From: Sasha Levin Date: Wed, 13 Oct 2021 11:36:30 +0000 (-0400) Subject: Fixes for 5.14 X-Git-Tag: v4.4.289~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=36481518e8372e91c3637f7d99db76cc8541b704;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.14 Signed-off-by: Sasha Levin --- diff --git a/queue-5.14/alsa-oxfw-fix-transmission-method-for-loud-models-ba.patch b/queue-5.14/alsa-oxfw-fix-transmission-method-for-loud-models-ba.patch new file mode 100644 index 00000000000..1b776a04078 --- /dev/null +++ b/queue-5.14/alsa-oxfw-fix-transmission-method-for-loud-models-ba.patch @@ -0,0 +1,55 @@ +From 6edb53c7f829e5510d14d0dcbc2df022129b1342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Sep 2021 11:10:42 +0900 +Subject: ALSA: oxfw: fix transmission method for Loud models based on OXFW971 + +From: Takashi Sakamoto + +[ Upstream commit 64794d6db49730d22f440aef0cf4da98a56a4ea3 ] + +Loud Technologies Mackie Onyx 1640i (former model) is identified as +the model which uses OXFW971. The analysis of packet dump shows that +it transfers events in blocking method of IEC 61883-6, however the +default behaviour of ALSA oxfw driver is for non-blocking method. + +This commit adds code to detect it assuming that all of loud models +based on OXFW971 have such quirk. It brings no functional change +except for alignment rule of PCM buffer. + +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210913021042.10085-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/oxfw/oxfw.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index cb5b5e3a481b..daf731364695 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -184,13 +184,16 @@ static int detect_quirks(struct snd_oxfw *oxfw, const struct ieee1394_device_id + model = val; + } + +- /* +- * Mackie Onyx Satellite with base station has a quirk to report a wrong +- * value in 'dbs' field of CIP header against its format information. +- */ +- if (vendor == VENDOR_LOUD && model == MODEL_SATELLITE) ++ if (vendor == VENDOR_LOUD) { ++ // Mackie Onyx Satellite with base station has a quirk to report a wrong ++ // value in 'dbs' field of CIP header against its format information. + oxfw->quirks |= SND_OXFW_QUIRK_WRONG_DBS; + ++ // OXFW971-based models may transfer events by blocking method. ++ if (!(oxfw->quirks & SND_OXFW_QUIRK_JUMBO_PAYLOAD)) ++ oxfw->quirks |= SND_OXFW_QUIRK_BLOCKING_TRANSMISSION; ++ } ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.14/alsa-usb-audio-unify-mixer-resume-and-reset_resume-p.patch b/queue-5.14/alsa-usb-audio-unify-mixer-resume-and-reset_resume-p.patch new file mode 100644 index 00000000000..1fba71778e0 --- /dev/null +++ b/queue-5.14/alsa-usb-audio-unify-mixer-resume-and-reset_resume-p.patch @@ -0,0 +1,182 @@ +From 8a50c0c22d618f905c5cd512085869748d239ceb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 12:51:55 +0200 +Subject: ALSA: usb-audio: Unify mixer resume and reset_resume procedure + +From: Takashi Iwai + +[ Upstream commit 7b9cf9036609428e845dc300aec13822ba2c4ab3 ] + +USB-audio driver assumes that the normal resume would preserve the +device configuration while reset_resume wouldn't, and tries to restore +the mixer elements only at reset_resume callback. However, this seems +too naive, and some devices do behave differently, resetting the +volume at the normal resume; this resulted in the inconsistent volume +that surprised users. + +This patch changes the mixer resume code to handle both the normal and +reset resume in the same way, always restoring the original mixer +element values. This allows us to unify the both callbacks as well as +dropping the no longer used reset_resume field, which ends up with a +good code reduction. + +A slight behavior change by this patch is that now we assign +restore_mixer_value() as the default resume callback, and the function +is no longer called at reset-resume when the resume callback is +overridden by the quirk function. That is, if needed, the quirk +resume function would have to handle similarly as +restore_mixer_value() by itself. + +Reported-by: En-Shuo Hsu +Cc: Yu-Hsuan Hsu +Link: https://lore.kernel.org/r/CADDZ45UPsbpAAqP6=ZkTT8BE-yLii4Y7xSDnjK550G2DhQsMew@mail.gmail.com +Link: https://lore.kernel.org/r/20210910105155.12862-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/card.c | 18 ++++-------------- + sound/usb/mixer.c | 26 ++++---------------------- + sound/usb/mixer.h | 3 +-- + sound/usb/mixer_quirks.c | 2 +- + 4 files changed, 10 insertions(+), 39 deletions(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 6abfc9d079e7..fa75b7e72ad1 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -1020,7 +1020,7 @@ static int usb_audio_suspend(struct usb_interface *intf, pm_message_t message) + return 0; + } + +-static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) ++static int usb_audio_resume(struct usb_interface *intf) + { + struct snd_usb_audio *chip = usb_get_intfdata(intf); + struct snd_usb_stream *as; +@@ -1046,7 +1046,7 @@ static int __usb_audio_resume(struct usb_interface *intf, bool reset_resume) + * we just notify and restart the mixers + */ + list_for_each_entry(mixer, &chip->mixer_list, list) { +- err = snd_usb_mixer_resume(mixer, reset_resume); ++ err = snd_usb_mixer_resume(mixer); + if (err < 0) + goto err_out; + } +@@ -1066,20 +1066,10 @@ err_out: + atomic_dec(&chip->active); /* allow autopm after this point */ + return err; + } +- +-static int usb_audio_resume(struct usb_interface *intf) +-{ +- return __usb_audio_resume(intf, false); +-} +- +-static int usb_audio_reset_resume(struct usb_interface *intf) +-{ +- return __usb_audio_resume(intf, true); +-} + #else + #define usb_audio_suspend NULL + #define usb_audio_resume NULL +-#define usb_audio_reset_resume NULL ++#define usb_audio_resume NULL + #endif /* CONFIG_PM */ + + static const struct usb_device_id usb_audio_ids [] = { +@@ -1101,7 +1091,7 @@ static struct usb_driver usb_audio_driver = { + .disconnect = usb_audio_disconnect, + .suspend = usb_audio_suspend, + .resume = usb_audio_resume, +- .reset_resume = usb_audio_reset_resume, ++ .reset_resume = usb_audio_resume, + .id_table = usb_audio_ids, + .supports_autosuspend = 1, + }; +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 9b713b4a5ec4..fa7cf982d39e 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -3655,33 +3655,16 @@ static int restore_mixer_value(struct usb_mixer_elem_list *list) + return 0; + } + +-static int default_mixer_reset_resume(struct usb_mixer_elem_list *list) +-{ +- int err; +- +- if (list->resume) { +- err = list->resume(list); +- if (err < 0) +- return err; +- } +- return restore_mixer_value(list); +-} +- +-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume) ++int snd_usb_mixer_resume(struct usb_mixer_interface *mixer) + { + struct usb_mixer_elem_list *list; +- usb_mixer_elem_resume_func_t f; + int id, err; + + /* restore cached mixer values */ + for (id = 0; id < MAX_ID_ELEMS; id++) { + for_each_mixer_elem(list, mixer, id) { +- if (reset_resume) +- f = list->reset_resume; +- else +- f = list->resume; +- if (f) { +- err = f(list); ++ if (list->resume) { ++ err = list->resume(list); + if (err < 0) + return err; + } +@@ -3702,7 +3685,6 @@ void snd_usb_mixer_elem_init_std(struct usb_mixer_elem_list *list, + list->id = unitid; + list->dump = snd_usb_mixer_dump_cval; + #ifdef CONFIG_PM +- list->resume = NULL; +- list->reset_resume = default_mixer_reset_resume; ++ list->resume = restore_mixer_value; + #endif + } +diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h +index ea41e7a1f7bf..16567912b998 100644 +--- a/sound/usb/mixer.h ++++ b/sound/usb/mixer.h +@@ -70,7 +70,6 @@ struct usb_mixer_elem_list { + bool is_std_info; + usb_mixer_elem_dump_func_t dump; + usb_mixer_elem_resume_func_t resume; +- usb_mixer_elem_resume_func_t reset_resume; + }; + + /* iterate over mixer element list of the given unit id */ +@@ -122,7 +121,7 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag, + + #ifdef CONFIG_PM + int snd_usb_mixer_suspend(struct usb_mixer_interface *mixer); +-int snd_usb_mixer_resume(struct usb_mixer_interface *mixer, bool reset_resume); ++int snd_usb_mixer_resume(struct usb_mixer_interface *mixer); + #endif + + int snd_usb_set_cur_mix_value(struct usb_mixer_elem_info *cval, int channel, +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 0a3cb8fd7d00..4a4d3361ac04 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -151,7 +151,7 @@ static int add_single_ctl_with_resume(struct usb_mixer_interface *mixer, + *listp = list; + list->mixer = mixer; + list->id = id; +- list->reset_resume = resume; ++ list->resume = resume; + kctl = snd_ctl_new1(knew, list); + if (!kctl) { + kfree(list); +-- +2.33.0 + diff --git a/queue-5.14/asoc-intel-sof_sdw-tag-soundwire-bes-as-non-atomic.patch b/queue-5.14/asoc-intel-sof_sdw-tag-soundwire-bes-as-non-atomic.patch new file mode 100644 index 00000000000..705ad1d6784 --- /dev/null +++ b/queue-5.14/asoc-intel-sof_sdw-tag-soundwire-bes-as-non-atomic.patch @@ -0,0 +1,49 @@ +From 3573cb0bd849d05fb58e477b60412a4a8abf1b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 13:44:36 -0500 +Subject: ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic + +From: Pierre-Louis Bossart + +[ Upstream commit 58eafe1ff52ee1ce255759fc15729519af180cbb ] + +The SoundWire BEs make use of 'stream' functions for .prepare and +.trigger. These functions will in turn force a Bank Switch, which +implies a wait operation. + +Mark SoundWire BEs as nonatomic for consistency, but keep all other +types of BEs as is. The initialization of .nonatomic is done outside +of the create_sdw_dailink helper to avoid adding more parameters to +deal with a single exception to the rule that BEs are atomic. + +Suggested-by: Takashi Iwai +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210907184436.33152-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 1a867c73a48e..cb3afc4519cf 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -860,6 +860,11 @@ static int create_sdw_dailink(struct device *dev, int *be_index, + cpus + *cpu_id, cpu_dai_num, + codecs, codec_num, + NULL, &sdw_ops); ++ /* ++ * SoundWire DAILINKs use 'stream' functions and Bank Switch operations ++ * based on wait_for_completion(), tag them as 'nonatomic'. ++ */ ++ dai_links[*be_index].nonatomic = true; + + ret = set_codec_init_func(link, dai_links + (*be_index)++, + playback, group_id); +-- +2.33.0 + diff --git a/queue-5.14/asoc-sof-loader-release_firmware-on-load-failure-to-.patch b/queue-5.14/asoc-sof-loader-release_firmware-on-load-failure-to-.patch new file mode 100644 index 00000000000..faf68875a00 --- /dev/null +++ b/queue-5.14/asoc-sof-loader-release_firmware-on-load-failure-to-.patch @@ -0,0 +1,74 @@ +From 05ce614e253f5bfaaaaeea40f26b96c8ef9fb7e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 11:50:08 +0300 +Subject: ASoC: SOF: loader: release_firmware() on load failure to avoid + batching + +From: Marc Herbert + +[ Upstream commit 8a8e1813ffc35111fc0b6db49968ceb0e1615ced ] + +Invoke release_firmware() when the firmware fails to boot in +sof_probe_continue(). + +The request_firmware() framework must be informed of failures in +sof_probe_continue() otherwise its internal "batching" +feature (different from caching) cached the firmware image +forever. Attempts to correct the file in /lib/firmware/ were then +silently and confusingly ignored until the next reboot. Unloading the +drivers did not help because from their disconnected perspective the +firmware had failed so there was nothing to release. + +Also leverage the new snd_sof_fw_unload() function to simplify the +snd_sof_device_remove() function. + +Signed-off-by: Marc Herbert +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Ranjani Sridharan +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20210916085008.28929-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/core.c | 4 +--- + sound/soc/sof/loader.c | 2 ++ + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/core.c b/sound/soc/sof/core.c +index 3e4dd4a86363..59d0d7b2b55c 100644 +--- a/sound/soc/sof/core.c ++++ b/sound/soc/sof/core.c +@@ -371,7 +371,6 @@ int snd_sof_device_remove(struct device *dev) + dev_warn(dev, "error: %d failed to prepare DSP for device removal", + ret); + +- snd_sof_fw_unload(sdev); + snd_sof_ipc_free(sdev); + snd_sof_free_debug(sdev); + snd_sof_free_trace(sdev); +@@ -394,8 +393,7 @@ int snd_sof_device_remove(struct device *dev) + snd_sof_remove(sdev); + + /* release firmware */ +- release_firmware(pdata->fw); +- pdata->fw = NULL; ++ snd_sof_fw_unload(sdev); + + return 0; + } +diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c +index 2b38a77cd594..9c3f251a0dd0 100644 +--- a/sound/soc/sof/loader.c ++++ b/sound/soc/sof/loader.c +@@ -880,5 +880,7 @@ EXPORT_SYMBOL(snd_sof_run_firmware); + void snd_sof_fw_unload(struct snd_sof_dev *sdev) + { + /* TODO: support module unloading at runtime */ ++ release_firmware(sdev->pdata->fw); ++ sdev->pdata->fw = NULL; + } + EXPORT_SYMBOL(snd_sof_fw_unload); +-- +2.33.0 + diff --git a/queue-5.14/drm-amdgpu-fix-gart.bo-pin_count-leak.patch b/queue-5.14/drm-amdgpu-fix-gart.bo-pin_count-leak.patch new file mode 100644 index 00000000000..ac978d3a91b --- /dev/null +++ b/queue-5.14/drm-amdgpu-fix-gart.bo-pin_count-leak.patch @@ -0,0 +1,72 @@ +From 261f765e12b62393e3b0e0c6a8dd5d7875d7a689 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 16:05:31 +0800 +Subject: drm/amdgpu: fix gart.bo pin_count leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leslie Shi + +[ Upstream commit 66805763a97f8f7bdf742fc0851d85c02ed9411f ] + +gmc_v{9,10}_0_gart_disable() isn't called matched with +correspoding gart_enbale function in SRIOV case. This will +lead to gart.bo pin_count leak on driver unload. + +Cc: Hawking Zhang +Signed-off-by: Leslie Shi +Signed-off-by: Guchun Chen +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 3 ++- + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +index 4523df2785d6..5b6317bf9751 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c +@@ -1094,6 +1094,8 @@ static int gmc_v10_0_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + ++ gmc_v10_0_gart_disable(adev); ++ + if (amdgpu_sriov_vf(adev)) { + /* full access mode, so don't touch any GMC register */ + DRM_DEBUG("For SRIOV client, shouldn't do anything.\n"); +@@ -1102,7 +1104,6 @@ static int gmc_v10_0_hw_fini(void *handle) + + amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0); + amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0); +- gmc_v10_0_gart_disable(adev); + + return 0; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index 7eb70d69f760..f3cd2b3fb4cc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -1764,6 +1764,8 @@ static int gmc_v9_0_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + ++ gmc_v9_0_gart_disable(adev); ++ + if (amdgpu_sriov_vf(adev)) { + /* full access mode, so don't touch any GMC register */ + DRM_DEBUG("For SRIOV client, shouldn't do anything.\n"); +@@ -1772,7 +1774,6 @@ static int gmc_v9_0_hw_fini(void *handle) + + amdgpu_irq_put(adev, &adev->gmc.ecc_irq, 0); + amdgpu_irq_put(adev, &adev->gmc.vm_fault, 0); +- gmc_v9_0_gart_disable(adev); + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.14/ext4-check-and-update-i_disksize-properly.patch b/queue-5.14/ext4-check-and-update-i_disksize-properly.patch new file mode 100644 index 00000000000..c4c206c23bb --- /dev/null +++ b/queue-5.14/ext4-check-and-update-i_disksize-properly.patch @@ -0,0 +1,90 @@ +From 9eba8ca230527124cda5aa61cf7f457b15616b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 20:20:21 +0800 +Subject: ext4: check and update i_disksize properly + +From: Zhang Yi + +[ Upstream commit 4df031ff5876d94b48dd9ee486ba5522382a06b2 ] + +After commit 3da40c7b0898 ("ext4: only call ext4_truncate when size <= +isize"), i_disksize could always be updated to i_size in ext4_setattr(), +and we could sure that i_disksize <= i_size since holding inode lock and +if i_disksize < i_size there are delalloc writes pending in the range +upto i_size. If the end of the current write is <= i_size, there's no +need to touch i_disksize since writeback will push i_disksize upto +i_size eventually. So we can switch to check i_size instead of +i_disksize in ext4_da_write_end() when write to the end of the file. +we also could remove ext4_mark_inode_dirty() together because we defer +inode dirtying to generic_write_end() or ext4_da_write_inline_data_end(). + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Signed-off-by: Theodore Ts'o +Link: https://lore.kernel.org/r/20210716122024.1105856-2-yi.zhang@huawei.com +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 34 ++++++++++++++++++---------------- + 1 file changed, 18 insertions(+), 16 deletions(-) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 73daf9443e5e..a47ff8ce289b 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3089,35 +3089,37 @@ static int ext4_da_write_end(struct file *file, + end = start + copied - 1; + + /* +- * generic_write_end() will run mark_inode_dirty() if i_size +- * changes. So let's piggyback the i_disksize mark_inode_dirty +- * into that. ++ * Since we are holding inode lock, we are sure i_disksize <= ++ * i_size. We also know that if i_disksize < i_size, there are ++ * delalloc writes pending in the range upto i_size. If the end of ++ * the current write is <= i_size, there's no need to touch ++ * i_disksize since writeback will push i_disksize upto i_size ++ * eventually. If the end of the current write is > i_size and ++ * inside an allocated block (ext4_da_should_update_i_disksize() ++ * check), we need to update i_disksize here as neither ++ * ext4_writepage() nor certain ext4_writepages() paths not ++ * allocating blocks update i_disksize. ++ * ++ * Note that we defer inode dirtying to generic_write_end() / ++ * ext4_da_write_inline_data_end(). + */ + new_i_size = pos + copied; +- if (copied && new_i_size > EXT4_I(inode)->i_disksize) { ++ if (copied && new_i_size > inode->i_size) { + if (ext4_has_inline_data(inode) || +- ext4_da_should_update_i_disksize(page, end)) { ++ ext4_da_should_update_i_disksize(page, end)) + ext4_update_i_disksize(inode, new_i_size); +- /* We need to mark inode dirty even if +- * new_i_size is less that inode->i_size +- * bu greater than i_disksize.(hint delalloc) +- */ +- ret = ext4_mark_inode_dirty(handle, inode); +- } + } + + if (write_mode != CONVERT_INLINE_DATA && + ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA) && + ext4_has_inline_data(inode)) +- ret2 = ext4_da_write_inline_data_end(inode, pos, len, copied, ++ ret = ext4_da_write_inline_data_end(inode, pos, len, copied, + page); + else +- ret2 = generic_write_end(file, mapping, pos, len, copied, ++ ret = generic_write_end(file, mapping, pos, len, copied, + page, fsdata); + +- copied = ret2; +- if (ret2 < 0) +- ret = ret2; ++ copied = ret; + ret2 = ext4_journal_stop(handle); + if (unlikely(ret2 && !ret)) + ret = ret2; +-- +2.33.0 + diff --git a/queue-5.14/ext4-correct-the-error-path-of-ext4_write_inline_dat.patch b/queue-5.14/ext4-correct-the-error-path-of-ext4_write_inline_dat.patch new file mode 100644 index 00000000000..3f69d18cf63 --- /dev/null +++ b/queue-5.14/ext4-correct-the-error-path-of-ext4_write_inline_dat.patch @@ -0,0 +1,129 @@ +From 9b9078aef67cd09854fca9de0749a7680087d3f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 20:20:22 +0800 +Subject: ext4: correct the error path of ext4_write_inline_data_end() + +From: Zhang Yi + +[ Upstream commit 55ce2f649b9e88111270333a8127e23f4f8f42d7 ] + +Current error path of ext4_write_inline_data_end() is not correct. + +Firstly, it should pass out the error value if ext4_get_inode_loc() +return fail, or else it could trigger infinite loop if we inject error +here. And then it's better to add inode to orphan list if it return fail +in ext4_journal_stop(), otherwise we could not restore inline xattr +entry after power failure. Finally, we need to reset the 'ret' value if +ext4_write_inline_data_end() return success in ext4_write_end() and +ext4_journalled_write_end(), otherwise we could not get the error return +value of ext4_journal_stop(). + +Signed-off-by: Zhang Yi +Reviewed-by: Jan Kara +Signed-off-by: Theodore Ts'o +Link: https://lore.kernel.org/r/20210716122024.1105856-3-yi.zhang@huawei.com +Signed-off-by: Sasha Levin +--- + fs/ext4/inline.c | 15 +++++---------- + fs/ext4/inode.c | 7 +++++-- + 2 files changed, 10 insertions(+), 12 deletions(-) + +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 24e994e75f5c..8049448476a6 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -733,18 +733,13 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + void *kaddr; + struct ext4_iloc iloc; + +- if (unlikely(copied < len)) { +- if (!PageUptodate(page)) { +- copied = 0; +- goto out; +- } +- } ++ if (unlikely(copied < len) && !PageUptodate(page)) ++ return 0; + + ret = ext4_get_inode_loc(inode, &iloc); + if (ret) { + ext4_std_error(inode->i_sb, ret); +- copied = 0; +- goto out; ++ return ret; + } + + ext4_write_lock_xattr(inode, &no_expand); +@@ -757,7 +752,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + (void) ext4_find_inline_data_nolock(inode); + + kaddr = kmap_atomic(page); +- ext4_write_inline_data(inode, &iloc, kaddr, pos, len); ++ ext4_write_inline_data(inode, &iloc, kaddr, pos, copied); + kunmap_atomic(kaddr); + SetPageUptodate(page); + /* clear page dirty so that writepages wouldn't work for us. */ +@@ -766,7 +761,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + ext4_write_unlock_xattr(inode, &no_expand); + brelse(iloc.bh); + mark_inode_dirty(inode); +-out: ++ + return copied; + } + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index a47ff8ce289b..fc6ea56de77c 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1295,6 +1295,7 @@ static int ext4_write_end(struct file *file, + goto errout; + } + copied = ret; ++ ret = 0; + } else + copied = block_write_end(file, mapping, pos, + len, copied, page, fsdata); +@@ -1321,13 +1322,14 @@ static int ext4_write_end(struct file *file, + if (i_size_changed || inline_data) + ret = ext4_mark_inode_dirty(handle, inode); + ++errout: + if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode)) + /* if we have allocated more blocks and copied + * less. We will have blocks allocated outside + * inode->i_size. So truncate them + */ + ext4_orphan_add(handle, inode); +-errout: ++ + ret2 = ext4_journal_stop(handle); + if (!ret) + ret = ret2; +@@ -1410,6 +1412,7 @@ static int ext4_journalled_write_end(struct file *file, + goto errout; + } + copied = ret; ++ ret = 0; + } else if (unlikely(copied < len) && !PageUptodate(page)) { + copied = 0; + ext4_journalled_zero_new_buffers(handle, page, from, to); +@@ -1439,6 +1442,7 @@ static int ext4_journalled_write_end(struct file *file, + ret = ret2; + } + ++errout: + if (pos + len > inode->i_size && !verity && ext4_can_truncate(inode)) + /* if we have allocated more blocks and copied + * less. We will have blocks allocated outside +@@ -1446,7 +1450,6 @@ static int ext4_journalled_write_end(struct file *file, + */ + ext4_orphan_add(handle, inode); + +-errout: + ret2 = ext4_journal_stop(handle); + if (!ret) + ret = ret2; +-- +2.33.0 + diff --git a/queue-5.14/ext4-enforce-buffer-head-state-assertion-in-ext4_da_.patch b/queue-5.14/ext4-enforce-buffer-head-state-assertion-in-ext4_da_.patch new file mode 100644 index 00000000000..5801065e57c --- /dev/null +++ b/queue-5.14/ext4-enforce-buffer-head-state-assertion-in-ext4_da_.patch @@ -0,0 +1,56 @@ +From b2838e02c515366e8452370fcda5baa2dcc8be68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 10:49:27 -0400 +Subject: ext4: enforce buffer head state assertion in ext4_da_map_blocks + +From: Eric Whitney + +[ Upstream commit 948ca5f30e1df0c11eb5b0f410b9ceb97fa77ad9 ] + +Remove the code that re-initializes a buffer head with an invalid block +number and BH_New and BH_Delay bits when a matching delayed and +unwritten block has been found in the extent status cache. Replace it +with assertions that verify the buffer head already has this state +correctly set. The current code masked an inline data truncation bug +that left stale entries in the extent status cache. With this change, +generic/130 can be used to reproduce and detect that bug. + +Signed-off-by: Eric Whitney +Signed-off-by: Theodore Ts'o +Link: https://lore.kernel.org/r/20210819144927.25163-3-enwlinux@gmail.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index fc6ea56de77c..d204688b32a3 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1726,13 +1726,16 @@ static int ext4_da_map_blocks(struct inode *inode, sector_t iblock, + } + + /* +- * Delayed extent could be allocated by fallocate. +- * So we need to check it. ++ * the buffer head associated with a delayed and not unwritten ++ * block found in the extent status cache must contain an ++ * invalid block number and have its BH_New and BH_Delay bits ++ * set, reflecting the state assigned when the block was ++ * initially delayed allocated + */ +- if (ext4_es_is_delayed(&es) && !ext4_es_is_unwritten(&es)) { +- map_bh(bh, inode->i_sb, invalid_block); +- set_buffer_new(bh); +- set_buffer_delay(bh); ++ if (ext4_es_is_delonly(&es)) { ++ BUG_ON(bh->b_blocknr != invalid_block); ++ BUG_ON(!buffer_new(bh)); ++ BUG_ON(!buffer_delay(bh)); + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.14/hid-apple-fix-logical-maximum-and-usage-maximum-of-m.patch b/queue-5.14/hid-apple-fix-logical-maximum-and-usage-maximum-of-m.patch new file mode 100644 index 00000000000..4c644d20687 --- /dev/null +++ b/queue-5.14/hid-apple-fix-logical-maximum-and-usage-maximum-of-m.patch @@ -0,0 +1,106 @@ +From 79ba7e46338fcf72f6894398ef28d3185f2e5743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 20:03:25 +0900 +Subject: HID: apple: Fix logical maximum and usage maximum of Magic Keyboard + JIS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mizuho Mori + +[ Upstream commit 67fd71ba16a37c663d139f5ba5296f344d80d072 ] + +Apple Magic Keyboard(JIS)'s Logical Maximum and Usage Maximum are wrong. + +Below is a report descriptor. + +0x05, 0x01, /* Usage Page (Desktop), */ +0x09, 0x06, /* Usage (Keyboard), */ +0xA1, 0x01, /* Collection (Application), */ +0x85, 0x01, /* Report ID (1), */ +0x05, 0x07, /* Usage Page (Keyboard), */ +0x15, 0x00, /* Logical Minimum (0), */ +0x25, 0x01, /* Logical Maximum (1), */ +0x19, 0xE0, /* Usage Minimum (KB Leftcontrol), */ +0x29, 0xE7, /* Usage Maximum (KB Right GUI), */ +0x75, 0x01, /* Report Size (1), */ +0x95, 0x08, /* Report Count (8), */ +0x81, 0x02, /* Input (Variable), */ +0x95, 0x05, /* Report Count (5), */ +0x75, 0x01, /* Report Size (1), */ +0x05, 0x08, /* Usage Page (LED), */ +0x19, 0x01, /* Usage Minimum (01h), */ +0x29, 0x05, /* Usage Maximum (05h), */ +0x91, 0x02, /* Output (Variable), */ +0x95, 0x01, /* Report Count (1), */ +0x75, 0x03, /* Report Size (3), */ +0x91, 0x03, /* Output (Constant, Variable), */ +0x95, 0x08, /* Report Count (8), */ +0x75, 0x01, /* Report Size (1), */ +0x15, 0x00, /* Logical Minimum (0), */ +0x25, 0x01, /* Logical Maximum (1), */ + +here is a report descriptor which is parsed one in kernel. +see sys/kernel/debug/hid//rdesc + +05 01 09 06 a1 01 85 01 05 07 +15 00 25 01 19 e0 29 e7 75 01 +95 08 81 02 95 05 75 01 05 08 +19 01 29 05 91 02 95 01 75 03 +91 03 95 08 75 01 15 00 25 01 +06 00 ff 09 03 81 03 95 06 75 +08 15 00 25 [65] 05 07 19 00 29 +[65] 81 00 95 01 75 01 15 00 25 +01 05 0c 09 b8 81 02 95 01 75 +01 06 01 ff 09 03 81 02 95 01 +75 06 81 03 06 02 ff 09 55 85 +55 15 00 26 ff 00 75 08 95 40 +b1 a2 c0 06 00 ff 09 14 a1 01 +85 90 05 84 75 01 95 03 15 00 +25 01 09 61 05 85 09 44 09 46 +81 02 95 05 81 01 75 08 95 01 +15 00 26 ff 00 09 65 81 02 c0 +00 + +Position 64(Logical Maximum) and 70(Usage Maximum) are 101. +Both should be 0xE7 to support JIS specific keys(ろ, Eisu, Kana, |) support. +position 117 is also 101 but not related(it is Usage 65h). + +There are no difference of product id between JIS and ANSI. +They are same 0x0267. + +Signed-off-by: Mizuho Mori +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-apple.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index dc6bd4299c54..87edcd4ce07c 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -322,12 +322,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field, + + /* + * MacBook JIS keyboard has wrong logical maximum ++ * Magic Keyboard JIS has wrong logical maximum + */ + static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { + struct apple_sc *asc = hid_get_drvdata(hdev); + ++ if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) { ++ hid_info(hdev, ++ "fixing up Magic Keyboard JIS report descriptor\n"); ++ rdesc[64] = rdesc[70] = 0xe7; ++ } ++ + if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 && + rdesc[53] == 0x65 && rdesc[59] == 0x65) { + hid_info(hdev, +-- +2.33.0 + diff --git a/queue-5.14/hid-wacom-add-new-intuos-bt-ctl-4100wl-ctl-6100wl-de.patch b/queue-5.14/hid-wacom-add-new-intuos-bt-ctl-4100wl-ctl-6100wl-de.patch new file mode 100644 index 00000000000..300973f12b0 --- /dev/null +++ b/queue-5.14/hid-wacom-add-new-intuos-bt-ctl-4100wl-ctl-6100wl-de.patch @@ -0,0 +1,49 @@ +From 40489da2a3a637c546fa1010a4780531be2a2981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 13:28:25 -0400 +Subject: HID: wacom: Add new Intuos BT (CTL-4100WL/CTL-6100WL) device IDs + +From: Joshua-Dickens + +[ Upstream commit 0c8fbaa553077630e8eae45bd9676cfc01836aeb ] + +Add the new PIDs to wacom_wac.c to support the new models in the Intuos series. + +[jkosina@suse.cz: fix changelog] +Signed-off-by: Joshua Dickens +Reviewed-by: Ping Cheng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/wacom_wac.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 81ba642adcb7..528d94ccd76f 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -4720,6 +4720,12 @@ static const struct wacom_features wacom_features_0x393 = + { "Wacom Intuos Pro S", 31920, 19950, 8191, 63, + INTUOSP2S_BT, WACOM_INTUOS3_RES, WACOM_INTUOS3_RES, 7, + .touch_max = 10 }; ++static const struct wacom_features wacom_features_0x3c6 = ++ { "Wacom Intuos BT S", 15200, 9500, 4095, 63, ++ INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 }; ++static const struct wacom_features wacom_features_0x3c8 = ++ { "Wacom Intuos BT M", 21600, 13500, 4095, 63, ++ INTUOSHT3_BT, WACOM_INTUOS_RES, WACOM_INTUOS_RES, 4 }; + + static const struct wacom_features wacom_features_HID_ANY_ID = + { "Wacom HID", .type = HID_GENERIC, .oVid = HID_ANY_ID, .oPid = HID_ANY_ID }; +@@ -4893,6 +4899,8 @@ const struct hid_device_id wacom_ids[] = { + { USB_DEVICE_WACOM(0x37A) }, + { USB_DEVICE_WACOM(0x37B) }, + { BT_DEVICE_WACOM(0x393) }, ++ { BT_DEVICE_WACOM(0x3c6) }, ++ { BT_DEVICE_WACOM(0x3c8) }, + { USB_DEVICE_WACOM(0x4001) }, + { USB_DEVICE_WACOM(0x4004) }, + { USB_DEVICE_WACOM(0x5000) }, +-- +2.33.0 + diff --git a/queue-5.14/hwmon-ltc2947-properly-handle-errors-when-looking-fo.patch b/queue-5.14/hwmon-ltc2947-properly-handle-errors-when-looking-fo.patch new file mode 100644 index 00000000000..34387f4b029 --- /dev/null +++ b/queue-5.14/hwmon-ltc2947-properly-handle-errors-when-looking-fo.patch @@ -0,0 +1,48 @@ +From 6567f320895c3219946e412b5dc6a030b94ee344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 22:11:13 +0200 +Subject: hwmon: (ltc2947) Properly handle errors when looking for the external + clock +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 6f7d70467121f790b36af2d84bc02b5c236bf5e6 ] + +The return value of devm_clk_get should in general be propagated to +upper layer. In this case the clk is optional, use the appropriate +wrapper instead of interpreting all errors as "The optional clk is not +available". + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20210923201113.398932-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ltc2947-core.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/ltc2947-core.c b/drivers/hwmon/ltc2947-core.c +index bb3f7749a0b0..5423466de697 100644 +--- a/drivers/hwmon/ltc2947-core.c ++++ b/drivers/hwmon/ltc2947-core.c +@@ -989,8 +989,12 @@ static int ltc2947_setup(struct ltc2947_data *st) + return ret; + + /* check external clock presence */ +- extclk = devm_clk_get(st->dev, NULL); +- if (!IS_ERR(extclk)) { ++ extclk = devm_clk_get_optional(st->dev, NULL); ++ if (IS_ERR(extclk)) ++ return dev_err_probe(st->dev, PTR_ERR(extclk), ++ "Failed to get external clock\n"); ++ ++ if (extclk) { + unsigned long rate_hz; + u8 pre = 0, div, tbctl; + u64 aux; +-- +2.33.0 + diff --git a/queue-5.14/hwmon-pmbus-ibm-cffps-max_power_out-swap-changes.patch b/queue-5.14/hwmon-pmbus-ibm-cffps-max_power_out-swap-changes.patch new file mode 100644 index 00000000000..e906fbeb10e --- /dev/null +++ b/queue-5.14/hwmon-pmbus-ibm-cffps-max_power_out-swap-changes.patch @@ -0,0 +1,58 @@ +From cac57709f71f4ca95cad333546a0f8b944faff63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 20:50:51 +0000 +Subject: hwmon: (pmbus/ibm-cffps) max_power_out swap changes + +From: Brandon Wyman + +[ Upstream commit f067d5585cda2de1e47dde914a8a4f151659e0ad ] + +The bytes for max_power_out from the ibm-cffps devices differ in byte +order for some power supplies. + +The Witherspoon power supply returns the bytes in MSB/LSB order. + +The Rainier power supply returns the bytes in LSB/MSB order. + +The Witherspoon power supply uses version cffps1. The Rainier power +supply should use version cffps2. If version is cffps1, swap the bytes +before output to max_power_out. + +Tested: + Witherspoon before: 3148. Witherspoon after: 3148. + Rainier before: 53255. Rainier after: 2000. + +Signed-off-by: Brandon Wyman +Reviewed-by: Eddie James +Link: https://lore.kernel.org/r/20210928205051.1222815-1-bjwyman@gmail.com +[groeck: Replaced yoda programming] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/ibm-cffps.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/pmbus/ibm-cffps.c b/drivers/hwmon/pmbus/ibm-cffps.c +index df712ce4b164..53f7d1418bc9 100644 +--- a/drivers/hwmon/pmbus/ibm-cffps.c ++++ b/drivers/hwmon/pmbus/ibm-cffps.c +@@ -171,8 +171,14 @@ static ssize_t ibm_cffps_debugfs_read(struct file *file, char __user *buf, + cmd = CFFPS_SN_CMD; + break; + case CFFPS_DEBUGFS_MAX_POWER_OUT: +- rc = i2c_smbus_read_word_swapped(psu->client, +- CFFPS_MAX_POWER_OUT_CMD); ++ if (psu->version == cffps1) { ++ rc = i2c_smbus_read_word_swapped(psu->client, ++ CFFPS_MAX_POWER_OUT_CMD); ++ } else { ++ rc = i2c_smbus_read_word_data(psu->client, ++ CFFPS_MAX_POWER_OUT_CMD); ++ } ++ + if (rc < 0) + return rc; + +-- +2.33.0 + diff --git a/queue-5.14/interconnect-qcom-sdm660-add-missing-a2noc-qos-clock.patch b/queue-5.14/interconnect-qcom-sdm660-add-missing-a2noc-qos-clock.patch new file mode 100644 index 00000000000..92a6430bc03 --- /dev/null +++ b/queue-5.14/interconnect-qcom-sdm660-add-missing-a2noc-qos-clock.patch @@ -0,0 +1,61 @@ +From 46b7837933b0ed99d10be58b48ffc159a4614aaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Sep 2021 15:49:55 +0300 +Subject: interconnect: qcom: sdm660: Add missing a2noc qos clocks + +From: Shawn Guo + +[ Upstream commit 13404ac8882f5225af07545215f4975a564c3740 ] + +It adds the missing a2noc clocks required for QoS registers programming +per downstream kernel[1]. Otherwise, qcom_icc_noc_set_qos_priority() +call on mas_ufs or mas_usb_hs node will simply result in a hardware hang +on SDM660 SoC. + +[1] https://source.codeaurora.org/quic/la/kernel/msm-4.4/tree/arch/arm/boot/dts/qcom/sdm660-bus.dtsi?h=LA.UM.8.2.r1-04800-sdm660.0#n43 + +Signed-off-by: Shawn Guo +Tested-by: Bjorn Andersson +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20210824043435.23190-3-shawn.guo@linaro.org +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/qcom/sdm660.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/interconnect/qcom/sdm660.c b/drivers/interconnect/qcom/sdm660.c +index 99eef7e2d326..fb23a5b780a4 100644 +--- a/drivers/interconnect/qcom/sdm660.c ++++ b/drivers/interconnect/qcom/sdm660.c +@@ -173,6 +173,16 @@ static const struct clk_bulk_data bus_mm_clocks[] = { + { .id = "iface" }, + }; + ++static const struct clk_bulk_data bus_a2noc_clocks[] = { ++ { .id = "bus" }, ++ { .id = "bus_a" }, ++ { .id = "ipa" }, ++ { .id = "ufs_axi" }, ++ { .id = "aggre2_ufs_axi" }, ++ { .id = "aggre2_usb3_axi" }, ++ { .id = "cfg_noc_usb2_axi" }, ++}; ++ + /** + * struct qcom_icc_provider - Qualcomm specific interconnect provider + * @provider: generic interconnect provider +@@ -809,6 +819,10 @@ static int qnoc_probe(struct platform_device *pdev) + qp->bus_clks = devm_kmemdup(dev, bus_mm_clocks, + sizeof(bus_mm_clocks), GFP_KERNEL); + qp->num_clks = ARRAY_SIZE(bus_mm_clocks); ++ } else if (of_device_is_compatible(dev->of_node, "qcom,sdm660-a2noc")) { ++ qp->bus_clks = devm_kmemdup(dev, bus_a2noc_clocks, ++ sizeof(bus_a2noc_clocks), GFP_KERNEL); ++ qp->num_clks = ARRAY_SIZE(bus_a2noc_clocks); + } else { + if (of_device_is_compatible(dev->of_node, "qcom,sdm660-bimc")) + qp->is_bimc_node = true; +-- +2.33.0 + diff --git a/queue-5.14/io_uring-kill-fasync.patch b/queue-5.14/io_uring-kill-fasync.patch new file mode 100644 index 00000000000..70931eaf111 --- /dev/null +++ b/queue-5.14/io_uring-kill-fasync.patch @@ -0,0 +1,83 @@ +From afc14c8d7826b1c45a27eb386bb732c582811bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 10:39:33 +0100 +Subject: io_uring: kill fasync + +From: Pavel Begunkov + +[ Upstream commit 3f008385d46d3cea4a097d2615cd485f2184ba26 ] + +We have never supported fasync properly, it would only fire when there +is something polling io_uring making it useless. The original support came +in through the initial io_uring merge for 5.1. Since it's broken and +nobody has reported it, get rid of the fasync bits. + +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/2f7ca3d344d406d34fa6713824198915c41cea86.1633080236.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 17 ++--------------- + 1 file changed, 2 insertions(+), 15 deletions(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 675216f7022d..2f79586c1a7c 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -419,7 +419,6 @@ struct io_ring_ctx { + struct wait_queue_head cq_wait; + unsigned cq_extra; + atomic_t cq_timeouts; +- struct fasync_struct *cq_fasync; + unsigned cq_last_tm_flush; + } ____cacheline_aligned_in_smp; + +@@ -1448,10 +1447,8 @@ static void io_cqring_ev_posted(struct io_ring_ctx *ctx) + wake_up(&ctx->sq_data->wait); + if (io_should_trigger_evfd(ctx)) + eventfd_signal(ctx->cq_ev_fd, 1); +- if (waitqueue_active(&ctx->poll_wait)) { ++ if (waitqueue_active(&ctx->poll_wait)) + wake_up_interruptible(&ctx->poll_wait); +- kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN); +- } + } + + static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx) +@@ -1465,10 +1462,8 @@ static void io_cqring_ev_posted_iopoll(struct io_ring_ctx *ctx) + } + if (io_should_trigger_evfd(ctx)) + eventfd_signal(ctx->cq_ev_fd, 1); +- if (waitqueue_active(&ctx->poll_wait)) { ++ if (waitqueue_active(&ctx->poll_wait)) + wake_up_interruptible(&ctx->poll_wait); +- kill_fasync(&ctx->cq_fasync, SIGIO, POLL_IN); +- } + } + + /* Returns true if there are no backlogged entries after the flush */ +@@ -8779,13 +8774,6 @@ static __poll_t io_uring_poll(struct file *file, poll_table *wait) + return mask; + } + +-static int io_uring_fasync(int fd, struct file *file, int on) +-{ +- struct io_ring_ctx *ctx = file->private_data; +- +- return fasync_helper(fd, file, on, &ctx->cq_fasync); +-} +- + static int io_unregister_personality(struct io_ring_ctx *ctx, unsigned id) + { + const struct cred *creds; +@@ -9571,7 +9559,6 @@ static const struct file_operations io_uring_fops = { + .mmap_capabilities = io_uring_nommu_mmap_capabilities, + #endif + .poll = io_uring_poll, +- .fasync = io_uring_fasync, + #ifdef CONFIG_PROC_FS + .show_fdinfo = io_uring_show_fdinfo, + #endif +-- +2.33.0 + diff --git a/queue-5.14/kvm-arm64-nvhe-fix-missing-force-for-hyp-reloc.s-bui.patch b/queue-5.14/kvm-arm64-nvhe-fix-missing-force-for-hyp-reloc.s-bui.patch new file mode 100644 index 00000000000..f5b43268311 --- /dev/null +++ b/queue-5.14/kvm-arm64-nvhe-fix-missing-force-for-hyp-reloc.s-bui.patch @@ -0,0 +1,43 @@ +From ca4527b9e146af36e76e77a6c736362df02ad711 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 13:21:37 +0800 +Subject: KVM: arm64: nvhe: Fix missing FORCE for hyp-reloc.S build rule + +From: Zenghui Yu + +[ Upstream commit a49b50a3c1c3226d26e1dd11e8b763f27e477623 ] + +Add FORCE so that if_changed can detect the command line change. + +We'll otherwise see a compilation warning since commit e1f86d7b4b2a +("kbuild: warn if FORCE is missing for if_changed(_dep,_rule) and +filechk"). + +arch/arm64/kvm/hyp/nvhe/Makefile:58: FORCE prerequisite is missing + +Cc: David Brazdil +Cc: Masahiro Yamada +Signed-off-by: Zenghui Yu +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210907052137.1059-1-yuzenghui@huawei.com +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/hyp/nvhe/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kvm/hyp/nvhe/Makefile b/arch/arm64/kvm/hyp/nvhe/Makefile +index 5df6193fc430..8d741f71377f 100644 +--- a/arch/arm64/kvm/hyp/nvhe/Makefile ++++ b/arch/arm64/kvm/hyp/nvhe/Makefile +@@ -54,7 +54,7 @@ $(obj)/kvm_nvhe.tmp.o: $(obj)/hyp.lds $(addprefix $(obj)/,$(hyp-obj)) FORCE + # runtime. Because the hypervisor is part of the kernel binary, relocations + # produce a kernel VA. We enumerate relocations targeting hyp at build time + # and convert the kernel VAs at those positions to hyp VAs. +-$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel ++$(obj)/hyp-reloc.S: $(obj)/kvm_nvhe.tmp.o $(obj)/gen-hyprel FORCE + $(call if_changed,hyprel) + + # 5) Compile hyp-reloc.S and link it into the existing partially linked object. +-- +2.33.0 + diff --git a/queue-5.14/m68k-handle-arrivals-of-multiple-signals-correctly.patch b/queue-5.14/m68k-handle-arrivals-of-multiple-signals-correctly.patch new file mode 100644 index 00000000000..3747e65e471 --- /dev/null +++ b/queue-5.14/m68k-handle-arrivals-of-multiple-signals-correctly.patch @@ -0,0 +1,231 @@ +From 2ba3770f6424b206acd69712e1cf37489a31472e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 17:19:00 +0000 +Subject: m68k: Handle arrivals of multiple signals correctly + +From: Al Viro + +[ Upstream commit 4bb0bd81ce5e97092dfda6a106d414b703ec0ee8 ] + +When we have several pending signals, have entered with the kernel +with large exception frame *and* have already built at least one +sigframe, regs->stkadj is going to be non-zero and regs->format/sr/pc +are going to be junk - the real values are in shifted exception stack +frame we'd built when putting together the first sigframe. + +If that happens, subsequent sigframes are going to be garbage. +Not hard to fix - just need to find the "adjusted" frame first +and look for format/vector/sr/pc in it. + +Signed-off-by: Al Viro +Tested-by: Michael Schmitz +Reviewed-by: Michael Schmitz +Tested-by: Finn Thain +Link: https://lore.kernel.org/r/YP2dBIAPTaVvHiZ6@zeniv-ca.linux.org.uk +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/kernel/signal.c | 88 +++++++++++++++++++-------------------- + 1 file changed, 42 insertions(+), 46 deletions(-) + +diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c +index 8f215e79e70e..cd11eb101eac 100644 +--- a/arch/m68k/kernel/signal.c ++++ b/arch/m68k/kernel/signal.c +@@ -447,7 +447,7 @@ static inline void save_fpu_state(struct sigcontext *sc, struct pt_regs *regs) + + if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) { + fpu_version = sc->sc_fpstate[0]; +- if (CPU_IS_020_OR_030 && ++ if (CPU_IS_020_OR_030 && !regs->stkadj && + regs->vector >= (VEC_FPBRUC * 4) && + regs->vector <= (VEC_FPNAN * 4)) { + /* Clear pending exception in 68882 idle frame */ +@@ -510,7 +510,7 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs * + if (!(CPU_IS_060 || CPU_IS_COLDFIRE)) + context_size = fpstate[1]; + fpu_version = fpstate[0]; +- if (CPU_IS_020_OR_030 && ++ if (CPU_IS_020_OR_030 && !regs->stkadj && + regs->vector >= (VEC_FPBRUC * 4) && + regs->vector <= (VEC_FPNAN * 4)) { + /* Clear pending exception in 68882 idle frame */ +@@ -832,18 +832,24 @@ badframe: + return 0; + } + ++static inline struct pt_regs *rte_regs(struct pt_regs *regs) ++{ ++ return (void *)regs + regs->stkadj; ++} ++ + static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, + unsigned long mask) + { ++ struct pt_regs *tregs = rte_regs(regs); + sc->sc_mask = mask; + sc->sc_usp = rdusp(); + sc->sc_d0 = regs->d0; + sc->sc_d1 = regs->d1; + sc->sc_a0 = regs->a0; + sc->sc_a1 = regs->a1; +- sc->sc_sr = regs->sr; +- sc->sc_pc = regs->pc; +- sc->sc_formatvec = regs->format << 12 | regs->vector; ++ sc->sc_sr = tregs->sr; ++ sc->sc_pc = tregs->pc; ++ sc->sc_formatvec = tregs->format << 12 | tregs->vector; + save_a5_state(sc, regs); + save_fpu_state(sc, regs); + } +@@ -851,6 +857,7 @@ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, + static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs) + { + struct switch_stack *sw = (struct switch_stack *)regs - 1; ++ struct pt_regs *tregs = rte_regs(regs); + greg_t __user *gregs = uc->uc_mcontext.gregs; + int err = 0; + +@@ -871,9 +878,9 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs * + err |= __put_user(sw->a5, &gregs[13]); + err |= __put_user(sw->a6, &gregs[14]); + err |= __put_user(rdusp(), &gregs[15]); +- err |= __put_user(regs->pc, &gregs[16]); +- err |= __put_user(regs->sr, &gregs[17]); +- err |= __put_user((regs->format << 12) | regs->vector, &uc->uc_formatvec); ++ err |= __put_user(tregs->pc, &gregs[16]); ++ err |= __put_user(tregs->sr, &gregs[17]); ++ err |= __put_user((tregs->format << 12) | tregs->vector, &uc->uc_formatvec); + err |= rt_save_fpu_state(uc, regs); + return err; + } +@@ -890,13 +897,14 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + struct pt_regs *regs) + { + struct sigframe __user *frame; +- int fsize = frame_extra_sizes(regs->format); ++ struct pt_regs *tregs = rte_regs(regs); ++ int fsize = frame_extra_sizes(tregs->format); + struct sigcontext context; + int err = 0, sig = ksig->sig; + + if (fsize < 0) { + pr_debug("setup_frame: Unknown frame format %#x\n", +- regs->format); ++ tregs->format); + return -EFAULT; + } + +@@ -907,7 +915,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + + err |= __put_user(sig, &frame->sig); + +- err |= __put_user(regs->vector, &frame->code); ++ err |= __put_user(tregs->vector, &frame->code); + err |= __put_user(&frame->sc, &frame->psc); + + if (_NSIG_WORDS > 1) +@@ -933,34 +941,28 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + + push_cache ((unsigned long) &frame->retcode); + +- /* +- * Set up registers for signal handler. All the state we are about +- * to destroy is successfully copied to sigframe. +- */ +- wrusp ((unsigned long) frame); +- regs->pc = (unsigned long) ksig->ka.sa.sa_handler; +- adjustformat(regs); +- + /* + * This is subtle; if we build more than one sigframe, all but the + * first one will see frame format 0 and have fsize == 0, so we won't + * screw stkadj. + */ +- if (fsize) ++ if (fsize) { + regs->stkadj = fsize; +- +- /* Prepare to skip over the extra stuff in the exception frame. */ +- if (regs->stkadj) { +- struct pt_regs *tregs = +- (struct pt_regs *)((ulong)regs + regs->stkadj); ++ tregs = rte_regs(regs); + pr_debug("Performing stackadjust=%04lx\n", regs->stkadj); +- /* This must be copied with decreasing addresses to +- handle overlaps. */ + tregs->vector = 0; + tregs->format = 0; +- tregs->pc = regs->pc; + tregs->sr = regs->sr; + } ++ ++ /* ++ * Set up registers for signal handler. All the state we are about ++ * to destroy is successfully copied to sigframe. ++ */ ++ wrusp ((unsigned long) frame); ++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler; ++ adjustformat(regs); ++ + return 0; + } + +@@ -968,7 +970,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + struct pt_regs *regs) + { + struct rt_sigframe __user *frame; +- int fsize = frame_extra_sizes(regs->format); ++ struct pt_regs *tregs = rte_regs(regs); ++ int fsize = frame_extra_sizes(tregs->format); + int err = 0, sig = ksig->sig; + + if (fsize < 0) { +@@ -1018,34 +1021,27 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + + push_cache ((unsigned long) &frame->retcode); + +- /* +- * Set up registers for signal handler. All the state we are about +- * to destroy is successfully copied to sigframe. +- */ +- wrusp ((unsigned long) frame); +- regs->pc = (unsigned long) ksig->ka.sa.sa_handler; +- adjustformat(regs); +- + /* + * This is subtle; if we build more than one sigframe, all but the + * first one will see frame format 0 and have fsize == 0, so we won't + * screw stkadj. + */ +- if (fsize) ++ if (fsize) { + regs->stkadj = fsize; +- +- /* Prepare to skip over the extra stuff in the exception frame. */ +- if (regs->stkadj) { +- struct pt_regs *tregs = +- (struct pt_regs *)((ulong)regs + regs->stkadj); ++ tregs = rte_regs(regs); + pr_debug("Performing stackadjust=%04lx\n", regs->stkadj); +- /* This must be copied with decreasing addresses to +- handle overlaps. */ + tregs->vector = 0; + tregs->format = 0; +- tregs->pc = regs->pc; + tregs->sr = regs->sr; + } ++ ++ /* ++ * Set up registers for signal handler. All the state we are about ++ * to destroy is successfully copied to sigframe. ++ */ ++ wrusp ((unsigned long) frame); ++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler; ++ adjustformat(regs); + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.14/mac80211-check-return-value-of-rhashtable_init.patch b/queue-5.14/mac80211-check-return-value-of-rhashtable_init.patch new file mode 100644 index 00000000000..63ab0082889 --- /dev/null +++ b/queue-5.14/mac80211-check-return-value-of-rhashtable_init.patch @@ -0,0 +1,41 @@ +From 6c0353af9164400deb9168407fb607a1436cd9cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 03:34:57 +0000 +Subject: mac80211: check return value of rhashtable_init + +From: MichelleJin + +[ Upstream commit 111461d573741c17eafad029ac93474fa9adcce0 ] + +When rhashtable_init() fails, it returns -EINVAL. +However, since error return value of rhashtable_init is not checked, +it can cause use of uninitialized pointers. +So, fix unhandled errors of rhashtable_init. + +Signed-off-by: MichelleJin +Link: https://lore.kernel.org/r/20210927033457.1020967-4-shjy180909@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/mesh_pathtbl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index efbefcbac3ac..7cab1cf09bf1 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -60,7 +60,10 @@ static struct mesh_table *mesh_table_alloc(void) + atomic_set(&newtbl->entries, 0); + spin_lock_init(&newtbl->gates_lock); + spin_lock_init(&newtbl->walk_lock); +- rhashtable_init(&newtbl->rhead, &mesh_rht_params); ++ if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) { ++ kfree(newtbl); ++ return NULL; ++ } + + return newtbl; + } +-- +2.33.0 + diff --git a/queue-5.14/mac80211-drop-frames-from-invalid-mac-address-in-ad-.patch b/queue-5.14/mac80211-drop-frames-from-invalid-mac-address-in-ad-.patch new file mode 100644 index 00000000000..1d7b524e5f5 --- /dev/null +++ b/queue-5.14/mac80211-drop-frames-from-invalid-mac-address-in-ad-.patch @@ -0,0 +1,51 @@ +From 441a952c55baf19f06e718e48ac832c5b892aeee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 22:42:30 +0800 +Subject: mac80211: Drop frames from invalid MAC address in ad-hoc mode + +From: YueHaibing + +[ Upstream commit a6555f844549cd190eb060daef595f94d3de1582 ] + +WARNING: CPU: 1 PID: 9 at net/mac80211/sta_info.c:554 +sta_info_insert_rcu+0x121/0x12a0 +Modules linked in: +CPU: 1 PID: 9 Comm: kworker/u8:1 Not tainted 5.14.0-rc7+ #253 +Workqueue: phy3 ieee80211_iface_work +RIP: 0010:sta_info_insert_rcu+0x121/0x12a0 +... +Call Trace: + ieee80211_ibss_finish_sta+0xbc/0x170 + ieee80211_ibss_work+0x13f/0x7d0 + ieee80211_iface_work+0x37a/0x500 + process_one_work+0x357/0x850 + worker_thread+0x41/0x4d0 + +If an Ad-Hoc node receives packets with invalid source MAC address, +it hits a WARN_ON in sta_info_insert_check(), this can spam the log. + +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20210827144230.39944-1-yuehaibing@huawei.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 2563473b5cf1..e023e307c0c3 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -4053,7 +4053,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + if (!bssid) + return false; + if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || +- ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) ++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) || ++ !is_valid_ether_addr(hdr->addr2)) + return false; + if (ieee80211_is_beacon(hdr->frame_control)) + return true; +-- +2.33.0 + diff --git a/queue-5.14/net-bgmac-platform-handle-mac-address-deferral.patch b/queue-5.14/net-bgmac-platform-handle-mac-address-deferral.patch new file mode 100644 index 00000000000..1ae6f23e943 --- /dev/null +++ b/queue-5.14/net-bgmac-platform-handle-mac-address-deferral.patch @@ -0,0 +1,46 @@ +From c66305f38dbe40a746fdc56c8983462adf9d5252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Sep 2021 11:36:27 +0000 +Subject: net: bgmac-platform: handle mac-address deferral + +From: Matthew Hagan + +[ Upstream commit 763716a55cb1f480ffe1a9702e6b5d9ea1a80a24 ] + +This patch is a replication of Christian Lamparter's "net: bgmac-bcma: +handle deferred probe error due to mac-address" patch for the +bgmac-platform driver [1]. + +As is the case with the bgmac-bcma driver, this change is to cover the +scenario where the MAC address cannot yet be discovered due to reliance +on an nvmem provider which is yet to be instantiated, resulting in a +random address being assigned that has to be manually overridden. + +[1] https://lore.kernel.org/netdev/20210919115725.29064-1-chunkeey@gmail.com + +Signed-off-by: Matthew Hagan +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bgmac-platform.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bgmac-platform.c b/drivers/net/ethernet/broadcom/bgmac-platform.c +index 4ab5bf64d353..df8ff839cc62 100644 +--- a/drivers/net/ethernet/broadcom/bgmac-platform.c ++++ b/drivers/net/ethernet/broadcom/bgmac-platform.c +@@ -192,6 +192,9 @@ static int bgmac_probe(struct platform_device *pdev) + bgmac->dma_dev = &pdev->dev; + + ret = of_get_mac_address(np, bgmac->net_dev->dev_addr); ++ if (ret == -EPROBE_DEFER) ++ return ret; ++ + if (ret) + dev_warn(&pdev->dev, + "MAC address not present in device tree\n"); +-- +2.33.0 + diff --git a/queue-5.14/net-prevent-user-from-passing-illegal-stab-size.patch b/queue-5.14/net-prevent-user-from-passing-illegal-stab-size.patch new file mode 100644 index 00000000000..c826ec36a47 --- /dev/null +++ b/queue-5.14/net-prevent-user-from-passing-illegal-stab-size.patch @@ -0,0 +1,71 @@ +From 88c9c0d29e391765497cf688085b70da4f63a868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 10:35:58 +0800 +Subject: net: prevent user from passing illegal stab size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: 王贇 + +[ Upstream commit b193e15ac69d56f35e1d8e2b5d16cbd47764d053 ] + +We observed below report when playing with netlink sock: + + UBSAN: shift-out-of-bounds in net/sched/sch_api.c:580:10 + shift exponent 249 is too large for 32-bit type + CPU: 0 PID: 685 Comm: a.out Not tainted + Call Trace: + dump_stack_lvl+0x8d/0xcf + ubsan_epilogue+0xa/0x4e + __ubsan_handle_shift_out_of_bounds+0x161/0x182 + __qdisc_calculate_pkt_len+0xf0/0x190 + __dev_queue_xmit+0x2ed/0x15b0 + +it seems like kernel won't check the stab log value passing from +user, and will use the insane value later to calculate pkt_len. + +This patch just add a check on the size/cell_log to avoid insane +calculation. + +Reported-by: Abaci +Signed-off-by: Michael Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/pkt_sched.h | 1 + + net/sched/sch_api.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h +index 6d7b12cba015..bf79f3a890af 100644 +--- a/include/net/pkt_sched.h ++++ b/include/net/pkt_sched.h +@@ -11,6 +11,7 @@ + #include + + #define DEFAULT_TX_QUEUE_LEN 1000 ++#define STAB_SIZE_LOG_MAX 30 + + struct qdisc_walker { + int stop; +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index f87d07736a14..148edd0e71e3 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -513,6 +513,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, + return stab; + } + ++ if (s->size_log > STAB_SIZE_LOG_MAX || ++ s->cell_log > STAB_SIZE_LOG_MAX) { ++ NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table"); ++ return ERR_PTR(-EINVAL); ++ } ++ + stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); + if (!stab) + return ERR_PTR(-ENOMEM); +-- +2.33.0 + diff --git a/queue-5.14/net-sun-sunvnet_common-should-depend-on-inet.patch b/queue-5.14/net-sun-sunvnet_common-should-depend-on-inet.patch new file mode 100644 index 00000000000..5340ec2950f --- /dev/null +++ b/queue-5.14/net-sun-sunvnet_common-should-depend-on-inet.patch @@ -0,0 +1,45 @@ +From 2b23f29df47439ca2d27862afa2f80f6d1721591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 14:48:23 -0700 +Subject: net: sun: SUNVNET_COMMON should depend on INET + +From: Randy Dunlap + +[ Upstream commit 103bde372f084206c6972be543ecc247ebbff9f3 ] + +When CONFIG_INET is not set, there are failing references to IPv4 +functions, so make this driver depend on INET. + +Fixes these build errors: + +sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_start_xmit_common': +sunvnet_common.c:(.text+0x1a68): undefined reference to `__icmp_send' +sparc64-linux-ld: drivers/net/ethernet/sun/sunvnet_common.o: in function `sunvnet_poll_common': +sunvnet_common.c:(.text+0x358c): undefined reference to `ip_send_check' + +Signed-off-by: Randy Dunlap +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Aaron Young +Cc: Rashmi Narasimhan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/sun/Kconfig b/drivers/net/ethernet/sun/Kconfig +index 309de38a7530..b0d3f9a2950c 100644 +--- a/drivers/net/ethernet/sun/Kconfig ++++ b/drivers/net/ethernet/sun/Kconfig +@@ -73,6 +73,7 @@ config CASSINI + config SUNVNET_COMMON + tristate "Common routines to support Sun Virtual Networking" + depends on SUN_LDOMS ++ depends on INET + default m + + config SUNVNET +-- +2.33.0 + diff --git a/queue-5.14/netfilter-ip6_tables-zero-initialize-fragment-offset.patch b/queue-5.14/netfilter-ip6_tables-zero-initialize-fragment-offset.patch new file mode 100644 index 00000000000..67e5532f9b0 --- /dev/null +++ b/queue-5.14/netfilter-ip6_tables-zero-initialize-fragment-offset.patch @@ -0,0 +1,38 @@ +From 992e007b33e03118a605917e8f78d699b4b9141a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 12 Sep 2021 22:24:33 +0100 +Subject: netfilter: ip6_tables: zero-initialize fragment offset + +From: Jeremy Sowden + +[ Upstream commit 310e2d43c3ad429c1fba4b175806cf1f55ed73a6 ] + +ip6tables only sets the `IP6T_F_PROTO` flag on a rule if a protocol is +specified (`-p tcp`, for example). However, if the flag is not set, +`ip6_packet_match` doesn't call `ipv6_find_hdr` for the skb, in which +case the fragment offset is left uninitialized and a garbage value is +passed to each matcher. + +Signed-off-by: Jeremy Sowden +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv6/netfilter/ip6_tables.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index de2cf3943b91..a579ea14a69b 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -273,6 +273,7 @@ ip6t_do_table(struct sk_buff *skb, + * things we don't know, ie. tcp syn flag or ports). If the + * rule is also a fragment-specific rule, non-fragments won't + * match it. */ ++ acpar.fragoff = 0; + acpar.hotdrop = false; + acpar.state = state; + +-- +2.33.0 + diff --git a/queue-5.14/netfilter-nf_nat_masquerade-defer-conntrack-walk-to-.patch b/queue-5.14/netfilter-nf_nat_masquerade-defer-conntrack-walk-to-.patch new file mode 100644 index 00000000000..41b1a69200b --- /dev/null +++ b/queue-5.14/netfilter-nf_nat_masquerade-defer-conntrack-walk-to-.patch @@ -0,0 +1,141 @@ +From e27e176259108c0c9f64de5cf7a05eb9128edfef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 16:46:39 +0200 +Subject: netfilter: nf_nat_masquerade: defer conntrack walk to work queue + +From: Florian Westphal + +[ Upstream commit 7970a19b71044bf4dc2c1becc200275bdf1884d4 ] + +The ipv4 and device notifiers are called with RTNL mutex held. +The table walk can take some time, better not block other RTNL users. + +'ip a' has been reported to block for up to 20 seconds when conntrack table +has many entries and device down events are frequent (e.g., PPP). + +Reported-and-tested-by: Martin Zaharinov +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_nat_masquerade.c | 50 +++++++++++++++---------------- + 1 file changed, 24 insertions(+), 26 deletions(-) + +diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c +index 415919a6ac1a..acd73f717a08 100644 +--- a/net/netfilter/nf_nat_masquerade.c ++++ b/net/netfilter/nf_nat_masquerade.c +@@ -131,13 +131,14 @@ static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr, + put_net(net); + } + +-static int device_cmp(struct nf_conn *i, void *ifindex) ++static int device_cmp(struct nf_conn *i, void *arg) + { + const struct nf_conn_nat *nat = nfct_nat(i); ++ const struct masq_dev_work *w = arg; + + if (!nat) + return 0; +- return nat->masq_index == (int)(long)ifindex; ++ return nat->masq_index == w->ifindex; + } + + static int masq_device_event(struct notifier_block *this, +@@ -153,8 +154,8 @@ static int masq_device_event(struct notifier_block *this, + * and forget them. + */ + +- nf_ct_iterate_cleanup_net(net, device_cmp, +- (void *)(long)dev->ifindex, 0, 0); ++ nf_nat_masq_schedule(net, NULL, dev->ifindex, ++ device_cmp, GFP_KERNEL); + } + + return NOTIFY_DONE; +@@ -162,35 +163,45 @@ static int masq_device_event(struct notifier_block *this, + + static int inet_cmp(struct nf_conn *ct, void *ptr) + { +- struct in_ifaddr *ifa = (struct in_ifaddr *)ptr; +- struct net_device *dev = ifa->ifa_dev->dev; + struct nf_conntrack_tuple *tuple; ++ struct masq_dev_work *w = ptr; + +- if (!device_cmp(ct, (void *)(long)dev->ifindex)) ++ if (!device_cmp(ct, ptr)) + return 0; + + tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; + +- return ifa->ifa_address == tuple->dst.u3.ip; ++ return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3); + } + + static int masq_inet_event(struct notifier_block *this, + unsigned long event, + void *ptr) + { +- struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev; +- struct net *net = dev_net(idev->dev); ++ const struct in_ifaddr *ifa = ptr; ++ const struct in_device *idev; ++ const struct net_device *dev; ++ union nf_inet_addr addr; ++ ++ if (event != NETDEV_DOWN) ++ return NOTIFY_DONE; + + /* The masq_dev_notifier will catch the case of the device going + * down. So if the inetdev is dead and being destroyed we have + * no work to do. Otherwise this is an individual address removal + * and we have to perform the flush. + */ ++ idev = ifa->ifa_dev; + if (idev->dead) + return NOTIFY_DONE; + +- if (event == NETDEV_DOWN) +- nf_ct_iterate_cleanup_net(net, inet_cmp, ptr, 0, 0); ++ memset(&addr, 0, sizeof(addr)); ++ ++ addr.ip = ifa->ifa_address; ++ ++ dev = idev->dev; ++ nf_nat_masq_schedule(dev_net(idev->dev), &addr, dev->ifindex, ++ inet_cmp, GFP_KERNEL); + + return NOTIFY_DONE; + } +@@ -253,19 +264,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range, + } + EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6); + +-static int inet6_cmp(struct nf_conn *ct, void *work) +-{ +- struct masq_dev_work *w = (struct masq_dev_work *)work; +- struct nf_conntrack_tuple *tuple; +- +- if (!device_cmp(ct, (void *)(long)w->ifindex)) +- return 0; +- +- tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; +- +- return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3); +-} +- + /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep). + * + * Defer it to the system workqueue. +@@ -289,7 +287,7 @@ static int masq_inet6_event(struct notifier_block *this, + + addr.in6 = ifa->addr; + +- nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp, ++ nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet_cmp, + GFP_ATOMIC); + return NOTIFY_DONE; + } +-- +2.33.0 + diff --git a/queue-5.14/netfilter-nf_nat_masquerade-make-async-masq_inet6_ev.patch b/queue-5.14/netfilter-nf_nat_masquerade-make-async-masq_inet6_ev.patch new file mode 100644 index 00000000000..123c6c0a439 --- /dev/null +++ b/queue-5.14/netfilter-nf_nat_masquerade-make-async-masq_inet6_ev.patch @@ -0,0 +1,210 @@ +From ace8a12c3a341a4ab34cc9bfe6565355558ad1b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 16:46:38 +0200 +Subject: netfilter: nf_nat_masquerade: make async masq_inet6_event handling + generic + +From: Florian Westphal + +[ Upstream commit 30db406923b9285a9bac06a6af5e74bd6d0f1d06 ] + +masq_inet6_event is called asynchronously from system work queue, +because the inet6 notifier is atomic and nf_iterate_cleanup can sleep. + +The ipv4 and device notifiers call nf_iterate_cleanup directly. + +This is legal, but these notifiers are called with RTNL mutex held. +A large conntrack table with many devices coming and going will have severe +impact on the system usability, with 'ip a' blocking for several seconds. + +This change places the defer code into a helper and makes it more +generic so ipv4 and ifdown notifiers can be converted to defer the +cleanup walk as well in a follow patch. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_nat_masquerade.c | 122 ++++++++++++++++++------------ + 1 file changed, 75 insertions(+), 47 deletions(-) + +diff --git a/net/netfilter/nf_nat_masquerade.c b/net/netfilter/nf_nat_masquerade.c +index 8e8a65d46345..415919a6ac1a 100644 +--- a/net/netfilter/nf_nat_masquerade.c ++++ b/net/netfilter/nf_nat_masquerade.c +@@ -9,8 +9,19 @@ + + #include + ++struct masq_dev_work { ++ struct work_struct work; ++ struct net *net; ++ union nf_inet_addr addr; ++ int ifindex; ++ int (*iter)(struct nf_conn *i, void *data); ++}; ++ ++#define MAX_MASQ_WORKER_COUNT 16 ++ + static DEFINE_MUTEX(masq_mutex); + static unsigned int masq_refcnt __read_mostly; ++static atomic_t masq_worker_count __read_mostly; + + unsigned int + nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum, +@@ -63,6 +74,63 @@ nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum, + } + EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4); + ++static void iterate_cleanup_work(struct work_struct *work) ++{ ++ struct masq_dev_work *w; ++ ++ w = container_of(work, struct masq_dev_work, work); ++ ++ nf_ct_iterate_cleanup_net(w->net, w->iter, (void *)w, 0, 0); ++ ++ put_net(w->net); ++ kfree(w); ++ atomic_dec(&masq_worker_count); ++ module_put(THIS_MODULE); ++} ++ ++/* Iterate conntrack table in the background and remove conntrack entries ++ * that use the device/address being removed. ++ * ++ * In case too many work items have been queued already or memory allocation ++ * fails iteration is skipped, conntrack entries will time out eventually. ++ */ ++static void nf_nat_masq_schedule(struct net *net, union nf_inet_addr *addr, ++ int ifindex, ++ int (*iter)(struct nf_conn *i, void *data), ++ gfp_t gfp_flags) ++{ ++ struct masq_dev_work *w; ++ ++ if (atomic_read(&masq_worker_count) > MAX_MASQ_WORKER_COUNT) ++ return; ++ ++ net = maybe_get_net(net); ++ if (!net) ++ return; ++ ++ if (!try_module_get(THIS_MODULE)) ++ goto err_module; ++ ++ w = kzalloc(sizeof(*w), gfp_flags); ++ if (w) { ++ /* We can overshoot MAX_MASQ_WORKER_COUNT, no big deal */ ++ atomic_inc(&masq_worker_count); ++ ++ INIT_WORK(&w->work, iterate_cleanup_work); ++ w->ifindex = ifindex; ++ w->net = net; ++ w->iter = iter; ++ if (addr) ++ w->addr = *addr; ++ schedule_work(&w->work); ++ return; ++ } ++ ++ module_put(THIS_MODULE); ++ err_module: ++ put_net(net); ++} ++ + static int device_cmp(struct nf_conn *i, void *ifindex) + { + const struct nf_conn_nat *nat = nfct_nat(i); +@@ -136,8 +204,6 @@ static struct notifier_block masq_inet_notifier = { + }; + + #if IS_ENABLED(CONFIG_IPV6) +-static atomic_t v6_worker_count __read_mostly; +- + static int + nat_ipv6_dev_get_saddr(struct net *net, const struct net_device *dev, + const struct in6_addr *daddr, unsigned int srcprefs, +@@ -187,13 +253,6 @@ nf_nat_masquerade_ipv6(struct sk_buff *skb, const struct nf_nat_range2 *range, + } + EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv6); + +-struct masq_dev_work { +- struct work_struct work; +- struct net *net; +- struct in6_addr addr; +- int ifindex; +-}; +- + static int inet6_cmp(struct nf_conn *ct, void *work) + { + struct masq_dev_work *w = (struct masq_dev_work *)work; +@@ -204,21 +263,7 @@ static int inet6_cmp(struct nf_conn *ct, void *work) + + tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; + +- return ipv6_addr_equal(&w->addr, &tuple->dst.u3.in6); +-} +- +-static void iterate_cleanup_work(struct work_struct *work) +-{ +- struct masq_dev_work *w; +- +- w = container_of(work, struct masq_dev_work, work); +- +- nf_ct_iterate_cleanup_net(w->net, inet6_cmp, (void *)w, 0, 0); +- +- put_net(w->net); +- kfree(w); +- atomic_dec(&v6_worker_count); +- module_put(THIS_MODULE); ++ return nf_inet_addr_cmp(&w->addr, &tuple->dst.u3); + } + + /* atomic notifier; can't call nf_ct_iterate_cleanup_net (it can sleep). +@@ -233,36 +278,19 @@ static int masq_inet6_event(struct notifier_block *this, + { + struct inet6_ifaddr *ifa = ptr; + const struct net_device *dev; +- struct masq_dev_work *w; +- struct net *net; ++ union nf_inet_addr addr; + +- if (event != NETDEV_DOWN || atomic_read(&v6_worker_count) >= 16) ++ if (event != NETDEV_DOWN) + return NOTIFY_DONE; + + dev = ifa->idev->dev; +- net = maybe_get_net(dev_net(dev)); +- if (!net) +- return NOTIFY_DONE; + +- if (!try_module_get(THIS_MODULE)) +- goto err_module; ++ memset(&addr, 0, sizeof(addr)); + +- w = kmalloc(sizeof(*w), GFP_ATOMIC); +- if (w) { +- atomic_inc(&v6_worker_count); ++ addr.in6 = ifa->addr; + +- INIT_WORK(&w->work, iterate_cleanup_work); +- w->ifindex = dev->ifindex; +- w->net = net; +- w->addr = ifa->addr; +- schedule_work(&w->work); +- +- return NOTIFY_DONE; +- } +- +- module_put(THIS_MODULE); +- err_module: +- put_net(net); ++ nf_nat_masq_schedule(dev_net(dev), &addr, dev->ifindex, inet6_cmp, ++ GFP_ATOMIC); + return NOTIFY_DONE; + } + +-- +2.33.0 + diff --git a/queue-5.14/perf-core-fix-userpage-time_enabled-of-inactive-even.patch b/queue-5.14/perf-core-fix-userpage-time_enabled-of-inactive-even.patch new file mode 100644 index 00000000000..c276ec28379 --- /dev/null +++ b/queue-5.14/perf-core-fix-userpage-time_enabled-of-inactive-even.patch @@ -0,0 +1,121 @@ +From f2ef4bb0105cb3bec2a8c3ea4f774fb636bd40ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 12:43:13 -0700 +Subject: perf/core: fix userpage->time_enabled of inactive events + +From: Song Liu + +[ Upstream commit f792565326825ed806626da50c6f9a928f1079c1 ] + +Users of rdpmc rely on the mmapped user page to calculate accurate +time_enabled. Currently, userpage->time_enabled is only updated when the +event is added to the pmu. As a result, inactive event (due to counter +multiplexing) does not have accurate userpage->time_enabled. This can +be reproduced with something like: + + /* open 20 task perf_event "cycles", to create multiplexing */ + + fd = perf_event_open(); /* open task perf_event "cycles" */ + userpage = mmap(fd); /* use mmap and rdmpc */ + + while (true) { + time_enabled_mmap = xxx; /* use logic in perf_event_mmap_page */ + time_enabled_read = read(fd).time_enabled; + if (time_enabled_mmap > time_enabled_read) + BUG(); + } + +Fix this by updating userpage for inactive events in merge_sched_in. + +Suggested-by: Peter Zijlstra (Intel) +Reported-and-tested-by: Lucian Grijincu +Signed-off-by: Song Liu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210929194313.2398474-1-songliubraving@fb.com +Signed-off-by: Sasha Levin +--- + include/linux/perf_event.h | 4 +++- + kernel/events/core.c | 34 ++++++++++++++++++++++++++++++---- + 2 files changed, 33 insertions(+), 5 deletions(-) + +diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h +index 2d510ad750ed..4aa52f7a48c1 100644 +--- a/include/linux/perf_event.h ++++ b/include/linux/perf_event.h +@@ -683,7 +683,9 @@ struct perf_event { + /* + * timestamp shadows the actual context timing but it can + * be safely used in NMI interrupt context. It reflects the +- * context time as it was when the event was last scheduled in. ++ * context time as it was when the event was last scheduled in, ++ * or when ctx_sched_in failed to schedule the event because we ++ * run out of PMC. + * + * ctx_time already accounts for ctx->timestamp. Therefore to + * compute ctx_time for a sample, simply add perf_clock(). +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e5c4aca620c5..22c5b1622c22 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3707,6 +3707,29 @@ static noinline int visit_groups_merge(struct perf_cpu_context *cpuctx, + return 0; + } + ++static inline bool event_update_userpage(struct perf_event *event) ++{ ++ if (likely(!atomic_read(&event->mmap_count))) ++ return false; ++ ++ perf_event_update_time(event); ++ perf_set_shadow_time(event, event->ctx); ++ perf_event_update_userpage(event); ++ ++ return true; ++} ++ ++static inline void group_update_userpage(struct perf_event *group_event) ++{ ++ struct perf_event *event; ++ ++ if (!event_update_userpage(group_event)) ++ return; ++ ++ for_each_sibling_event(event, group_event) ++ event_update_userpage(event); ++} ++ + static int merge_sched_in(struct perf_event *event, void *data) + { + struct perf_event_context *ctx = event->ctx; +@@ -3725,14 +3748,15 @@ static int merge_sched_in(struct perf_event *event, void *data) + } + + if (event->state == PERF_EVENT_STATE_INACTIVE) { ++ *can_add_hw = 0; + if (event->attr.pinned) { + perf_cgroup_event_disable(event, ctx); + perf_event_set_state(event, PERF_EVENT_STATE_ERROR); ++ } else { ++ ctx->rotate_necessary = 1; ++ perf_mux_hrtimer_restart(cpuctx); ++ group_update_userpage(event); + } +- +- *can_add_hw = 0; +- ctx->rotate_necessary = 1; +- perf_mux_hrtimer_restart(cpuctx); + } + + return 0; +@@ -6311,6 +6335,8 @@ accounting: + + ring_buffer_attach(event, rb); + ++ perf_event_update_time(event); ++ perf_set_shadow_time(event, event->ctx); + perf_event_init_userpage(event); + perf_event_update_userpage(event); + } else { +-- +2.33.0 + diff --git a/queue-5.14/pinctrl-qcom-sc7280-add-pm-suspend-callbacks.patch b/queue-5.14/pinctrl-qcom-sc7280-add-pm-suspend-callbacks.patch new file mode 100644 index 00000000000..a2d9f8fa3f8 --- /dev/null +++ b/queue-5.14/pinctrl-qcom-sc7280-add-pm-suspend-callbacks.patch @@ -0,0 +1,36 @@ +From 3c3bc1343a321cf489f65ab2445ec7fa26f09140 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 15:01:27 +0530 +Subject: pinctrl: qcom: sc7280: Add PM suspend callbacks + +From: Rajendra Nayak + +[ Upstream commit 28406a21999152ff7faa30b194f734565bdd8e0d ] + +Use PM suspend callbacks from msm core, without this the hog_sleep +pins don't change state in suspend. + +Signed-off-by: Rajendra Nayak +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1632389487-11283-1-git-send-email-rnayak@codeaurora.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-sc7280.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-sc7280.c b/drivers/pinctrl/qcom/pinctrl-sc7280.c +index afddf6d60dbe..9017ede409c9 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sc7280.c ++++ b/drivers/pinctrl/qcom/pinctrl-sc7280.c +@@ -1496,6 +1496,7 @@ static const struct of_device_id sc7280_pinctrl_of_match[] = { + static struct platform_driver sc7280_pinctrl_driver = { + .driver = { + .name = "sc7280-pinctrl", ++ .pm = &msm_pinctrl_dev_pm_ops, + .of_match_table = sc7280_pinctrl_of_match, + }, + .probe = sc7280_pinctrl_probe, +-- +2.33.0 + diff --git a/queue-5.14/sched-always-inline-is_percpu_thread.patch b/queue-5.14/sched-always-inline-is_percpu_thread.patch new file mode 100644 index 00000000000..141b2aa5601 --- /dev/null +++ b/queue-5.14/sched-always-inline-is_percpu_thread.patch @@ -0,0 +1,35 @@ +From 69ad67f64bdbd016d80365f8a4e958fe7710df88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 15:31:11 +0200 +Subject: sched: Always inline is_percpu_thread() + +From: Peter Zijlstra + +[ Upstream commit 83d40a61046f73103b4e5d8f1310261487ff63b0 ] + + vmlinux.o: warning: objtool: check_preemption_disabled()+0x81: call to is_percpu_thread() leaves .noinstr.text section + +Reported-by: Stephen Rothwell +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210928084218.063371959@infradead.org +Signed-off-by: Sasha Levin +--- + include/linux/sched.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index f6935787e7e8..8e10c7accdbc 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1633,7 +1633,7 @@ extern struct pid *cad_pid; + #define tsk_used_math(p) ((p)->flags & PF_USED_MATH) + #define used_math() tsk_used_math(current) + +-static inline bool is_percpu_thread(void) ++static __always_inline bool is_percpu_thread(void) + { + #ifdef CONFIG_SMP + return (current->flags & PF_NO_SETAFFINITY) && +-- +2.33.0 + diff --git a/queue-5.14/scsi-qla2xxx-fix-excessive-messages-during-device-lo.patch b/queue-5.14/scsi-qla2xxx-fix-excessive-messages-during-device-lo.patch new file mode 100644 index 00000000000..9050a024492 --- /dev/null +++ b/queue-5.14/scsi-qla2xxx-fix-excessive-messages-during-device-lo.patch @@ -0,0 +1,48 @@ +From 39be5f12bc406c2e7344ae06cba2df43d5cf3d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 20:51:54 -0700 +Subject: scsi: qla2xxx: Fix excessive messages during device logout + +From: Arun Easi + +[ Upstream commit 8e2d81c6b5be0d7629fb50b6f678fc07a4c58fae ] + +Disable default logging of some I/O path messages. If desired, the messages +can be turned back on by setting ql2xextended_error_logging. + +Link: https://lore.kernel.org/r/20210925035154.29815-1-njavali@marvell.com +Reviewed-by: Ewan D. Milne +Reviewed-by: Himanshu Madhani +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_isr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 2aa8f519aae6..5f1092195d1f 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -2399,7 +2399,7 @@ static void qla24xx_nvme_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, + } + + if (unlikely(logit)) +- ql_log(ql_log_warn, fcport->vha, 0x5060, ++ ql_log(ql_dbg_io, fcport->vha, 0x5060, + "NVME-%s ERR Handling - hdl=%x status(%x) tr_len:%x resid=%x ox_id=%x\n", + sp->name, sp->handle, comp_status, + fd->transferred_length, le32_to_cpu(sts->residual_len), +@@ -3246,7 +3246,7 @@ check_scsi_status: + + out: + if (logit) +- ql_log(ql_log_warn, fcport->vha, 0x3022, ++ ql_log(ql_dbg_io, fcport->vha, 0x3022, + "FCP command status: 0x%x-0x%x (0x%x) nexus=%ld:%d:%llu portid=%02x%02x%02x oxid=0x%x cdb=%10phN len=0x%x rsp_info=0x%x resid=0x%x fw_resid=0x%x sp=%p cp=%p.\n", + comp_status, scsi_status, res, vha->host_no, + cp->device->id, cp->device->lun, fcport->d_id.b.domain, +-- +2.33.0 + diff --git a/queue-5.14/scsi-ses-fix-unsigned-comparison-with-less-than-zero.patch b/queue-5.14/scsi-ses-fix-unsigned-comparison-with-less-than-zero.patch new file mode 100644 index 00000000000..42ee2e3ceae --- /dev/null +++ b/queue-5.14/scsi-ses-fix-unsigned-comparison-with-less-than-zero.patch @@ -0,0 +1,39 @@ +From ab625fb09a666cd053bf1fc0c98b800dabfacbf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 17:51:53 +0800 +Subject: scsi: ses: Fix unsigned comparison with less than zero + +From: Jiapeng Chong + +[ Upstream commit dd689ed5aa905daf4ba4c99319a52aad6ea0a796 ] + +Fix the following coccicheck warning: + +./drivers/scsi/ses.c:137:10-16: WARNING: Unsigned expression compared +with zero: result > 0. + +Link: https://lore.kernel.org/r/1632477113-90378-1-git-send-email-jiapeng.chong@linux.alibaba.com +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ses.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 43e682297fd5..0a1734f34587 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -118,7 +118,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code, + static int ses_send_diag(struct scsi_device *sdev, int page_code, + void *buf, int bufflen) + { +- u32 result; ++ int result; + + unsigned char cmd[] = { + SEND_DIAGNOSTIC, +-- +2.33.0 + diff --git a/queue-5.14/scsi-virtio_scsi-fix-spelling-mistake-unsupport-unsu.patch b/queue-5.14/scsi-virtio_scsi-fix-spelling-mistake-unsupport-unsu.patch new file mode 100644 index 00000000000..15f46ee8a89 --- /dev/null +++ b/queue-5.14/scsi-virtio_scsi-fix-spelling-mistake-unsupport-unsu.patch @@ -0,0 +1,45 @@ +From 9c150107e6f2ecbf92a4ef1d95b32df1ec7e069c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Sep 2021 00:03:30 +0100 +Subject: scsi: virtio_scsi: Fix spelling mistake "Unsupport" -> "Unsupported" + +From: Colin Ian King + +[ Upstream commit cced4c0ec7c06f5230a2958907a409c849762293 ] + +There are a couple of spelling mistakes in pr_info and pr_err messages. +Fix them. + +Link: https://lore.kernel.org/r/20210924230330.143785-1-colin.king@canonical.com +Signed-off-by: Colin Ian King +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/virtio_scsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index b0deaf4af5a3..13f55f41a902 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -300,7 +300,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi, + } + break; + default: +- pr_info("Unsupport virtio scsi event reason %x\n", event->reason); ++ pr_info("Unsupported virtio scsi event reason %x\n", event->reason); + } + } + +@@ -392,7 +392,7 @@ static void virtscsi_handle_event(struct work_struct *work) + virtscsi_handle_param_change(vscsi, event); + break; + default: +- pr_err("Unsupport virtio scsi event %x\n", event->event); ++ pr_err("Unsupported virtio scsi event %x\n", event->event); + } + virtscsi_kick_event(vscsi, event_node); + } +-- +2.33.0 + diff --git a/queue-5.14/series b/queue-5.14/series index e69de29bb2d..79de9d7e6d3 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -0,0 +1,31 @@ +ext4-check-and-update-i_disksize-properly.patch +ext4-correct-the-error-path-of-ext4_write_inline_dat.patch +asoc-intel-sof_sdw-tag-soundwire-bes-as-non-atomic.patch +ext4-enforce-buffer-head-state-assertion-in-ext4_da_.patch +alsa-oxfw-fix-transmission-method-for-loud-models-ba.patch +interconnect-qcom-sdm660-add-missing-a2noc-qos-clock.patch +alsa-usb-audio-unify-mixer-resume-and-reset_resume-p.patch +hid-apple-fix-logical-maximum-and-usage-maximum-of-m.patch +netfilter-ip6_tables-zero-initialize-fragment-offset.patch +hid-wacom-add-new-intuos-bt-ctl-4100wl-ctl-6100wl-de.patch +asoc-sof-loader-release_firmware-on-load-failure-to-.patch +kvm-arm64-nvhe-fix-missing-force-for-hyp-reloc.s-bui.patch +netfilter-nf_nat_masquerade-make-async-masq_inet6_ev.patch +netfilter-nf_nat_masquerade-defer-conntrack-walk-to-.patch +mac80211-drop-frames-from-invalid-mac-address-in-ad-.patch +pinctrl-qcom-sc7280-add-pm-suspend-callbacks.patch +m68k-handle-arrivals-of-multiple-signals-correctly.patch +hwmon-ltc2947-properly-handle-errors-when-looking-fo.patch +net-prevent-user-from-passing-illegal-stab-size.patch +mac80211-check-return-value-of-rhashtable_init.patch +net-bgmac-platform-handle-mac-address-deferral.patch +vboxfs-fix-broken-legacy-mount-signature-checking.patch +net-sun-sunvnet_common-should-depend-on-inet.patch +drm-amdgpu-fix-gart.bo-pin_count-leak.patch +scsi-ses-fix-unsigned-comparison-with-less-than-zero.patch +scsi-virtio_scsi-fix-spelling-mistake-unsupport-unsu.patch +scsi-qla2xxx-fix-excessive-messages-during-device-lo.patch +perf-core-fix-userpage-time_enabled-of-inactive-even.patch +sched-always-inline-is_percpu_thread.patch +io_uring-kill-fasync.patch +hwmon-pmbus-ibm-cffps-max_power_out-swap-changes.patch diff --git a/queue-5.14/vboxfs-fix-broken-legacy-mount-signature-checking.patch b/queue-5.14/vboxfs-fix-broken-legacy-mount-signature-checking.patch new file mode 100644 index 00000000000..fcd7a843dbd --- /dev/null +++ b/queue-5.14/vboxfs-fix-broken-legacy-mount-signature-checking.patch @@ -0,0 +1,68 @@ +From 6f3ecb2444ff6af16c05d5c49f8d8de47c21561c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 11:26:21 -0700 +Subject: vboxfs: fix broken legacy mount signature checking + +From: Linus Torvalds + +[ Upstream commit 9b3b353ef330e20bc2d99bf3165cc044cff26a09 ] + +Commit 9d682ea6bcc7 ("vboxsf: Fix the check for the old binary +mount-arguments struct") was meant to fix a build error due to sign +mismatch in 'char' and the use of character constants, but it just moved +the error elsewhere, in that on some architectures characters and signed +and on others they are unsigned, and that's just how the C standard +works. + +The proper fix is a simple "don't do that then". The code was just +being silly and odd, and it should never have cared about signed vs +unsigned characters in the first place, since what it is testing is not +four "characters", but four bytes. + +And the way to compare four bytes is by using "memcmp()". + +Which compilers will know to just turn into a single 32-bit compare with +a constant, as long as you don't have crazy debug options enabled. + +Link: https://lore.kernel.org/lkml/20210927094123.576521-1-arnd@kernel.org/ +Cc: Arnd Bergmann +Cc: Hans de Goede +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/vboxsf/super.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/fs/vboxsf/super.c b/fs/vboxsf/super.c +index 4f5e59f06284..37dd3fe5b1e9 100644 +--- a/fs/vboxsf/super.c ++++ b/fs/vboxsf/super.c +@@ -21,10 +21,7 @@ + + #define VBOXSF_SUPER_MAGIC 0x786f4256 /* 'VBox' little endian */ + +-#define VBSF_MOUNT_SIGNATURE_BYTE_0 ('\000') +-#define VBSF_MOUNT_SIGNATURE_BYTE_1 ('\377') +-#define VBSF_MOUNT_SIGNATURE_BYTE_2 ('\376') +-#define VBSF_MOUNT_SIGNATURE_BYTE_3 ('\375') ++static const unsigned char VBSF_MOUNT_SIGNATURE[4] = "\000\377\376\375"; + + static int follow_symlinks; + module_param(follow_symlinks, int, 0444); +@@ -386,12 +383,7 @@ fail_nomem: + + static int vboxsf_parse_monolithic(struct fs_context *fc, void *data) + { +- unsigned char *options = data; +- +- if (options && options[0] == VBSF_MOUNT_SIGNATURE_BYTE_0 && +- options[1] == VBSF_MOUNT_SIGNATURE_BYTE_1 && +- options[2] == VBSF_MOUNT_SIGNATURE_BYTE_2 && +- options[3] == VBSF_MOUNT_SIGNATURE_BYTE_3) { ++ if (data && !memcmp(data, VBSF_MOUNT_SIGNATURE, 4)) { + vbg_err("vboxsf: Old binary mount data not supported, remove obsolete mount.vboxsf and/or update your VBoxService.\n"); + return -EINVAL; + } +-- +2.33.0 +