 44a94c7ef989 ("arm64: dts: allwinner: H5: Restore EMAC changes") +Signed-off-by: Nenad Peric +Signed-off-by: Maxime Ripard +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201028115817.68113-1-nperic@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts +index b75ca4d7d0019..7a30211d59ef5 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-prime.dts +@@ -164,7 +164,7 @@ + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <®_gmac_3v3>; + phy-handle = <&ext_rgmii_phy>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch b/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch new file mode 100644 index 00000000000..2aae40a9a44 --- /dev/null +++ b/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch @@ -0,0 +1,50 @@ +From 1695efd96b678a4555da317b759dd86fd49ee53b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 10:26:50 +0530 +Subject: ASoC: qcom: lpass-platform: Fix memory leak + +From: Srinivasa Rao Mandadapu + +[ Upstream commit bd6327fda2f3ded85b69b3c3125c99aaa51c7881 ] + +lpass_pcm_data is not freed in error paths. Free it in +error paths to avoid memory leak. + +Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage") +Signed-off-by: Pavel Machek +Signed-off-by: V Sujith Kumar Reddy +Signed-off-by: Srinivasa Rao Mandadapu +Link: https://lore.kernel.org/r/1605416210-14530-1-git-send-email-srivasam@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-platform.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c +index 2f29672477892..1d06e2b7bb635 100644 +--- a/sound/soc/qcom/lpass-platform.c ++++ b/sound/soc/qcom/lpass-platform.c +@@ -81,8 +81,10 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream) + else + dma_ch = 0; + +- if (dma_ch < 0) ++ if (dma_ch < 0) { ++ kfree(data); + return dma_ch; ++ } + + drvdata->substream[dma_ch] = substream; + +@@ -103,6 +105,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream) + ret = snd_pcm_hw_constraint_integer(runtime, + SNDRV_PCM_HW_PARAM_PERIODS); + if (ret < 0) { ++ kfree(data); + dev_err(soc_runtime->dev, "setting constraints failed: %d\n", + ret); + return -EINVAL; +-- +2.27.0 + diff --git a/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch b/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch new file mode 100644 index 00000000000..49b00125c1b --- /dev/null +++ b/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch @@ -0,0 +1,69 @@ +From 6a30424b5d01637949cddb92dc6a12c2d354f2a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 03:09:05 +0530 +Subject: can: af_can: prevent potential access of uninitialized member in + can_rcv() + +From: Anant Thazhemadam + +[ Upstream commit c8c958a58fc67f353289986850a0edf553435702 ] + +In can_rcv(), cfd->len is uninitialized when skb->len = 0, and this +uninitialized cfd->len is accessed nonetheless by pr_warn_once(). + +Fix this uninitialized variable access by checking cfd->len's validity +condition (cfd->len > CAN_MAX_DLEN) separately after the skb->len's +condition is checked, and appropriately modify the log messages that +are generated as well. +In case either of the required conditions fail, the skb is freed and +NET_RX_DROP is returned, same as before. + +Fixes: 8cb68751c115 ("can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once") +Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com +Tested-by: Anant Thazhemadam +Signed-off-by: Anant Thazhemadam +Link: https://lore.kernel.org/r/20201103213906.24219-2-anant.thazhemadam@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/af_can.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 04132b0b5d360..1201846dc07e3 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -722,16 +722,25 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, + { + struct canfd_frame *cfd = (struct canfd_frame *)skb->data; + +- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU || +- cfd->len > CAN_MAX_DLEN)) { +- pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n", ++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d\n", ++ dev->type, skb->len); ++ goto free_skb; ++ } ++ ++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ ++ if (unlikely(cfd->len > CAN_MAX_DLEN)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN skbuff: dev type %d, len %d, datalen %d\n", + dev->type, skb->len, cfd->len); +- kfree_skb(skb); +- return NET_RX_DROP; ++ goto free_skb; + } + + can_receive(skb, dev); + return NET_RX_SUCCESS; ++ ++free_skb: ++ kfree_skb(skb); ++ return NET_RX_DROP; + } + + static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, +-- +2.27.0 + diff --git a/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch-27791 b/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch-27791 new file mode 100644 index 00000000000..fe8bba97b94 --- /dev/null +++ b/queue-4.19/can-af_can-prevent-potential-access-of-uninitialized.patch-27791 @@ -0,0 +1,69 @@ +From 4b5f1f0d6555cf1e43aa2da8adf77ee8f34e21ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 03:09:06 +0530 +Subject: can: af_can: prevent potential access of uninitialized member in + canfd_rcv() + +From: Anant Thazhemadam + +[ Upstream commit 9aa9379d8f868e91719333a7f063ccccc0579acc ] + +In canfd_rcv(), cfd->len is uninitialized when skb->len = 0, and this +uninitialized cfd->len is accessed nonetheless by pr_warn_once(). + +Fix this uninitialized variable access by checking cfd->len's validity +condition (cfd->len > CANFD_MAX_DLEN) separately after the skb->len's +condition is checked, and appropriately modify the log messages that +are generated as well. +In case either of the required conditions fail, the skb is freed and +NET_RX_DROP is returned, same as before. + +Fixes: d4689846881d ("can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once") +Reported-by: syzbot+9bcb0c9409066696d3aa@syzkaller.appspotmail.com +Tested-by: Anant Thazhemadam +Signed-off-by: Anant Thazhemadam +Link: https://lore.kernel.org/r/20201103213906.24219-3-anant.thazhemadam@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/af_can.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 1201846dc07e3..b3edb80921248 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -748,16 +748,25 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, + { + struct canfd_frame *cfd = (struct canfd_frame *)skb->data; + +- if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU || +- cfd->len > CANFD_MAX_DLEN)) { +- pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n", ++ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d\n", ++ dev->type, skb->len); ++ goto free_skb; ++ } ++ ++ /* This check is made separately since cfd->len would be uninitialized if skb->len = 0. */ ++ if (unlikely(cfd->len > CANFD_MAX_DLEN)) { ++ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuff: dev type %d, len %d, datalen %d\n", + dev->type, skb->len, cfd->len); +- kfree_skb(skb); +- return NET_RX_DROP; ++ goto free_skb; + } + + can_receive(skb, dev); + return NET_RX_SUCCESS; ++ ++free_skb: ++ kfree_skb(skb); ++ return NET_RX_DROP; + } + + /* +-- +2.27.0 + diff --git a/queue-4.19/can-dev-can_restart-post-buffer-from-the-right-conte.patch b/queue-4.19/can-dev-can_restart-post-buffer-from-the-right-conte.patch new file mode 100644 index 00000000000..4fd16975209 --- /dev/null +++ b/queue-4.19/can-dev-can_restart-post-buffer-from-the-right-conte.patch @@ -0,0 +1,41 @@ +From 273f51e620f6b5bf07b526519fd2e0fb128e943f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 21:51:47 +0000 +Subject: can: dev: can_restart(): post buffer from the right context + +From: Alejandro Concepcion Rodriguez + +[ Upstream commit a1e654070a60d5d4f7cce59c38f4ca790bb79121 ] + +netif_rx() is meant to be called from interrupt contexts. can_restart() may be +called by can_restart_work(), which is called from a worqueue, so it may run in +process context. Use netif_rx_ni() instead. + +Fixes: 39549eef3587 ("can: CAN Network device driver and Netlink interface") +Co-developed-by: Loris Fauster +Signed-off-by: Loris Fauster +Signed-off-by: Alejandro Concepcion Rodriguez +Link: https://lore.kernel.org/r/4e84162b-fb31-3a73-fa9a-9438b4bd5234@acoro.eu +[mkl: use netif_rx_ni() instead of netif_rx_any_context()] +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 1950b13f22dfc..f88590074569e 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -579,7 +579,7 @@ static void can_restart(struct net_device *dev) + } + cf->can_id |= CAN_ERR_RESTARTED; + +- netif_rx(skb); ++ netif_rx_ni(skb); + + stats->rx_packets++; + stats->rx_bytes += cf->can_dlc; +-- +2.27.0 + diff --git a/queue-4.19/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch b/queue-4.19/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch new file mode 100644 index 00000000000..eb2cfa172fd --- /dev/null +++ b/queue-4.19/can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch @@ -0,0 +1,36 @@ +From ae9d79af812cc5a5be12ac30454dde1e4343fef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 17:30:23 +0100 +Subject: can: kvaser_usb: kvaser_usb_hydra: Fix KCAN bittiming limits + +From: Jimmy Assarsson + +[ Upstream commit d003868d7f8579838ed58b6429af91844039b6f8 ] + +Use correct bittiming limits for the KCAN CAN controller. + +Fixes: aec5fb2268b7 ("can: kvaser_usb: Add support for Kvaser USB hydra family") +Signed-off-by: Jimmy Assarsson +Link: https://lore.kernel.org/r/20201115163027.16851-2-jimmyassarsson@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +index 7ab87a7587545..218fadc911558 100644 +--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c ++++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +@@ -367,7 +367,7 @@ static const struct can_bittiming_const kvaser_usb_hydra_kcan_bittiming_c = { + .tseg2_max = 32, + .sjw_max = 16, + .brp_min = 1, +- .brp_max = 4096, ++ .brp_max = 8192, + .brp_inc = 1, + }; + +-- +2.27.0 + diff --git a/queue-4.19/can-m_can-m_can_handle_state_change-fix-state-change.patch b/queue-4.19/can-m_can-m_can_handle_state_change-fix-state-change.patch new file mode 100644 index 00000000000..53dae453567 --- /dev/null +++ b/queue-4.19/can-m_can-m_can_handle_state_change-fix-state-change.patch @@ -0,0 +1,51 @@ +From 813d94986e3bfb67d10d8a59d8a8344204795cd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jan 2020 10:23:30 +0800 +Subject: can: m_can: m_can_handle_state_change(): fix state change + +From: Wu Bo + +[ Upstream commit cd0d83eab2e0c26fe87a10debfedbb23901853c1 ] + +m_can_handle_state_change() is called with the new_state as an argument. + +In the switch statements for CAN_STATE_ERROR_ACTIVE, the comment and the +following code indicate that a CAN_STATE_ERROR_WARNING is handled. + +This patch fixes this problem by changing the case to CAN_STATE_ERROR_WARNING. + +Signed-off-by: Wu Bo +Link: http://lore.kernel.org/r/20200129022330.21248-2-wubo.oduw@gmail.com +Cc: Dan Murphy +Fixes: e0d1f4816f2a ("can: m_can: add Bosch M_CAN controller support") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index deb274a19ba00..efaa342600c41 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -675,7 +675,7 @@ static int m_can_handle_state_change(struct net_device *dev, + unsigned int ecr; + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + priv->can.can_stats.error_warning++; + priv->can.state = CAN_STATE_ERROR_WARNING; +@@ -704,7 +704,7 @@ static int m_can_handle_state_change(struct net_device *dev, + __m_can_get_berr_counter(dev, &bec); + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] = (bec.txerr > bec.rxerr) ? +-- +2.27.0 + diff --git a/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch b/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch new file mode 100644 index 00000000000..94cc57393f6 --- /dev/null +++ b/queue-4.19/can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch @@ -0,0 +1,51 @@ +From fd1d487c6aa605f0232ab4b174f71ef573d74e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 21:16:55 +0200 +Subject: can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to + can_put_echo_skb() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marc Kleine-Budde + +[ Upstream commit 81c9c8e0adef3285336b942f93287c554c89e6c6 ] + +The driver has to first fill the skb with data and then handle it to +can_put_echo_skb(). This patch moves the can_put_echo_skb() down, right before +sending the skb out via USB. + +Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") +Cc: Remigiusz Kołłątaj +Link: https://lore.kernel.org/r/20201111221204.1639007-1-mkl@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/mcba_usb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 1b0afeaf1a3c2..896f5b0227295 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -337,8 +337,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + if (!ctx) + return NETDEV_TX_BUSY; + +- can_put_echo_skb(skb, priv->netdev, ctx->ndx); +- + if (cf->can_id & CAN_EFF_FLAG) { + /* SIDH | SIDL | EIDH | EIDL + * 28 - 21 | 20 19 18 x x x 17 16 | 15 - 8 | 7 - 0 +@@ -368,6 +366,8 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + if (cf->can_id & CAN_RTR_FLAG) + usb_msg.dlc |= MCBA_DLC_RTR_MASK; + ++ can_put_echo_skb(skb, priv->netdev, ctx->ndx); ++ + err = mcba_usb_xmit(priv, (struct mcba_usb_msg *)&usb_msg, ctx); + if (err) + goto xmit_failed; +-- +2.27.0 + diff --git a/queue-4.19/can-peak_usb-fix-potential-integer-overflow-on-shift.patch b/queue-4.19/can-peak_usb-fix-potential-integer-overflow-on-shift.patch new file mode 100644 index 00000000000..4142c931525 --- /dev/null +++ b/queue-4.19/can-peak_usb-fix-potential-integer-overflow-on-shift.patch @@ -0,0 +1,48 @@ +From 337dd9f6e316658684e2f58a3144599bf29c6ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 11:24:27 +0000 +Subject: can: peak_usb: fix potential integer overflow on shift of a int + +From: Colin Ian King + +[ Upstream commit 8a68cc0d690c9e5730d676b764c6f059343b842c ] + +The left shift of int 32 bit integer constant 1 is evaluated using 32 bit +arithmetic and then assigned to a signed 64 bit variable. In the case where +time_ref->adapter->ts_used_bits is 32 or more this can lead to an oveflow. +Avoid this by shifting using the BIT_ULL macro instead. + +Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20201105112427.40688-1-colin.king@canonical.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index db156a11e6db5..f7d653d48a1e4 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -164,7 +164,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time) + if (time_ref->ts_dev_1 < time_ref->ts_dev_2) { + /* case when event time (tsw) wraps */ + if (ts < time_ref->ts_dev_1) +- delta_ts = 1 << time_ref->adapter->ts_used_bits; ++ delta_ts = BIT_ULL(time_ref->adapter->ts_used_bits); + + /* Otherwise, sync time counter (ts_dev_2) has wrapped: + * handle case when event time (tsn) hasn't. +@@ -176,7 +176,7 @@ void peak_usb_get_ts_time(struct peak_time_ref *time_ref, u32 ts, ktime_t *time) + * tsn ts + */ + } else if (time_ref->ts_dev_1 < ts) { +- delta_ts = -(1 << time_ref->adapter->ts_used_bits); ++ delta_ts = -BIT_ULL(time_ref->adapter->ts_used_bits); + } + + /* add delay between last sync and event timestamps */ +-- +2.27.0 + diff --git a/queue-4.19/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch b/queue-4.19/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch new file mode 100644 index 00000000000..88366a579fa --- /dev/null +++ b/queue-4.19/can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch @@ -0,0 +1,74 @@ +From 572524b4bdc2168d99cc7bab059dfaf3dcaca2d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 19:17:08 +0800 +Subject: can: ti_hecc: Fix memleak in ti_hecc_probe + +From: Zhang Qilong + +[ Upstream commit 7968c7c79d3be8987feb8021f0c46e6866831408 ] + +In the error handling, we should goto the probe_exit_candev +to free ndev to prevent memory leak. + +Fixes: dabf54dd1c63 ("can: ti_hecc: Convert TI HECC driver to DT only driver") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201114111708.3465543-1-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/ti_hecc.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c +index db6ea936dc3fc..81a3fdd5e0103 100644 +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -903,7 +903,8 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->base)) { + dev_err(&pdev->dev, "hecc ioremap failed\n"); +- return PTR_ERR(priv->base); ++ err = PTR_ERR(priv->base); ++ goto probe_exit_candev; + } + + /* handle hecc-ram memory */ +@@ -916,7 +917,8 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->hecc_ram = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->hecc_ram)) { + dev_err(&pdev->dev, "hecc-ram ioremap failed\n"); +- return PTR_ERR(priv->hecc_ram); ++ err = PTR_ERR(priv->hecc_ram); ++ goto probe_exit_candev; + } + + /* handle mbx memory */ +@@ -929,13 +931,14 @@ static int ti_hecc_probe(struct platform_device *pdev) + priv->mbx = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(priv->mbx)) { + dev_err(&pdev->dev, "mbx ioremap failed\n"); +- return PTR_ERR(priv->mbx); ++ err = PTR_ERR(priv->mbx); ++ goto probe_exit_candev; + } + + irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); + if (!irq) { + dev_err(&pdev->dev, "No irq resource\n"); +- goto probe_exit; ++ goto probe_exit_candev; + } + + priv->ndev = ndev; +@@ -988,7 +991,7 @@ probe_exit_clk: + clk_put(priv->clk); + probe_exit_candev: + free_candev(ndev); +-probe_exit: ++ + return err; + } + +-- +2.27.0 + diff --git a/queue-4.19/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch b/queue-4.19/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch new file mode 100644 index 00000000000..970330a054b --- /dev/null +++ b/queue-4.19/drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch @@ -0,0 +1,38 @@ +From 67a7657bdcf26771d0207bf3d8e0476aa8e20795 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 09:09:29 +0800 +Subject: drm/sun4i: dw-hdmi: fix error return code in sun8i_dw_hdmi_bind() + +From: Xiongfeng Wang + +[ Upstream commit 6654b57866b98230a270953dd34f67de17ab1708 ] + +Fix to return a negative error code from the error handling case instead +of 0 in function sun8i_dw_hdmi_bind(). + +Fixes: b7c7436a5ff0 ("drm/sun4i: Implement A83T HDMI driver") +Reported-by: Hulk Robot +Signed-off-by: Xiongfeng Wang +Reviewed-by: Jernej Skrabec +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/1605488969-5211-1-git-send-email-wangxiongfeng2@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index 31875b636434a..5073622cbb567 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -140,6 +140,7 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master, + phy_node = of_parse_phandle(dev->of_node, "phys", 0); + if (!phy_node) { + dev_err(dev, "Can't found PHY phandle\n"); ++ ret = -EINVAL; + goto err_disable_clk_tmds; + } + +-- +2.27.0 + diff --git a/queue-4.19/efi-x86-free-efi_pgd-with-free_pages.patch b/queue-4.19/efi-x86-free-efi_pgd-with-free_pages.patch new file mode 100644 index 00000000000..20baf615446 --- /dev/null +++ b/queue-4.19/efi-x86-free-efi_pgd-with-free_pages.patch @@ -0,0 +1,83 @@ +From 1666f71ca68daeca23eafe0f38aeca33d45ec808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 11:39:19 -0500 +Subject: efi/x86: Free efi_pgd with free_pages() + +From: Arvind Sankar + +[ Upstream commit c2fe61d8be491ff8188edaf22e838f819999146b ] + +Commit + + d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD") + +changed the PGD allocation to allocate PGD_ALLOCATION_ORDER pages, so in +the error path it should be freed using free_pages() rather than +free_page(). + +Commit + + 06ace26f4e6f ("x86/efi: Free efi_pgd with free_pages()") + +fixed one instance of this, but missed another. + +Move the freeing out-of-line to avoid code duplication and fix this bug. + +Fixes: d9e9a6418065 ("x86/mm/pti: Allocate a separate user PGD") +Link: https://lore.kernel.org/r/20201110163919.1134431-1-nivedita@alum.mit.edu +Signed-off-by: Arvind Sankar +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/x86/platform/efi/efi_64.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index 52dd59af873ee..77d05b56089a2 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -214,28 +214,30 @@ int __init efi_alloc_page_tables(void) + gfp_mask = GFP_KERNEL | __GFP_ZERO; + efi_pgd = (pgd_t *)__get_free_pages(gfp_mask, PGD_ALLOCATION_ORDER); + if (!efi_pgd) +- return -ENOMEM; ++ goto fail; + + pgd = efi_pgd + pgd_index(EFI_VA_END); + p4d = p4d_alloc(&init_mm, pgd, EFI_VA_END); +- if (!p4d) { +- free_page((unsigned long)efi_pgd); +- return -ENOMEM; +- } ++ if (!p4d) ++ goto free_pgd; + + pud = pud_alloc(&init_mm, p4d, EFI_VA_END); +- if (!pud) { +- if (pgtable_l5_enabled()) +- free_page((unsigned long) pgd_page_vaddr(*pgd)); +- free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER); +- return -ENOMEM; +- } ++ if (!pud) ++ goto free_p4d; + + efi_mm.pgd = efi_pgd; + mm_init_cpumask(&efi_mm); + init_new_context(NULL, &efi_mm); + + return 0; ++ ++free_p4d: ++ if (pgtable_l5_enabled()) ++ free_page((unsigned long)pgd_page_vaddr(*pgd)); ++free_pgd: ++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER); ++fail: ++ return -ENOMEM; + } + + /* +-- +2.27.0 + diff --git a/queue-4.19/fail_function-remove-a-redundant-mutex-unlock.patch b/queue-4.19/fail_function-remove-a-redundant-mutex-unlock.patch new file mode 100644 index 00000000000..f0713a84966 --- /dev/null +++ b/queue-4.19/fail_function-remove-a-redundant-mutex-unlock.patch @@ -0,0 +1,51 @@ +From abe27c44acbf2918b84c5d6c9372a1de8407d3ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 22:49:31 +0900 +Subject: fail_function: Remove a redundant mutex unlock + +From: Luo Meng + +[ Upstream commit 2801a5da5b25b7af9dd2addd19b2315c02d17b64 ] + +Fix a mutex_unlock() issue where before copy_from_user() is +not called mutex_locked. + +Fixes: 4b1a29a7f542 ("error-injection: Support fault injection framework") +Reported-by: Hulk Robot +Signed-off-by: Luo Meng +Signed-off-by: Masami Hiramatsu +Signed-off-by: Alexei Starovoitov +Acked-by: Masami Hiramatsu +Link: https://lore.kernel.org/bpf/160570737118.263807.8358435412898356284.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + kernel/fail_function.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/kernel/fail_function.c b/kernel/fail_function.c +index bc80a4e268c0b..a52151a2291fb 100644 +--- a/kernel/fail_function.c ++++ b/kernel/fail_function.c +@@ -261,7 +261,7 @@ static ssize_t fei_write(struct file *file, const char __user *buffer, + + if (copy_from_user(buf, buffer, count)) { + ret = -EFAULT; +- goto out; ++ goto out_free; + } + buf[count] = '\0'; + sym = strstrip(buf); +@@ -315,8 +315,9 @@ static ssize_t fei_write(struct file *file, const char __user *buffer, + ret = count; + } + out: +- kfree(buf); + mutex_unlock(&fei_lock); ++out_free: ++ kfree(buf); + return ret; + } + +-- +2.27.0 + diff --git a/queue-4.19/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch b/queue-4.19/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch new file mode 100644 index 00000000000..0a17bc9611b --- /dev/null +++ b/queue-4.19/input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch @@ -0,0 +1,38 @@ +From 845abb575aa3c6aee807c823ff392cd7c5a95f60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 17:10:09 -0700 +Subject: Input: adxl34x - clean up a data type in adxl34x_probe() + +From: Dan Carpenter + +[ Upstream commit 33b6c39e747c552fa770eecebd1776f1f4a222b1 ] + +The "revid" is used to store negative error codes so it should be an int +type. + +Fixes: e27c729219ad ("Input: add driver for ADXL345/346 Digital Accelerometers") +Signed-off-by: Dan Carpenter +Acked-by: Michael Hennerich +Link: https://lore.kernel.org/r/20201026072824.GA1620546@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/misc/adxl34x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/misc/adxl34x.c b/drivers/input/misc/adxl34x.c +index a3e79bf5a04b0..3695dd7dbb9b4 100644 +--- a/drivers/input/misc/adxl34x.c ++++ b/drivers/input/misc/adxl34x.c +@@ -696,7 +696,7 @@ struct adxl34x *adxl34x_probe(struct device *dev, int irq, + struct input_dev *input_dev; + const struct adxl34x_platform_data *pdata; + int err, range, i; +- unsigned char revid; ++ int revid; + + if (!irq) { + dev_err(dev, "no IRQ?\n"); +-- +2.27.0 + diff --git a/queue-4.19/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch b/queue-4.19/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch new file mode 100644 index 00000000000..fbaeb798193 --- /dev/null +++ b/queue-4.19/input-resistive-adc-touch-fix-kconfig-dependency-on-.patch @@ -0,0 +1,49 @@ +From d6e4a4ef85beebc9368a019f2af5a925427b9cfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 17:48:52 -0800 +Subject: Input: resistive-adc-touch - fix kconfig dependency on IIO_BUFFER + +From: Necip Fazil Yildiran + +[ Upstream commit 676650d007e06fddcf3fe38238251d71bd179641 ] + +When TOUCHSCREEN_ADC is enabled and IIO_BUFFER is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for IIO_BUFFER_CB + Depends on [n]: IIO [=y] && IIO_BUFFER [=n] + Selected by [y]: + - TOUCHSCREEN_ADC [=y] && !UML && INPUT [=y] && INPUT_TOUCHSCREEN [=y] && IIO [=y] + +The reason is that TOUCHSCREEN_ADC selects IIO_BUFFER_CB without depending +on or selecting IIO_BUFFER while IIO_BUFFER_CB depends on IIO_BUFFER. This +can also fail building the kernel. + +Honor the kconfig dependency to remove unmet direct dependency warnings +and avoid any potential build failures. + +Fixes: aa132ffb6b0a ("input: touchscreen: resistive-adc-touch: add generic resistive ADC touchscreen") +Signed-off-by: Necip Fazil Yildiran +Acked-by: Jonathan Cameron +Link: https://lore.kernel.org/r/20201102221504.541279-1-fazilyildiran@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/Kconfig b/drivers/input/touchscreen/Kconfig +index 2a80675cfd947..de400d76df55a 100644 +--- a/drivers/input/touchscreen/Kconfig ++++ b/drivers/input/touchscreen/Kconfig +@@ -95,6 +95,7 @@ config TOUCHSCREEN_AD7879_SPI + config TOUCHSCREEN_ADC + tristate "Generic ADC based resistive touchscreen" + depends on IIO ++ select IIO_BUFFER + select IIO_BUFFER_CB + help + Say Y here if you want to use the generic ADC +-- +2.27.0 + diff --git a/queue-4.19/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch b/queue-4.19/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch new file mode 100644 index 00000000000..b94740b4e8b --- /dev/null +++ b/queue-4.19/ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch @@ -0,0 +1,70 @@ +From 79f14ca55e751b1ce118913045f598c1535bcd89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 16:16:40 -0800 +Subject: ip_tunnels: Set tunnel option flag when tunnel metadata is present + +From: Yi-Hung Wei + +[ Upstream commit 9c2e14b48119b39446031d29d994044ae958d8fc ] + +Currently, we may set the tunnel option flag when the size of metadata +is zero. For example, we set TUNNEL_GENEVE_OPT in the receive function +no matter the geneve option is present or not. As this may result in +issues on the tunnel flags consumers, this patch fixes the issue. + +Related discussion: +* https://lore.kernel.org/netdev/1604448694-19351-1-git-send-email-yihung.wei@gmail.com/T/#u + +Fixes: 256c87c17c53 ("net: check tunnel option type in tunnel flags") +Signed-off-by: Yi-Hung Wei +Link: https://lore.kernel.org/r/1605053800-74072-1-git-send-email-yihung.wei@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 3 +-- + include/net/ip_tunnels.h | 7 ++++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index d0b5844c8a315..2e2afc824a6a8 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -223,8 +223,7 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + if (ip_tunnel_collect_metadata() || gs->collect_md) { + __be16 flags; + +- flags = TUNNEL_KEY | TUNNEL_GENEVE_OPT | +- (gnvh->oam ? TUNNEL_OAM : 0) | ++ flags = TUNNEL_KEY | (gnvh->oam ? TUNNEL_OAM : 0) | + (gnvh->critical ? TUNNEL_CRIT_OPT : 0); + + tun_dst = udp_tun_rx_dst(skb, geneve_get_sk_family(gs), flags, +diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h +index e11423530d642..f8873c4eb003a 100644 +--- a/include/net/ip_tunnels.h ++++ b/include/net/ip_tunnels.h +@@ -489,9 +489,11 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info, + const void *from, int len, + __be16 flags) + { +- memcpy(ip_tunnel_info_opts(info), from, len); + info->options_len = len; +- info->key.tun_flags |= flags; ++ if (len > 0) { ++ memcpy(ip_tunnel_info_opts(info), from, len); ++ info->key.tun_flags |= flags; ++ } + } + + static inline struct ip_tunnel_info *lwt_tun_info(struct lwtunnel_state *lwtstate) +@@ -537,7 +539,6 @@ static inline void ip_tunnel_info_opts_set(struct ip_tunnel_info *info, + __be16 flags) + { + info->options_len = 0; +- info->key.tun_flags |= flags; + } + + #endif /* CONFIG_INET */ +-- +2.27.0 + diff --git a/queue-4.19/libfs-fix-error-cast-of-negative-value-in-simple_att.patch b/queue-4.19/libfs-fix-error-cast-of-negative-value-in-simple_att.patch new file mode 100644 index 00000000000..242b50bfc09 --- /dev/null +++ b/queue-4.19/libfs-fix-error-cast-of-negative-value-in-simple_att.patch @@ -0,0 +1,57 @@ +From 3b64c2a6eece36b5039e2f6a7cd7ae929f27df24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 22:17:19 -0800 +Subject: libfs: fix error cast of negative value in simple_attr_write() + +From: Yicong Yang + +[ Upstream commit 488dac0c9237647e9b8f788b6a342595bfa40bda ] + +The attr->set() receive a value of u64, but simple_strtoll() is used for +doing the conversion. It will lead to the error cast if user inputs a +negative value. + +Use kstrtoull() instead of simple_strtoll() to convert a string got from +the user to an unsigned value. The former will return '-EINVAL' if it +gets a negetive value, but the latter can't handle the situation +correctly. Make 'val' unsigned long long as what kstrtoull() takes, +this will eliminate the compile warning on no 64-bit architectures. + +Fixes: f7b88631a897 ("fs/libfs.c: fix simple_attr_write() on 32bit machines") +Signed-off-by: Yicong Yang +Signed-off-by: Andrew Morton +Cc: Al Viro +Link: https://lkml.kernel.org/r/1605341356-11872-1-git-send-email-yangyicong@hisilicon.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/libfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/libfs.c b/fs/libfs.c +index 02158618f4c99..be57e64834e5a 100644 +--- a/fs/libfs.c ++++ b/fs/libfs.c +@@ -868,7 +868,7 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + size_t len, loff_t *ppos) + { + struct simple_attr *attr; +- u64 val; ++ unsigned long long val; + size_t size; + ssize_t ret; + +@@ -886,7 +886,9 @@ ssize_t simple_attr_write(struct file *file, const char __user *buf, + goto out; + + attr->set_buf[size] = '\0'; +- val = simple_strtoll(attr->set_buf, NULL, 0); ++ ret = kstrtoull(attr->set_buf, 0, &val); ++ if (ret) ++ goto out; + ret = attr->set(attr->data, val); + if (ret == 0) + ret = len; /* on success, claim we got the whole input */ +-- +2.27.0 + diff --git a/queue-4.19/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch b/queue-4.19/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch new file mode 100644 index 00000000000..9b1aeac0c47 --- /dev/null +++ b/queue-4.19/mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch @@ -0,0 +1,51 @@ +From 2c3ee018eb25cf932783a66c664f3e2ac96f5473 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:18:56 +0800 +Subject: MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu + +From: Zhang Qilong + +[ Upstream commit ac3b57adf87ad9bac7e33ca26bbbb13fae1ed62b ] + +If the clk_register fails, we should free h before +function returns to prevent memleak. + +Fixes: 474402291a0ad ("MIPS: Alchemy: clock framework integration of onchip clocks") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/alchemy/common/clock.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/alchemy/common/clock.c b/arch/mips/alchemy/common/clock.c +index d129475fd40de..4254ba13c5c51 100644 +--- a/arch/mips/alchemy/common/clock.c ++++ b/arch/mips/alchemy/common/clock.c +@@ -152,6 +152,7 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + { + struct clk_init_data id; + struct clk_hw *h; ++ struct clk *clk; + + h = kzalloc(sizeof(*h), GFP_KERNEL); + if (!h) +@@ -164,7 +165,13 @@ static struct clk __init *alchemy_clk_setup_cpu(const char *parent_name, + id.ops = &alchemy_clkops_cpu; + h->init = &id; + +- return clk_register(NULL, h); ++ clk = clk_register(NULL, h); ++ if (IS_ERR(clk)) { ++ pr_err("failed to register clock\n"); ++ kfree(h); ++ } ++ ++ return clk; + } + + /* AUXPLLs ************************************************************/ +-- +2.27.0 + diff --git a/queue-4.19/mips-export-has_transparent_hugepage-for-modules.patch b/queue-4.19/mips-export-has_transparent_hugepage-for-modules.patch new file mode 100644 index 00000000000..6dce21b1739 --- /dev/null +++ b/queue-4.19/mips-export-has_transparent_hugepage-for-modules.patch @@ -0,0 +1,47 @@ +From 6e7cb57d47d8cbad4f10778071ce4f1adbe97ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 12:44:40 -0700 +Subject: MIPS: export has_transparent_hugepage() for modules + +From: Randy Dunlap + +[ Upstream commit 31b4d8e172f614adc53ddecb4b6b2f6411a49b84 ] + +MIPS should export its local version of "has_transparent_hugepage" +so that loadable modules (dax) can use it. + +Fixes this build error: +ERROR: modpost: "has_transparent_hugepage" [drivers/dax/dax.ko] undefined! + +Fixes: fd8cfd300019 ("arch: fix has_transparent_hugepage()") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Dan Williams +Cc: Vishal Verma +Cc: Dave Jiang +Cc: linux-nvdimm@lists.01.org +Cc: Hugh Dickins +Cc: Andrew Morton +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/mm/tlb-r4k.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/mm/tlb-r4k.c b/arch/mips/mm/tlb-r4k.c +index 0596505770dba..11985399c4695 100644 +--- a/arch/mips/mm/tlb-r4k.c ++++ b/arch/mips/mm/tlb-r4k.c +@@ -424,6 +424,7 @@ int has_transparent_hugepage(void) + } + return mask == PM_HUGE_MASK; + } ++EXPORT_SYMBOL(has_transparent_hugepage); + + #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ + +-- +2.27.0 + diff --git a/queue-4.19/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch b/queue-4.19/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch new file mode 100644 index 00000000000..68b9541a9e7 --- /dev/null +++ b/queue-4.19/perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch @@ -0,0 +1,54 @@ +From 40a340ecf2bd4c2857ec7afb7f1aa1250428d1a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 17:42:29 +0800 +Subject: perf lock: Don't free "lock_seq_stat" if read_count isn't zero + +From: Leo Yan + +[ Upstream commit b0e5a05cc9e37763c7f19366d94b1a6160c755bc ] + +When execute command "perf lock report", it hits failure and outputs log +as follows: + + perf: builtin-lock.c:623: report_lock_release_event: Assertion `!(seq->read_count < 0)' failed. + Aborted + +This is an imbalance issue. The locking sequence structure +"lock_seq_stat" contains the reader counter and it is used to check if +the locking sequence is balance or not between acquiring and releasing. + +If the tool wrongly frees "lock_seq_stat" when "read_count" isn't zero, +the "read_count" will be reset to zero when allocate a new structure at +the next time; thus it causes the wrong counting for reader and finally +results in imbalance issue. + +To fix this issue, if detects "read_count" is not zero (means still have +read user in the locking sequence), goto the "end" tag to skip freeing +structure "lock_seq_stat". + +Fixes: e4cef1f65061 ("perf lock: Fix state machine to recognize lock sequence") +Signed-off-by: Leo Yan +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20201104094229.17509-2-leo.yan@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-lock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-lock.c b/tools/perf/builtin-lock.c +index 6e0189df2b3ba..0cb7f7b731fb0 100644 +--- a/tools/perf/builtin-lock.c ++++ b/tools/perf/builtin-lock.c +@@ -620,7 +620,7 @@ static int report_lock_release_event(struct perf_evsel *evsel, + case SEQ_STATE_READ_ACQUIRED: + seq->read_count--; + BUG_ON(seq->read_count < 0); +- if (!seq->read_count) { ++ if (seq->read_count) { + ls->nr_release++; + goto end; + } +-- +2.27.0 + diff --git a/queue-4.19/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch b/queue-4.19/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch new file mode 100644 index 00000000000..fe0fabac18d --- /dev/null +++ b/queue-4.19/regulator-ti-abb-fix-array-out-of-bound-read-access-.patch @@ -0,0 +1,71 @@ +From e89b0a9b8be7bd14a39067e9a229ad855b47fa26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 08:50:09 -0600 +Subject: regulator: ti-abb: Fix array out of bound read access on the first + transition + +From: Nishanth Menon + +[ Upstream commit 2ba546ebe0ce2af47833d8912ced9b4a579f13cb ] + +At the start of driver initialization, we do not know what bias +setting the bootloader has configured the system for and we only know +for certain the very first time we do a transition. + +However, since the initial value of the comparison index is -EINVAL, +this negative value results in an array out of bound access on the +very first transition. + +Since we don't know what the setting is, we just set the bias +configuration as there is nothing to compare against. This prevents +the array out of bound access. + +NOTE: Even though we could use a more relaxed check of "< 0" the only +valid values(ignoring cosmic ray induced bitflips) are -EINVAL, 0+. + +Fixes: 40b1936efebd ("regulator: Introduce TI Adaptive Body Bias(ABB) on-chip LDO driver") +Link: https://lore.kernel.org/linux-mm/CA+G9fYuk4imvhyCN7D7T6PMDH6oNp6HDCRiTUKMQ6QXXjBa4ag@mail.gmail.com/ +Reported-by: Naresh Kamboju +Reviewed-by: Arnd Bergmann +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/20201118145009.10492-1-nm@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/ti-abb-regulator.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/ti-abb-regulator.c b/drivers/regulator/ti-abb-regulator.c +index 89b9314d64c9d..016330f909c09 100644 +--- a/drivers/regulator/ti-abb-regulator.c ++++ b/drivers/regulator/ti-abb-regulator.c +@@ -342,8 +342,17 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + return ret; + } + +- /* If data is exactly the same, then just update index, no change */ + info = &abb->info[sel]; ++ /* ++ * When Linux kernel is starting up, we are'nt sure of the ++ * Bias configuration that bootloader has configured. ++ * So, we get to know the actual setting the first time ++ * we are asked to transition. ++ */ ++ if (abb->current_info_idx == -EINVAL) ++ goto just_set_abb; ++ ++ /* If data is exactly the same, then just update index, no change */ + oinfo = &abb->info[abb->current_info_idx]; + if (!memcmp(info, oinfo, sizeof(*info))) { + dev_dbg(dev, "%s: Same data new idx=%d, old idx=%d\n", __func__, +@@ -351,6 +360,7 @@ static int ti_abb_set_voltage_sel(struct regulator_dev *rdev, unsigned sel) + goto out; + } + ++just_set_abb: + ret = ti_abb_set_opp(rdev, abb, info); + + out: +-- +2.27.0 + diff --git a/queue-4.19/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch b/queue-4.19/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch new file mode 100644 index 00000000000..ec20b7a1141 --- /dev/null +++ b/queue-4.19/revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch @@ -0,0 +1,48 @@ +From 747c1f08f3e61d078b534a6970e0310d520e2e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 00:25:06 +0800 +Subject: Revert "arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to + active high" + +From: Chen-Yu Tsai + +[ Upstream commit 8d80e2f00a42ef10b54e1b2d9e97314f8fd046c0 ] + +This reverts commit 75ee680cbd2e4d0156b94f9fec50076361ab12f2. + +Turns out the activity and link LEDs on the RJ45 port are active low, +just like on the Orange Pi PC. + +Revert the commit that says otherwise. + +Fixes: 75ee680cbd2e ("arm: sun8i: orangepi-pc-plus: Set EMAC activity LEDs to active high") +Fixes: 4904337fe34f ("ARM: dts: sunxi: Restore EMAC changes (boards)") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Tested-by: Jernej Skrabec +Acked-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201024162515.30032-1-wens@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts +index 71fb732089397..babf4cf1b2f68 100644 +--- a/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts ++++ b/arch/arm/boot/dts/sun8i-h3-orangepi-pc-plus.dts +@@ -53,11 +53,6 @@ + }; + }; + +-&emac { +- /* LEDs changed to active high on the plus */ +- /delete-property/ allwinner,leds-active-low; +-}; +- + &mmc1 { + vmmc-supply = <®_vcc3v3>; + bus-width = <4>; +-- +2.27.0 + diff --git a/queue-4.19/series b/queue-4.19/series index aa676f0b718..e5448e84e47 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -30,3 +30,36 @@ selftests-kvm-fix-the-segment-descriptor-layout-to-m.patch acpi-button-add-dmi-quirk-for-medion-akoya-e2228t.patch arm64-psci-avoid-printing-in-cpu_psci_cpu_die.patch vfs-remove-lockdep-bogosity-in-__sb_start_write.patch +arm64-dts-allwinner-a64-pine64-plus-fix-ethernet-nod.patch +arm64-dts-allwinner-h5-orangepi-pc2-fix-ethernet-nod.patch +arm-dts-sun8i-r40-bananapi-m2-ultra-fix-ethernet-nod.patch +revert-arm-sun8i-orangepi-pc-plus-set-emac-activity-.patch +arm-dts-sun8i-h3-orangepi-plus2e-enable-rgmii-rx-tx-.patch +arm-dts-sun8i-a83t-enable-both-rgmii-rx-tx-delay-on-.patch +arm64-dts-allwinner-a64-bananapi-m64-enable-rgmii-rx.patch +input-adxl34x-clean-up-a-data-type-in-adxl34x_probe.patch +mips-export-has_transparent_hugepage-for-modules.patch +arm64-dts-allwinner-h5-orangepi-prime-fix-ethernet-n.patch +arm-dts-imx6qdl-udoo-fix-rgmii-phy-mode-for-ksz9031-.patch +arm-dts-imx50-evk-fix-the-chip-select-1-iomux.patch +input-resistive-adc-touch-fix-kconfig-dependency-on-.patch +perf-lock-don-t-free-lock_seq_stat-if-read_count-isn.patch +ip_tunnels-set-tunnel-option-flag-when-tunnel-metada.patch +can-af_can-prevent-potential-access-of-uninitialized.patch +can-af_can-prevent-potential-access-of-uninitialized.patch-27791 +can-dev-can_restart-post-buffer-from-the-right-conte.patch +can-ti_hecc-fix-memleak-in-ti_hecc_probe.patch +can-mcba_usb-mcba_usb_start_xmit-first-fill-skb-then.patch +can-peak_usb-fix-potential-integer-overflow-on-shift.patch +can-m_can-m_can_handle_state_change-fix-state-change.patch +asoc-qcom-lpass-platform-fix-memory-leak.patch +mips-alchemy-fix-memleak-in-alchemy_clk_setup_cpu.patch +drm-sun4i-dw-hdmi-fix-error-return-code-in-sun8i_dw_.patch +can-kvaser_usb-kvaser_usb_hydra-fix-kcan-bittiming-l.patch +xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch +xfs-strengthen-rmap-record-flags-checking.patch +regulator-ti-abb-fix-array-out-of-bound-read-access-.patch +fail_function-remove-a-redundant-mutex-unlock.patch +xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch +efi-x86-free-efi_pgd-with-free_pages.patch +libfs-fix-error-cast-of-negative-value-in-simple_att.patch diff --git a/queue-4.19/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch b/queue-4.19/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch new file mode 100644 index 00000000000..d958206e3d2 --- /dev/null +++ b/queue-4.19/xfs-fix-the-minrecs-logic-when-dealing-with-inode-ro.patch @@ -0,0 +1,92 @@ +From 7ddbcf9c5f9904bdec74c4998bf9d5174c6df480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:41 -0800 +Subject: xfs: fix the minrecs logic when dealing with inode root child blocks + +From: Darrick J. Wong + +[ Upstream commit e95b6c3ef1311dd7b20467d932a24b6d0fd88395 ] + +The comment and logic in xchk_btree_check_minrecs for dealing with +inode-rooted btrees isn't quite correct. While the direct children of +the inode root are allowed to have fewer records than what would +normally be allowed for a regular ondisk btree block, this is only true +if there is only one child block and the number of records don't fit in +the inode root. + +Fixes: 08a3a692ef58 ("xfs: btree scrub should check minrecs") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/btree.c | 45 ++++++++++++++++++++++++++------------------ + 1 file changed, 27 insertions(+), 18 deletions(-) + +diff --git a/fs/xfs/scrub/btree.c b/fs/xfs/scrub/btree.c +index 4ae959f7ad2c0..c924fe3cdad65 100644 +--- a/fs/xfs/scrub/btree.c ++++ b/fs/xfs/scrub/btree.c +@@ -450,32 +450,41 @@ xchk_btree_check_minrecs( + int level, + struct xfs_btree_block *block) + { +- unsigned int numrecs; +- int ok_level; +- +- numrecs = be16_to_cpu(block->bb_numrecs); ++ struct xfs_btree_cur *cur = bs->cur; ++ unsigned int root_level = cur->bc_nlevels - 1; ++ unsigned int numrecs = be16_to_cpu(block->bb_numrecs); + + /* More records than minrecs means the block is ok. */ +- if (numrecs >= bs->cur->bc_ops->get_minrecs(bs->cur, level)) ++ if (numrecs >= cur->bc_ops->get_minrecs(cur, level)) + return; + + /* +- * Certain btree blocks /can/ have fewer than minrecs records. Any +- * level greater than or equal to the level of the highest dedicated +- * btree block are allowed to violate this constraint. +- * +- * For a btree rooted in a block, the btree root can have fewer than +- * minrecs records. If the btree is rooted in an inode and does not +- * store records in the root, the direct children of the root and the +- * root itself can have fewer than minrecs records. ++ * For btrees rooted in the inode, it's possible that the root block ++ * contents spilled into a regular ondisk block because there wasn't ++ * enough space in the inode root. The number of records in that ++ * child block might be less than the standard minrecs, but that's ok ++ * provided that there's only one direct child of the root. + */ +- ok_level = bs->cur->bc_nlevels - 1; +- if (bs->cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) +- ok_level--; +- if (level >= ok_level) ++ if ((cur->bc_flags & XFS_BTREE_ROOT_IN_INODE) && ++ level == cur->bc_nlevels - 2) { ++ struct xfs_btree_block *root_block; ++ struct xfs_buf *root_bp; ++ int root_maxrecs; ++ ++ root_block = xfs_btree_get_block(cur, root_level, &root_bp); ++ root_maxrecs = cur->bc_ops->get_dmaxrecs(cur, root_level); ++ if (be16_to_cpu(root_block->bb_numrecs) != 1 || ++ numrecs <= root_maxrecs) ++ xchk_btree_set_corrupt(bs->sc, cur, level); + return; ++ } + +- xchk_btree_set_corrupt(bs->sc, bs->cur, level); ++ /* ++ * Otherwise, only the root level is allowed to have fewer than minrecs ++ * records or keyptrs. ++ */ ++ if (level < root_level) ++ xchk_btree_set_corrupt(bs->sc, cur, level); + } + + /* +-- +2.27.0 + diff --git a/queue-4.19/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch b/queue-4.19/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch new file mode 100644 index 00000000000..bfb90adbd28 --- /dev/null +++ b/queue-4.19/xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch @@ -0,0 +1,83 @@ +From d38daaf7c3c941cac66ad3661603c25789afad6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 15:17:50 -0800 +Subject: xfs: revert "xfs: fix rmap key and record comparison functions" + +From: Darrick J. Wong + +[ Upstream commit eb8409071a1d47e3593cfe077107ac46853182ab ] + +This reverts commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f. + +Your maintainer committed a major braino in the rmap code by adding the +attr fork, bmbt, and unwritten extent usage bits into rmap record key +comparisons. While XFS uses the usage bits *in the rmap records* for +cross-referencing metadata in xfs_scrub and xfs_repair, it only needs +the owner and offset information to distinguish between reverse mappings +of the same physical extent into the data fork of a file at multiple +offsets. The other bits are not important for key comparisons for index +lookups, and never have been. + +Eric Sandeen reports that this causes regressions in generic/299, so +undo this patch before it does more damage. + +Reported-by: Eric Sandeen +Fixes: 6ff646b2ceb0 ("xfs: fix rmap key and record comparison functions") +Signed-off-by: Darrick J. Wong +Reviewed-by: Eric Sandeen +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c +index 77528f413286b..f79cf040d7450 100644 +--- a/fs/xfs/libxfs/xfs_rmap_btree.c ++++ b/fs/xfs/libxfs/xfs_rmap_btree.c +@@ -247,8 +247,8 @@ xfs_rmapbt_key_diff( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp->rm_offset); +- y = xfs_rmap_irec_offset_pack(rec); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset)); ++ y = rec->rm_offset; + if (x > y) + return 1; + else if (y > x) +@@ -279,8 +279,8 @@ xfs_rmapbt_diff_two_keys( + else if (y > x) + return -1; + +- x = be64_to_cpu(kp1->rm_offset); +- y = be64_to_cpu(kp2->rm_offset); ++ x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset)); ++ y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset)); + if (x > y) + return 1; + else if (y > x) +@@ -393,8 +393,8 @@ xfs_rmapbt_keys_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(k1->rmap.rm_offset); +- b = be64_to_cpu(k2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +@@ -423,8 +423,8 @@ xfs_rmapbt_recs_inorder( + return 1; + else if (a > b) + return 0; +- a = be64_to_cpu(r1->rmap.rm_offset); +- b = be64_to_cpu(r2->rmap.rm_offset); ++ a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset)); ++ b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset)); + if (a <= b) + return 1; + return 0; +-- +2.27.0 + diff --git a/queue-4.19/xfs-strengthen-rmap-record-flags-checking.patch b/queue-4.19/xfs-strengthen-rmap-record-flags-checking.patch new file mode 100644 index 00000000000..80c480c223b --- /dev/null +++ b/queue-4.19/xfs-strengthen-rmap-record-flags-checking.patch @@ -0,0 +1,46 @@ +From a92c0aaba8cb051108f95c32733245e76851a55e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:41 -0800 +Subject: xfs: strengthen rmap record flags checking + +From: Darrick J. Wong + +[ Upstream commit 498fe261f0d6d5189f8e11d283705dd97b474b54 ] + +We always know the correct state of the rmap record flags (attr, bmbt, +unwritten) so check them by direct comparison. + +Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/bmap.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c +index b05d65fd360b3..cf005e18d6186 100644 +--- a/fs/xfs/scrub/bmap.c ++++ b/fs/xfs/scrub/bmap.c +@@ -225,13 +225,13 @@ xchk_bmap_xref_rmap( + * which doesn't track unwritten state. + */ + if (owner != XFS_RMAP_OWN_COW && +- irec->br_state == XFS_EXT_UNWRITTEN && +- !(rmap.rm_flags & XFS_RMAP_UNWRITTEN)) ++ !!(irec->br_state == XFS_EXT_UNWRITTEN) != ++ !!(rmap.rm_flags & XFS_RMAP_UNWRITTEN)) + xchk_fblock_xref_set_corrupt(info->sc, info->whichfork, + irec->br_startoff); + +- if (info->whichfork == XFS_ATTR_FORK && +- !(rmap.rm_flags & XFS_RMAP_ATTR_FORK)) ++ if (!!(info->whichfork == XFS_ATTR_FORK) != ++ !!(rmap.rm_flags & XFS_RMAP_ATTR_FORK)) + xchk_fblock_xref_set_corrupt(info->sc, info->whichfork, + irec->br_startoff); + if (rmap.rm_flags & XFS_RMAP_BMBT_BLOCK) +-- +2.27.0 +