From: Greg Kroah-Hartman Date: Tue, 7 Jul 2020 13:47:30 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.230~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=53c8b957229d49606cab24ae6c216ae7ff44a2fd;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: cifs-fix-the-target-file-was-deleted-when-rename-failed.patch dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch irqchip-gic-atomically-update-affinity.patch mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch nfsd-apply-umask-on-fs-without-acl-support.patch revert-alsa-usb-audio-improve-frames-size-computation.patch smb3-honor-handletimeout-flag-for-multiuser-mounts.patch smb3-honor-lease-disabling-for-multiuser-mounts.patch smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch smb3-honor-seal-flag-for-multiuser-mounts.patch spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch --- diff --git a/queue-5.4/cifs-fix-the-target-file-was-deleted-when-rename-failed.patch b/queue-5.4/cifs-fix-the-target-file-was-deleted-when-rename-failed.patch new file mode 100644 index 00000000000..d0e485ce13d --- /dev/null +++ b/queue-5.4/cifs-fix-the-target-file-was-deleted-when-rename-failed.patch @@ -0,0 +1,56 @@ +From 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2 Mon Sep 17 00:00:00 2001 +From: Zhang Xiaoxu +Date: Sun, 28 Jun 2020 21:06:38 -0400 +Subject: cifs: Fix the target file was deleted when rename failed. + +From: Zhang Xiaoxu + +commit 9ffad9263b467efd8f8dc7ae1941a0a655a2bab2 upstream. + +When xfstest generic/035, we found the target file was deleted +if the rename return -EACESS. + +In cifs_rename2, we unlink the positive target dentry if rename +failed with EACESS or EEXIST, even if the target dentry is positived +before rename. Then the existing file was deleted. + +We should just delete the target file which created during the +rename. + +Reported-by: Hulk Robot +Signed-off-by: Zhang Xiaoxu +Cc: stable@vger.kernel.org +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/inode.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1791,6 +1791,7 @@ cifs_rename2(struct inode *source_dir, s + FILE_UNIX_BASIC_INFO *info_buf_target; + unsigned int xid; + int rc, tmprc; ++ bool new_target = d_really_is_negative(target_dentry); + + if (flags & ~RENAME_NOREPLACE) + return -EINVAL; +@@ -1867,8 +1868,13 @@ cifs_rename2(struct inode *source_dir, s + */ + + unlink_target: +- /* Try unlinking the target dentry if it's not negative */ +- if (d_really_is_positive(target_dentry) && (rc == -EACCES || rc == -EEXIST)) { ++ /* ++ * If the target dentry was created during the rename, try ++ * unlinking it if it's not negative ++ */ ++ if (new_target && ++ d_really_is_positive(target_dentry) && ++ (rc == -EACCES || rc == -EEXIST)) { + if (d_is_dir(target_dentry)) + tmprc = cifs_rmdir(target_dir, target_dentry); + else diff --git a/queue-5.4/dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch b/queue-5.4/dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch new file mode 100644 index 00000000000..64b37abb22a --- /dev/null +++ b/queue-5.4/dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch @@ -0,0 +1,135 @@ +From 4ab59c3c638c6c8952bf07739805d20eb6358a4d Mon Sep 17 00:00:00 2001 +From: Sumit Semwal +Date: Thu, 11 Jun 2020 17:14:18 +0530 +Subject: dma-buf: Move dma_buf_release() from fops to dentry_ops + +From: Sumit Semwal + +commit 4ab59c3c638c6c8952bf07739805d20eb6358a4d upstream. + +Charan Teja reported a 'use-after-free' in dmabuffs_dname [1], which +happens if the dma_buf_release() is called while the userspace is +accessing the dma_buf pseudo fs's dmabuffs_dname() in another process, +and dma_buf_release() releases the dmabuf object when the last reference +to the struct file goes away. + +I discussed with Arnd Bergmann, and he suggested that rather than tying +the dma_buf_release() to the file_operations' release(), we can tie it to +the dentry_operations' d_release(), which will be called when the last ref +to the dentry is removed. + +The path exercised by __fput() calls f_op->release() first, and then calls +dput, which eventually calls d_op->d_release(). + +In the 'normal' case, when no userspace access is happening via dma_buf +pseudo fs, there should be exactly one fd, file, dentry and inode, so +closing the fd will kill of everything right away. + +In the presented case, the dentry's d_release() will be called only when +the dentry's last ref is released. + +Therefore, lets move dma_buf_release() from fops->release() to +d_ops->d_release() + +Many thanks to Arnd for his FS insights :) + +[1]: https://lore.kernel.org/patchwork/patch/1238278/ + +Fixes: bb2bb9030425 ("dma-buf: add DMA_BUF_SET_NAME ioctls") +Reported-by: syzbot+3643a18836bce555bff6@syzkaller.appspotmail.com +Cc: [5.3+] +Cc: Arnd Bergmann +Reported-by: Charan Teja Reddy +Reviewed-by: Arnd Bergmann +Signed-off-by: Sumit Semwal +Tested-by: Charan Teja Reddy +Link: https://patchwork.freedesktop.org/patch/msgid/20200611114418.19852-1-sumit.semwal@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma-buf/dma-buf.c | 54 +++++++++++++++++++++------------------------- + 1 file changed, 25 insertions(+), 29 deletions(-) + +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -54,37 +54,11 @@ static char *dmabuffs_dname(struct dentr + dentry->d_name.name, ret > 0 ? name : ""); + } + +-static const struct dentry_operations dma_buf_dentry_ops = { +- .d_dname = dmabuffs_dname, +-}; +- +-static struct vfsmount *dma_buf_mnt; +- +-static int dma_buf_fs_init_context(struct fs_context *fc) +-{ +- struct pseudo_fs_context *ctx; +- +- ctx = init_pseudo(fc, DMA_BUF_MAGIC); +- if (!ctx) +- return -ENOMEM; +- ctx->dops = &dma_buf_dentry_ops; +- return 0; +-} +- +-static struct file_system_type dma_buf_fs_type = { +- .name = "dmabuf", +- .init_fs_context = dma_buf_fs_init_context, +- .kill_sb = kill_anon_super, +-}; +- +-static int dma_buf_release(struct inode *inode, struct file *file) ++static void dma_buf_release(struct dentry *dentry) + { + struct dma_buf *dmabuf; + +- if (!is_dma_buf_file(file)) +- return -EINVAL; +- +- dmabuf = file->private_data; ++ dmabuf = dentry->d_fsdata; + + BUG_ON(dmabuf->vmapping_counter); + +@@ -110,9 +84,32 @@ static int dma_buf_release(struct inode + module_put(dmabuf->owner); + kfree(dmabuf->name); + kfree(dmabuf); ++} ++ ++static const struct dentry_operations dma_buf_dentry_ops = { ++ .d_dname = dmabuffs_dname, ++ .d_release = dma_buf_release, ++}; ++ ++static struct vfsmount *dma_buf_mnt; ++ ++static int dma_buf_fs_init_context(struct fs_context *fc) ++{ ++ struct pseudo_fs_context *ctx; ++ ++ ctx = init_pseudo(fc, DMA_BUF_MAGIC); ++ if (!ctx) ++ return -ENOMEM; ++ ctx->dops = &dma_buf_dentry_ops; + return 0; + } + ++static struct file_system_type dma_buf_fs_type = { ++ .name = "dmabuf", ++ .init_fs_context = dma_buf_fs_init_context, ++ .kill_sb = kill_anon_super, ++}; ++ + static int dma_buf_mmap_internal(struct file *file, struct vm_area_struct *vma) + { + struct dma_buf *dmabuf; +@@ -412,7 +409,6 @@ static void dma_buf_show_fdinfo(struct s + } + + static const struct file_operations dma_buf_fops = { +- .release = dma_buf_release, + .mmap = dma_buf_mmap_internal, + .llseek = dma_buf_llseek, + .poll = dma_buf_poll, diff --git a/queue-5.4/drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch b/queue-5.4/drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch new file mode 100644 index 00000000000..70fe96a5ab4 --- /dev/null +++ b/queue-5.4/drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch @@ -0,0 +1,54 @@ +From 6eb3cf2e06d22b2b08e6b0ab48cb9c05a8e1a107 Mon Sep 17 00:00:00 2001 +From: Nicholas Kazlauskas +Date: Mon, 29 Jun 2020 13:03:52 -0400 +Subject: drm/amd/display: Only revalidate bandwidth on medium and fast updates + +From: Nicholas Kazlauskas + +commit 6eb3cf2e06d22b2b08e6b0ab48cb9c05a8e1a107 upstream. + +[Why] +Changes that are fast don't require updating DLG parameters making +this call unnecessary. Considering this is an expensive call it should +not be done on every flip. + +DML touches clocks, p-state support, DLG params and a few other DC +internal flags and these aren't expected during fast. A hang has been +reported with this change when called on every flip which suggests that +modifying these fields is not recommended behavior on fast updates. + +[How] +Guard the validation to only happen if update type isn't FAST. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1191 +Fixes: a24eaa5c51255b ("drm/amd/display: Revalidate bandwidth before commiting DC updates") +Signed-off-by: Nicholas Kazlauskas +Acked-by: Alex Deucher +Reviewed-by: Roman Li +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2226,10 +2226,12 @@ void dc_commit_updates_for_stream(struct + + copy_stream_update_to_stream(dc, context, stream, stream_update); + +- if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) { +- DC_ERROR("Mode validation failed for stream update!\n"); +- dc_release_state(context); +- return; ++ if (update_type > UPDATE_TYPE_FAST) { ++ if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) { ++ DC_ERROR("Mode validation failed for stream update!\n"); ++ dc_release_state(context); ++ return; ++ } + } + + commit_planes_for_stream( diff --git a/queue-5.4/drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch b/queue-5.4/drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch new file mode 100644 index 00000000000..9682372d54f --- /dev/null +++ b/queue-5.4/drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch @@ -0,0 +1,34 @@ +From d7a6634a4cfba073ff6a526cb4265d6e58ece234 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 25 Jun 2020 17:55:57 -0400 +Subject: drm/amdgpu/atomfirmware: fix vram_info fetching for renoir + +From: Alex Deucher + +commit d7a6634a4cfba073ff6a526cb4265d6e58ece234 upstream. + +Renoir uses integrated_system_info table v12. The table +has the same layout as v11 with respect to this data. Just +reuse the existing code for v12 for stable. + +Fixes incorrectly reported vram info in the driver output. + +Acked-by: Evan Quan +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atomfirmware.c +@@ -150,6 +150,7 @@ int amdgpu_atomfirmware_get_vram_width(s + (mode_info->atom_context->bios + data_offset); + switch (crev) { + case 11: ++ case 12: + mem_channel_number = igp_info->v11.umachannelnumber; + /* channel width is 64 */ + return mem_channel_number * 64; diff --git a/queue-5.4/drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch b/queue-5.4/drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch new file mode 100644 index 00000000000..b9c2d3616e8 --- /dev/null +++ b/queue-5.4/drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch @@ -0,0 +1,42 @@ +From beaf10efca64ac824240838ab1f054dfbefab5e6 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 1 Jul 2020 12:00:08 -0400 +Subject: drm/amdgpu: use %u rather than %d for sclk/mclk + +From: Alex Deucher + +commit beaf10efca64ac824240838ab1f054dfbefab5e6 upstream. + +Large clock values may overflow and show up as negative. + +Reported by prOMiNd on IRC. + +Acked-by: Nirmoy Das +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c +@@ -2101,7 +2101,7 @@ static ssize_t amdgpu_hwmon_show_sclk(st + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%d\n", sclk * 10 * 1000); ++ return snprintf(buf, PAGE_SIZE, "%u\n", sclk * 10 * 1000); + } + + static ssize_t amdgpu_hwmon_show_sclk_label(struct device *dev, +@@ -2131,7 +2131,7 @@ static ssize_t amdgpu_hwmon_show_mclk(st + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%d\n", mclk * 10 * 1000); ++ return snprintf(buf, PAGE_SIZE, "%u\n", mclk * 10 * 1000); + } + + static ssize_t amdgpu_hwmon_show_mclk_label(struct device *dev, diff --git a/queue-5.4/irqchip-gic-atomically-update-affinity.patch b/queue-5.4/irqchip-gic-atomically-update-affinity.patch new file mode 100644 index 00000000000..ac891f5a64b --- /dev/null +++ b/queue-5.4/irqchip-gic-atomically-update-affinity.patch @@ -0,0 +1,61 @@ +From 005c34ae4b44f085120d7f371121ec7ded677761 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sun, 21 Jun 2020 14:43:15 +0100 +Subject: irqchip/gic: Atomically update affinity + +From: Marc Zyngier + +commit 005c34ae4b44f085120d7f371121ec7ded677761 upstream. + +The GIC driver uses a RMW sequence to update the affinity, and +relies on the gic_lock_irqsave/gic_unlock_irqrestore sequences +to update it atomically. + +But these sequences only expand into anything meaningful if +the BL_SWITCHER option is selected, which almost never happens. + +It also turns out that using a RMW and locks is just as silly, +as the GIC distributor supports byte accesses for the GICD_TARGETRn +registers, which when used make the update atomic by definition. + +Drop the terminally broken code and replace it by a byte write. + +Fixes: 04c8b0f82c7d ("irqchip/gic: Make locking a BL_SWITCHER only feature") +Cc: stable@vger.kernel.org +Signed-off-by: Marc Zyngier +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/irqchip/irq-gic.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -329,10 +329,8 @@ static int gic_irq_set_vcpu_affinity(str + static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val, + bool force) + { +- void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + (gic_irq(d) & ~3); +- unsigned int cpu, shift = (gic_irq(d) % 4) * 8; +- u32 val, mask, bit; +- unsigned long flags; ++ void __iomem *reg = gic_dist_base(d) + GIC_DIST_TARGET + gic_irq(d); ++ unsigned int cpu; + + if (!force) + cpu = cpumask_any_and(mask_val, cpu_online_mask); +@@ -342,13 +340,7 @@ static int gic_set_affinity(struct irq_d + if (cpu >= NR_GIC_CPU_IF || cpu >= nr_cpu_ids) + return -EINVAL; + +- gic_lock_irqsave(flags); +- mask = 0xff << shift; +- bit = gic_cpu_map[cpu] << shift; +- val = readl_relaxed(reg) & ~mask; +- writel_relaxed(val | bit, reg); +- gic_unlock_irqrestore(flags); +- ++ writeb_relaxed(gic_cpu_map[cpu], reg); + irq_data_update_effective_affinity(d, cpumask_of(cpu)); + + return IRQ_SET_MASK_OK_DONE; diff --git a/queue-5.4/mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch b/queue-5.4/mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch new file mode 100644 index 00000000000..8ffbfbd2b35 --- /dev/null +++ b/queue-5.4/mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch @@ -0,0 +1,68 @@ +From fcec538ef8cca0ad0b84432235dccd9059c8e6f8 Mon Sep 17 00:00:00 2001 +From: Hauke Mehrtens +Date: Fri, 3 Jul 2020 00:53:34 +0200 +Subject: MIPS: Add missing EHB in mtc0 -> mfc0 sequence for DSPen + +From: Hauke Mehrtens + +commit fcec538ef8cca0ad0b84432235dccd9059c8e6f8 upstream. + +This resolves the hazard between the mtc0 in the change_c0_status() and +the mfc0 in configure_exception_vector(). Without resolving this hazard +configure_exception_vector() could read an old value and would restore +this old value again. This would revert the changes change_c0_status() +did. I checked this by printing out the read_c0_status() at the end of +per_cpu_trap_init() and the ST0_MX is not set without this patch. + +The hazard is documented in the MIPS Architecture Reference Manual Vol. +III: MIPS32/microMIPS32 Privileged Resource Architecture (MD00088), rev +6.03 table 8.1 which includes: + + Producer | Consumer | Hazard + ----------|----------|---------------------------- + mtc0 | mfc0 | any coprocessor 0 register + +I saw this hazard on an Atheros AR9344 rev 2 SoC with a MIPS 74Kc CPU. +There the change_c0_status() function would activate the DSPen by +setting ST0_MX in the c0_status register. This was reverted and then the +system got a DSP exception when the DSP registers were saved in +save_dsp() in the first process switch. The crash looks like this: + +[ 0.089999] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) +[ 0.097796] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear) +[ 0.107070] Kernel panic - not syncing: Unexpected DSP exception +[ 0.113470] Rebooting in 1 seconds.. + +We saw this problem in OpenWrt only on the MIPS 74Kc based Atheros SoCs, +not on the 24Kc based SoCs. We only saw it with kernel 5.4 not with +kernel 4.19, in addition we had to use GCC 8.4 or 9.X, with GCC 8.3 it +did not happen. + +In the kernel I bisected this problem to commit 9012d011660e ("compiler: +allow all arches to enable CONFIG_OPTIMIZE_INLINING"), but when this was +reverted it also happened after commit 172dcd935c34b ("MIPS: Always +allocate exception vector for MIPSr2+"). + +Commit 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.") +does similar changes to a different file. I am not sure if there are +more places affected by this problem. + +Signed-off-by: Hauke Mehrtens +Cc: +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/traps.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -2126,6 +2126,7 @@ static void configure_status(void) + + change_c0_status(ST0_CU|ST0_MX|ST0_RE|ST0_FR|ST0_BEV|ST0_TS|ST0_KX|ST0_SX|ST0_UX, + status_set); ++ back_to_back_c0_hazard(); + } + + unsigned int hwrena; diff --git a/queue-5.4/mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch b/queue-5.4/mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch new file mode 100644 index 00000000000..20a78324c27 --- /dev/null +++ b/queue-5.4/mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch @@ -0,0 +1,48 @@ +From 03e62fd67d3ab33f39573fc8787d89dc9b4d7255 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Sun, 7 Jun 2020 15:10:23 +0200 +Subject: MIPS: lantiq: xway: sysctrl: fix the GPHY clock alias names + +From: Martin Blumenstingl + +commit 03e62fd67d3ab33f39573fc8787d89dc9b4d7255 upstream. + +The dt-bindings for the GSWIP describe that the node should be named +"switch". Use the same name in sysctrl.c so the GSWIP driver can +actually find the "gphy0" and "gphy1" clocks. + +Fixes: 14fceff4771e51 ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") +Cc: stable@vger.kernel.org +Signed-off-by: Martin Blumenstingl +Acked-by: Hauke Mehrtens +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/lantiq/xway/sysctrl.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/lantiq/xway/sysctrl.c ++++ b/arch/mips/lantiq/xway/sysctrl.c +@@ -514,8 +514,8 @@ void __init ltq_soc_init(void) + clkdev_add_pmu("1e10b308.eth", NULL, 0, 0, PMU_SWITCH | + PMU_PPE_DP | PMU_PPE_TC); + clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); +- clkdev_add_pmu("1e108000.gswip", "gphy0", 0, 0, PMU_GPHY); +- clkdev_add_pmu("1e108000.gswip", "gphy1", 0, 0, PMU_GPHY); ++ clkdev_add_pmu("1e108000.switch", "gphy0", 0, 0, PMU_GPHY); ++ clkdev_add_pmu("1e108000.switch", "gphy1", 0, 0, PMU_GPHY); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); + clkdev_add_pmu("1e116000.mei", "afe", 1, 2, PMU_ANALOG_DSL_AFE); + clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); +@@ -538,8 +538,8 @@ void __init ltq_soc_init(void) + PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM | + PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 | + PMU_PPE_QSB | PMU_PPE_TOP); +- clkdev_add_pmu("1e108000.gswip", "gphy0", 0, 0, PMU_GPHY); +- clkdev_add_pmu("1e108000.gswip", "gphy1", 0, 0, PMU_GPHY); ++ clkdev_add_pmu("1e108000.switch", "gphy0", 0, 0, PMU_GPHY); ++ clkdev_add_pmu("1e108000.switch", "gphy1", 0, 0, PMU_GPHY); + clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); + clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); diff --git a/queue-5.4/mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch b/queue-5.4/mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch new file mode 100644 index 00000000000..31a3917d245 --- /dev/null +++ b/queue-5.4/mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch @@ -0,0 +1,87 @@ +From 6467552ca64c4ddd2b83ed73192107d7145f533b Mon Sep 17 00:00:00 2001 +From: Vlastimil Babka +Date: Wed, 1 Apr 2020 21:10:35 -0700 +Subject: mm, compaction: fully assume capture is not NULL in compact_zone_order() + +From: Vlastimil Babka + +commit 6467552ca64c4ddd2b83ed73192107d7145f533b upstream. + +Dan reports: + +The patch 5e1f0f098b46: "mm, compaction: capture a page under direct +compaction" from Mar 5, 2019, leads to the following Smatch complaint: + + mm/compaction.c:2321 compact_zone_order() + error: we previously assumed 'capture' could be null (see line 2313) + +mm/compaction.c + 2288 static enum compact_result compact_zone_order(struct zone *zone, int order, + 2289 gfp_t gfp_mask, enum compact_priority prio, + 2290 unsigned int alloc_flags, int classzone_idx, + 2291 struct page **capture) + ^^^^^^^ + + 2313 if (capture) + ^^^^^^^ +Check for NULL + + 2314 current->capture_control = &capc; + 2315 + 2316 ret = compact_zone(&cc, &capc); + 2317 + 2318 VM_BUG_ON(!list_empty(&cc.freepages)); + 2319 VM_BUG_ON(!list_empty(&cc.migratepages)); + 2320 + 2321 *capture = capc.page; + ^^^^^^^^ +Unchecked dereference. + + 2322 current->capture_control = NULL; + 2323 + +In practice this is not an issue, as the only caller path passes non-NULL +capture: + +__alloc_pages_direct_compact() + struct page *page = NULL; + try_to_compact_pages(capture = &page); + compact_zone_order(capture = capture); + +So let's remove the unnecessary check, which should also make Smatch happy. + +Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction") +Reported-by: Dan Carpenter +Suggested-by: Andrew Morton +Signed-off-by: Vlastimil Babka +Signed-off-by: Andrew Morton +Reviewed-by: Andrew Morton +Acked-by: Mel Gorman +Link: http://lkml.kernel.org/r/18b0df3c-0589-d96c-23fa-040798fee187@suse.cz +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/compaction.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -2310,8 +2310,7 @@ static enum compact_result compact_zone_ + .page = NULL, + }; + +- if (capture) +- current->capture_control = &capc; ++ current->capture_control = &capc; + + ret = compact_zone(&cc, &capc); + +@@ -2333,6 +2332,7 @@ int sysctl_extfrag_threshold = 500; + * @alloc_flags: The allocation flags of the current allocation + * @ac: The context of current allocation + * @prio: Determines how hard direct compaction should try to succeed ++ * @capture: Pointer to free page created by compaction will be stored here + * + * This is the main entry point for direct page compaction. + */ diff --git a/queue-5.4/mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch b/queue-5.4/mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch new file mode 100644 index 00000000000..da04fe747a7 --- /dev/null +++ b/queue-5.4/mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch @@ -0,0 +1,93 @@ +From b9e20f0da1f5c9c68689450a8cb436c9486434c8 Mon Sep 17 00:00:00 2001 +From: Vlastimil Babka +Date: Thu, 25 Jun 2020 20:29:24 -0700 +Subject: mm, compaction: make capture control handling safe wrt interrupts + +From: Vlastimil Babka + +commit b9e20f0da1f5c9c68689450a8cb436c9486434c8 upstream. + +Hugh reports: + + "While stressing compaction, one run oopsed on NULL capc->cc in + __free_one_page()'s task_capc(zone): compact_zone_order() had been + interrupted, and a page was being freed in the return from interrupt. + + Though you would not expect it from the source, both gccs I was using + (4.8.1 and 7.5.0) had chosen to compile compact_zone_order() with the + ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before + callq compact_zone - long after the "current->capture_control = + &capc". An interrupt in between those finds capc->cc NULL (zeroed by + an earlier rep stos). + + This could presumably be fixed by a barrier() before setting + current->capture_control in compact_zone_order(); but would also need + more care on return from compact_zone(), in order not to risk leaking + a page captured by interrupt just before capture_control is reset. + + Maybe that is the preferable fix, but I felt safer for task_capc() to + exclude the rather surprising possibility of capture at interrupt + time" + +I have checked that gcc10 also behaves the same. + +The advantage of fix in compact_zone_order() is that we don't add +another test in the page freeing hot path, and that it might prevent +future problems if we stop exposing pointers to uninitialized structures +in current task. + +So this patch implements the suggestion for compact_zone_order() with +barrier() (and WRITE_ONCE() to prevent store tearing) for setting +current->capture_control, and prevents page leaking with +WRITE_ONCE/READ_ONCE in the proper order. + +Link: http://lkml.kernel.org/r/20200616082649.27173-1-vbabka@suse.cz +Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction") +Signed-off-by: Vlastimil Babka +Reported-by: Hugh Dickins +Suggested-by: Hugh Dickins +Acked-by: Hugh Dickins +Cc: Alex Shi +Cc: Li Wang +Cc: Mel Gorman +Cc: [5.1+] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/compaction.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/mm/compaction.c ++++ b/mm/compaction.c +@@ -2310,15 +2310,26 @@ static enum compact_result compact_zone_ + .page = NULL, + }; + +- current->capture_control = &capc; ++ /* ++ * Make sure the structs are really initialized before we expose the ++ * capture control, in case we are interrupted and the interrupt handler ++ * frees a page. ++ */ ++ barrier(); ++ WRITE_ONCE(current->capture_control, &capc); + + ret = compact_zone(&cc, &capc); + + VM_BUG_ON(!list_empty(&cc.freepages)); + VM_BUG_ON(!list_empty(&cc.migratepages)); + +- *capture = capc.page; +- current->capture_control = NULL; ++ /* ++ * Make sure we hide capture control first before we read the captured ++ * page pointer, otherwise an interrupt could free and capture a page ++ * and we would leak it. ++ */ ++ WRITE_ONCE(current->capture_control, NULL); ++ *capture = READ_ONCE(capc.page); + + return ret; + } diff --git a/queue-5.4/nfsd-apply-umask-on-fs-without-acl-support.patch b/queue-5.4/nfsd-apply-umask-on-fs-without-acl-support.patch new file mode 100644 index 00000000000..59cedeaa293 --- /dev/null +++ b/queue-5.4/nfsd-apply-umask-on-fs-without-acl-support.patch @@ -0,0 +1,56 @@ +From 22cf8419f1319ff87ec759d0ebdff4cbafaee832 Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Tue, 16 Jun 2020 16:43:18 -0400 +Subject: nfsd: apply umask on fs without ACL support + +From: J. Bruce Fields + +commit 22cf8419f1319ff87ec759d0ebdff4cbafaee832 upstream. + +The server is failing to apply the umask when creating new objects on +filesystems without ACL support. + +To reproduce this, you need to use NFSv4.2 and a client and server +recent enough to support umask, and you need to export a filesystem that +lacks ACL support (for example, ext4 with the "noacl" mount option). + +Filesystems with ACL support are expected to take care of the umask +themselves (usually by calling posix_acl_create). + +For filesystems without ACL support, this is up to the caller of +vfs_create(), vfs_mknod(), or vfs_mkdir(). + +Reported-by: Elliott Mitchell +Reported-by: Salvatore Bonaccorso +Tested-by: Salvatore Bonaccorso +Fixes: 47057abde515 ("nfsd: add support for the umask attribute") +Cc: stable@vger.kernel.org +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/vfs.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1184,6 +1184,9 @@ nfsd_create_locked(struct svc_rqst *rqst + iap->ia_mode = 0; + iap->ia_mode = (iap->ia_mode & S_IALLUGO) | type; + ++ if (!IS_POSIXACL(dirp)) ++ iap->ia_mode &= ~current_umask(); ++ + err = 0; + host_err = 0; + switch (type) { +@@ -1416,6 +1419,9 @@ do_nfsd_create(struct svc_rqst *rqstp, s + goto out; + } + ++ if (!IS_POSIXACL(dirp)) ++ iap->ia_mode &= ~current_umask(); ++ + host_err = vfs_create(dirp, dchild, iap->ia_mode, true); + if (host_err < 0) { + fh_drop_write(fhp); diff --git a/queue-5.4/revert-alsa-usb-audio-improve-frames-size-computation.patch b/queue-5.4/revert-alsa-usb-audio-improve-frames-size-computation.patch new file mode 100644 index 00000000000..c4f5c035cc8 --- /dev/null +++ b/queue-5.4/revert-alsa-usb-audio-improve-frames-size-computation.patch @@ -0,0 +1,144 @@ +From 22cfd031dc5354715bf1dd143f1e664d3f70febf Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Tue, 7 Jul 2020 14:42:38 +0200 +Subject: Revert "ALSA: usb-audio: Improve frames size computation" + +From: Greg Kroah-Hartman + +This reverts commit aba41867dd66939d336fdf604e4d73b805d8039f which is +commit f0bd62b64016508938df9babe47f65c2c727d25c upstream. + +It causes a number of reported issues and a fix for it has not hit +Linus's tree yet. Revert this to resolve those problems. + +Cc: Alexander Tsoy +Cc: Takashi Iwai +Cc: Sasha Levin +Cc: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.h | 4 ---- + sound/usb/endpoint.c | 43 +++++-------------------------------------- + sound/usb/endpoint.h | 1 - + sound/usb/pcm.c | 2 -- + 4 files changed, 5 insertions(+), 45 deletions(-) + +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -84,10 +84,6 @@ struct snd_usb_endpoint { + dma_addr_t sync_dma; /* DMA address of syncbuf */ + + unsigned int pipe; /* the data i/o pipe */ +- unsigned int framesize[2]; /* small/large frame sizes in samples */ +- unsigned int sample_rem; /* remainder from division fs/fps */ +- unsigned int sample_accum; /* sample accumulator */ +- unsigned int fps; /* frames per second */ + unsigned int freqn; /* nominal sampling rate in fs/fps in Q16.16 format */ + unsigned int freqm; /* momentary sampling rate in fs/fps in Q16.16 format */ + int freqshift; /* how much to shift the feedback value to get Q16.16 */ +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -124,12 +124,12 @@ int snd_usb_endpoint_implicit_feedback_s + + /* + * For streaming based on information derived from sync endpoints, +- * prepare_outbound_urb_sizes() will call slave_next_packet_size() to ++ * prepare_outbound_urb_sizes() will call next_packet_size() to + * determine the number of samples to be sent in the next packet. + * +- * For implicit feedback, slave_next_packet_size() is unused. ++ * For implicit feedback, next_packet_size() is unused. + */ +-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep) ++int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) + { + unsigned long flags; + int ret; +@@ -146,29 +146,6 @@ int snd_usb_endpoint_slave_next_packet_s + return ret; + } + +-/* +- * For adaptive and synchronous endpoints, prepare_outbound_urb_sizes() +- * will call next_packet_size() to determine the number of samples to be +- * sent in the next packet. +- */ +-int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep) +-{ +- int ret; +- +- if (ep->fill_max) +- return ep->maxframesize; +- +- ep->sample_accum += ep->sample_rem; +- if (ep->sample_accum >= ep->fps) { +- ep->sample_accum -= ep->fps; +- ret = ep->framesize[1]; +- } else { +- ret = ep->framesize[0]; +- } +- +- return ret; +-} +- + static void retire_outbound_urb(struct snd_usb_endpoint *ep, + struct snd_urb_ctx *urb_ctx) + { +@@ -213,8 +190,6 @@ static void prepare_silent_urb(struct sn + + if (ctx->packet_size[i]) + counts = ctx->packet_size[i]; +- else if (ep->sync_master) +- counts = snd_usb_endpoint_slave_next_packet_size(ep); + else + counts = snd_usb_endpoint_next_packet_size(ep); + +@@ -1086,17 +1061,10 @@ int snd_usb_endpoint_set_params(struct s + ep->maxpacksize = fmt->maxpacksize; + ep->fill_max = !!(fmt->attributes & UAC_EP_CS_ATTR_FILL_MAX); + +- if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) { ++ if (snd_usb_get_speed(ep->chip->dev) == USB_SPEED_FULL) + ep->freqn = get_usb_full_speed_rate(rate); +- ep->fps = 1000; +- } else { ++ else + ep->freqn = get_usb_high_speed_rate(rate); +- ep->fps = 8000; +- } +- +- ep->sample_rem = rate % ep->fps; +- ep->framesize[0] = rate / ep->fps; +- ep->framesize[1] = (rate + (ep->fps - 1)) / ep->fps; + + /* calculate the frequency in 16.16 format */ + ep->freqm = ep->freqn; +@@ -1155,7 +1123,6 @@ int snd_usb_endpoint_start(struct snd_us + ep->active_mask = 0; + ep->unlink_mask = 0; + ep->phase = 0; +- ep->sample_accum = 0; + + snd_usb_endpoint_start_quirk(ep); + +--- a/sound/usb/endpoint.h ++++ b/sound/usb/endpoint.h +@@ -28,7 +28,6 @@ void snd_usb_endpoint_release(struct snd + void snd_usb_endpoint_free(struct snd_usb_endpoint *ep); + + int snd_usb_endpoint_implicit_feedback_sink(struct snd_usb_endpoint *ep); +-int snd_usb_endpoint_slave_next_packet_size(struct snd_usb_endpoint *ep); + int snd_usb_endpoint_next_packet_size(struct snd_usb_endpoint *ep); + + void snd_usb_handle_sync_urb(struct snd_usb_endpoint *ep, +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1581,8 +1581,6 @@ static void prepare_playback_urb(struct + for (i = 0; i < ctx->packets; i++) { + if (ctx->packet_size[i]) + counts = ctx->packet_size[i]; +- else if (ep->sync_master) +- counts = snd_usb_endpoint_slave_next_packet_size(ep); + else + counts = snd_usb_endpoint_next_packet_size(ep); + diff --git a/queue-5.4/series b/queue-5.4/series index 01c684794c1..c69cbd9ce73 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -43,3 +43,20 @@ nvme-fix-a-crash-in-nvme_mpath_add_disk.patch samples-vfs-avoid-warning-in-statx-override.patch i2c-algo-pca-add-0x78-as-scl-stuck-low-status-for-pc.patch i2c-mlxcpld-check-correct-size-of-maximum-recv_len-p.patch +spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch +nfsd-apply-umask-on-fs-without-acl-support.patch +revert-alsa-usb-audio-improve-frames-size-computation.patch +smb3-honor-seal-flag-for-multiuser-mounts.patch +smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch +smb3-honor-lease-disabling-for-multiuser-mounts.patch +smb3-honor-handletimeout-flag-for-multiuser-mounts.patch +cifs-fix-the-target-file-was-deleted-when-rename-failed.patch +mips-lantiq-xway-sysctrl-fix-the-gphy-clock-alias-names.patch +mips-add-missing-ehb-in-mtc0-mfc0-sequence-for-dspen.patch +drm-amd-display-only-revalidate-bandwidth-on-medium-and-fast-updates.patch +drm-amdgpu-use-u-rather-than-d-for-sclk-mclk.patch +drm-amdgpu-atomfirmware-fix-vram_info-fetching-for-renoir.patch +dma-buf-move-dma_buf_release-from-fops-to-dentry_ops.patch +irqchip-gic-atomically-update-affinity.patch +mm-compaction-fully-assume-capture-is-not-null-in-compact_zone_order.patch +mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch diff --git a/queue-5.4/smb3-honor-handletimeout-flag-for-multiuser-mounts.patch b/queue-5.4/smb3-honor-handletimeout-flag-for-multiuser-mounts.patch new file mode 100644 index 00000000000..1d3820c71c6 --- /dev/null +++ b/queue-5.4/smb3-honor-handletimeout-flag-for-multiuser-mounts.patch @@ -0,0 +1,30 @@ +From 6b356f6cf941d5054d7fab072cae4a5f8658e3db Mon Sep 17 00:00:00 2001 +From: Paul Aurich +Date: Fri, 26 Jun 2020 12:58:08 -0700 +Subject: SMB3: Honor 'handletimeout' flag for multiuser mounts + +From: Paul Aurich + +commit 6b356f6cf941d5054d7fab072cae4a5f8658e3db upstream. + +Fixes: ca567eb2b3f0 ("SMB3: Allow persistent handle timeout to be configurable on mount") +Signed-off-by: Paul Aurich +CC: Stable +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -5284,6 +5284,7 @@ cifs_construct_tcon(struct cifs_sb_info + vol_info->no_lease = master_tcon->no_lease; + vol_info->resilient = master_tcon->use_resilient; + vol_info->persistent = master_tcon->use_persistent; ++ vol_info->handle_timeout = master_tcon->handle_timeout; + vol_info->no_linux_ext = !master_tcon->unix_ext; + vol_info->linux_ext = master_tcon->posix_extensions; + vol_info->sectype = master_tcon->ses->sectype; diff --git a/queue-5.4/smb3-honor-lease-disabling-for-multiuser-mounts.patch b/queue-5.4/smb3-honor-lease-disabling-for-multiuser-mounts.patch new file mode 100644 index 00000000000..599d885d93e --- /dev/null +++ b/queue-5.4/smb3-honor-lease-disabling-for-multiuser-mounts.patch @@ -0,0 +1,30 @@ +From ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 Mon Sep 17 00:00:00 2001 +From: Paul Aurich +Date: Fri, 26 Jun 2020 12:58:07 -0700 +Subject: SMB3: Honor lease disabling for multiuser mounts + +From: Paul Aurich + +commit ad35f169db6cd5a4c5c0a5a42fb0cad3efeccb83 upstream. + +Fixes: 3e7a02d47872 ("smb3: allow disabling requesting leases") +Signed-off-by: Paul Aurich +CC: Stable +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -5281,6 +5281,7 @@ cifs_construct_tcon(struct cifs_sb_info + vol_info->nocase = master_tcon->nocase; + vol_info->nohandlecache = master_tcon->nohandlecache; + vol_info->local_lease = master_tcon->local_lease; ++ vol_info->no_lease = master_tcon->no_lease; + vol_info->resilient = master_tcon->use_resilient; + vol_info->persistent = master_tcon->use_persistent; + vol_info->no_linux_ext = !master_tcon->unix_ext; diff --git a/queue-5.4/smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch b/queue-5.4/smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch new file mode 100644 index 00000000000..63781ce0a55 --- /dev/null +++ b/queue-5.4/smb3-honor-persistent-resilient-handle-flags-for-multiuser-mounts.patch @@ -0,0 +1,36 @@ +From 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f Mon Sep 17 00:00:00 2001 +From: Paul Aurich +Date: Fri, 26 Jun 2020 12:58:06 -0700 +Subject: SMB3: Honor persistent/resilient handle flags for multiuser mounts + +From: Paul Aurich + +commit 00dfbc2f9c61185a2e662f27c45a0bb29b2a134f upstream. + +Without this: + +- persistent handles will only be enabled for per-user tcons if the + server advertises the 'Continuous Availabity' capability +- resilient handles would never be enabled for per-user tcons + +Signed-off-by: Paul Aurich +CC: Stable +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -5281,6 +5281,8 @@ cifs_construct_tcon(struct cifs_sb_info + vol_info->nocase = master_tcon->nocase; + vol_info->nohandlecache = master_tcon->nohandlecache; + vol_info->local_lease = master_tcon->local_lease; ++ vol_info->resilient = master_tcon->use_resilient; ++ vol_info->persistent = master_tcon->use_persistent; + vol_info->no_linux_ext = !master_tcon->unix_ext; + vol_info->linux_ext = master_tcon->posix_extensions; + vol_info->sectype = master_tcon->ses->sectype; diff --git a/queue-5.4/smb3-honor-seal-flag-for-multiuser-mounts.patch b/queue-5.4/smb3-honor-seal-flag-for-multiuser-mounts.patch new file mode 100644 index 00000000000..a4d8d444598 --- /dev/null +++ b/queue-5.4/smb3-honor-seal-flag-for-multiuser-mounts.patch @@ -0,0 +1,35 @@ +From cc15461c73d7d044d56c47e869a215e49bd429c8 Mon Sep 17 00:00:00 2001 +From: Paul Aurich +Date: Fri, 26 Jun 2020 12:58:05 -0700 +Subject: SMB3: Honor 'seal' flag for multiuser mounts + +From: Paul Aurich + +commit cc15461c73d7d044d56c47e869a215e49bd429c8 upstream. + +Ensure multiuser SMB3 mounts use encryption for all users' tcons if the +mount options are configured to require encryption. Without this, only +the primary tcon and IPC tcons are guaranteed to be encrypted. Per-user +tcons would only be encrypted if the server was configured to require +encryption. + +Signed-off-by: Paul Aurich +CC: Stable +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -5285,6 +5285,7 @@ cifs_construct_tcon(struct cifs_sb_info + vol_info->linux_ext = master_tcon->posix_extensions; + vol_info->sectype = master_tcon->ses->sectype; + vol_info->sign = master_tcon->ses->sign; ++ vol_info->seal = master_tcon->seal; + + rc = cifs_set_vol_auth(vol_info, master_tcon->ses); + if (rc) { diff --git a/queue-5.4/spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch b/queue-5.4/spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch new file mode 100644 index 00000000000..08be7a06894 --- /dev/null +++ b/queue-5.4/spi-spi-fsl-dspi-fix-external-abort-on-interrupt-in-resume-or-exit-paths.patch @@ -0,0 +1,122 @@ +From 3d87b613d6a3c6f0980e877ab0895785a2dde581 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 22 Jun 2020 13:05:42 +0200 +Subject: spi: spi-fsl-dspi: Fix external abort on interrupt in resume or exit paths + +From: Krzysztof Kozlowski + +commit 3d87b613d6a3c6f0980e877ab0895785a2dde581 upstream. + +If shared interrupt comes late, during probe error path or device remove +(could be triggered with CONFIG_DEBUG_SHIRQ), the interrupt handler +dspi_interrupt() will access registers with the clock being disabled. +This leads to external abort on non-linefetch on Toradex Colibri VF50 +module (with Vybrid VF5xx): + + $ echo 4002d000.spi > /sys/devices/platform/soc/40000000.bus/4002d000.spi/driver/unbind + + Unhandled fault: external abort on non-linefetch (0x1008) at 0x8887f02c + Internal error: : 1008 [#1] ARM + Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree) + Backtrace: + (regmap_mmio_read32le) + (regmap_mmio_read) + (_regmap_bus_reg_read) + (_regmap_read) + (regmap_read) + (dspi_interrupt) + (free_irq) + (devm_irq_release) + (release_nodes) + (devres_release_all) + (device_release_driver_internal) + +The resource-managed framework should not be used for shared interrupt +handling, because the interrupt handler might be called after releasing +other resources and disabling clocks. + +Similar bug could happen during suspend - the shared interrupt handler +could be invoked after suspending the device. Each device sharing this +interrupt line should disable the IRQ during suspend so handler will be +invoked only in following cases: +1. None suspended, +2. All devices resumed. + +Fixes: 349ad66c0ab0 ("spi:Add Freescale DSPI driver for Vybrid VF610 platform") +Signed-off-by: Krzysztof Kozlowski +Tested-by: Vladimir Oltean +Reviewed-by: Vladimir Oltean +Cc: +Link: https://lore.kernel.org/r/20200622110543.5035-3-krzk@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-dspi.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-fsl-dspi.c ++++ b/drivers/spi/spi-fsl-dspi.c +@@ -901,6 +901,8 @@ static int dspi_suspend(struct device *d + struct spi_controller *ctlr = dev_get_drvdata(dev); + struct fsl_dspi *dspi = spi_controller_get_devdata(ctlr); + ++ if (dspi->irq) ++ disable_irq(dspi->irq); + spi_controller_suspend(ctlr); + clk_disable_unprepare(dspi->clk); + +@@ -921,6 +923,8 @@ static int dspi_resume(struct device *de + if (ret) + return ret; + spi_controller_resume(ctlr); ++ if (dspi->irq) ++ enable_irq(dspi->irq); + + return 0; + } +@@ -1108,8 +1112,8 @@ static int dspi_probe(struct platform_de + goto poll_mode; + } + +- ret = devm_request_irq(&pdev->dev, dspi->irq, dspi_interrupt, +- IRQF_SHARED, pdev->name, dspi); ++ ret = request_threaded_irq(dspi->irq, dspi_interrupt, NULL, ++ IRQF_SHARED, pdev->name, dspi); + if (ret < 0) { + dev_err(&pdev->dev, "Unable to attach DSPI interrupt\n"); + goto out_clk_put; +@@ -1122,7 +1126,7 @@ poll_mode: + ret = dspi_request_dma(dspi, res->start); + if (ret < 0) { + dev_err(&pdev->dev, "can't get dma channels\n"); +- goto out_clk_put; ++ goto out_free_irq; + } + } + +@@ -1134,11 +1138,14 @@ poll_mode: + ret = spi_register_controller(ctlr); + if (ret != 0) { + dev_err(&pdev->dev, "Problem registering DSPI ctlr\n"); +- goto out_clk_put; ++ goto out_free_irq; + } + + return ret; + ++out_free_irq: ++ if (dspi->irq) ++ free_irq(dspi->irq, dspi); + out_clk_put: + clk_disable_unprepare(dspi->clk); + out_ctlr_put: +@@ -1154,6 +1161,8 @@ static int dspi_remove(struct platform_d + + /* Disconnect from the SPI framework */ + dspi_release_dma(dspi); ++ if (dspi->irq) ++ free_irq(dspi->irq, dspi); + clk_disable_unprepare(dspi->clk); + spi_unregister_controller(dspi->ctlr); +