From: Greg Kroah-Hartman Date: Fri, 30 Oct 2020 09:19:13 +0000 (+0100) Subject: queue-4.19: drop all patches already in 4.19.153 X-Git-Tag: v4.19.154~1 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5841cf78fc5a4487892b14c57c77f7b71c67b00e;p=thirdparty%2Fkernel%2Fstable-queue.git queue-4.19: drop all patches already in 4.19.153 --- diff --git a/queue-4.19/alsa-bebob-potential-info-leak-in-hwdep_read.patch b/queue-4.19/alsa-bebob-potential-info-leak-in-hwdep_read.patch deleted file mode 100644 index 833ced5ffeb..00000000000 --- a/queue-4.19/alsa-bebob-potential-info-leak-in-hwdep_read.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b41c15f4e1c1f1657da15c482fa837c1b7384452 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Wed, 7 Oct 2020 10:49:28 +0300 -Subject: ALSA: bebob: potential info leak in hwdep_read() - -From: Dan Carpenter - -commit b41c15f4e1c1f1657da15c482fa837c1b7384452 upstream. - -The "count" variable needs to be capped on every path so that we don't -copy too much information to the user. - -Fixes: 618eabeae711 ("ALSA: bebob: Add hwdep interface") -Signed-off-by: Dan Carpenter -Acked-by: Takashi Sakamoto -Cc: -Link: https://lore.kernel.org/r/20201007074928.GA2529578@mwanda -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/firewire/bebob/bebob_hwdep.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - ---- a/sound/firewire/bebob/bebob_hwdep.c -+++ b/sound/firewire/bebob/bebob_hwdep.c -@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char - } - - memset(&event, 0, sizeof(event)); -+ count = min_t(long, count, sizeof(event.lock_status)); - if (bebob->dev_lock_changed) { - event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS; - event.lock_status.status = (bebob->dev_lock_count > 0); - bebob->dev_lock_changed = false; -- -- count = min_t(long, count, sizeof(event.lock_status)); - } - - spin_unlock_irq(&bebob->lock); diff --git a/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-d700sa-with-alc887.patch b/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-d700sa-with-alc887.patch deleted file mode 100644 index 35ef1141cb4..00000000000 --- a/queue-4.19/alsa-hda-realtek-enable-audio-jacks-of-asus-d700sa-with-alc887.patch +++ /dev/null @@ -1,99 +0,0 @@ -From ca184355db8e60290fa34bf61c13308e6f4f50d3 Mon Sep 17 00:00:00 2001 -From: Jian-Hong Pan -Date: Wed, 7 Oct 2020 13:22:25 +0800 -Subject: ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 - -From: Jian-Hong Pan - -commit ca184355db8e60290fa34bf61c13308e6f4f50d3 upstream. - -The ASUS D700SA desktop's audio (1043:2390) with ALC887 cannot detect -the headset microphone and another headphone jack until -ALC887_FIXUP_ASUS_HMIC and ALC887_FIXUP_ASUS_AUDIO quirks are applied. -The NID 0x15 maps as the headset microphone and NID 0x19 maps as another -headphone jack. Also need the function like alc887_fixup_asus_jack to -enable the audio jacks. - -Signed-off-by: Jian-Hong Pan -Signed-off-by: Kailang Yang -Cc: -Link: https://lore.kernel.org/r/20201007052224.22611-1-jhp@endlessos.org -Signed-off-by: Takashi Iwai -Signed-off-by: Greg Kroah-Hartman - ---- - sound/pci/hda/patch_realtek.c | 42 ++++++++++++++++++++++++++++++++++++++++++ - 1 file changed, 42 insertions(+) - ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -1906,6 +1906,8 @@ enum { - ALC1220_FIXUP_CLEVO_P950, - ALC1220_FIXUP_CLEVO_PB51ED, - ALC1220_FIXUP_CLEVO_PB51ED_PINS, -+ ALC887_FIXUP_ASUS_AUDIO, -+ ALC887_FIXUP_ASUS_HMIC, - }; - - static void alc889_fixup_coef(struct hda_codec *codec, -@@ -2118,6 +2120,31 @@ static void alc1220_fixup_clevo_pb51ed(s - alc_fixup_headset_mode_no_hp_mic(codec, fix, action); - } - -+static void alc887_asus_hp_automute_hook(struct hda_codec *codec, -+ struct hda_jack_callback *jack) -+{ -+ struct alc_spec *spec = codec->spec; -+ unsigned int vref; -+ -+ snd_hda_gen_hp_automute(codec, jack); -+ -+ if (spec->gen.hp_jack_present) -+ vref = AC_PINCTL_VREF_80; -+ else -+ vref = AC_PINCTL_VREF_HIZ; -+ snd_hda_set_pin_ctl(codec, 0x19, PIN_HP | vref); -+} -+ -+static void alc887_fixup_asus_jack(struct hda_codec *codec, -+ const struct hda_fixup *fix, int action) -+{ -+ struct alc_spec *spec = codec->spec; -+ if (action != HDA_FIXUP_ACT_PROBE) -+ return; -+ snd_hda_set_pin_ctl_cache(codec, 0x1b, PIN_HP); -+ spec->gen.hp_automute_hook = alc887_asus_hp_automute_hook; -+} -+ - static const struct hda_fixup alc882_fixups[] = { - [ALC882_FIXUP_ABIT_AW9D_MAX] = { - .type = HDA_FIXUP_PINS, -@@ -2375,6 +2402,20 @@ static const struct hda_fixup alc882_fix - .chained = true, - .chain_id = ALC1220_FIXUP_CLEVO_PB51ED, - }, -+ [ALC887_FIXUP_ASUS_AUDIO] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x15, 0x02a14150 }, /* use as headset mic, without its own jack detect */ -+ { 0x19, 0x22219420 }, -+ {} -+ }, -+ }, -+ [ALC887_FIXUP_ASUS_HMIC] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc887_fixup_asus_jack, -+ .chained = true, -+ .chain_id = ALC887_FIXUP_ASUS_AUDIO, -+ }, - }; - - static const struct snd_pci_quirk alc882_fixup_tbl[] = { -@@ -2408,6 +2449,7 @@ static const struct snd_pci_quirk alc882 - SND_PCI_QUIRK(0x1043, 0x13c2, "Asus A7M", ALC882_FIXUP_EAPD), - SND_PCI_QUIRK(0x1043, 0x1873, "ASUS W90V", ALC882_FIXUP_ASUS_W90V), - SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC), -+ SND_PCI_QUIRK(0x1043, 0x2390, "Asus D700SA", ALC887_FIXUP_ASUS_HMIC), - SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601), - SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS), - SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3), diff --git a/queue-4.19/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch b/queue-4.19/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch deleted file mode 100644 index 27a14d29737..00000000000 --- a/queue-4.19/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch +++ /dev/null @@ -1,51 +0,0 @@ -From e90d6ff171ae80d173b8e58fe18e22eb222ef50f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 22 Sep 2020 10:38:56 +0200 -Subject: ALSA: seq: oss: Avoid mutex lock for a long-time ioctl - -From: Takashi Iwai - -[ Upstream commit 2759caad2600d503c3b0ed800e7e03d2cd7a4c05 ] - -Recently we applied a fix to cover the whole OSS sequencer ioctls with -the mutex for dealing with the possible races. This works fine in -general, but in theory, this may lead to unexpectedly long stall if an -ioctl like SNDCTL_SEQ_SYNC is issued and an event with the far future -timestamp was queued. - -For fixing such a potential stall, this patch changes the mutex lock -applied conditionally excluding such an ioctl command. Also, change -the mutex_lock() with the interruptible version for user to allow -escaping from the big-hammer mutex. - -Fixes: 80982c7e834e ("ALSA: seq: oss: Serialize ioctls") -Suggested-by: Pavel Machek -Link: https://lore.kernel.org/r/20200922083856.28572-1-tiwai@suse.de -Signed-off-by: Takashi Iwai -Signed-off-by: Sasha Levin ---- - sound/core/seq/oss/seq_oss.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c -index ed5bca0db3e73..f4a9d9972330b 100644 ---- a/sound/core/seq/oss/seq_oss.c -+++ b/sound/core/seq/oss/seq_oss.c -@@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - if (snd_BUG_ON(!dp)) - return -ENXIO; - -- mutex_lock(®ister_mutex); -+ if (cmd != SNDCTL_SEQ_SYNC && -+ mutex_lock_interruptible(®ister_mutex)) -+ return -ERESTARTSYS; - rc = snd_seq_oss_ioctl(dp, cmd, arg); -- mutex_unlock(®ister_mutex); -+ if (cmd != SNDCTL_SEQ_SYNC) -+ mutex_unlock(®ister_mutex); - return rc; - } - --- -2.25.1 - diff --git a/queue-4.19/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch b/queue-4.19/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch deleted file mode 100644 index 3e393c698e9..00000000000 --- a/queue-4.19/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch +++ /dev/null @@ -1,45 +0,0 @@ -From a4603eb4e3c549b1f4c85ff9b9be2f9ea8ee177a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 14 Sep 2020 14:46:52 +0300 -Subject: arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER - -From: Necip Fazil Yildiran - -[ Upstream commit 63bcf87cb1c57956e1179f1a78dde625c7e3cba7 ] - -When ARC_SOC_HSDK is enabled and RESET_CONTROLLER is disabled, it results -in the following Kbuild warning: - -WARNING: unmet direct dependencies detected for RESET_HSDK - Depends on [n]: RESET_CONTROLLER [=n] && HAS_IOMEM [=y] && (ARC_SOC_HSDK [=y] || COMPILE_TEST [=n]) - Selected by [y]: - - ARC_SOC_HSDK [=y] && ISA_ARCV2 [=y] - -The reason is that ARC_SOC_HSDK selects RESET_HSDK without depending on or -selecting RESET_CONTROLLER while RESET_HSDK is subordinate to -RESET_CONTROLLER. - -Honor the kconfig menu hierarchy to remove kconfig dependency warnings. - -Fixes: a528629dfd3b ("ARC: [plat-hsdk] select CONFIG_RESET_HSDK from Kconfig") -Signed-off-by: Necip Fazil Yildiran -Signed-off-by: Vineet Gupta -Signed-off-by: Sasha Levin ---- - arch/arc/plat-hsdk/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig -index c285a83cbf08f..df35ea1912e8b 100644 ---- a/arch/arc/plat-hsdk/Kconfig -+++ b/arch/arc/plat-hsdk/Kconfig -@@ -11,5 +11,6 @@ menuconfig ARC_SOC_HSDK - select ARC_HAS_ACCL_REGS - select ARC_IRQ_NO_AUTOSAVE - select CLK_HSDK -+ select RESET_CONTROLLER - select RESET_HSDK - select MIGHT_HAVE_PCI --- -2.25.1 - diff --git a/queue-4.19/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch b/queue-4.19/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch deleted file mode 100644 index cb890b6addf..00000000000 --- a/queue-4.19/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 4907d814c69a51fd3648f0754b616a5ec69b2424 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 1 Sep 2020 16:58:06 +0100 -Subject: ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT - values - -From: Guillaume Tucker - -[ Upstream commit 8e007b367a59bcdf484c81f6df9bd5a4cc179ca6 ] - -The L310_PREFETCH_CTRL register bits 28 and 29 to enable data and -instruction prefetch respectively can also be accessed via the -L2X0_AUX_CTRL register. They appear to be actually wired together in -hardware between the registers. Changing them in the prefetch -register only will get undone when restoring the aux control register -later on. For this reason, set these bits in both registers during -initialisation according to the devicetree property values. - -Link: https://lore.kernel.org/lkml/76f2f3ad5e77e356e0a5b99ceee1e774a2842c25.1597061474.git.guillaume.tucker@collabora.com/ - -Fixes: ec3bd0e68a67 ("ARM: 8391/1: l2c: add options to overwrite prefetching behavior") -Signed-off-by: Guillaume Tucker -Signed-off-by: Russell King -Signed-off-by: Sasha Levin ---- - arch/arm/mm/cache-l2x0.c | 16 ++++++++++++---- - 1 file changed, 12 insertions(+), 4 deletions(-) - -diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c -index 808efbb89b88c..02f613def40dc 100644 ---- a/arch/arm/mm/cache-l2x0.c -+++ b/arch/arm/mm/cache-l2x0.c -@@ -1261,20 +1261,28 @@ static void __init l2c310_of_parse(const struct device_node *np, - - ret = of_property_read_u32(np, "prefetch-data", &val); - if (ret == 0) { -- if (val) -+ if (val) { - prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH; -- else -+ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH; -+ } else { - prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; -+ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; -+ } -+ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; - } else if (ret != -EINVAL) { - pr_err("L2C-310 OF prefetch-data property value is missing\n"); - } - - ret = of_property_read_u32(np, "prefetch-instr", &val); - if (ret == 0) { -- if (val) -+ if (val) { - prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH; -- else -+ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ } else { - prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; -+ } -+ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; - } else if (ret != -EINVAL) { - pr_err("L2C-310 OF prefetch-instr property value is missing\n"); - } --- -2.25.1 - diff --git a/queue-4.19/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch b/queue-4.19/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch deleted file mode 100644 index 8f473f3d783..00000000000 --- a/queue-4.19/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch +++ /dev/null @@ -1,62 +0,0 @@ -From d8861794462c062941ee1e3228a8ac143c61b517 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 14 Aug 2020 16:23:02 +0530 -Subject: ASoC: qcom: lpass-cpu: fix concurrency issue - -From: Rohit kumar - -[ Upstream commit 753a6e17942f6f425ca622e1610625998312ad89 ] - -i2sctl register value is set to 0 during hw_free(). This -impacts any ongoing concurrent session on the same i2s -port. As trigger() stop already resets enable bit to 0, -there is no need of explicit hw_free. Removing it to -fix the issue. - -Fixes: 80beab8e1d86 ("ASoC: qcom: Add LPASS CPU DAI driver") -Signed-off-by: Rohit kumar -Reviewed-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/1597402388-14112-7-git-send-email-rohitkr@codeaurora.org -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin ---- - sound/soc/qcom/lpass-cpu.c | 16 ---------------- - 1 file changed, 16 deletions(-) - -diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c -index 292b103abada9..475579a9830a3 100644 ---- a/sound/soc/qcom/lpass-cpu.c -+++ b/sound/soc/qcom/lpass-cpu.c -@@ -182,21 +182,6 @@ static int lpass_cpu_daiops_hw_params(struct snd_pcm_substream *substream, - return 0; - } - --static int lpass_cpu_daiops_hw_free(struct snd_pcm_substream *substream, -- struct snd_soc_dai *dai) --{ -- struct lpass_data *drvdata = snd_soc_dai_get_drvdata(dai); -- int ret; -- -- ret = regmap_write(drvdata->lpaif_map, -- LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id), -- 0); -- if (ret) -- dev_err(dai->dev, "error writing to i2sctl reg: %d\n", ret); -- -- return ret; --} -- - static int lpass_cpu_daiops_prepare(struct snd_pcm_substream *substream, - struct snd_soc_dai *dai) - { -@@ -277,7 +262,6 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops = { - .startup = lpass_cpu_daiops_startup, - .shutdown = lpass_cpu_daiops_shutdown, - .hw_params = lpass_cpu_daiops_hw_params, -- .hw_free = lpass_cpu_daiops_hw_free, - .prepare = lpass_cpu_daiops_prepare, - .trigger = lpass_cpu_daiops_trigger, - }; --- -2.25.1 - diff --git a/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch b/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch deleted file mode 100644 index 94446bcb4f7..00000000000 --- a/queue-4.19/asoc-qcom-lpass-platform-fix-memory-leak.patch +++ /dev/null @@ -1,46 +0,0 @@ -From f5ac3a17feadf711ebfc12b2dccf08f1dfa40e14 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 14 Aug 2020 16:23:00 +0530 -Subject: ASoC: qcom: lpass-platform: fix memory leak - -From: Rohit kumar - -[ Upstream commit 5fd188215d4eb52703600d8986b22311099a5940 ] - -lpass_pcm_data is never freed. Free it in close -ops to avoid memory leak. - -Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage") -Signed-off-by: Rohit kumar -Reviewed-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/1597402388-14112-5-git-send-email-rohitkr@codeaurora.org -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin ---- - sound/soc/qcom/lpass-platform.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c -index d07271ea4c451..2f29672477892 100644 ---- a/sound/soc/qcom/lpass-platform.c -+++ b/sound/soc/qcom/lpass-platform.c -@@ -69,7 +69,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream) - int ret, dma_ch, dir = substream->stream; - struct lpass_pcm_data *data; - -- data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL); -+ data = kzalloc(sizeof(*data), GFP_KERNEL); - if (!data) - return -ENOMEM; - -@@ -127,6 +127,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream) - if (v->free_dma_channel) - v->free_dma_channel(drvdata, data->dma_ch); - -+ kfree(data); - return 0; - } - --- -2.25.1 - diff --git a/queue-4.19/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch b/queue-4.19/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch deleted file mode 100644 index ba544f114b3..00000000000 --- a/queue-4.19/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 064659832fcf2f894c2fc181c85299a0477fd18b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 14:22:27 +0200 -Subject: ath10k: Fix the size used in a 'dma_free_coherent()' call in an error - handling path - -From: Christophe JAILLET - -[ Upstream commit 454530a9950b5a26d4998908249564cedfc4babc ] - -Update the size used in 'dma_free_coherent()' in order to match the one -used in the corresponding 'dma_alloc_coherent()'. - -Fixes: 1863008369ae ("ath10k: fix shadow register implementation for WCN3990") -Signed-off-by: Christophe JAILLET -Reviewed-by: Rakesh Pillai -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200802122227.678637-1-christophe.jaillet@wanadoo.fr -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/ath10k/ce.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c -index f761d651c16e7..2276d608bca35 100644 ---- a/drivers/net/wireless/ath/ath10k/ce.c -+++ b/drivers/net/wireless/ath/ath10k/ce.c -@@ -1453,7 +1453,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id, - ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries); - if (ret) { - dma_free_coherent(ar->dev, -- (nentries * sizeof(struct ce_desc_64) + -+ (nentries * sizeof(struct ce_desc) + - CE_DESC_RING_ALIGN), - src_ring->base_addr_owner_space_unaligned, - base_addr); --- -2.25.1 - diff --git a/queue-4.19/ath10k-provide-survey-info-as-accumulated-data.patch b/queue-4.19/ath10k-provide-survey-info-as-accumulated-data.patch deleted file mode 100644 index 5b1092013c5..00000000000 --- a/queue-4.19/ath10k-provide-survey-info-as-accumulated-data.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 16115629fac1256aa372c6a9a96b0426fd2f3d79 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 15 Jun 2020 20:29:03 +0300 -Subject: ath10k: provide survey info as accumulated data - -From: Venkateswara Naralasetty - -[ Upstream commit 720e5c03e5cb26d33d97f55192b791bb48478aa5 ] - -It is expected that the returned counters by .get_survey are monotonic -increasing. But the data from ath10k gets reset to zero regularly. Channel -active/busy time are then showing incorrect values (less than previous or -sometimes zero) for the currently active channel during successive survey -dump commands. - -example: - - $ iw dev wlan0 survey dump - Survey data from wlan0 - frequency: 5180 MHz [in use] - channel active time: 54995 ms - channel busy time: 432 ms - channel receive time: 0 ms - channel transmit time: 59 ms - ... - - $ iw dev wlan0 survey dump - Survey data from wlan0 - frequency: 5180 MHz [in use] - channel active time: 32592 ms - channel busy time: 254 ms - channel receive time: 0 ms - channel transmit time: 0 ms - ... - -The correct way to handle this is to use the non-clearing -WMI_BSS_SURVEY_REQ_TYPE_READ wmi_bss_survey_req_type. The firmware will -then accumulate the survey data and handle wrap arounds. - -Tested-on: QCA9984 hw1.0 10.4-3.5.3-00057 -Tested-on: QCA988X hw2.0 10.2.4-1.0-00047 -Tested-on: QCA9888 hw2.0 10.4-3.9.0.2-00024 -Tested-on: QCA4019 hw1.0 10.4-3.6-00140 - -Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information") -Signed-off-by: Venkateswara Naralasetty -Tested-by: Markus Theil -Tested-by: John Deere <24601deerej@gmail.com> -[sven@narfation.org: adjust commit message] -Signed-off-by: Sven Eckelmann -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/1592232686-28712-1-git-send-email-kvalo@codeaurora.org -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/ath10k/mac.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 81af403c19c2a..faaca7fe9ad1e 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -6862,7 +6862,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar, - struct ieee80211_channel *channel) - { - int ret; -- enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR; -+ enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ; - - lockdep_assert_held(&ar->conf_mutex); - --- -2.25.1 - diff --git a/queue-4.19/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch b/queue-4.19/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch deleted file mode 100644 index e9e39f0d462..00000000000 --- a/queue-4.19/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch +++ /dev/null @@ -1,39 +0,0 @@ -From cdf81a6a25f2a804ff65baf7453f1bbdae2738db Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 13 Aug 2020 17:13:15 +0300 -Subject: ath6kl: prevent potential array overflow in ath6kl_add_new_sta() - -From: Dan Carpenter - -[ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ] - -The value for "aid" comes from skb->data so Smatch marks it as -untrusted. If it's invalid then it can result in an out of bounds array -access in ath6kl_add_new_sta(). - -Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates") -Signed-off-by: Dan Carpenter -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/ath6kl/main.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c -index 0c61dbaa62a41..702c4761006ca 100644 ---- a/drivers/net/wireless/ath/ath6kl/main.c -+++ b/drivers/net/wireless/ath/ath6kl/main.c -@@ -429,6 +429,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, - - ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); - -+ if (aid < 1 || aid > AP_MAX_NUM_STA) -+ return; -+ - if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { - struct ieee80211_mgmt *mgmt = - (struct ieee80211_mgmt *) assoc_info; --- -2.25.1 - diff --git a/queue-4.19/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch b/queue-4.19/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch deleted file mode 100644 index ac66c2b776e..00000000000 --- a/queue-4.19/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 423a443e607b98408fe5abc1e899da9b70ed7cf7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 18 Sep 2020 17:27:32 +0300 -Subject: ath6kl: wmi: prevent a shift wrapping bug in - ath6kl_wmi_delete_pstream_cmd() - -From: Dan Carpenter - -[ Upstream commit 6a950755cec1a90ddaaff3e4acb5333617441c32 ] - -The "tsid" is a user controlled u8 which comes from debugfs. Values -more than 15 are invalid because "active_tsids" is a 16 bit variable. -If the value of "tsid" is more than 31 then that leads to a shift -wrapping bug. - -Fixes: 8fffd9e5ec9e ("ath6kl: Implement support for QOS-enable and QOS-disable from userspace") -Signed-off-by: Dan Carpenter -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200918142732.GA909725@mwanda -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/ath6kl/wmi.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c -index bc7916f2add09..987ebae8ea0e1 100644 ---- a/drivers/net/wireless/ath/ath6kl/wmi.c -+++ b/drivers/net/wireless/ath/ath6kl/wmi.c -@@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, - return -EINVAL; - } - -+ if (tsid >= 16) { -+ ath6kl_err("invalid tsid: %d\n", tsid); -+ return -EINVAL; -+ } -+ - skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); - if (!skb) - return -ENOMEM; --- -2.25.1 - diff --git a/queue-4.19/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch b/queue-4.19/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch deleted file mode 100644 index ba940c2d518..00000000000 --- a/queue-4.19/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 3c518742976c3a0318aed1a3ba5cd73cb8055881 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 13 Aug 2020 17:12:53 +0300 -Subject: ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() - -From: Dan Carpenter - -[ Upstream commit 2705cd7558e718a7240c64eb0afb2edad5f8c190 ] - -The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks -it as untrusted so we have to check it before using it as an array -offset. - -This is similar to a bug that syzkaller found in commit e4ff08a4d727 -("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is -probably a real issue. - -Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") -Signed-off-by: Dan Carpenter -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/ath9k/htc_hst.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c -index f705f0e1cb5be..05fca38b38ed4 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_hst.c -+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c -@@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, - - if (skb) { - htc_hdr = (struct htc_frame_hdr *) skb->data; -+ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint)) -+ goto ret; - endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id]; - skb_pull(skb, sizeof(struct htc_frame_hdr)); - --- -2.25.1 - diff --git a/queue-4.19/backlight-sky81452-backlight-fix-refcount-imbalance-.patch b/queue-4.19/backlight-sky81452-backlight-fix-refcount-imbalance-.patch deleted file mode 100644 index 0f5d7a21cfc..00000000000 --- a/queue-4.19/backlight-sky81452-backlight-fix-refcount-imbalance-.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8928e5f0f1b7c2503e55e734b681ecacc5780281 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 20 Aug 2020 14:38:17 +0800 -Subject: backlight: sky81452-backlight: Fix refcount imbalance on error - -From: dinghao.liu@zju.edu.cn - -[ Upstream commit b7a4f80bc316a56d6ec8750e93e66f42431ed960 ] - -When of_property_read_u32_array() returns an error code, a -pairing refcount decrement is needed to keep np's refcount -balanced. - -Fixes: f705806c9f355 ("backlight: Add support Skyworks SKY81452 backlight driver") -Signed-off-by: Dinghao Liu -Reviewed-by: Daniel Thompson -Signed-off-by: Lee Jones -Signed-off-by: Sasha Levin ---- - drivers/video/backlight/sky81452-backlight.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c -index d414c7a3acf5a..a2f77625b7170 100644 ---- a/drivers/video/backlight/sky81452-backlight.c -+++ b/drivers/video/backlight/sky81452-backlight.c -@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( - num_entry); - if (ret < 0) { - dev_err(dev, "led-sources node is invalid.\n"); -+ of_node_put(np); - return ERR_PTR(-EINVAL); - } - --- -2.25.1 - diff --git a/queue-4.19/binder-fix-uaf-when-releasing-todo-list.patch b/queue-4.19/binder-fix-uaf-when-releasing-todo-list.patch deleted file mode 100644 index 712da6eeeeb..00000000000 --- a/queue-4.19/binder-fix-uaf-when-releasing-todo-list.patch +++ /dev/null @@ -1,113 +0,0 @@ -From f3277cbfba763cd2826396521b9296de67cf1bbc Mon Sep 17 00:00:00 2001 -From: Todd Kjos -Date: Fri, 9 Oct 2020 16:24:55 -0700 -Subject: binder: fix UAF when releasing todo list - -From: Todd Kjos - -commit f3277cbfba763cd2826396521b9296de67cf1bbc upstream. - -When releasing a thread todo list when tearing down -a binder_proc, the following race was possible which -could result in a use-after-free: - -1. Thread 1: enter binder_release_work from binder_thread_release -2. Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked() -3. Thread 2: dec nodeA --> 0 (will free node) -4. Thread 1: ACQ inner_proc_lock -5. Thread 2: block on inner_proc_lock -6. Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA) -7. Thread 1: REL inner_proc_lock -8. Thread 2: ACQ inner_proc_lock -9. Thread 2: todo list cleanup, but work was already dequeued -10. Thread 2: free node -11. Thread 2: REL inner_proc_lock -12. Thread 1: deref w->type (UAF) - -The problem was that for a BINDER_WORK_NODE, the binder_work element -must not be accessed after releasing the inner_proc_lock while -processing the todo list elements since another thread might be -handling a deref on the node containing the binder_work element -leading to the node being freed. - -Signed-off-by: Todd Kjos -Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com -Cc: # 4.14, 4.19, 5.4, 5.8 -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/android/binder.c | 35 ++++++++++------------------------- - 1 file changed, 10 insertions(+), 25 deletions(-) - ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -285,7 +285,7 @@ struct binder_device { - struct binder_work { - struct list_head entry; - -- enum { -+ enum binder_work_type { - BINDER_WORK_TRANSACTION = 1, - BINDER_WORK_TRANSACTION_COMPLETE, - BINDER_WORK_RETURN_ERROR, -@@ -895,27 +895,6 @@ static struct binder_work *binder_dequeu - return w; - } - --/** -- * binder_dequeue_work_head() - Dequeues the item at head of list -- * @proc: binder_proc associated with list -- * @list: list to dequeue head -- * -- * Removes the head of the list if there are items on the list -- * -- * Return: pointer dequeued binder_work, NULL if list was empty -- */ --static struct binder_work *binder_dequeue_work_head( -- struct binder_proc *proc, -- struct list_head *list) --{ -- struct binder_work *w; -- -- binder_inner_proc_lock(proc); -- w = binder_dequeue_work_head_ilocked(list); -- binder_inner_proc_unlock(proc); -- return w; --} -- - static void - binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); - static void binder_free_thread(struct binder_thread *thread); -@@ -4242,13 +4221,17 @@ static void binder_release_work(struct b - struct list_head *list) - { - struct binder_work *w; -+ enum binder_work_type wtype; - - while (1) { -- w = binder_dequeue_work_head(proc, list); -+ binder_inner_proc_lock(proc); -+ w = binder_dequeue_work_head_ilocked(list); -+ wtype = w ? w->type : 0; -+ binder_inner_proc_unlock(proc); - if (!w) - return; - -- switch (w->type) { -+ switch (wtype) { - case BINDER_WORK_TRANSACTION: { - struct binder_transaction *t; - -@@ -4282,9 +4265,11 @@ static void binder_release_work(struct b - kfree(death); - binder_stats_deleted(BINDER_STAT_DEATH); - } break; -+ case BINDER_WORK_NODE: -+ break; - default: - pr_err("unexpected work type, %d, not freed\n", -- w->type); -+ wtype); - break; - } - } diff --git a/queue-4.19/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch b/queue-4.19/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch deleted file mode 100644 index cc0b6bca3e0..00000000000 --- a/queue-4.19/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 3c0651bb7dd872d0ea1eb8260258fd1fd5456e7a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 1 Aug 2020 11:29:56 -0500 -Subject: Bluetooth: hci_uart: Cancel init work before unregistering - -From: Samuel Holland - -[ Upstream commit 3b799254cf6f481460719023d7a18f46651e5e7f ] - -If hci_uart_tty_close() or hci_uart_unregister_device() is called while -hu->init_ready is scheduled, hci_register_dev() could be called after -the hci_uart is torn down. Avoid this by ensuring the work is complete -or canceled before checking the HCI_UART_REGISTERED flag. - -Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers") -Signed-off-by: Samuel Holland -Signed-off-by: Marcel Holtmann -Signed-off-by: Sasha Levin ---- - drivers/bluetooth/hci_ldisc.c | 1 + - drivers/bluetooth/hci_serdev.c | 2 ++ - 2 files changed, 3 insertions(+) - -diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c -index efeb8137ec67f..48560e646e53e 100644 ---- a/drivers/bluetooth/hci_ldisc.c -+++ b/drivers/bluetooth/hci_ldisc.c -@@ -545,6 +545,7 @@ static void hci_uart_tty_close(struct tty_struct *tty) - clear_bit(HCI_UART_PROTO_READY, &hu->flags); - percpu_up_write(&hu->proto_lock); - -+ cancel_work_sync(&hu->init_ready); - cancel_work_sync(&hu->write_work); - - if (hdev) { -diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c -index d3fb0d657fa52..7b3aade431e5e 100644 ---- a/drivers/bluetooth/hci_serdev.c -+++ b/drivers/bluetooth/hci_serdev.c -@@ -369,6 +369,8 @@ void hci_uart_unregister_device(struct hci_uart *hu) - struct hci_dev *hdev = hu->hdev; - - clear_bit(HCI_UART_PROTO_READY, &hu->flags); -+ -+ cancel_work_sync(&hu->init_ready); - if (test_bit(HCI_UART_REGISTERED, &hu->flags)) - hci_unregister_dev(hdev); - hci_free_dev(hdev); --- -2.25.1 - diff --git a/queue-4.19/brcmfmac-check-ndev-pointer.patch b/queue-4.19/brcmfmac-check-ndev-pointer.patch deleted file mode 100644 index ab9df3a8274..00000000000 --- a/queue-4.19/brcmfmac-check-ndev-pointer.patch +++ /dev/null @@ -1,54 +0,0 @@ -From a8f28be135b513b0ccee6318de7af28e91b81dd1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 09:18:04 -0700 -Subject: brcmfmac: check ndev pointer - -From: Tom Rix - -[ Upstream commit 9c9f015bc9f8839831c7ba0a6d731a3853c464e2 ] - -Clang static analysis reports this error - -brcmfmac/core.c:490:4: warning: Dereference of null pointer - (*ifp)->ndev->stats.rx_errors++; - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -In this block of code - - if (ret || !(*ifp) || !(*ifp)->ndev) { - if (ret != -ENODATA && *ifp) - (*ifp)->ndev->stats.rx_errors++; - brcmu_pkt_buf_free_skb(skb); - return -ENODATA; - } - -(*ifp)->ndev being NULL is caught as an error -But then it is used to report the error. - -So add a check before using it. - -Fixes: 91b632803ee4 ("brcmfmac: Use net_device_stats from struct net_device") -Signed-off-by: Tom Rix -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200802161804.6126-1-trix@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -index 9d7b8834b8545..db4c541f58ae0 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c -@@ -438,7 +438,7 @@ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb, - ret = brcmf_proto_hdrpull(drvr, true, skb, ifp); - - if (ret || !(*ifp) || !(*ifp)->ndev) { -- if (ret != -ENODATA && *ifp) -+ if (ret != -ENODATA && *ifp && (*ifp)->ndev) - (*ifp)->ndev->stats.rx_errors++; - brcmu_pkt_buf_free_skb(skb); - return -ENODATA; --- -2.25.1 - diff --git a/queue-4.19/chelsio-chtls-correct-function-return-and-return-type.patch b/queue-4.19/chelsio-chtls-correct-function-return-and-return-type.patch deleted file mode 100644 index 661a4517673..00000000000 --- a/queue-4.19/chelsio-chtls-correct-function-return-and-return-type.patch +++ /dev/null @@ -1,34 +0,0 @@ -From foo@baz Sat Oct 24 11:10:05 AM CEST 2020 -From: Vinay Kumar Yadav -Date: Mon, 19 Oct 2020 17:20:24 +0530 -Subject: chelsio/chtls: correct function return and return type - -From: Vinay Kumar Yadav - -[ Upstream commit 8580a61aede28d441e1c80588803411ee86aa299 ] - -csk_mem_free() should return true if send buffer is available, -false otherwise. - -Fixes: 3b8305f5c844 ("crypto: chtls - wait for memory sendmsg, sendpage") -Signed-off-by: Vinay Kumar Yadav -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/crypto/chelsio/chtls/chtls_io.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/drivers/crypto/chelsio/chtls/chtls_io.c -+++ b/drivers/crypto/chelsio/chtls/chtls_io.c -@@ -914,9 +914,9 @@ static int tls_header_read(struct tls_hd - return (__force int)cpu_to_be16(thdr->length); - } - --static int csk_mem_free(struct chtls_dev *cdev, struct sock *sk) -+static bool csk_mem_free(struct chtls_dev *cdev, struct sock *sk) - { -- return (cdev->max_host_sndbuf - sk->sk_wmem_queued); -+ return (cdev->max_host_sndbuf - sk->sk_wmem_queued > 0); - } - - static int csk_wait_memory(struct chtls_dev *cdev, diff --git a/queue-4.19/chelsio-chtls-correct-netdevice-for-vlan-interface.patch b/queue-4.19/chelsio-chtls-correct-netdevice-for-vlan-interface.patch deleted file mode 100644 index 1ed01b7c7cb..00000000000 --- a/queue-4.19/chelsio-chtls-correct-netdevice-for-vlan-interface.patch +++ /dev/null @@ -1,32 +0,0 @@ -From foo@baz Sat Oct 24 11:10:05 AM CEST 2020 -From: Vinay Kumar Yadav -Date: Mon, 19 Oct 2020 17:20:21 +0530 -Subject: chelsio/chtls: correct netdevice for vlan interface - -From: Vinay Kumar Yadav - -[ Upstream commit 81519d1f7df7ed1bd5b1397540c8884438f57ae2 ] - -Check if netdevice is a vlan interface and find real vlan netdevice. - -Fixes: cc35c88ae4db ("crypto : chtls - CPL handler definition") -Signed-off-by: Venkatesh Ellapu -Signed-off-by: Vinay Kumar Yadav -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/crypto/chelsio/chtls/chtls_cm.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/drivers/crypto/chelsio/chtls/chtls_cm.c -+++ b/drivers/crypto/chelsio/chtls/chtls_cm.c -@@ -1057,6 +1057,9 @@ static struct sock *chtls_recv_sock(stru - ndev = n->dev; - if (!ndev) - goto free_dst; -+ if (is_vlan_dev(ndev)) -+ ndev = vlan_dev_real_dev(ndev); -+ - port_id = cxgb4_port_idx(ndev); - - csk = chtls_sock_create(cdev); diff --git a/queue-4.19/chelsio-chtls-fix-socket-lock.patch b/queue-4.19/chelsio-chtls-fix-socket-lock.patch deleted file mode 100644 index 464474c4076..00000000000 --- a/queue-4.19/chelsio-chtls-fix-socket-lock.patch +++ /dev/null @@ -1,30 +0,0 @@ -From foo@baz Sat Oct 24 11:10:05 AM CEST 2020 -From: Vinay Kumar Yadav -Date: Mon, 19 Oct 2020 17:20:20 +0530 -Subject: chelsio/chtls: fix socket lock - -From: Vinay Kumar Yadav - -[ Upstream commit 0fb5f0160a36d7acaa8e84ce873af99f94b60484 ] - -In chtls_sendpage() socket lock is released but not acquired, -fix it by taking lock. - -Fixes: 36bedb3f2e5b ("crypto: chtls - Inline TLS record Tx") -Signed-off-by: Vinay Kumar Yadav -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/crypto/chelsio/chtls/chtls_io.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/crypto/chelsio/chtls/chtls_io.c -+++ b/drivers/crypto/chelsio/chtls/chtls_io.c -@@ -1217,6 +1217,7 @@ int chtls_sendpage(struct sock *sk, stru - copied = 0; - csk = rcu_dereference_sk_user_data(sk); - cdev = csk->cdev; -+ lock_sock(sk); - timeo = sock_sndtimeo(sk, flags & MSG_DONTWAIT); - - err = sk_stream_wait_connect(sk, &timeo); diff --git a/queue-4.19/cifs-remove-bogus-debug-code.patch b/queue-4.19/cifs-remove-bogus-debug-code.patch deleted file mode 100644 index 00c3828c45e..00000000000 --- a/queue-4.19/cifs-remove-bogus-debug-code.patch +++ /dev/null @@ -1,72 +0,0 @@ -From d367cb960ce88914898cbfa43645c2e43ede9465 Mon Sep 17 00:00:00 2001 -From: Dan Carpenter -Date: Wed, 16 Sep 2020 23:18:21 +0300 -Subject: cifs: remove bogus debug code - -From: Dan Carpenter - -commit d367cb960ce88914898cbfa43645c2e43ede9465 upstream. - -The "end" pointer is either NULL or it points to the next byte to parse. -If there isn't a next byte then dereferencing "end" is an off-by-one out -of bounds error. And, of course, if it's NULL that leads to an Oops. -Printing "*end" doesn't seem very useful so let's delete this code. - -Also for the last debug statement, I noticed that it should be printing -"sequence_end" instead of "end" so fix that as well. - -Reported-by: Dominik Maier -Signed-off-by: Dan Carpenter -Signed-off-by: Steve French -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/asn1.c | 16 ++++++++-------- - 1 file changed, 8 insertions(+), 8 deletions(-) - ---- a/fs/cifs/asn1.c -+++ b/fs/cifs/asn1.c -@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *secur - return 0; - } else if ((cls != ASN1_CTX) || (con != ASN1_CON) - || (tag != ASN1_EOC)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", -+ cls, con, tag, end); - return 0; - } - -@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *secur - return 0; - } else if ((cls != ASN1_UNI) || (con != ASN1_CON) - || (tag != ASN1_SEQ)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n", -+ cls, con, tag, end); - return 0; - } - -@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *secur - return 0; - } else if ((cls != ASN1_CTX) || (con != ASN1_CON) - || (tag != ASN1_EOC)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n", -+ cls, con, tag, end); - return 0; - } - -@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *secur - return 0; - } else if ((cls != ASN1_UNI) || (con != ASN1_CON) - || (tag != ASN1_SEQ)) { -- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n", -- cls, con, tag, end, *end); -+ cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n", -+ cls, con, tag, sequence_end); - return 0; - } - diff --git a/queue-4.19/cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch b/queue-4.19/cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch deleted file mode 100644 index 817fac48074..00000000000 --- a/queue-4.19/cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 0bd294b55a5de442370c29fa53bab17aef3ff318 Mon Sep 17 00:00:00 2001 -From: Shyam Prasad N -Date: Thu, 15 Oct 2020 10:41:31 -0700 -Subject: cifs: Return the error from crypt_message when enc/dec key not found. - -From: Shyam Prasad N - -commit 0bd294b55a5de442370c29fa53bab17aef3ff318 upstream. - -In crypt_message, when smb2_get_enc_key returns error, we need to -return the error back to the caller. If not, we end up processing -the message further, causing a kernel oops due to unwarranted access -of memory. - -Call Trace: -smb3_receive_transform+0x120/0x870 [cifs] -cifs_demultiplex_thread+0xb53/0xc20 [cifs] -? cifs_handle_standard+0x190/0x190 [cifs] -kthread+0x116/0x130 -? kthread_park+0x80/0x80 -ret_from_fork+0x1f/0x30 - -Signed-off-by: Shyam Prasad N -Reviewed-by: Pavel Shilovsky -Reviewed-by: Ronnie Sahlberg -CC: Stable -Signed-off-by: Steve French -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/smb2ops.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -2730,7 +2730,7 @@ crypt_message(struct TCP_Server_Info *se - if (rc) { - cifs_dbg(VFS, "%s: Could not get %scryption key\n", __func__, - enc ? "en" : "de"); -- return 0; -+ return rc; - } - - rc = smb3_crypto_aead_allocate(server); diff --git a/queue-4.19/cpufreq-armada-37xx-add-missing-module_device_table.patch b/queue-4.19/cpufreq-armada-37xx-add-missing-module_device_table.patch deleted file mode 100644 index 4322e4d2ff0..00000000000 --- a/queue-4.19/cpufreq-armada-37xx-add-missing-module_device_table.patch +++ /dev/null @@ -1,47 +0,0 @@ -From de5a5762b85119ae73dcf49cbba11266e461d136 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 7 Sep 2020 15:27:16 +0200 -Subject: cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Pali Rohár - -[ Upstream commit c942d1542f1bc5001216fabce9cb8ffbe515777e ] - -CONFIG_ARM_ARMADA_37XX_CPUFREQ is tristate option and therefore this -cpufreq driver can be compiled as a module. This patch adds missing -MODULE_DEVICE_TABLE which generates correct modalias for automatic -loading of this cpufreq driver when is compiled as an external module. - -Reviewed-by: Andrew Lunn -Signed-off-by: Pali Rohár -Fixes: 92ce45fb875d7 ("cpufreq: Add DVFS support for Armada 37xx") -[ Viresh: Added __maybe_unused ] -Signed-off-by: Viresh Kumar -Signed-off-by: Sasha Levin ---- - drivers/cpufreq/armada-37xx-cpufreq.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c -index c5f98cafc25c9..9b0b490d70ff4 100644 ---- a/drivers/cpufreq/armada-37xx-cpufreq.c -+++ b/drivers/cpufreq/armada-37xx-cpufreq.c -@@ -486,6 +486,12 @@ static int __init armada37xx_cpufreq_driver_init(void) - /* late_initcall, to guarantee the driver is loaded after A37xx clock driver */ - late_initcall(armada37xx_cpufreq_driver_init); - -+static const struct of_device_id __maybe_unused armada37xx_cpufreq_of_match[] = { -+ { .compatible = "marvell,armada-3700-nb-pm" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(of, armada37xx_cpufreq_of_match); -+ - MODULE_AUTHOR("Gregory CLEMENT "); - MODULE_DESCRIPTION("Armada 37xx cpufreq driver"); - MODULE_LICENSE("GPL"); --- -2.25.1 - diff --git a/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch b/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch deleted file mode 100644 index 5a13cade0c3..00000000000 --- a/queue-4.19/crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch +++ /dev/null @@ -1,56 +0,0 @@ -From cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 31 Jul 2020 17:03:50 +1000 -Subject: crypto: algif_aead - Do not set MAY_BACKLOG on the async path - -From: Herbert Xu - -commit cbdad1f246dd98e6c9c32a6e5212337f542aa7e0 upstream. - -The async path cannot use MAY_BACKLOG because it is not meant to -block, which is what MAY_BACKLOG does. On the other hand, both -the sync and async paths can make use of MAY_SLEEP. - -Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...") -Cc: -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- - crypto/algif_aead.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -82,7 +82,7 @@ static int crypto_aead_copy_sgl(struct c - SKCIPHER_REQUEST_ON_STACK(skreq, null_tfm); - - skcipher_request_set_tfm(skreq, null_tfm); -- skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_BACKLOG, -+ skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_SLEEP, - NULL, NULL); - skcipher_request_set_crypt(skreq, src, dst, len, NULL); - -@@ -295,19 +295,20 @@ static int _aead_recvmsg(struct socket * - areq->outlen = outlen; - - aead_request_set_callback(&areq->cra_u.aead_req, -- CRYPTO_TFM_REQ_MAY_BACKLOG, -+ CRYPTO_TFM_REQ_MAY_SLEEP, - af_alg_async_cb, areq); - err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) : - crypto_aead_decrypt(&areq->cra_u.aead_req); - - /* AIO operation in progress */ -- if (err == -EINPROGRESS || err == -EBUSY) -+ if (err == -EINPROGRESS) - return -EIOCBQUEUED; - - sock_put(sk); - } else { - /* Synchronous operation */ - aead_request_set_callback(&areq->cra_u.aead_req, -+ CRYPTO_TFM_REQ_MAY_SLEEP | - CRYPTO_TFM_REQ_MAY_BACKLOG, - crypto_req_done, &ctx->wait); - err = crypto_wait_req(ctx->enc ? diff --git a/queue-4.19/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch b/queue-4.19/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch deleted file mode 100644 index ed478a86db1..00000000000 --- a/queue-4.19/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch +++ /dev/null @@ -1,37 +0,0 @@ -From ede795def562e700ade104d6f032bc7022dfe576 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 31 Jul 2020 17:03:27 +1000 -Subject: crypto: algif_skcipher - EBUSY on aio should be an error - -From: Herbert Xu - -[ Upstream commit 2a05b029c1ee045b886ebf9efef9985ca23450de ] - -I removed the MAY_BACKLOG flag on the aio path a while ago but -the error check still incorrectly interpreted EBUSY as success. -This may cause the submitter to wait for a request that will never -complete. - -Fixes: dad419970637 ("crypto: algif_skcipher - Do not set...") -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - crypto/algif_skcipher.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index 1cb106c46043d..9d2e9783c0d4e 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -127,7 +127,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - crypto_skcipher_decrypt(&areq->cra_u.skcipher_req); - - /* AIO operation in progress */ -- if (err == -EINPROGRESS || err == -EBUSY) -+ if (err == -EINPROGRESS) - return -EIOCBQUEUED; - - sock_put(sk); --- -2.25.1 - diff --git a/queue-4.19/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch b/queue-4.19/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch deleted file mode 100644 index e439d173560..00000000000 --- a/queue-4.19/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 9825efe23799dc24aa03638915dfa27412cbdea8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 16:56:48 +0200 -Subject: crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call - -From: Christophe JAILLET - -[ Upstream commit f7ade9aaf66bd5599690acf0597df2c0f6cd825a ] - -Update the size used in 'dma_free_coherent()' in order to match the one -used in the corresponding 'dma_alloc_coherent()', in 'setup_crypt_desc()'. - -Fixes: 81bef0150074 ("crypto: ixp4xx - Hardware crypto support for IXP4xx CPUs") -Signed-off-by: Christophe JAILLET -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - drivers/crypto/ixp4xx_crypto.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c -index 27f7dad2d45d9..9b7b8558db31d 100644 ---- a/drivers/crypto/ixp4xx_crypto.c -+++ b/drivers/crypto/ixp4xx_crypto.c -@@ -530,7 +530,7 @@ static void release_ixp_crypto(struct device *dev) - - if (crypt_virt) { - dma_free_coherent(dev, -- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl), -+ NPE_QLEN * sizeof(struct crypt_ctl), - crypt_virt, crypt_phys); - } - } --- -2.25.1 - diff --git a/queue-4.19/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch b/queue-4.19/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch deleted file mode 100644 index 575e0c5b65b..00000000000 --- a/queue-4.19/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 9854cc0d2931a5b0a06b10a3e17c51c48f9b45b2 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 19:15:32 +0800 -Subject: crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() - -From: Tianjia Zhang - -[ Upstream commit 8cbde6c6a6d2b1599ff90f932304aab7e32fce89 ] - -In case of memory allocation failure, a negative error code should -be returned. - -Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips") -Cc: Ryder Lee -Signed-off-by: Tianjia Zhang -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - drivers/crypto/mediatek/mtk-platform.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c -index ee0404e27a0f2..03b1436f87096 100644 ---- a/drivers/crypto/mediatek/mtk-platform.c -+++ b/drivers/crypto/mediatek/mtk-platform.c -@@ -446,7 +446,7 @@ static void mtk_desc_dma_free(struct mtk_cryp *cryp) - static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) - { - struct mtk_ring **ring = cryp->ring; -- int i, err = ENOMEM; -+ int i; - - for (i = 0; i < MTK_RING_MAX; i++) { - ring[i] = kzalloc(sizeof(**ring), GFP_KERNEL); -@@ -480,7 +480,7 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) - ring[i]->cmd_base, ring[i]->cmd_dma); - kfree(ring[i]); - } -- return err; -+ return -ENOMEM; - } - - static int mtk_crypto_probe(struct platform_device *pdev) --- -2.25.1 - diff --git a/queue-4.19/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch b/queue-4.19/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch deleted file mode 100644 index cbeda7a21b1..00000000000 --- a/queue-4.19/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch +++ /dev/null @@ -1,39 +0,0 @@ -From d8a0ee6486111f3b97dbb781fba97fa66f4787c9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 7 Sep 2020 10:56:24 +0300 -Subject: crypto: omap-sham - fix digcnt register handling with export/import - -From: Tero Kristo - -[ Upstream commit 3faf757bad75f3fc1b2736f0431e295a073a7423 ] - -Running export/import for hashes in peculiar order (mostly done by -openssl) can mess up the internal book keeping of the OMAP SHA core. -Fix by forcibly writing the correct DIGCNT back to hardware. This issue -was noticed while transitioning to openssl 1.1 support. - -Fixes: 0d373d603202 ("crypto: omap-sham - Add OMAP4/AM33XX SHAM Support") -Signed-off-by: Tero Kristo -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - drivers/crypto/omap-sham.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c -index 2faaa4069cdd8..4d31ef4724366 100644 ---- a/drivers/crypto/omap-sham.c -+++ b/drivers/crypto/omap-sham.c -@@ -456,6 +456,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length, - struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req); - u32 val, mask; - -+ if (likely(ctx->digcnt)) -+ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt); -+ - /* - * Setting ALGO_CONST only for the first iteration and - * CLOSE_HASH only for the last one. Note that flags mode bits --- -2.25.1 - diff --git a/queue-4.19/crypto-picoxcell-fix-potential-race-condition-bug.patch b/queue-4.19/crypto-picoxcell-fix-potential-race-condition-bug.patch deleted file mode 100644 index 833d7a0a6f3..00000000000 --- a/queue-4.19/crypto-picoxcell-fix-potential-race-condition-bug.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 833227505bf4cd33775f034115c0041f2e9ddf97 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 11 Aug 2020 18:00:24 +0530 -Subject: crypto: picoxcell - Fix potential race condition bug - -From: Madhuparna Bhowmik - -[ Upstream commit 64f4a62e3b17f1e473f971127c2924cae42afc82 ] - -engine->stat_irq_thresh was initialized after device_create_file() in -the probe function, the initialization may race with call to -spacc_stat_irq_thresh_store() which updates engine->stat_irq_thresh, -therefore initialize it before creating the file in probe function. - -Found by Linux Driver Verification project (linuxtesting.org). - -Fixes: ce92136843cb ("crypto: picoxcell - add support for the...") -Signed-off-by: Madhuparna Bhowmik -Acked-by: Jamie Iles -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - drivers/crypto/picoxcell_crypto.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - -diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c -index e2491754c468f..1ef47f7208b92 100644 ---- a/drivers/crypto/picoxcell_crypto.c -+++ b/drivers/crypto/picoxcell_crypto.c -@@ -1701,11 +1701,6 @@ static int spacc_probe(struct platform_device *pdev) - goto err_clk_put; - } - -- ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh); -- if (ret) -- goto err_clk_disable; -- -- - /* - * Use an IRQ threshold of 50% as a default. This seems to be a - * reasonable trade off of latency against throughput but can be -@@ -1713,6 +1708,10 @@ static int spacc_probe(struct platform_device *pdev) - */ - engine->stat_irq_thresh = (engine->fifo_sz / 2); - -+ ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh); -+ if (ret) -+ goto err_clk_disable; -+ - /* - * Configure the interrupts. We only use the STAT_CNT interrupt as we - * only submit a new packet for processing when we complete another in --- -2.25.1 - diff --git a/queue-4.19/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch b/queue-4.19/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch deleted file mode 100644 index 3d37d376b43..00000000000 --- a/queue-4.19/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 3ad2f78fe8e3f6477edbb5bb85041fa5dbabc7c2 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 14 Sep 2020 11:00:51 +0800 -Subject: cypto: mediatek - fix leaks in mtk_desc_ring_alloc - -From: Xiaoliang Pang - -[ Upstream commit 228d284aac61283cde508a925d666f854b57af63 ] - -In the init loop, if an error occurs in function 'dma_alloc_coherent', -then goto the err_cleanup section, after run i--, -in the array ring, the struct mtk_ring with index i will not be released, -causing memory leaks - -Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips") -Cc: Ryder Lee -Signed-off-by: Xiaoliang Pang -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin ---- - drivers/crypto/mediatek/mtk-platform.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c -index 03b1436f87096..e4d7ef3bfb61d 100644 ---- a/drivers/crypto/mediatek/mtk-platform.c -+++ b/drivers/crypto/mediatek/mtk-platform.c -@@ -473,13 +473,13 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) - return 0; - - err_cleanup: -- for (; i--; ) { -+ do { - dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ, - ring[i]->res_base, ring[i]->res_dma); - dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ, - ring[i]->cmd_base, ring[i]->cmd_dma); - kfree(ring[i]); -- } -+ } while (i--); - return -ENOMEM; - } - --- -2.25.1 - diff --git a/queue-4.19/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch b/queue-4.19/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch deleted file mode 100644 index df99b9667ef..00000000000 --- a/queue-4.19/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch +++ /dev/null @@ -1,126 +0,0 @@ -From bf49e9f5d4c6401e992e5e8100970ce887ba91f1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 15 Sep 2020 16:41:09 -0400 -Subject: drivers/perf: xgene_pmu: Fix uninitialized resource struct - -From: Mark Salter - -[ Upstream commit a76b8236edcf5b785d044b930f9e14ad02b4a484 ] - -This splat was reported on newer Fedora kernels booting on certain -X-gene based machines: - - xgene-pmu APMC0D83:00: X-Gene PMU version 3 - Unable to handle kernel read from unreadable memory at virtual \ - address 0000000000004006 - ... - Call trace: - string+0x50/0x100 - vsnprintf+0x160/0x750 - devm_kvasprintf+0x5c/0xb4 - devm_kasprintf+0x54/0x60 - __devm_ioremap_resource+0xdc/0x1a0 - devm_ioremap_resource+0x14/0x20 - acpi_get_pmu_hw_inf.isra.0+0x84/0x15c - acpi_pmu_dev_add+0xbc/0x21c - acpi_ns_walk_namespace+0x16c/0x1e4 - acpi_walk_namespace+0xb4/0xfc - xgene_pmu_probe_pmu_dev+0x7c/0xe0 - xgene_pmu_probe.part.0+0x2c0/0x310 - xgene_pmu_probe+0x54/0x64 - platform_drv_probe+0x60/0xb4 - really_probe+0xe8/0x4a0 - driver_probe_device+0xe4/0x100 - device_driver_attach+0xcc/0xd4 - __driver_attach+0xb0/0x17c - bus_for_each_dev+0x6c/0xb0 - driver_attach+0x30/0x40 - bus_add_driver+0x154/0x250 - driver_register+0x84/0x140 - __platform_driver_register+0x54/0x60 - xgene_pmu_driver_init+0x28/0x34 - do_one_initcall+0x40/0x204 - do_initcalls+0x104/0x144 - kernel_init_freeable+0x198/0x210 - kernel_init+0x20/0x12c - ret_from_fork+0x10/0x18 - Code: 91000400 110004e1 eb08009f 540000c0 (38646846) - ---[ end trace f08c10566496a703 ]--- - -This is due to use of an uninitialized local resource struct in the xgene -pmu driver. The thunderx2_pmu driver avoids this by using the resource list -constructed by acpi_dev_get_resources() rather than using a callback from -that function. The callback in the xgene driver didn't fully initialize -the resource. So get rid of the callback and search the resource list as -done by thunderx2. - -Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver") -Signed-off-by: Mark Salter -Link: https://lore.kernel.org/r/20200915204110.326138-1-msalter@redhat.com -Signed-off-by: Will Deacon -Signed-off-by: Sasha Levin ---- - drivers/perf/xgene_pmu.c | 32 +++++++++++++++++--------------- - 1 file changed, 17 insertions(+), 15 deletions(-) - -diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c -index 0e31f1392a53c..949b07e29c06b 100644 ---- a/drivers/perf/xgene_pmu.c -+++ b/drivers/perf/xgene_pmu.c -@@ -1474,17 +1474,6 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id) - } - - #if defined(CONFIG_ACPI) --static int acpi_pmu_dev_add_resource(struct acpi_resource *ares, void *data) --{ -- struct resource *res = data; -- -- if (ares->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32) -- acpi_dev_resource_memory(ares, res); -- -- /* Always tell the ACPI core to skip this resource */ -- return 1; --} -- - static struct - xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, - struct acpi_device *adev, u32 type) -@@ -1496,6 +1485,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, - struct hw_pmu_info *inf; - void __iomem *dev_csr; - struct resource res; -+ struct resource_entry *rentry; - int enable_bit; - int rc; - -@@ -1504,11 +1494,23 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, - return NULL; - - INIT_LIST_HEAD(&resource_list); -- rc = acpi_dev_get_resources(adev, &resource_list, -- acpi_pmu_dev_add_resource, &res); -+ rc = acpi_dev_get_resources(adev, &resource_list, NULL, NULL); -+ if (rc <= 0) { -+ dev_err(dev, "PMU type %d: No resources found\n", type); -+ return NULL; -+ } -+ -+ list_for_each_entry(rentry, &resource_list, node) { -+ if (resource_type(rentry->res) == IORESOURCE_MEM) { -+ res = *rentry->res; -+ rentry = NULL; -+ break; -+ } -+ } - acpi_dev_free_resource_list(&resource_list); -- if (rc < 0) { -- dev_err(dev, "PMU type %d: No resource address found\n", type); -+ -+ if (rentry) { -+ dev_err(dev, "PMU type %d: No memory resource found\n", type); - return NULL; - } - --- -2.25.1 - diff --git a/queue-4.19/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch b/queue-4.19/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch deleted file mode 100644 index 097fff999dc..00000000000 --- a/queue-4.19/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 7e01f1f2cd3c2d44132ba4d4986869ede252eb69 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 02:51:11 +0530 -Subject: drivers/virt/fsl_hypervisor: Fix error handling path - -From: Souptick Joarder - -[ Upstream commit 7f360bec37857bfd5a48cef21d86f58a09a3df63 ] - -First, when memory allocation for sg_list_unaligned failed, there -is a bug of calling put_pages() as we haven't pinned any pages. - -Second, if get_user_pages_fast() failed we should unpin num_pinned -pages. - -This will address both. - -As part of these changes, minor update in documentation. - -Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver") -Signed-off-by: Souptick Joarder -Reviewed-by: Dan Carpenter -Reviewed-by: John Hubbard -Link: https://lore.kernel.org/r/1598995271-6755-1-git-send-email-jrdr.linux@gmail.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/virt/fsl_hypervisor.c | 17 ++++++++--------- - 1 file changed, 8 insertions(+), 9 deletions(-) - -diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c -index 1bbd910d4ddb8..2a7f7f47fe893 100644 ---- a/drivers/virt/fsl_hypervisor.c -+++ b/drivers/virt/fsl_hypervisor.c -@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - - unsigned int i; - long ret = 0; -- int num_pinned; /* return value from get_user_pages() */ -+ int num_pinned = 0; /* return value from get_user_pages_fast() */ - phys_addr_t remote_paddr; /* The next address in the remote buffer */ - uint32_t count; /* The number of bytes left to copy */ - -@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - return -EINVAL; - - /* -- * The array of pages returned by get_user_pages() covers only -+ * The array of pages returned by get_user_pages_fast() covers only - * page-aligned memory. Since the user buffer is probably not - * page-aligned, we need to handle the discrepancy. - * -@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - - /* - * 'pages' is an array of struct page pointers that's initialized by -- * get_user_pages(). -+ * get_user_pages_fast(). - */ - pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL); - if (!pages) { -@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - if (!sg_list_unaligned) { - pr_debug("fsl-hv: could not allocate S/G list\n"); - ret = -ENOMEM; -- goto exit; -+ goto free_pages; - } - sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list)); - -@@ -250,7 +250,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - num_pages, param.source != -1, pages); - - if (num_pinned != num_pages) { -- /* get_user_pages() failed */ - pr_debug("fsl-hv: could not lock source buffer\n"); - ret = (num_pinned < 0) ? num_pinned : -EFAULT; - goto exit; -@@ -292,13 +291,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) - virt_to_phys(sg_list), num_pages); - - exit: -- if (pages) { -- for (i = 0; i < num_pages; i++) -- if (pages[i]) -- put_page(pages[i]); -+ if (pages && (num_pinned > 0)) { -+ for (i = 0; i < num_pinned; i++) -+ put_page(pages[i]); - } - - kfree(sg_list_unaligned); -+free_pages: - kfree(pages); - - if (!ret) --- -2.25.1 - diff --git a/queue-4.19/drm-gma500-fix-error-check.patch b/queue-4.19/drm-gma500-fix-error-check.patch deleted file mode 100644 index b8e49dc9f74..00000000000 --- a/queue-4.19/drm-gma500-fix-error-check.patch +++ /dev/null @@ -1,54 +0,0 @@ -From e84b79cba1cd3add2e384fd63d218855554494a3 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 5 Aug 2020 13:59:11 -0700 -Subject: drm/gma500: fix error check - -From: Tom Rix - -[ Upstream commit cdd296cdae1af2d27dae3fcfbdf12c5252ab78cf ] - -Reviewing this block of code in cdv_intel_dp_init() - -ret = cdv_intel_dp_aux_native_read(gma_encoder, DP_DPCD_REV, ... - -cdv_intel_edp_panel_vdd_off(gma_encoder); -if (ret == 0) { - /* if this fails, presume the device is a ghost */ - DRM_INFO("failed to retrieve link info, disabling eDP\n"); - drm_encoder_cleanup(encoder); - cdv_intel_dp_destroy(connector); - goto err_priv; -} else { - -The (ret == 0) is not strict enough. -cdv_intel_dp_aux_native_read() returns > 0 on success -otherwise it is failure. - -So change to <= - -Fixes: d112a8163f83 ("gma500/cdv: Add eDP support") - -Signed-off-by: Tom Rix -Signed-off-by: Patrik Jakobsson -Link: https://patchwork.freedesktop.org/patch/msgid/20200805205911.20927-1-trix@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c -index 90ed20083009f..05eba6dec5ebf 100644 ---- a/drivers/gpu/drm/gma500/cdv_intel_dp.c -+++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c -@@ -2119,7 +2119,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev - intel_dp->dpcd, - sizeof(intel_dp->dpcd)); - cdv_intel_edp_panel_vdd_off(gma_encoder); -- if (ret == 0) { -+ if (ret <= 0) { - /* if this fails, presume the device is a ghost */ - DRM_INFO("failed to retrieve link info, disabling eDP\n"); - cdv_intel_dp_encoder_destroy(encoder); --- -2.25.1 - diff --git a/queue-4.19/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch b/queue-4.19/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch deleted file mode 100644 index 269ec5cb720..00000000000 --- a/queue-4.19/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch +++ /dev/null @@ -1,69 +0,0 @@ -From aa725fdcd958bf567437f3d07412f67abd2dcaca Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 26 Aug 2020 20:14:37 +0800 -Subject: EDAC/i5100: Fix error handling order in i5100_init_one() - -From: Dinghao Liu - -[ Upstream commit 857a3139bd8be4f702c030c8ca06f3fd69c1741a ] - -When pci_get_device_func() fails, the driver doesn't need to execute -pci_dev_put(). mci should still be freed, though, to prevent a memory -leak. When pci_enable_device() fails, the error injection PCI device -"einj" doesn't need to be disabled either. - - [ bp: Massage commit message, rename label to "bail_mc_free". ] - -Fixes: 52608ba205461 ("i5100_edac: probe for device 19 function 0") -Signed-off-by: Dinghao Liu -Signed-off-by: Borislav Petkov -Link: https://lkml.kernel.org/r/20200826121437.31606-1-dinghao.liu@zju.edu.cn -Signed-off-by: Sasha Levin ---- - drivers/edac/i5100_edac.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c -index b506eef6b146d..858ef4e15180b 100644 ---- a/drivers/edac/i5100_edac.c -+++ b/drivers/edac/i5100_edac.c -@@ -1072,16 +1072,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - PCI_DEVICE_ID_INTEL_5100_19, 0); - if (!einj) { - ret = -ENODEV; -- goto bail_einj; -+ goto bail_mc_free; - } - - rc = pci_enable_device(einj); - if (rc < 0) { - ret = rc; -- goto bail_disable_einj; -+ goto bail_einj; - } - -- - mci->pdev = &pdev->dev; - - priv = mci->pvt_info; -@@ -1147,14 +1146,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) - bail_scrub: - priv->scrub_enable = 0; - cancel_delayed_work_sync(&(priv->i5100_scrubbing)); -- edac_mc_free(mci); -- --bail_disable_einj: - pci_disable_device(einj); - - bail_einj: - pci_dev_put(einj); - -+bail_mc_free: -+ edac_mc_free(mci); -+ - bail_disable_ch1: - pci_disable_device(ch1mm); - --- -2.25.1 - diff --git a/queue-4.19/edac-ti-fix-handling-of-platform_get_irq-error.patch b/queue-4.19/edac-ti-fix-handling-of-platform_get_irq-error.patch deleted file mode 100644 index 6b9629acfb6..00000000000 --- a/queue-4.19/edac-ti-fix-handling-of-platform_get_irq-error.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 661cb6a5313dd7ef14caf6fcf9b08706d2457c35 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 27 Aug 2020 09:07:43 +0200 -Subject: EDAC/ti: Fix handling of platform_get_irq() error - -From: Krzysztof Kozlowski - -[ Upstream commit 66077adb70a2a9e92540155b2ace33ec98299c90 ] - -platform_get_irq() returns a negative error number on error. In such a -case, comparison to 0 would pass the check therefore check the return -value properly, whether it is negative. - - [ bp: Massage commit message. ] - -Fixes: 86a18ee21e5e ("EDAC, ti: Add support for TI keystone and DRA7xx EDAC") -Signed-off-by: Krzysztof Kozlowski -Signed-off-by: Borislav Petkov -Reviewed-by: Tero Kristo -Link: https://lkml.kernel.org/r/20200827070743.26628-2-krzk@kernel.org -Signed-off-by: Sasha Levin ---- - drivers/edac/ti_edac.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c -index 6ac26d1b929f0..3247689467435 100644 ---- a/drivers/edac/ti_edac.c -+++ b/drivers/edac/ti_edac.c -@@ -278,7 +278,8 @@ static int ti_edac_probe(struct platform_device *pdev) - - /* add EMIF ECC error handler */ - error_irq = platform_get_irq(pdev, 0); -- if (!error_irq) { -+ if (error_irq < 0) { -+ ret = error_irq; - edac_printk(KERN_ERR, EDAC_MOD_NAME, - "EMIF irq number not defined.\n"); - goto err; --- -2.25.1 - diff --git a/queue-4.19/hid-hid-input-fix-stylus-battery-reporting.patch b/queue-4.19/hid-hid-input-fix-stylus-battery-reporting.patch deleted file mode 100644 index a257422d48f..00000000000 --- a/queue-4.19/hid-hid-input-fix-stylus-battery-reporting.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 8cba88c32c9ca6c5a43bf698acd6a5e0e048c1fe Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 25 Sep 2020 16:35:52 -0700 -Subject: HID: hid-input: fix stylus battery reporting - -From: Dmitry Torokhov - -[ Upstream commit 505f394fa239cecb76d916aa858f87ed7ea7fde4 ] - -With commit 4f3882177240 hid-input started clearing of "ignored" usages -to avoid using garbage that might have been left in them. However -"battery strength" usages should not be ignored, as we do want to -use them. - -Fixes: 4f3882177240 ("HID: hid-input: clear unmapped usages") -Reported-by: Kenneth Albanowski -Tested-by: Kenneth Albanowski -Signed-off-by: Dmitry Torokhov -Signed-off-by: Jiri Kosina -Signed-off-by: Sasha Levin ---- - drivers/hid/hid-input.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c -index a9da1526c40ae..11bd2ca22a2e6 100644 ---- a/drivers/hid/hid-input.c -+++ b/drivers/hid/hid-input.c -@@ -796,7 +796,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case 0x3b: /* Battery Strength */ - hidinput_setup_battery(device, HID_INPUT_REPORT, field); - usage->type = EV_PWR; -- goto ignore; -+ return; - - case 0x3c: /* Invert */ - map_key_clear(BTN_TOOL_RUBBER); -@@ -1052,7 +1052,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel - case HID_DC_BATTERYSTRENGTH: - hidinput_setup_battery(device, HID_INPUT_REPORT, field); - usage->type = EV_PWR; -- goto ignore; -+ return; - } - goto unknown; - --- -2.25.1 - diff --git a/queue-4.19/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch b/queue-4.19/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch deleted file mode 100644 index 4f39ca3dea8..00000000000 --- a/queue-4.19/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 561f363762ac385d5a5e58a2e0064adbdfe16728 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 24 Aug 2020 11:57:35 +0300 -Subject: HID: roccat: add bounds checking in kone_sysfs_write_settings() - -From: Dan Carpenter - -[ Upstream commit d4f98dbfe717490e771b6e701904bfcf4b4557f0 ] - -This code doesn't check if "settings->startup_profile" is within bounds -and that could result in an out of bounds array access. What the code -does do is it checks if the settings can be written to the firmware, so -it's possible that the firmware has a bounds check? It's safer and -easier to verify when the bounds checking is done in the kernel. - -Fixes: 14bf62cde794 ("HID: add driver for Roccat Kone gaming mouse") -Signed-off-by: Dan Carpenter -Signed-off-by: Jiri Kosina -Signed-off-by: Sasha Levin ---- - drivers/hid/hid-roccat-kone.c | 23 ++++++++++++++++------- - 1 file changed, 16 insertions(+), 7 deletions(-) - -diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c -index bf4675a273965..9be8c31f613fd 100644 ---- a/drivers/hid/hid-roccat-kone.c -+++ b/drivers/hid/hid-roccat-kone.c -@@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, - struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev)); - struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev)); - int retval = 0, difference, old_profile; -+ struct kone_settings *settings = (struct kone_settings *)buf; - - /* I need to get my data in one piece */ - if (off != 0 || count != sizeof(struct kone_settings)) - return -EINVAL; - - mutex_lock(&kone->kone_lock); -- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings)); -+ difference = memcmp(settings, &kone->settings, -+ sizeof(struct kone_settings)); - if (difference) { -- retval = kone_set_settings(usb_dev, -- (struct kone_settings const *)buf); -- if (retval) { -- mutex_unlock(&kone->kone_lock); -- return retval; -+ if (settings->startup_profile < 1 || -+ settings->startup_profile > 5) { -+ retval = -EINVAL; -+ goto unlock; - } - -+ retval = kone_set_settings(usb_dev, settings); -+ if (retval) -+ goto unlock; -+ - old_profile = kone->settings.startup_profile; -- memcpy(&kone->settings, buf, sizeof(struct kone_settings)); -+ memcpy(&kone->settings, settings, sizeof(struct kone_settings)); - - kone_profile_activated(kone, kone->settings.startup_profile); - - if (kone->settings.startup_profile != old_profile) - kone_profile_report(kone, kone->settings.startup_profile); - } -+unlock: - mutex_unlock(&kone->kone_lock); - -+ if (retval) -+ return retval; -+ - return sizeof(struct kone_settings); - } - static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, --- -2.25.1 - diff --git a/queue-4.19/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch b/queue-4.19/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch deleted file mode 100644 index d8295092034..00000000000 --- a/queue-4.19/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 87ac2e55d0e0b4b1cce32c7418e4bea0fbbbe914 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 17 Sep 2020 14:39:29 -0700 -Subject: hwmon: (pmbus/max34440) Fix status register reads for - MAX344{51,60,61} - -From: Guenter Roeck - -[ Upstream commit 6c094b31ea2ad773824362ba0fccb88d36f8d32d ] - -Starting with MAX34451, the chips of this series support STATUS_IOUT and -STATUS_TEMPERATURE commands, and no longer report over-current and -over-temperature status with STATUS_MFR_SPECIFIC. - -Fixes: 7a001dbab4ade ("hwmon: (pmbus/max34440) Add support for MAX34451.") -Fixes: 50115ac9b6f35 ("hwmon: (pmbus/max34440) Add support for MAX34460 and MAX34461") -Reported-by: Steve Foreman -Cc: Steve Foreman -Signed-off-by: Guenter Roeck -Signed-off-by: Sasha Levin ---- - drivers/hwmon/pmbus/max34440.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c -index 47576c4600105..9af5ab52ca31c 100644 ---- a/drivers/hwmon/pmbus/max34440.c -+++ b/drivers/hwmon/pmbus/max34440.c -@@ -400,7 +400,6 @@ static struct pmbus_driver_info max34440_info[] = { - .func[18] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, -- .read_byte_data = max34440_read_byte_data, - .read_word_data = max34440_read_word_data, - .write_word_data = max34440_write_word_data, - }, -@@ -431,7 +430,6 @@ static struct pmbus_driver_info max34440_info[] = { - .func[15] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[16] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[17] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, -- .read_byte_data = max34440_read_byte_data, - .read_word_data = max34440_read_word_data, - .write_word_data = max34440_write_word_data, - }, -@@ -467,7 +465,6 @@ static struct pmbus_driver_info max34440_info[] = { - .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, - .func[21] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, -- .read_byte_data = max34440_read_byte_data, - .read_word_data = max34440_read_word_data, - .write_word_data = max34440_write_word_data, - }, --- -2.25.1 - diff --git a/queue-4.19/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch b/queue-4.19/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch deleted file mode 100644 index 5ced942f03c..00000000000 --- a/queue-4.19/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 7f75135f2bd96dfd138b2fd8688b60ebdb3c373b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 3 Aug 2020 08:19:41 +0200 -Subject: IB/mlx4: Adjust delayed work when a dup is observed -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: HÃ¥kon Bugge - -[ Upstream commit 785167a114855c5aa75efca97000e405c2cc85bf ] - -When scheduling delayed work to clean up the cache, if the entry already -has been scheduled for deletion, we adjust the delay. - -Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") -Link: https://lore.kernel.org/r/20200803061941.1139994-7-haakon.bugge@oracle.com -Signed-off-by: HÃ¥kon Bugge -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/hw/mlx4/cm.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c -index 8c79a480f2b76..d3e11503e67ca 100644 ---- a/drivers/infiniband/hw/mlx4/cm.c -+++ b/drivers/infiniband/hw/mlx4/cm.c -@@ -307,6 +307,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) - if (!sriov->is_going_down) { - id->scheduled_delete = 1; - schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); -+ } else if (id->scheduled_delete) { -+ /* Adjust timeout if already scheduled */ -+ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); - } - spin_unlock_irqrestore(&sriov->going_down_lock, flags); - spin_unlock(&sriov->id_map_lock); --- -2.25.1 - diff --git a/queue-4.19/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch b/queue-4.19/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch deleted file mode 100644 index a1282d22938..00000000000 --- a/queue-4.19/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch +++ /dev/null @@ -1,181 +0,0 @@ -From ce74e13300c55e9e27a7f0eec2c3a078ef2a7888 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 3 Aug 2020 08:19:39 +0200 -Subject: IB/mlx4: Fix starvation in paravirt mux/demux -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: HÃ¥kon Bugge - -[ Upstream commit 7fd1507df7cee9c533f38152fcd1dd769fcac6ce ] - -The mlx4 driver will proxy MAD packets through the PF driver. A VM or an -instantiated VF will send its MAD packets to the PF driver using -loop-back. The PF driver will be informed by an interrupt, but defer the -handling and polling of CQEs to a worker thread running on an ordered -work-queue. - -Consider the following scenario: the VMs will in short proximity in time, -for example due to a network event, send many MAD packets to the PF -driver. Lets say there are K VMs, each sending N packets. - -The interrupt from the first VM will start the worker thread, which will -poll N CQEs. A common case here is where the PF driver will multiplex the -packets received from the VMs out on the wire QP. - -But before the wire QP has returned a send CQE and associated interrupt, -the other K - 1 VMs have sent their N packets as well. - -The PF driver has to multiplex K * N packets out on the wire QP. But the -send-queue on the wire QP has a finite capacity. - -So, in this scenario, if K * N is larger than the send-queue capacity of -the wire QP, we will get MAD packets dropped on the floor with this -dynamic debug message: - -mlx4_ib_multiplex_mad: failed sending GSI to wire on behalf of slave 2 (-11) - -and this despite the fact that the wire send-queue could have capacity, -but the PF driver isn't aware, because the wire send CQEs have not yet -been polled. - -We can also have a similar scenario inbound, with a wire recv-queue larger -than the tunnel QP's send-queue. If many remote peers send MAD packets to -the very same VM, the tunnel send-queue destined to the VM could allegedly -be construed to be full by the PF driver. - -This starvation is fixed by introducing separate work queues for the wire -QPs vs. the tunnel QPs. - -With this fix, using a dual ported HCA, 8 VFs instantiated, we could run -cmtime on each of the 18 interfaces towards a similar configured peer, -each cmtime instance with 800 QPs (all in all 14400 QPs) without a single -CM packet getting lost. - -Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") -Link: https://lore.kernel.org/r/20200803061941.1139994-5-haakon.bugge@oracle.com -Signed-off-by: HÃ¥kon Bugge -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/hw/mlx4/mad.c | 34 +++++++++++++++++++++++++--- - drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 ++ - 2 files changed, 33 insertions(+), 3 deletions(-) - -diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c -index 5aaa2a6c431b6..418b9312fb2d7 100644 ---- a/drivers/infiniband/hw/mlx4/mad.c -+++ b/drivers/infiniband/hw/mlx4/mad.c -@@ -1305,6 +1305,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg) - spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); - } - -+static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg) -+{ -+ unsigned long flags; -+ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context; -+ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev); -+ -+ spin_lock_irqsave(&dev->sriov.going_down_lock, flags); -+ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE) -+ queue_work(ctx->wi_wq, &ctx->work); -+ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); -+} -+ - static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx, - struct mlx4_ib_demux_pv_qp *tun_qp, - int index) -@@ -2000,7 +2012,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, - cq_size *= 2; - - cq_attr.cqe = cq_size; -- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler, -+ ctx->cq = ib_create_cq(ctx->ib_dev, -+ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler, - NULL, ctx, &cq_attr); - if (IS_ERR(ctx->cq)) { - ret = PTR_ERR(ctx->cq); -@@ -2037,6 +2050,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, - INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker); - - ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq; -+ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq; - - ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP); - if (ret) { -@@ -2180,7 +2194,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, - goto err_mcg; - } - -- snprintf(name, sizeof name, "mlx4_ibt%d", port); -+ snprintf(name, sizeof(name), "mlx4_ibt%d", port); - ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); - if (!ctx->wq) { - pr_err("Failed to create tunnelling WQ for port %d\n", port); -@@ -2188,7 +2202,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, - goto err_wq; - } - -- snprintf(name, sizeof name, "mlx4_ibud%d", port); -+ snprintf(name, sizeof(name), "mlx4_ibwi%d", port); -+ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); -+ if (!ctx->wi_wq) { -+ pr_err("Failed to create wire WQ for port %d\n", port); -+ ret = -ENOMEM; -+ goto err_wiwq; -+ } -+ -+ snprintf(name, sizeof(name), "mlx4_ibud%d", port); - ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); - if (!ctx->ud_wq) { - pr_err("Failed to create up/down WQ for port %d\n", port); -@@ -2199,6 +2221,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, - return 0; - - err_udwq: -+ destroy_workqueue(ctx->wi_wq); -+ ctx->wi_wq = NULL; -+ -+err_wiwq: - destroy_workqueue(ctx->wq); - ctx->wq = NULL; - -@@ -2246,12 +2272,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx) - ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING; - } - flush_workqueue(ctx->wq); -+ flush_workqueue(ctx->wi_wq); - for (i = 0; i < dev->dev->caps.sqp_demux; i++) { - destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0); - free_pv_object(dev, i, ctx->port); - } - kfree(ctx->tun); - destroy_workqueue(ctx->ud_wq); -+ destroy_workqueue(ctx->wi_wq); - destroy_workqueue(ctx->wq); - } - } -diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h -index e10dccc7958f1..76ca67aa40158 100644 ---- a/drivers/infiniband/hw/mlx4/mlx4_ib.h -+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h -@@ -464,6 +464,7 @@ struct mlx4_ib_demux_pv_ctx { - struct ib_pd *pd; - struct work_struct work; - struct workqueue_struct *wq; -+ struct workqueue_struct *wi_wq; - struct mlx4_ib_demux_pv_qp qp[2]; - }; - -@@ -471,6 +472,7 @@ struct mlx4_ib_demux_ctx { - struct ib_device *ib_dev; - int port; - struct workqueue_struct *wq; -+ struct workqueue_struct *wi_wq; - struct workqueue_struct *ud_wq; - spinlock_t ud_lock; - atomic64_t subnet_prefix; --- -2.25.1 - diff --git a/queue-4.19/ibmveth-identify-ingress-large-send-packets.patch b/queue-4.19/ibmveth-identify-ingress-large-send-packets.patch deleted file mode 100644 index 1eb01160bda..00000000000 --- a/queue-4.19/ibmveth-identify-ingress-large-send-packets.patch +++ /dev/null @@ -1,57 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: David Wilder -Date: Tue, 13 Oct 2020 16:20:14 -0700 -Subject: ibmveth: Identify ingress large send packets. - -From: David Wilder - -[ Upstream commit 413f142cc05cb03f2d1ea83388e40c1ddc0d74e9 ] - -Ingress large send packets are identified by either: -The IBMVETH_RXQ_LRG_PKT flag in the receive buffer -or with a -1 placed in the ip header checksum. -The method used depends on firmware version. Frame -geometry and sufficient header validation is performed by the -hypervisor eliminating the need for further header checks here. - -Fixes: 7b5967389f5a ("ibmveth: set correct gso_size and gso_type") -Signed-off-by: David Wilder -Reviewed-by: Thomas Falcon -Reviewed-by: Cristobal Forno -Reviewed-by: Pradeep Satyanarayana -Acked-by: Willem de Bruijn -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/ibm/ibmveth.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1330,6 +1330,7 @@ static int ibmveth_poll(struct napi_stru - int offset = ibmveth_rxq_frame_offset(adapter); - int csum_good = ibmveth_rxq_csum_good(adapter); - int lrg_pkt = ibmveth_rxq_large_packet(adapter); -+ __sum16 iph_check = 0; - - skb = ibmveth_rxq_get_buffer(adapter); - -@@ -1366,7 +1367,17 @@ static int ibmveth_poll(struct napi_stru - skb_put(skb, length); - skb->protocol = eth_type_trans(skb, netdev); - -- if (length > netdev->mtu + ETH_HLEN) { -+ /* PHYP without PLSO support places a -1 in the ip -+ * checksum for large send frames. -+ */ -+ if (skb->protocol == cpu_to_be16(ETH_P_IP)) { -+ struct iphdr *iph = (struct iphdr *)skb->data; -+ -+ iph_check = iph->check; -+ } -+ -+ if ((length > netdev->mtu + ETH_HLEN) || -+ lrg_pkt || iph_check == 0xffff) { - ibmveth_rx_mss_helper(skb, mss, lrg_pkt); - adapter->rx_large_packets++; - } diff --git a/queue-4.19/ibmveth-switch-order-of-ibmveth_helper-calls.patch b/queue-4.19/ibmveth-switch-order-of-ibmveth_helper-calls.patch deleted file mode 100644 index 3a17b8227fa..00000000000 --- a/queue-4.19/ibmveth-switch-order-of-ibmveth_helper-calls.patch +++ /dev/null @@ -1,48 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: David Wilder -Date: Tue, 13 Oct 2020 16:20:13 -0700 -Subject: ibmveth: Switch order of ibmveth_helper calls. - -From: David Wilder - -[ Upstream commit 5ce9ad815a296374ca21f43f3b1ab5083d202ee1 ] - -ibmveth_rx_csum_helper() must be called after ibmveth_rx_mss_helper() -as ibmveth_rx_csum_helper() may alter ip and tcp checksum values. - -Fixes: 66aa0678efc2 ("ibmveth: Support to enable LSO/CSO for Trunk VEA.") -Signed-off-by: David Wilder -Reviewed-by: Thomas Falcon -Reviewed-by: Cristobal Forno -Reviewed-by: Pradeep Satyanarayana -Acked-by: Willem de Bruijn -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/ibm/ibmveth.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1366,16 +1366,16 @@ static int ibmveth_poll(struct napi_stru - skb_put(skb, length); - skb->protocol = eth_type_trans(skb, netdev); - -- if (csum_good) { -- skb->ip_summed = CHECKSUM_UNNECESSARY; -- ibmveth_rx_csum_helper(skb, adapter); -- } -- - if (length > netdev->mtu + ETH_HLEN) { - ibmveth_rx_mss_helper(skb, mss, lrg_pkt); - adapter->rx_large_packets++; - } - -+ if (csum_good) { -+ skb->ip_summed = CHECKSUM_UNNECESSARY; -+ ibmveth_rx_csum_helper(skb, adapter); -+ } -+ - napi_gro_receive(napi, skb); /* send it up */ - - netdev->stats.rx_packets++; diff --git a/queue-4.19/icmp-randomize-the-global-rate-limiter.patch b/queue-4.19/icmp-randomize-the-global-rate-limiter.patch deleted file mode 100644 index 43b1ba5360d..00000000000 --- a/queue-4.19/icmp-randomize-the-global-rate-limiter.patch +++ /dev/null @@ -1,67 +0,0 @@ -From foo@baz Sat Oct 24 11:00:25 AM CEST 2020 -From: Eric Dumazet -Date: Thu, 15 Oct 2020 11:42:00 -0700 -Subject: icmp: randomize the global rate limiter - -From: Eric Dumazet - -[ Upstream commit b38e7819cae946e2edf869e604af1e65a5d241c5 ] - -Keyu Man reported that the ICMP rate limiter could be used -by attackers to get useful signal. Details will be provided -in an upcoming academic publication. - -Our solution is to add some noise, so that the attackers -no longer can get help from the predictable token bucket limiter. - -Fixes: 4cdf507d5452 ("icmp: add a global rate limitation") -Signed-off-by: Eric Dumazet -Reported-by: Keyu Man -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - Documentation/networking/ip-sysctl.txt | 4 +++- - net/ipv4/icmp.c | 7 +++++-- - 2 files changed, 8 insertions(+), 3 deletions(-) - ---- a/Documentation/networking/ip-sysctl.txt -+++ b/Documentation/networking/ip-sysctl.txt -@@ -934,12 +934,14 @@ icmp_ratelimit - INTEGER - icmp_msgs_per_sec - INTEGER - Limit maximal number of ICMP packets sent per second from this host. - Only messages whose type matches icmp_ratemask (see below) are -- controlled by this limit. -+ controlled by this limit. For security reasons, the precise count -+ of messages per second is randomized. - Default: 1000 - - icmp_msgs_burst - INTEGER - icmp_msgs_per_sec controls number of ICMP packets sent per second, - while icmp_msgs_burst controls the burst size of these packets. -+ For security reasons, the precise burst size is randomized. - Default: 50 - - icmp_ratemask - INTEGER ---- a/net/ipv4/icmp.c -+++ b/net/ipv4/icmp.c -@@ -244,7 +244,7 @@ static struct { - /** - * icmp_global_allow - Are we allowed to send one more ICMP message ? - * -- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec. -+ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec. - * Returns false if we reached the limit and can not send another packet. - * Note: called with BH disabled - */ -@@ -272,7 +272,10 @@ bool icmp_global_allow(void) - } - credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst); - if (credit) { -- credit--; -+ /* We want to use a credit of one in average, but need to randomize -+ * it for security reasons. -+ */ -+ credit = max_t(int, credit - prandom_u32_max(3), 0); - rc = true; - } - WRITE_ONCE(icmp_global.credit, credit); diff --git a/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch b/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch deleted file mode 100644 index 0c8978ac829..00000000000 --- a/queue-4.19/ima-don-t-ignore-errors-from-crypto_shash_update.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 60386b854008adc951c470067f90a2d85b5d520f Mon Sep 17 00:00:00 2001 -From: Roberto Sassu -Date: Fri, 4 Sep 2020 11:23:28 +0200 -Subject: ima: Don't ignore errors from crypto_shash_update() - -From: Roberto Sassu - -commit 60386b854008adc951c470067f90a2d85b5d520f upstream. - -Errors returned by crypto_shash_update() are not checked in -ima_calc_boot_aggregate_tfm() and thus can be overwritten at the next -iteration of the loop. This patch adds a check after calling -crypto_shash_update() and returns immediately if the result is not zero. - -Cc: stable@vger.kernel.org -Fixes: 3323eec921efd ("integrity: IMA as an integrity service provider") -Signed-off-by: Roberto Sassu -Signed-off-by: Mimi Zohar -Signed-off-by: Greg Kroah-Hartman - ---- - security/integrity/ima/ima_crypto.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/security/integrity/ima/ima_crypto.c -+++ b/security/integrity/ima/ima_crypto.c -@@ -682,6 +682,8 @@ static int ima_calc_boot_aggregate_tfm(c - ima_pcrread(i, pcr_i); - /* now accumulate with current aggregate */ - rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE); -+ if (rc != 0) -+ return rc; - } - if (!rc) - crypto_shash_final(shash, digest); diff --git a/queue-4.19/ipv4-restore-flowi4_oif-update-before-call-to-xfrm_lookup_route.patch b/queue-4.19/ipv4-restore-flowi4_oif-update-before-call-to-xfrm_lookup_route.patch deleted file mode 100644 index f2a837ccbb2..00000000000 --- a/queue-4.19/ipv4-restore-flowi4_oif-update-before-call-to-xfrm_lookup_route.patch +++ /dev/null @@ -1,40 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: David Ahern -Date: Fri, 9 Oct 2020 11:01:01 -0700 -Subject: ipv4: Restore flowi4_oif update before call to xfrm_lookup_route - -From: David Ahern - -[ Upstream commit 874fb9e2ca949b443cc419a4f2227cafd4381d39 ] - -Tobias reported regressions in IPsec tests following the patch -referenced by the Fixes tag below. The root cause is dropping the -reset of the flowi4_oif after the fib_lookup. Apparently it is -needed for xfrm cases, so restore the oif update to ip_route_output_flow -right before the call to xfrm_lookup_route. - -Fixes: 2fbc6e89b2f1 ("ipv4: Update exception handling for multipath routes via same device") -Reported-by: Tobias Brunner -Signed-off-by: David Ahern -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/route.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2634,10 +2634,12 @@ struct rtable *ip_route_output_flow(stru - if (IS_ERR(rt)) - return rt; - -- if (flp4->flowi4_proto) -+ if (flp4->flowi4_proto) { -+ flp4->flowi4_oif = rt->dst.dev->ifindex; - rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst, - flowi4_to_flowi(flp4), - sk, 0); -+ } - - return rt; - } diff --git a/queue-4.19/ipvs-clear-skb-tstamp-in-forwarding-path.patch b/queue-4.19/ipvs-clear-skb-tstamp-in-forwarding-path.patch deleted file mode 100644 index 5a9304034f7..00000000000 --- a/queue-4.19/ipvs-clear-skb-tstamp-in-forwarding-path.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 39cbbfc38d85341bffad5a1553a2e2f8e7400ad9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 9 Oct 2020 21:24:25 +0300 -Subject: ipvs: clear skb->tstamp in forwarding path - -From: Julian Anastasov - -[ Upstream commit 7980d2eabde82be86c5be18aa3d07e88ec13c6a1 ] - -fq qdisc requires tstamp to be cleared in forwarding path - -Reported-by: Evgeny B -Link: https://bugzilla.kernel.org/show_bug.cgi?id=209427 -Suggested-by: Eric Dumazet -Fixes: 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths") -Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") -Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") -Signed-off-by: Julian Anastasov -Reviewed-by: Simon Horman -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin ---- - net/netfilter/ipvs/ip_vs_xmit.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c -index 3f75cd947045e..11f7c546e57b3 100644 ---- a/net/netfilter/ipvs/ip_vs_xmit.c -+++ b/net/netfilter/ipvs/ip_vs_xmit.c -@@ -586,6 +586,8 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb, - if (ret == NF_ACCEPT) { - nf_reset(skb); - skb_forward_csum(skb); -+ if (skb->dev) -+ skb->tstamp = 0; - } - return ret; - } -@@ -626,6 +628,8 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb, - - if (!local) { - skb_forward_csum(skb); -+ if (skb->dev) -+ skb->tstamp = 0; - NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb, - NULL, skb_dst(skb)->dev, dst_output); - } else -@@ -646,6 +650,8 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb, - if (!local) { - ip_vs_drop_early_demux_sk(skb); - skb_forward_csum(skb); -+ if (skb->dev) -+ skb->tstamp = 0; - NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb, - NULL, skb_dst(skb)->dev, dst_output); - } else --- -2.25.1 - diff --git a/queue-4.19/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch b/queue-4.19/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch deleted file mode 100644 index 6dfeb365114..00000000000 --- a/queue-4.19/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 707063366ceee4b0696ddb5425de63f64933700f Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 30 Sep 2020 10:31:20 +0300 -Subject: iwlwifi: mvm: split a print to avoid a WARNING in ROC - -From: Emmanuel Grumbach - -[ Upstream commit 903b3f9badf1d54f77b468b96706dab679b45b14 ] - -A print in the remain on channel code was too long and caused -a WARNING, split it. - -Signed-off-by: Emmanuel Grumbach -Fixes: dc28e12f2125 ("iwlwifi: mvm: ROC: Extend the ROC max delay duration & limit ROC duration") -Signed-off-by: Luca Coelho -Link: https://lore.kernel.org/r/iwlwifi.20200930102759.58d57c0bdc68.Ib06008665e7bf1199c360aa92691d9c74fb84990@changeid -Signed-off-by: Luca Coelho -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++--- - 1 file changed, 6 insertions(+), 3 deletions(-) - -diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -index 58653598db146..525b26e0f65ee 100644 ---- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c -@@ -3424,9 +3424,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm, - aux_roc_req.apply_time_max_delay = cpu_to_le32(delay); - - IWL_DEBUG_TE(mvm, -- "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", -- channel->hw_value, req_dur, duration, delay, -- dtim_interval); -+ "ROC: Requesting to remain on channel %u for %ums\n", -+ channel->hw_value, req_dur); -+ IWL_DEBUG_TE(mvm, -+ "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", -+ duration, delay, dtim_interval); -+ - /* Set the node address */ - memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN); - --- -2.25.1 - diff --git a/queue-4.19/kvm-svm-initialize-prev_ga_tag-before-use.patch b/queue-4.19/kvm-svm-initialize-prev_ga_tag-before-use.patch deleted file mode 100644 index 49666e46ca4..00000000000 --- a/queue-4.19/kvm-svm-initialize-prev_ga_tag-before-use.patch +++ /dev/null @@ -1,62 +0,0 @@ -From f6426ab9c957e97418ac5b0466538792767b1738 Mon Sep 17 00:00:00 2001 -From: Suravee Suthikulpanit -Date: Sat, 3 Oct 2020 23:27:07 +0000 -Subject: KVM: SVM: Initialize prev_ga_tag before use - -From: Suravee Suthikulpanit - -commit f6426ab9c957e97418ac5b0466538792767b1738 upstream. - -The function amd_ir_set_vcpu_affinity makes use of the parameter struct -amd_iommu_pi_data.prev_ga_tag to determine if it should delete struct -amd_iommu_pi_data from a list when not running in AVIC mode. - -However, prev_ga_tag is initialized only when AVIC is enabled. The non-zero -uninitialized value can cause unintended code path, which ends up making -use of the struct vcpu_svm.ir_list and ir_list_lock without being -initialized (since they are intended only for the AVIC case). - -This triggers NULL pointer dereference bug in the function vm_ir_list_del -with the following call trace: - - svm_update_pi_irte+0x3c2/0x550 [kvm_amd] - ? proc_create_single_data+0x41/0x50 - kvm_arch_irq_bypass_add_producer+0x40/0x60 [kvm] - __connect+0x5f/0xb0 [irqbypass] - irq_bypass_register_producer+0xf8/0x120 [irqbypass] - vfio_msi_set_vector_signal+0x1de/0x2d0 [vfio_pci] - vfio_msi_set_block+0x77/0xe0 [vfio_pci] - vfio_pci_set_msi_trigger+0x25c/0x2f0 [vfio_pci] - vfio_pci_set_irqs_ioctl+0x88/0xb0 [vfio_pci] - vfio_pci_ioctl+0x2ea/0xed0 [vfio_pci] - ? alloc_file_pseudo+0xa5/0x100 - vfio_device_fops_unl_ioctl+0x26/0x30 [vfio] - ? vfio_device_fops_unl_ioctl+0x26/0x30 [vfio] - __x64_sys_ioctl+0x96/0xd0 - do_syscall_64+0x37/0x80 - entry_SYSCALL_64_after_hwframe+0x44/0xa9 - -Therefore, initialize prev_ga_tag to zero before use. This should be safe -because ga_tag value 0 is invalid (see function avic_vm_init). - -Fixes: dfa20099e26e ("KVM: SVM: Refactor AVIC vcpu initialization into avic_init_vcpu()") -Signed-off-by: Suravee Suthikulpanit -Message-Id: <20201003232707.4662-1-suravee.suthikulpanit@amd.com> -Cc: stable@vger.kernel.org -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/svm.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -5380,6 +5380,7 @@ static int svm_update_pi_irte(struct kvm - * - Tell IOMMU to use legacy mode for this interrupt. - * - Retrieve ga_tag of prior interrupt remapping data. - */ -+ pi.prev_ga_tag = 0; - pi.is_guest_mode = false; - ret = irq_set_vcpu_affinity(host_irq, &pi); - diff --git a/queue-4.19/kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch b/queue-4.19/kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch deleted file mode 100644 index 5022f6b1aeb..00000000000 --- a/queue-4.19/kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch +++ /dev/null @@ -1,39 +0,0 @@ -From e89505698c9f70125651060547da4ff5046124fc Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Wed, 23 Sep 2020 11:37:28 -0700 -Subject: KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages - -From: Sean Christopherson - -commit e89505698c9f70125651060547da4ff5046124fc upstream. - -Call kvm_mmu_commit_zap_page() after exiting the "prepare zap" loop in -kvm_recover_nx_lpages() to finish zapping pages in the unlikely event -that the loop exited due to lpage_disallowed_mmu_pages being empty. -Because the recovery thread drops mmu_lock() when rescheduling, it's -possible that lpage_disallowed_mmu_pages could be emptied by a different -thread without to_zap reaching zero despite to_zap being derived from -the number of disallowed lpages. - -Fixes: 1aa9b9572b105 ("kvm: x86: mmu: Recovery of shattered NX large pages") -Cc: Junaid Shahid -Cc: stable@vger.kernel.org -Signed-off-by: Sean Christopherson -Message-Id: <20200923183735.584-2-sean.j.christopherson@intel.com> -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/mmu.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -6225,6 +6225,7 @@ static void kvm_recover_nx_lpages(struct - cond_resched_lock(&kvm->mmu_lock); - } - } -+ kvm_mmu_commit_zap_page(kvm, &invalid_list); - - spin_unlock(&kvm->mmu_lock); - srcu_read_unlock(&kvm->srcu, rcu_idx); diff --git a/queue-4.19/media-camss-fix-a-reference-count-leak.patch b/queue-4.19/media-camss-fix-a-reference-count-leak.patch deleted file mode 100644 index ace61579e40..00000000000 --- a/queue-4.19/media-camss-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,42 +0,0 @@ -From acfcbae004de49ff4967cb4c443258e7b44b6cbf Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 01:27:12 +0200 -Subject: media: camss: Fix a reference count leak. - -From: Qiushi Wu - -[ Upstream commit d0675b67b42eb4f1a840d1513b5b00f78312f833 ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code, causing incorrect ref count if -PM runtime put is not called in error handling paths. -Thus call pm_runtime_put_sync() if pm_runtime_get_sync() fails. - -Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/qcom/camss/camss-csiphy.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c -index 008afb85023be..3c5b9082ad723 100644 ---- a/drivers/media/platform/qcom/camss/camss-csiphy.c -+++ b/drivers/media/platform/qcom/camss/camss-csiphy.c -@@ -176,8 +176,10 @@ static int csiphy_set_power(struct v4l2_subdev *sd, int on) - int ret; - - ret = pm_runtime_get_sync(dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_sync(dev); - return ret; -+ } - - ret = csiphy_set_clock_rates(csiphy); - if (ret < 0) { --- -2.25.1 - diff --git a/queue-4.19/media-m5mols-check-function-pointer-in-m5mols_sensor.patch b/queue-4.19/media-m5mols-check-function-pointer-in-m5mols_sensor.patch deleted file mode 100644 index dcc9eb02e9d..00000000000 --- a/queue-4.19/media-m5mols-check-function-pointer-in-m5mols_sensor.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 07057c1b3eb470874c50e74ddb5b5f6a87657518 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 19 Jul 2020 17:34:47 +0200 -Subject: media: m5mols: Check function pointer in m5mols_sensor_power - -From: Tom Rix - -[ Upstream commit 52438c4463ac904d14bf3496765e67750766f3a6 ] - -clang static analysis reports this error - -m5mols_core.c:767:4: warning: Called function pointer - is null (null dereference) [core.CallAndMessage] - info->set_power(&client->dev, 0); - ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -In other places, the set_power ptr is checked. -So add a check. - -Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP") -Signed-off-by: Tom Rix -Signed-off-by: Sakari Ailus -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/i2c/m5mols/m5mols_core.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c -index 12e79f9e32d53..d9a9644306096 100644 ---- a/drivers/media/i2c/m5mols/m5mols_core.c -+++ b/drivers/media/i2c/m5mols/m5mols_core.c -@@ -768,7 +768,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable) - - ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies); - if (ret) { -- info->set_power(&client->dev, 0); -+ if (info->set_power) -+ info->set_power(&client->dev, 0); - return ret; - } - --- -2.25.1 - diff --git a/queue-4.19/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch b/queue-4.19/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch deleted file mode 100644 index 4f50e1c67a8..00000000000 --- a/queue-4.19/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 66991bd20775e9fc8351663ef8ff3d92cfec7294 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 26 Aug 2020 11:26:04 +0200 -Subject: media: mx2_emmaprp: Fix memleak in emmaprp_probe - -From: Dinghao Liu - -[ Upstream commit 21d387b8d372f859d9e87fdcc7c3b4a432737f4d ] - -When platform_get_irq() fails, we should release -vfd and unregister pcdev->v4l2_dev just like the -subsequent error paths. - -Fixes: d4e192cc44914 ("media: mx2_emmaprp: Check for platform_get_irq() error") -Signed-off-by: Dinghao Liu -Reviewed-by: Fabio Estevam -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/mx2_emmaprp.c | 7 +++++-- - 1 file changed, 5 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c -index 419e1cb10dc66..f4be4c672d40e 100644 ---- a/drivers/media/platform/mx2_emmaprp.c -+++ b/drivers/media/platform/mx2_emmaprp.c -@@ -929,8 +929,11 @@ static int emmaprp_probe(struct platform_device *pdev) - platform_set_drvdata(pdev, pcdev); - - irq = platform_get_irq(pdev, 0); -- if (irq < 0) -- return irq; -+ if (irq < 0) { -+ ret = irq; -+ goto rel_vdev; -+ } -+ - ret = devm_request_irq(&pdev->dev, irq, emmaprp_irq, 0, - dev_name(&pdev->dev), pcdev); - if (ret) --- -2.25.1 - diff --git a/queue-4.19/media-omap3isp-fix-memleak-in-isp_probe.patch b/queue-4.19/media-omap3isp-fix-memleak-in-isp_probe.patch deleted file mode 100644 index 9b12caf5378..00000000000 --- a/queue-4.19/media-omap3isp-fix-memleak-in-isp_probe.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 4cf6c3cd9456c2d66e6fec86149f424119df7748 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 24 Aug 2020 08:53:52 +0200 -Subject: media: omap3isp: Fix memleak in isp_probe - -From: Dinghao Liu - -[ Upstream commit d8fc21c17099635e8ebd986d042be65a6c6b5bd0 ] - -When devm_ioremap_resource() fails, isp should be -freed just like other error paths in isp_probe. - -Fixes: 8644cdf972dd6 ("[media] omap3isp: Replace many MMIO regions by two") -Signed-off-by: Dinghao Liu -Signed-off-by: Sakari Ailus -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/omap3isp/isp.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c -index addd03b517481..00e52f0b8251b 100644 ---- a/drivers/media/platform/omap3isp/isp.c -+++ b/drivers/media/platform/omap3isp/isp.c -@@ -2265,8 +2265,10 @@ static int isp_probe(struct platform_device *pdev) - mem = platform_get_resource(pdev, IORESOURCE_MEM, i); - isp->mmio_base[map_idx] = - devm_ioremap_resource(isp->dev, mem); -- if (IS_ERR(isp->mmio_base[map_idx])) -- return PTR_ERR(isp->mmio_base[map_idx]); -+ if (IS_ERR(isp->mmio_base[map_idx])) { -+ ret = PTR_ERR(isp->mmio_base[map_idx]); -+ goto error; -+ } - } - - ret = isp_get_clocks(isp); --- -2.25.1 - diff --git a/queue-4.19/media-platform-fcp-fix-a-reference-count-leak.patch b/queue-4.19/media-platform-fcp-fix-a-reference-count-leak.patch deleted file mode 100644 index 60b8639277c..00000000000 --- a/queue-4.19/media-platform-fcp-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 5edadc3044b545899c31c09837708a4b07dc501a Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 01:19:44 +0200 -Subject: media: platform: fcp: Fix a reference count leak. - -From: Qiushi Wu - -[ Upstream commit 63e36a381d92a9cded97e90d481ee22566557dd1 ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code, causing incorrect ref count if -pm_runtime_put_noidle() is not called in error handling paths. -Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. - -Fixes: 6eaafbdb668b ("[media] v4l: rcar-fcp: Keep the coding style consistent") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/rcar-fcp.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c -index 5c6b00737fe75..05c712e00a2a7 100644 ---- a/drivers/media/platform/rcar-fcp.c -+++ b/drivers/media/platform/rcar-fcp.c -@@ -103,8 +103,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp) - return 0; - - ret = pm_runtime_get_sync(fcp->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(fcp->dev); - return ret; -+ } - - return 0; - } --- -2.25.1 - diff --git a/queue-4.19/media-rcar-vin-fix-a-reference-count-leak.patch b/queue-4.19/media-rcar-vin-fix-a-reference-count-leak.patch deleted file mode 100644 index e338b2f9f6f..00000000000 --- a/queue-4.19/media-rcar-vin-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 2de9a79c5586265356ed626806a67c01bafb30e9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 00:30:08 +0200 -Subject: media: rcar-vin: Fix a reference count leak. - -From: Qiushi Wu - -[ Upstream commit aaffa0126a111d65f4028c503c76192d4cc93277 ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code. Thus call pm_runtime_put_noidle() -if pm_runtime_get_sync() fails. - -Fixes: 90dedce9bc54 ("media: rcar-vin: add function to manipulate Gen3 chsel value") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/rcar-vin/rcar-dma.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c -index 92323310f7352..70a8cc433a03f 100644 ---- a/drivers/media/platform/rcar-vin/rcar-dma.c -+++ b/drivers/media/platform/rcar-vin/rcar-dma.c -@@ -1323,8 +1323,10 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel) - int ret; - - ret = pm_runtime_get_sync(vin->dev); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(vin->dev); - return ret; -+ } - - /* Make register writes take effect immediately. */ - vnmc = rvin_read(vin, VNMC_REG); --- -2.25.1 - diff --git a/queue-4.19/media-revert-media-exynos4-is-add-missed-check-for-p.patch b/queue-4.19/media-revert-media-exynos4-is-add-missed-check-for-p.patch deleted file mode 100644 index 43c61fc4e41..00000000000 --- a/queue-4.19/media-revert-media-exynos4-is-add-missed-check-for-p.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 97670cc6ec2d492536ad420eac6a061e6c7c8034 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 10 Aug 2020 17:32:39 +0200 -Subject: media: Revert "media: exynos4-is: Add missed check for - pinctrl_lookup_state()" - -From: Sylwester Nawrocki - -[ Upstream commit 00d21f325d58567d81d9172096692d0a9ea7f725 ] - -The "idle" pinctrl state is optional as documented in the DT binding. -The change introduced by the commit being reverted makes that pinctrl state -mandatory and breaks initialization of the whole media driver, since the -"idle" state is not specified in any mainline dts. - -This reverts commit 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()") -to fix the regression. - -Fixes: 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()") -Signed-off-by: Sylwester Nawrocki -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/exynos4-is/media-dev.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c -index 2d25a197dc657..f5fca01f3248e 100644 ---- a/drivers/media/platform/exynos4-is/media-dev.c -+++ b/drivers/media/platform/exynos4-is/media-dev.c -@@ -1257,11 +1257,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) - if (IS_ERR(pctl->state_default)) - return PTR_ERR(pctl->state_default); - -+ /* PINCTRL_STATE_IDLE is optional */ - pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, - PINCTRL_STATE_IDLE); -- if (IS_ERR(pctl->state_idle)) -- return PTR_ERR(pctl->state_idle); -- - return 0; - } - --- -2.25.1 - diff --git a/queue-4.19/media-rockchip-rga-fix-a-reference-count-leak.patch b/queue-4.19/media-rockchip-rga-fix-a-reference-count-leak.patch deleted file mode 100644 index f9b1cf7ed8c..00000000000 --- a/queue-4.19/media-rockchip-rga-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 8d0fbf54f3e418c84a52c2f3bcc33d4df9d28087 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 01:13:49 +0200 -Subject: media: rockchip/rga: Fix a reference count leak. - -From: Qiushi Wu - -[ Upstream commit 884d638e0853c4b5f01eb6d048fc3b6239012404 ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code. Thus call pm_runtime_put_noidle() -if pm_runtime_get_sync() fails. - -Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support") -Signed-off-by: Qiushi Wu -Reviewed-by: Heiko Stuebner -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/rockchip/rga/rga-buf.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c -index 356821c2dacf0..0932f1445deab 100644 ---- a/drivers/media/platform/rockchip/rga/rga-buf.c -+++ b/drivers/media/platform/rockchip/rga/rga-buf.c -@@ -89,6 +89,7 @@ static int rga_buf_start_streaming(struct vb2_queue *q, unsigned int count) - - ret = pm_runtime_get_sync(rga->dev); - if (ret < 0) { -+ pm_runtime_put_noidle(rga->dev); - rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED); - return ret; - } --- -2.25.1 - diff --git a/queue-4.19/media-s5p-mfc-fix-a-reference-count-leak.patch b/queue-4.19/media-s5p-mfc-fix-a-reference-count-leak.patch deleted file mode 100644 index d9809151b6e..00000000000 --- a/queue-4.19/media-s5p-mfc-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 4112ede14617668e7df0e373fda8df0b09681c49 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 04:31:22 +0200 -Subject: media: s5p-mfc: Fix a reference count leak - -From: Qiushi Wu - -[ Upstream commit 78741ce98c2e36188e2343434406b0e0bc50b0e7 ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code, causing incorrect ref count if -pm_runtime_put_noidle() is not called in error handling paths. -Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. - -Fixes: c5086f130a77 ("[media] s5p-mfc: Use clock gating only on MFC v5 hardware") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c -index 5e080f32b0e82..95abf2bd7ebae 100644 ---- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c -+++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c -@@ -83,8 +83,10 @@ int s5p_mfc_power_on(void) - int i, ret = 0; - - ret = pm_runtime_get_sync(pm->device); -- if (ret < 0) -+ if (ret < 0) { -+ pm_runtime_put_noidle(pm->device); - return ret; -+ } - - /* clock control */ - for (i = 0; i < pm->num_clocks; i++) { --- -2.25.1 - diff --git a/queue-4.19/media-stm32-dcmi-fix-a-reference-count-leak.patch b/queue-4.19/media-stm32-dcmi-fix-a-reference-count-leak.patch deleted file mode 100644 index 7dcce22668e..00000000000 --- a/queue-4.19/media-stm32-dcmi-fix-a-reference-count-leak.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 20f469aa64a1d343c976b48ea453f154fef165b7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 04:36:59 +0200 -Subject: media: stm32-dcmi: Fix a reference count leak - -From: Qiushi Wu - -[ Upstream commit 88f50a05f907d96a27a9ce3cc9e8cbb91a6f0f22 ] - -Calling pm_runtime_get_sync increments the counter even in case of -failure, causing incorrect ref count if pm_runtime_put is not -called in error handling paths. Thus replace the jump target -"err_release_buffers" by "err_pm_putw". - -Fixes: 152e0bf60219 ("media: stm32-dcmi: add power saving support") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/stm32/stm32-dcmi.c | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c -index 18d0b56417894..ee1a211797673 100644 ---- a/drivers/media/platform/stm32/stm32-dcmi.c -+++ b/drivers/media/platform/stm32/stm32-dcmi.c -@@ -587,7 +587,7 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count) - if (ret < 0) { - dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync (%d)\n", - __func__, ret); -- goto err_release_buffers; -+ goto err_pm_put; - } - - /* Enable stream on the sub device */ -@@ -682,8 +682,6 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count) - - err_pm_put: - pm_runtime_put(dcmi->dev); -- --err_release_buffers: - spin_lock_irq(&dcmi->irqlock); - /* - * Return all buffers to vb2 in QUEUED state. --- -2.25.1 - diff --git a/queue-4.19/media-tc358743-cleanup-tc358743_cec_isr.patch b/queue-4.19/media-tc358743-cleanup-tc358743_cec_isr.patch deleted file mode 100644 index 0f048ff1dae..00000000000 --- a/queue-4.19/media-tc358743-cleanup-tc358743_cec_isr.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 2e5347a97190955c501785207a8a0df273226e6c Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 20:32:12 +0200 -Subject: media: tc358743: cleanup tc358743_cec_isr - -From: Tom Rix - -[ Upstream commit 877cb8a444dad2304e891294afb0915fe3c278d6 ] - -tc358743_cec_isr is misnammed, it is not the main isr. -So rename it to be consistent with its siblings, -tc358743_cec_handler. - -It also does not check if its input parameter 'handled' is -is non NULL like its siblings, so add a check. - -Fixes: a0ec8d1dc42e ("media: tc358743: add CEC support") -Signed-off-by: Tom Rix -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/i2c/tc358743.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - -diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index 874673218dd6e..d9bc3851bf63b 100644 ---- a/drivers/media/i2c/tc358743.c -+++ b/drivers/media/i2c/tc358743.c -@@ -919,8 +919,8 @@ static const struct cec_adap_ops tc358743_cec_adap_ops = { - .adap_monitor_all_enable = tc358743_cec_adap_monitor_all_enable, - }; - --static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, -- bool *handled) -+static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus, -+ bool *handled) - { - struct tc358743_state *state = to_state(sd); - unsigned int cec_rxint, cec_txint; -@@ -953,7 +953,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, - cec_transmit_attempt_done(state->cec_adap, - CEC_TX_STATUS_ERROR); - } -- *handled = true; -+ if (handled) -+ *handled = true; - } - if ((intstatus & MASK_CEC_RINT) && - (cec_rxint & MASK_CECRIEND)) { -@@ -968,7 +969,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, - msg.msg[i] = v & 0xff; - } - cec_received_msg(state->cec_adap, &msg); -- *handled = true; -+ if (handled) -+ *handled = true; - } - i2c_wr16(sd, INTSTATUS, - intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)); -@@ -1432,7 +1434,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) - - #ifdef CONFIG_VIDEO_TC358743_CEC - if (intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)) { -- tc358743_cec_isr(sd, intstatus, handled); -+ tc358743_cec_handler(sd, intstatus, handled); - i2c_wr16(sd, INTSTATUS, - intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)); - intstatus &= ~(MASK_CEC_RINT | MASK_CEC_TINT); --- -2.25.1 - diff --git a/queue-4.19/media-tc358743-initialize-variable.patch b/queue-4.19/media-tc358743-initialize-variable.patch deleted file mode 100644 index b4745dfaf7d..00000000000 --- a/queue-4.19/media-tc358743-initialize-variable.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 25253d3e5354e253205f4a11c80c98af730ded3c Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 30 Aug 2020 18:30:43 +0200 -Subject: media: tc358743: initialize variable - -From: Tom Rix - -[ Upstream commit 274cf92d5dff5c2fec1a518078542ffe70d07646 ] - -clang static analysis flags this error - -tc358743.c:1468:9: warning: Branch condition evaluates - to a garbage value - return handled ? IRQ_HANDLED : IRQ_NONE; - ^~~~~~~ -handled should be initialized to false. - -Fixes: d747b806abf4 ("[media] tc358743: add direct interrupt handling") -Signed-off-by: Tom Rix -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/i2c/tc358743.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index e4c0a27b636aa..874673218dd6e 100644 ---- a/drivers/media/i2c/tc358743.c -+++ b/drivers/media/i2c/tc358743.c -@@ -1461,7 +1461,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) - static irqreturn_t tc358743_irq_handler(int irq, void *dev_id) - { - struct tc358743_state *state = dev_id; -- bool handled; -+ bool handled = false; - - tc358743_isr(&state->sd, 0, &handled); - --- -2.25.1 - diff --git a/queue-4.19/media-ti-vpe-fix-a-missing-check-and-reference-count.patch b/queue-4.19/media-ti-vpe-fix-a-missing-check-and-reference-count.patch deleted file mode 100644 index 88b71c26729..00000000000 --- a/queue-4.19/media-ti-vpe-fix-a-missing-check-and-reference-count.patch +++ /dev/null @@ -1,42 +0,0 @@ -From ac55d5812365854153eb0c14dba95d1c382ef3d0 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 14 Jun 2020 04:56:05 +0200 -Subject: media: ti-vpe: Fix a missing check and reference count leak - -From: Qiushi Wu - -[ Upstream commit 7dae2aaaf432767ca7aa11fa84643a7c2600dbdd ] - -pm_runtime_get_sync() increments the runtime PM usage counter even -when it returns an error code, causing incorrect ref count if -pm_runtime_put_noidle() is not called in error handling paths. -And also, when the call of function vpe_runtime_get() failed, -we won't call vpe_runtime_put(). -Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails -inside vpe_runtime_get(). - -Fixes: 4571912743ac ("[media] v4l: ti-vpe: Add VPE mem to mem driver") -Signed-off-by: Qiushi Wu -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/platform/ti-vpe/vpe.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c -index a285b9db7ee86..70a8371b7e9a1 100644 ---- a/drivers/media/platform/ti-vpe/vpe.c -+++ b/drivers/media/platform/ti-vpe/vpe.c -@@ -2451,6 +2451,8 @@ static int vpe_runtime_get(struct platform_device *pdev) - - r = pm_runtime_get_sync(&pdev->dev); - WARN_ON(r < 0); -+ if (r) -+ pm_runtime_put_noidle(&pdev->dev); - return r < 0 ? r : 0; - } - --- -2.25.1 - diff --git a/queue-4.19/media-tuner-simple-fix-regression-in-simple_set_radi.patch b/queue-4.19/media-tuner-simple-fix-regression-in-simple_set_radi.patch deleted file mode 100644 index cd51167b9ae..00000000000 --- a/queue-4.19/media-tuner-simple-fix-regression-in-simple_set_radi.patch +++ /dev/null @@ -1,66 +0,0 @@ -From c90877e19669f12e5e70ef09706f27ae040ec191 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 22 Aug 2020 23:15:47 +0200 -Subject: media: tuner-simple: fix regression in simple_set_radio_freq - -From: Tom Rix - -[ Upstream commit 505bfc2a142f12ce7bc7a878b44abc3496f2e747 ] - -clang static analysis reports this problem - -tuner-simple.c:714:13: warning: Assigned value is - garbage or undefined - buffer[1] = buffer[3]; - ^ ~~~~~~~~~ -In simple_set_radio_freq buffer[3] used to be done -in-function with a switch of tuner type, now done -by a call to simple_radio_bandswitch which has this case - - case TUNER_TENA_9533_DI: - case TUNER_YMEC_TVF_5533MF: - tuner_dbg("This tuner doesn't ... - return 0; - -which does not set buffer[3]. In the old logic, this case -would have returned 0 from simple_set_radio_freq. - -Recover this old behavior by returning an error for this -codition. Since the old simple_set_radio_freq behavior -returned a 0, do the same. - -Fixes: c7a9f3aa1e1b ("V4L/DVB (7129): tuner-simple: move device-specific code into three separate functions") -Signed-off-by: Tom Rix -Signed-off-by: Hans Verkuil -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/tuners/tuner-simple.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/media/tuners/tuner-simple.c b/drivers/media/tuners/tuner-simple.c -index 29c1473f2e9f6..81e24cf0c8b80 100644 ---- a/drivers/media/tuners/tuner-simple.c -+++ b/drivers/media/tuners/tuner-simple.c -@@ -499,7 +499,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer) - case TUNER_TENA_9533_DI: - case TUNER_YMEC_TVF_5533MF: - tuner_dbg("This tuner doesn't have FM. Most cards have a TEA5767 for FM\n"); -- return 0; -+ return -EINVAL; - case TUNER_PHILIPS_FM1216ME_MK3: - case TUNER_PHILIPS_FM1236_MK3: - case TUNER_PHILIPS_FMD1216ME_MK3: -@@ -701,7 +701,8 @@ static int simple_set_radio_freq(struct dvb_frontend *fe, - TUNER_RATIO_SELECT_50; /* 50 kHz step */ - - /* Bandswitch byte */ -- simple_radio_bandswitch(fe, &buffer[0]); -+ if (simple_radio_bandswitch(fe, &buffer[0])) -+ return 0; - - /* Convert from 1/16 kHz V4L steps to 1/20 MHz (=50 kHz) PLL steps - freq * (1 Mhz / 16000 V4L steps) * (20 PLL steps / 1 MHz) = --- -2.25.1 - diff --git a/queue-4.19/media-uvcvideo-set-media-controller-entity-functions.patch b/queue-4.19/media-uvcvideo-set-media-controller-entity-functions.patch deleted file mode 100644 index d8fda64d113..00000000000 --- a/queue-4.19/media-uvcvideo-set-media-controller-entity-functions.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 629720ddeba5b3450dc8effc9d96c1f0191202b1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 7 Jun 2020 04:05:49 +0200 -Subject: media: uvcvideo: Set media controller entity functions - -From: Laurent Pinchart - -[ Upstream commit d6834b4b58d110814aaf3469e7fd87d34ae5ae81 ] - -The media controller core prints a warning when an entity is registered -without a function being set. This affects the uvcvideo driver, as the -warning was added without first addressing the issue in existing -drivers. The problem is harmless, but unnecessarily worries users. Fix -it by mapping UVC entity types to MC entity functions as accurately as -possible using the existing functions. - -Fixes: b50bde4e476d ("[media] v4l2-subdev: use MEDIA_ENT_T_UNKNOWN for new subdevs") -Signed-off-by: Laurent Pinchart -Reviewed-by: Kieran Bingham -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/usb/uvc/uvc_entity.c | 35 ++++++++++++++++++++++++++++++ - 1 file changed, 35 insertions(+) - -diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c -index 554063c07d7a2..f2457953f27c6 100644 ---- a/drivers/media/usb/uvc/uvc_entity.c -+++ b/drivers/media/usb/uvc/uvc_entity.c -@@ -78,10 +78,45 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain, - int ret; - - if (UVC_ENTITY_TYPE(entity) != UVC_TT_STREAMING) { -+ u32 function; -+ - v4l2_subdev_init(&entity->subdev, &uvc_subdev_ops); - strlcpy(entity->subdev.name, entity->name, - sizeof(entity->subdev.name)); - -+ switch (UVC_ENTITY_TYPE(entity)) { -+ case UVC_VC_SELECTOR_UNIT: -+ function = MEDIA_ENT_F_VID_MUX; -+ break; -+ case UVC_VC_PROCESSING_UNIT: -+ case UVC_VC_EXTENSION_UNIT: -+ /* For lack of a better option. */ -+ function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER; -+ break; -+ case UVC_COMPOSITE_CONNECTOR: -+ case UVC_COMPONENT_CONNECTOR: -+ function = MEDIA_ENT_F_CONN_COMPOSITE; -+ break; -+ case UVC_SVIDEO_CONNECTOR: -+ function = MEDIA_ENT_F_CONN_SVIDEO; -+ break; -+ case UVC_ITT_CAMERA: -+ function = MEDIA_ENT_F_CAM_SENSOR; -+ break; -+ case UVC_TT_VENDOR_SPECIFIC: -+ case UVC_ITT_VENDOR_SPECIFIC: -+ case UVC_ITT_MEDIA_TRANSPORT_INPUT: -+ case UVC_OTT_VENDOR_SPECIFIC: -+ case UVC_OTT_DISPLAY: -+ case UVC_OTT_MEDIA_TRANSPORT_OUTPUT: -+ case UVC_EXTERNAL_VENDOR_SPECIFIC: -+ default: -+ function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN; -+ break; -+ } -+ -+ entity->subdev.entity.function = function; -+ - ret = media_entity_pads_init(&entity->subdev.entity, - entity->num_pads, entity->pads); - --- -2.25.1 - diff --git a/queue-4.19/media-uvcvideo-silence-shift-out-of-bounds-warning.patch b/queue-4.19/media-uvcvideo-silence-shift-out-of-bounds-warning.patch deleted file mode 100644 index 7afaa66db69..00000000000 --- a/queue-4.19/media-uvcvideo-silence-shift-out-of-bounds-warning.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 6299058bde6761747b628405551d89f56e0c5437 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 19 Aug 2020 01:56:49 +0200 -Subject: media: uvcvideo: Silence shift-out-of-bounds warning - -From: Laurent Pinchart - -[ Upstream commit 171994e498a0426cbe17f874c5c6af3c0af45200 ] - -UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The -report is correct, but the issue should be harmless as the computed -value isn't used when the shift is negative. This may however cause -incorrect behaviour if a negative shift could generate adverse side -effects (such as a trap on some architectures for instance). - -Regardless of whether that may happen or not, silence the warning as a -full WARN backtrace isn't nice. - -Reported-by: Bart Van Assche -Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") -Signed-off-by: Laurent Pinchart -Reviewed-by: Bart Van Assche -Tested-by: Bart Van Assche -Signed-off-by: Mauro Carvalho Chehab -Signed-off-by: Sasha Levin ---- - drivers/media/usb/uvc/uvc_ctrl.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index f2854337cdcac..abfc49901222e 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -778,12 +778,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping, - offset &= 7; - mask = ((1LL << bits) - 1) << offset; - -- for (; bits > 0; data++) { -+ while (1) { - u8 byte = *data & mask; - value |= offset > 0 ? (byte >> offset) : (byte << (-offset)); - bits -= 8 - (offset > 0 ? offset : 0); -+ if (bits <= 0) -+ break; -+ - offset -= 8; - mask = (1 << bits) - 1; -+ data++; - } - - /* Sign-extend the value if needed. */ --- -2.25.1 - diff --git a/queue-4.19/mfd-sm501-fix-leaks-in-probe.patch b/queue-4.19/mfd-sm501-fix-leaks-in-probe.patch deleted file mode 100644 index 7f496035fb7..00000000000 --- a/queue-4.19/mfd-sm501-fix-leaks-in-probe.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 8409a010df1eeae97885013531e91209375a6573 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 11 Sep 2020 14:33:26 +0300 -Subject: mfd: sm501: Fix leaks in probe() - -From: Dan Carpenter - -[ Upstream commit 8ce24f8967df2836b4557a23e74dc4bb098249f1 ] - -This code should clean up if sm501_init_dev() fails. - -Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") -Signed-off-by: Dan Carpenter -Signed-off-by: Lee Jones -Signed-off-by: Sasha Levin ---- - drivers/mfd/sm501.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c -index e0173bf4b0dc7..ec1ac61a21ed1 100644 ---- a/drivers/mfd/sm501.c -+++ b/drivers/mfd/sm501.c -@@ -1429,8 +1429,14 @@ static int sm501_plat_probe(struct platform_device *dev) - goto err_claim; - } - -- return sm501_init_dev(sm); -+ ret = sm501_init_dev(sm); -+ if (ret) -+ goto err_unmap; -+ -+ return 0; - -+ err_unmap: -+ iounmap(sm->regs); - err_claim: - release_resource(sm->regs_claim); - kfree(sm->regs_claim); --- -2.25.1 - diff --git a/queue-4.19/misc-mic-scif-fix-error-handling-path.patch b/queue-4.19/misc-mic-scif-fix-error-handling-path.patch deleted file mode 100644 index ec82c3f5e27..00000000000 --- a/queue-4.19/misc-mic-scif-fix-error-handling-path.patch +++ /dev/null @@ -1,65 +0,0 @@ -From db81bfb7447858c39d9d0979542227051cffe194 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 20 Sep 2020 08:21:35 +0530 -Subject: misc: mic: scif: Fix error handling path - -From: Souptick Joarder - -[ Upstream commit a81072a9c0ae734b7889929b0bc070fe3f353f0e ] - -Inside __scif_pin_pages(), when map_flags != SCIF_MAP_KERNEL it -will call pin_user_pages_fast() to map nr_pages. However, -pin_user_pages_fast() might fail with a return value -ERRNO. - -The return value is stored in pinned_pages->nr_pages. which in -turn is passed to unpin_user_pages(), which expects -pinned_pages->nr_pages >=0, else disaster. - -Fix this by assigning pinned_pages->nr_pages to 0 if -pin_user_pages_fast() returns -ERRNO. - -Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration") -Cc: John Hubbard -Cc: Ira Weiny -Cc: Dan Carpenter -Reviewed-by: John Hubbard -Signed-off-by: Souptick Joarder -Link: https://lore.kernel.org/r/1600570295-29546-1-git-send-email-jrdr.linux@gmail.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/misc/mic/scif/scif_rma.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c -index 0e4193cb08cf1..e1f59b17715d5 100644 ---- a/drivers/misc/mic/scif/scif_rma.c -+++ b/drivers/misc/mic/scif/scif_rma.c -@@ -1403,6 +1403,8 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, - NULL); - up_write(&mm->mmap_sem); - if (nr_pages != pinned_pages->nr_pages) { -+ if (pinned_pages->nr_pages < 0) -+ pinned_pages->nr_pages = 0; - if (try_upgrade) { - if (ulimit) - __scif_dec_pinned_vm_lock(mm, -@@ -1423,7 +1425,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, - - if (pinned_pages->nr_pages < nr_pages) { - err = -EFAULT; -- pinned_pages->nr_pages = nr_pages; - goto dec_pinned; - } - -@@ -1436,7 +1437,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, - __scif_dec_pinned_vm_lock(mm, nr_pages, 0); - /* Something went wrong! Rollback */ - error_unmap: -- pinned_pages->nr_pages = nr_pages; - scif_destroy_pinned_pages(pinned_pages); - *pages = NULL; - dev_dbg(scif_info.mdev.this_device, --- -2.25.1 - diff --git a/queue-4.19/mlx4-handle-non-napi-callers-to-napi_poll.patch b/queue-4.19/mlx4-handle-non-napi-callers-to-napi_poll.patch deleted file mode 100644 index f7ded3e1ba2..00000000000 --- a/queue-4.19/mlx4-handle-non-napi-callers-to-napi_poll.patch +++ /dev/null @@ -1,46 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Jonathan Lemon -Date: Thu, 8 Oct 2020 11:45:26 -0700 -Subject: mlx4: handle non-napi callers to napi_poll - -From: Jonathan Lemon - -[ Upstream commit b2b8a92733b288128feb57ffa694758cf475106c ] - -netcons calls napi_poll with a budget of 0 to transmit packets. -Handle this by: - - skipping RX processing - - do not try to recycle TX packets to the RX cache - -Signed-off-by: Jonathan Lemon -Reviewed-by: Tariq Toukan -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 +++ - drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- - 2 files changed, 4 insertions(+), 1 deletion(-) - ---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -@@ -945,6 +945,9 @@ int mlx4_en_poll_rx_cq(struct napi_struc - bool clean_complete = true; - int done; - -+ if (!budget) -+ return 0; -+ - if (priv->tx_ring_num[TX_XDP]) { - xdp_tx_cq = priv->tx_cq[TX_XDP][cq->ring]; - if (xdp_tx_cq->xdp_busy) { ---- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c -@@ -343,7 +343,7 @@ u32 mlx4_en_recycle_tx_desc(struct mlx4_ - .dma = tx_info->map0_dma, - }; - -- if (!mlx4_en_rx_recycle(ring->recycle_ring, &frame)) { -+ if (!napi_mode || !mlx4_en_rx_recycle(ring->recycle_ring, &frame)) { - dma_unmap_page(priv->ddev, tx_info->map0_dma, - PAGE_SIZE, priv->dma_dir); - put_page(tx_info->page); diff --git a/queue-4.19/mm-memcg-fix-device-private-memcg-accounting.patch b/queue-4.19/mm-memcg-fix-device-private-memcg-accounting.patch deleted file mode 100644 index 1572e26ac65..00000000000 --- a/queue-4.19/mm-memcg-fix-device-private-memcg-accounting.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 7300cbf745a55cabfed7ad7cb7f808f700cbd5f9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 13 Oct 2020 16:53:13 -0700 -Subject: mm/memcg: fix device private memcg accounting - -From: Ralph Campbell - -[ Upstream commit 9a137153fc8798a89d8fce895cd0a06ea5b8e37c ] - -The code in mc_handle_swap_pte() checks for non_swap_entry() and returns -NULL before checking is_device_private_entry() so device private pages are -never handled. Fix this by checking for non_swap_entry() after handling -device private swap PTEs. - -I assume the memory cgroup accounting would be off somehow when moving -a process to another memory cgroup. Currently, the device private page -is charged like a normal anonymous page when allocated and is uncharged -when the page is freed so I think that path is OK. - -Signed-off-by: Ralph Campbell -Signed-off-by: Andrew Morton -Acked-by: Johannes Weiner -Cc: Michal Hocko -Cc: Vladimir Davydov -Cc: Jerome Glisse -Cc: Balbir Singh -Cc: Ira Weiny -Link: https://lkml.kernel.org/r/20201009215952.2726-1-rcampbell@nvidia.com -xFixes: c733a82874a7 ("mm/memcontrol: support MEMORY_DEVICE_PRIVATE") -Signed-off-by: Linus Torvalds -Signed-off-by: Sasha Levin ---- - mm/memcontrol.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index aa730a3d5c258..87cd5bf1b4874 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -4780,7 +4780,7 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma, - struct page *page = NULL; - swp_entry_t ent = pte_to_swp_entry(ptent); - -- if (!(mc.flags & MOVE_ANON) || non_swap_entry(ent)) -+ if (!(mc.flags & MOVE_ANON)) - return NULL; - - /* -@@ -4799,6 +4799,9 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma, - return page; - } - -+ if (non_swap_entry(ent)) -+ return NULL; -+ - /* - * Because lookup_swap_cache() updates some statistics counter, - * we call find_get_page() with swapper_space directly. --- -2.25.1 - diff --git a/queue-4.19/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch b/queue-4.19/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch deleted file mode 100644 index 3e61f7790ff..00000000000 --- a/queue-4.19/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch +++ /dev/null @@ -1,187 +0,0 @@ -From ee290ac68a6668de0ba9e967898f54e0c4141cc9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 13 Oct 2020 16:58:35 -0700 -Subject: mm, oom_adj: don't loop through tasks in __set_oom_adj when not - necessary - -From: Suren Baghdasaryan - -[ Upstream commit 67197a4f28d28d0b073ab0427b03cb2ee5382578 ] - -Currently __set_oom_adj loops through all processes in the system to keep -oom_score_adj and oom_score_adj_min in sync between processes sharing -their mm. This is done for any task with more that one mm_users, which -includes processes with multiple threads (sharing mm and signals). -However for such processes the loop is unnecessary because their signal -structure is shared as well. - -Android updates oom_score_adj whenever a tasks changes its role -(background/foreground/...) or binds to/unbinds from a service, making it -more/less important. Such operation can happen frequently. We noticed -that updates to oom_score_adj became more expensive and after further -investigation found out that the patch mentioned in "Fixes" introduced a -regression. Using Pixel 4 with a typical Android workload, write time to -oom_score_adj increased from ~3.57us to ~362us. Moreover this regression -linearly depends on the number of multi-threaded processes running on the -system. - -Mark the mm with a new MMF_MULTIPROCESS flag bit when task is created with -(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK). Change __set_oom_adj to use -MMF_MULTIPROCESS instead of mm_users to decide whether oom_score_adj -update should be synchronized between multiple processes. To prevent -races between clone() and __set_oom_adj(), when oom_score_adj of the -process being cloned might be modified from userspace, we use -oom_adj_mutex. Its scope is changed to global. - -The combination of (CLONE_VM && !CLONE_THREAD) is rarely used except for -the case of vfork(). To prevent performance regressions of vfork(), we -skip taking oom_adj_mutex and setting MMF_MULTIPROCESS when CLONE_VFORK is -specified. Clearing the MMF_MULTIPROCESS flag (when the last process -sharing the mm exits) is left out of this patch to keep it simple and -because it is believed that this threading model is rare. Should there -ever be a need for optimizing that case as well, it can be done by hooking -into the exit path, likely following the mm_update_next_owner pattern. - -With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being -quite rare, the regression is gone after the change is applied. - -[surenb@google.com: v3] - Link: https://lkml.kernel.org/r/20200902012558.2335613-1-surenb@google.com - -Fixes: 44a70adec910 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj") -Reported-by: Tim Murray -Suggested-by: Michal Hocko -Signed-off-by: Suren Baghdasaryan -Signed-off-by: Andrew Morton -Acked-by: Christian Brauner -Acked-by: Michal Hocko -Acked-by: Oleg Nesterov -Cc: Ingo Molnar -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: Eugene Syromiatnikov -Cc: Christian Kellner -Cc: Adrian Reber -Cc: Shakeel Butt -Cc: Aleksa Sarai -Cc: Alexey Dobriyan -Cc: "Eric W. Biederman" -Cc: Alexey Gladkov -Cc: Michel Lespinasse -Cc: Daniel Jordan -Cc: Andrei Vagin -Cc: Bernd Edlinger -Cc: John Johansen -Cc: Yafang Shao -Link: https://lkml.kernel.org/r/20200824153036.3201505-1-surenb@google.com -Debugged-by: Minchan Kim -Signed-off-by: Linus Torvalds -Signed-off-by: Sasha Levin ---- - fs/proc/base.c | 3 +-- - include/linux/oom.h | 1 + - include/linux/sched/coredump.h | 1 + - kernel/fork.c | 21 +++++++++++++++++++++ - mm/oom_kill.c | 2 ++ - 5 files changed, 26 insertions(+), 2 deletions(-) - -diff --git a/fs/proc/base.c b/fs/proc/base.c -index 3b9b726b1a6ca..5e705fa9a913d 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -1035,7 +1035,6 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count, - - static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) - { -- static DEFINE_MUTEX(oom_adj_mutex); - struct mm_struct *mm = NULL; - struct task_struct *task; - int err = 0; -@@ -1075,7 +1074,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) - struct task_struct *p = find_lock_task_mm(task); - - if (p) { -- if (atomic_read(&p->mm->mm_users) > 1) { -+ if (test_bit(MMF_MULTIPROCESS, &p->mm->flags)) { - mm = p->mm; - mmgrab(mm); - } -diff --git a/include/linux/oom.h b/include/linux/oom.h -index 69864a547663e..3f649be179dad 100644 ---- a/include/linux/oom.h -+++ b/include/linux/oom.h -@@ -45,6 +45,7 @@ struct oom_control { - }; - - extern struct mutex oom_lock; -+extern struct mutex oom_adj_mutex; - - static inline void set_current_oom_origin(void) - { -diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h -index ecdc6542070f1..dfd82eab29025 100644 ---- a/include/linux/sched/coredump.h -+++ b/include/linux/sched/coredump.h -@@ -72,6 +72,7 @@ static inline int get_dumpable(struct mm_struct *mm) - #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */ - #define MMF_OOM_VICTIM 25 /* mm is the oom victim */ - #define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */ -+#define MMF_MULTIPROCESS 27 /* mm is shared between processes */ - #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP) - - #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\ -diff --git a/kernel/fork.c b/kernel/fork.c -index 1a2d18e98bf99..3ed29bf8eb291 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1647,6 +1647,25 @@ static __always_inline void delayed_free_task(struct task_struct *tsk) - free_task(tsk); - } - -+static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk) -+{ -+ /* Skip if kernel thread */ -+ if (!tsk->mm) -+ return; -+ -+ /* Skip if spawning a thread or using vfork */ -+ if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM) -+ return; -+ -+ /* We need to synchronize with __set_oom_adj */ -+ mutex_lock(&oom_adj_mutex); -+ set_bit(MMF_MULTIPROCESS, &tsk->mm->flags); -+ /* Update the values in case they were changed after copy_signal */ -+ tsk->signal->oom_score_adj = current->signal->oom_score_adj; -+ tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min; -+ mutex_unlock(&oom_adj_mutex); -+} -+ - /* - * This creates a new process as a copy of the old one, - * but does not actually start it yet. -@@ -2084,6 +2103,8 @@ static __latent_entropy struct task_struct *copy_process( - trace_task_newtask(p, clone_flags); - uprobe_copy_process(p, clone_flags); - -+ copy_oom_score_adj(clone_flags, p); -+ - return p; - - bad_fork_cancel_cgroup: -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index a581fe2a2f1fe..928b3b5e24e6b 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -62,6 +62,8 @@ int sysctl_oom_dump_tasks = 1; - * and mark_oom_victim - */ - DEFINE_MUTEX(oom_lock); -+/* Serializes oom_score_adj and oom_score_adj_min updates */ -+DEFINE_MUTEX(oom_adj_mutex); - - #ifdef CONFIG_NUMA - /** --- -2.25.1 - diff --git a/queue-4.19/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch b/queue-4.19/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch deleted file mode 100644 index 878fbcf158c..00000000000 --- a/queue-4.19/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch +++ /dev/null @@ -1,96 +0,0 @@ -From dfec1970976c023bf511363ee4ede17a7e6f36ff Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 5 May 2020 16:01:16 +0200 -Subject: mtd: lpddr: fix excessive stack usage with clang - -From: Arnd Bergmann - -[ Upstream commit 3e1b6469f8324bee5927b063e2aca30d3e56b907 ] - -Building lpddr2_nvm with clang can result in a giant stack usage -in one function: - -drivers/mtd/lpddr/lpddr2_nvm.c:399:12: error: stack frame size of 1144 bytes in function 'lpddr2_nvm_probe' [-Werror,-Wframe-larger-than=] - -The problem is that clang decides to build a copy of the mtd_info -structure on the stack and then do a memcpy() into the actual version. It -shouldn't really do it that way, but it's not strictly a bug either. - -As a workaround, use a static const version of the structure to assign -most of the members upfront and then only set the few members that -require runtime knowledge at probe time. - -Fixes: 96ba9dd65788 ("mtd: lpddr: add driver for LPDDR2-NVM PCM memories") -Signed-off-by: Arnd Bergmann -Reviewed-by: Nathan Chancellor -Acked-by: Miquel Raynal -Signed-off-by: Miquel Raynal -Link: https://lore.kernel.org/linux-mtd/20200505140136.263461-1-arnd@arndb.de -Signed-off-by: Sasha Levin ---- - drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++++++++++++++++++---------------- - 1 file changed, 19 insertions(+), 16 deletions(-) - -diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c -index c950c880ad590..90e6cb64db69c 100644 ---- a/drivers/mtd/lpddr/lpddr2_nvm.c -+++ b/drivers/mtd/lpddr/lpddr2_nvm.c -@@ -402,6 +402,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add, - return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK); - } - -+static const struct mtd_info lpddr2_nvm_mtd_info = { -+ .type = MTD_RAM, -+ .writesize = 1, -+ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), -+ ._read = lpddr2_nvm_read, -+ ._write = lpddr2_nvm_write, -+ ._erase = lpddr2_nvm_erase, -+ ._unlock = lpddr2_nvm_unlock, -+ ._lock = lpddr2_nvm_lock, -+}; -+ - /* - * lpddr2_nvm driver probe method - */ -@@ -442,6 +453,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) - .pfow_base = OW_BASE_ADDRESS, - .fldrv_priv = pcm_data, - }; -+ - if (IS_ERR(map->virt)) - return PTR_ERR(map->virt); - -@@ -453,22 +465,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) - return PTR_ERR(pcm_data->ctl_regs); - - /* Populate mtd_info data structure */ -- *mtd = (struct mtd_info) { -- .dev = { .parent = &pdev->dev }, -- .name = pdev->dev.init_name, -- .type = MTD_RAM, -- .priv = map, -- .size = resource_size(add_range), -- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width, -- .writesize = 1, -- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width, -- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), -- ._read = lpddr2_nvm_read, -- ._write = lpddr2_nvm_write, -- ._erase = lpddr2_nvm_erase, -- ._unlock = lpddr2_nvm_unlock, -- ._lock = lpddr2_nvm_lock, -- }; -+ *mtd = lpddr2_nvm_mtd_info; -+ mtd->dev.parent = &pdev->dev; -+ mtd->name = pdev->dev.init_name; -+ mtd->priv = map; -+ mtd->size = resource_size(add_range); -+ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width; -+ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width; - - /* Verify the presence of the device looking for PFOW string */ - if (!lpddr2_nvm_pfow_present(map)) { --- -2.25.1 - diff --git a/queue-4.19/mtd-mtdoops-don-t-write-panic-data-twice.patch b/queue-4.19/mtd-mtdoops-don-t-write-panic-data-twice.patch deleted file mode 100644 index 744e2dba7e7..00000000000 --- a/queue-4.19/mtd-mtdoops-don-t-write-panic-data-twice.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 1c40f26c6f9d5975e60449fbe0819cb8d8363c55 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 3 Sep 2020 15:42:17 +1200 -Subject: mtd: mtdoops: Don't write panic data twice - -From: Mark Tomlinson - -[ Upstream commit c1cf1d57d1492235309111ea6a900940213a9166 ] - -If calling mtdoops_write, don't also schedule work to be done later. - -Although this appears to not be causing an issue, possibly because the -scheduled work will never get done, it is confusing. - -Fixes: 016c1291ce70 ("mtd: mtdoops: do not use mtd->panic_write directly") -Signed-off-by: Mark Tomlinson -Signed-off-by: Miquel Raynal -Link: https://lore.kernel.org/linux-mtd/20200903034217.23079-1-mark.tomlinson@alliedtelesis.co.nz -Signed-off-by: Sasha Levin ---- - drivers/mtd/mtdoops.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - -diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c -index e078fc41aa612..feeffde2d4fa9 100644 ---- a/drivers/mtd/mtdoops.c -+++ b/drivers/mtd/mtdoops.c -@@ -293,12 +293,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper, - kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE, - record_size - MTDOOPS_HEADER_SIZE, NULL); - -- /* Panics must be written immediately */ -- if (reason != KMSG_DUMP_OOPS) -+ if (reason != KMSG_DUMP_OOPS) { -+ /* Panics must be written immediately */ - mtdoops_write(cxt, 1); -- -- /* For other cases, schedule work to write it "nicely" */ -- schedule_work(&cxt->work_write); -+ } else { -+ /* For other cases, schedule work to write it "nicely" */ -+ schedule_work(&cxt->work_write); -+ } - } - - static void mtdoops_notify_add(struct mtd_info *mtd) --- -2.25.1 - diff --git a/queue-4.19/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch b/queue-4.19/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch deleted file mode 100644 index dbbaf0a1998..00000000000 --- a/queue-4.19/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 932e1f6084f74ba044395a8e04d6ced24a49c0f4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 9 Aug 2020 11:29:06 +0200 -Subject: mwifiex: Do not use GFP_KERNEL in atomic context - -From: Christophe JAILLET - -[ Upstream commit d2ab7f00f4321370a8ee14e5630d4349fdacc42e ] - -A possible call chain is as follow: - mwifiex_sdio_interrupt (sdio.c) - --> mwifiex_main_process (main.c) - --> mwifiex_process_cmdresp (cmdevt.c) - --> mwifiex_process_sta_cmdresp (sta_cmdresp.c) - --> mwifiex_ret_802_11_scan (scan.c) - --> mwifiex_parse_single_response_buf (scan.c) - -'mwifiex_sdio_interrupt()' is an interrupt function. - -Also note that 'mwifiex_ret_802_11_scan()' already uses GFP_ATOMIC. - -So use GFP_ATOMIC instead of GFP_KERNEL when memory is allocated in -'mwifiex_parse_single_response_buf()'. - -Fixes: 7c6fa2a843c5 ("mwifiex: use cfg80211 dynamic scan table and cfg80211_get_bss API") -or -Fixes: 601216e12c65e ("mwifiex: process RX packets in SDIO IRQ thread directly") -Signed-off-by: Christophe JAILLET -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200809092906.744621-1-christophe.jaillet@wanadoo.fr -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c -index 85d6d5f3dce5b..c9f6cd2919699 100644 ---- a/drivers/net/wireless/marvell/mwifiex/scan.c -+++ b/drivers/net/wireless/marvell/mwifiex/scan.c -@@ -1895,7 +1895,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, - chan, CFG80211_BSS_FTYPE_UNKNOWN, - bssid, timestamp, - cap_info_bitmap, beacon_period, -- ie_buf, ie_len, rssi, GFP_KERNEL); -+ ie_buf, ie_len, rssi, GFP_ATOMIC); - if (bss) { - bss_priv = (struct mwifiex_bss_priv *)bss->priv; - bss_priv->band = band; --- -2.25.1 - diff --git a/queue-4.19/mwifiex-fix-double-free.patch b/queue-4.19/mwifiex-fix-double-free.patch deleted file mode 100644 index 07ef5d62e6e..00000000000 --- a/queue-4.19/mwifiex-fix-double-free.patch +++ /dev/null @@ -1,50 +0,0 @@ -From a82c761ef59e2d5199c23d91eef99fd6e2e2b147 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 4 Oct 2020 06:19:31 -0700 -Subject: mwifiex: fix double free - -From: Tom Rix - -[ Upstream commit 53708f4fd9cfe389beab5c8daa763bcd0e0b4aef ] - -clang static analysis reports this problem: - -sdio.c:2403:3: warning: Attempt to free released memory - kfree(card->mpa_rx.buf); - ^~~~~~~~~~~~~~~~~~~~~~~ - -When mwifiex_init_sdio() fails in its first call to -mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it -again. If the second alloc of mpa_tx.buf fails, the error -handler will try to free the old, previously freed mpa_rx.buf. -Reviewing the code, it looks like a second double free would -happen with mwifiex_cleanup_sdio(). - -So set both pointers to NULL when they are freed. - -Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") -Signed-off-by: Tom Rix -Reviewed-by: Brian Norris -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20201004131931.29782-1-trix@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/marvell/mwifiex/sdio.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c -index bfbe3aa058d93..0773d81072aa1 100644 ---- a/drivers/net/wireless/marvell/mwifiex/sdio.c -+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c -@@ -1985,6 +1985,8 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter, - kfree(card->mpa_rx.buf); - card->mpa_tx.buf_size = 0; - card->mpa_rx.buf_size = 0; -+ card->mpa_tx.buf = NULL; -+ card->mpa_rx.buf = NULL; - } - - return ret; --- -2.25.1 - diff --git a/queue-4.19/net-dsa-rtl8366-check-validity-of-passed-vlans.patch b/queue-4.19/net-dsa-rtl8366-check-validity-of-passed-vlans.patch deleted file mode 100644 index 35db7ac9575..00000000000 --- a/queue-4.19/net-dsa-rtl8366-check-validity-of-passed-vlans.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 6328f39c9fa10eb07593269e4a6aba5aa481c48b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 00:09:34 +0200 -Subject: net: dsa: rtl8366: Check validity of passed VLANs - -From: Linus Walleij - -[ Upstream commit 6641a2c42b0a307b7638d10e5d4b90debc61389d ] - -The rtl8366_set_vlan() and rtl8366_set_pvid() get invalid -VLANs tossed at it, especially VLAN0, something the hardware -and driver cannot handle. Check validity and bail out like -we do in the other callbacks. - -Reviewed-by: Florian Fainelli -Signed-off-by: Linus Walleij -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - drivers/net/dsa/rtl8366.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c -index 430988f797225..c854fea473f76 100644 ---- a/drivers/net/dsa/rtl8366.c -+++ b/drivers/net/dsa/rtl8366.c -@@ -43,6 +43,9 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - int ret; - int i; - -+ if (!smi->ops->is_vlan_valid(smi, vid)) -+ return -EINVAL; -+ - dev_dbg(smi->dev, - "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", - vid, member, untag); -@@ -118,6 +121,9 @@ int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, - int ret; - int i; - -+ if (!smi->ops->is_vlan_valid(smi, vid)) -+ return -EINVAL; -+ - /* Try to find an existing MC entry for this VID */ - for (i = 0; i < smi->num_vlan_mc; i++) { - ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); --- -2.25.1 - diff --git a/queue-4.19/net-dsa-rtl8366-refactor-vlan-pvid-init.patch b/queue-4.19/net-dsa-rtl8366-refactor-vlan-pvid-init.patch deleted file mode 100644 index f6cdb942f63..00000000000 --- a/queue-4.19/net-dsa-rtl8366-refactor-vlan-pvid-init.patch +++ /dev/null @@ -1,398 +0,0 @@ -From f7795ee1a717e903552caa50bb40924ac6348834 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 00:09:35 +0200 -Subject: net: dsa: rtl8366: Refactor VLAN/PVID init - -From: Linus Walleij - -[ Upstream commit 7e1301ed1881447d2a25f9c6423738c33cbca133 ] - -The VLANs and PVIDs on the RTL8366 utilizes a "member -configuration" (MC) which is largely unexplained in the -code. - -This set-up requires a special ordering: rtl8366_set_pvid() -must be called first, followed by rtl8366_set_vlan(), -else the MC will not be properly allocated. Relax this -by factoring out the code obtaining an MC and reuse -the helper in both rtl8366_set_pvid() and -rtl8366_set_vlan() so we remove this strict ordering -requirement. - -In the process, add some better comments and debug prints -so people who read the code understand what is going on. - -Reviewed-by: Florian Fainelli -Signed-off-by: Linus Walleij -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - drivers/net/dsa/realtek-smi.h | 4 +- - drivers/net/dsa/rtl8366.c | 273 ++++++++++++++++++---------------- - 2 files changed, 146 insertions(+), 131 deletions(-) - -diff --git a/drivers/net/dsa/realtek-smi.h b/drivers/net/dsa/realtek-smi.h -index 9a63b51e1d82f..6f2dab7e33d65 100644 ---- a/drivers/net/dsa/realtek-smi.h -+++ b/drivers/net/dsa/realtek-smi.h -@@ -25,6 +25,9 @@ struct rtl8366_mib_counter { - const char *name; - }; - -+/** -+ * struct rtl8366_vlan_mc - Virtual LAN member configuration -+ */ - struct rtl8366_vlan_mc { - u16 vid; - u16 untag; -@@ -119,7 +122,6 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi); - int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used); - int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - u32 untag, u32 fid); --int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val); - int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, - unsigned int vid); - int rtl8366_enable_vlan4k(struct realtek_smi *smi, bool enable); -diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c -index c854fea473f76..4e1a2427fc314 100644 ---- a/drivers/net/dsa/rtl8366.c -+++ b/drivers/net/dsa/rtl8366.c -@@ -36,12 +36,110 @@ int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used) - } - EXPORT_SYMBOL_GPL(rtl8366_mc_is_used); - -+/** -+ * rtl8366_obtain_mc() - retrieve or allocate a VLAN member configuration -+ * @smi: the Realtek SMI device instance -+ * @vid: the VLAN ID to look up or allocate -+ * @vlanmc: the pointer will be assigned to a pointer to a valid member config -+ * if successful -+ * @return: index of a new member config or negative error number -+ */ -+static int rtl8366_obtain_mc(struct realtek_smi *smi, int vid, -+ struct rtl8366_vlan_mc *vlanmc) -+{ -+ struct rtl8366_vlan_4k vlan4k; -+ int ret; -+ int i; -+ -+ /* Try to find an existing member config entry for this VID */ -+ for (i = 0; i < smi->num_vlan_mc; i++) { -+ ret = smi->ops->get_vlan_mc(smi, i, vlanmc); -+ if (ret) { -+ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n", -+ i, vid); -+ return ret; -+ } -+ -+ if (vid == vlanmc->vid) -+ return i; -+ } -+ -+ /* We have no MC entry for this VID, try to find an empty one */ -+ for (i = 0; i < smi->num_vlan_mc; i++) { -+ ret = smi->ops->get_vlan_mc(smi, i, vlanmc); -+ if (ret) { -+ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n", -+ i, vid); -+ return ret; -+ } -+ -+ if (vlanmc->vid == 0 && vlanmc->member == 0) { -+ /* Update the entry from the 4K table */ -+ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); -+ if (ret) { -+ dev_err(smi->dev, "error looking for 4K VLAN MC %d for VID %d\n", -+ i, vid); -+ return ret; -+ } -+ -+ vlanmc->vid = vid; -+ vlanmc->member = vlan4k.member; -+ vlanmc->untag = vlan4k.untag; -+ vlanmc->fid = vlan4k.fid; -+ ret = smi->ops->set_vlan_mc(smi, i, vlanmc); -+ if (ret) { -+ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n", -+ i, vid); -+ return ret; -+ } -+ -+ dev_dbg(smi->dev, "created new MC at index %d for VID %d\n", -+ i, vid); -+ return i; -+ } -+ } -+ -+ /* MC table is full, try to find an unused entry and replace it */ -+ for (i = 0; i < smi->num_vlan_mc; i++) { -+ int used; -+ -+ ret = rtl8366_mc_is_used(smi, i, &used); -+ if (ret) -+ return ret; -+ -+ if (!used) { -+ /* Update the entry from the 4K table */ -+ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); -+ if (ret) -+ return ret; -+ -+ vlanmc->vid = vid; -+ vlanmc->member = vlan4k.member; -+ vlanmc->untag = vlan4k.untag; -+ vlanmc->fid = vlan4k.fid; -+ ret = smi->ops->set_vlan_mc(smi, i, vlanmc); -+ if (ret) { -+ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n", -+ i, vid); -+ return ret; -+ } -+ dev_dbg(smi->dev, "recycled MC at index %i for VID %d\n", -+ i, vid); -+ return i; -+ } -+ } -+ -+ dev_err(smi->dev, "all VLAN member configurations are in use\n"); -+ return -ENOSPC; -+} -+ - int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - u32 untag, u32 fid) - { -+ struct rtl8366_vlan_mc vlanmc; - struct rtl8366_vlan_4k vlan4k; -+ int mc; - int ret; -- int i; - - if (!smi->ops->is_vlan_valid(smi, vid)) - return -EINVAL; -@@ -66,136 +164,58 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, - "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", - vid, vlan4k.member, vlan4k.untag); - -- /* Try to find an existing MC entry for this VID */ -- for (i = 0; i < smi->num_vlan_mc; i++) { -- struct rtl8366_vlan_mc vlanmc; -- -- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -- -- if (vid == vlanmc.vid) { -- /* update the MC entry */ -- vlanmc.member |= member; -- vlanmc.untag |= untag; -- vlanmc.fid = fid; -- -- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); -+ /* Find or allocate a member config for this VID */ -+ ret = rtl8366_obtain_mc(smi, vid, &vlanmc); -+ if (ret < 0) -+ return ret; -+ mc = ret; - -- dev_dbg(smi->dev, -- "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", -- vid, vlanmc.member, vlanmc.untag); -+ /* Update the MC entry */ -+ vlanmc.member |= member; -+ vlanmc.untag |= untag; -+ vlanmc.fid = fid; - -- break; -- } -- } -+ /* Commit updates to the MC entry */ -+ ret = smi->ops->set_vlan_mc(smi, mc, &vlanmc); -+ if (ret) -+ dev_err(smi->dev, "failed to commit changes to VLAN MC index %d for VID %d\n", -+ mc, vid); -+ else -+ dev_dbg(smi->dev, -+ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", -+ vid, vlanmc.member, vlanmc.untag); - - return ret; - } - EXPORT_SYMBOL_GPL(rtl8366_set_vlan); - --int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val) --{ -- struct rtl8366_vlan_mc vlanmc; -- int ret; -- int index; -- -- ret = smi->ops->get_mc_index(smi, port, &index); -- if (ret) -- return ret; -- -- ret = smi->ops->get_vlan_mc(smi, index, &vlanmc); -- if (ret) -- return ret; -- -- *val = vlanmc.vid; -- return 0; --} --EXPORT_SYMBOL_GPL(rtl8366_get_pvid); -- - int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, - unsigned int vid) - { - struct rtl8366_vlan_mc vlanmc; -- struct rtl8366_vlan_4k vlan4k; -+ int mc; - int ret; -- int i; - - if (!smi->ops->is_vlan_valid(smi, vid)) - return -EINVAL; - -- /* Try to find an existing MC entry for this VID */ -- for (i = 0; i < smi->num_vlan_mc; i++) { -- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -- -- if (vid == vlanmc.vid) { -- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -- -- ret = smi->ops->set_mc_index(smi, port, i); -- return ret; -- } -- } -- -- /* We have no MC entry for this VID, try to find an empty one */ -- for (i = 0; i < smi->num_vlan_mc; i++) { -- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -- -- if (vlanmc.vid == 0 && vlanmc.member == 0) { -- /* Update the entry from the 4K table */ -- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); -- if (ret) -- return ret; -- -- vlanmc.vid = vid; -- vlanmc.member = vlan4k.member; -- vlanmc.untag = vlan4k.untag; -- vlanmc.fid = vlan4k.fid; -- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -- -- ret = smi->ops->set_mc_index(smi, port, i); -- return ret; -- } -- } -- -- /* MC table is full, try to find an unused entry and replace it */ -- for (i = 0; i < smi->num_vlan_mc; i++) { -- int used; -- -- ret = rtl8366_mc_is_used(smi, i, &used); -- if (ret) -- return ret; -- -- if (!used) { -- /* Update the entry from the 4K table */ -- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); -- if (ret) -- return ret; -- -- vlanmc.vid = vid; -- vlanmc.member = vlan4k.member; -- vlanmc.untag = vlan4k.untag; -- vlanmc.fid = vlan4k.fid; -- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); -- if (ret) -- return ret; -+ /* Find or allocate a member config for this VID */ -+ ret = rtl8366_obtain_mc(smi, vid, &vlanmc); -+ if (ret < 0) -+ return ret; -+ mc = ret; - -- ret = smi->ops->set_mc_index(smi, port, i); -- return ret; -- } -+ ret = smi->ops->set_mc_index(smi, port, mc); -+ if (ret) { -+ dev_err(smi->dev, "set PVID: failed to set MC index %d for port %d\n", -+ mc, port); -+ return ret; - } - -- dev_err(smi->dev, -- "all VLAN member configurations are in use\n"); -+ dev_dbg(smi->dev, "set PVID: the PVID for port %d set to %d using existing MC index %d\n", -+ port, vid, mc); - -- return -ENOSPC; -+ return 0; - } - EXPORT_SYMBOL_GPL(rtl8366_set_pvid); - -@@ -395,7 +415,8 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, - if (!smi->ops->is_vlan_valid(smi, vid)) - return; - -- dev_info(smi->dev, "add VLAN on port %d, %s, %s\n", -+ dev_info(smi->dev, "add VLAN %d on port %d, %s, %s\n", -+ vlan->vid_begin, - port, - untagged ? "untagged" : "tagged", - pvid ? " PVID" : "no PVID"); -@@ -404,34 +425,26 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, - dev_err(smi->dev, "port is DSA or CPU port\n"); - - for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) { -- int pvid_val = 0; -- -- dev_info(smi->dev, "add VLAN %04x\n", vid); - member |= BIT(port); - - if (untagged) - untag |= BIT(port); - -- /* To ensure that we have a valid MC entry for this VLAN, -- * initialize the port VLAN ID here. -- */ -- ret = rtl8366_get_pvid(smi, port, &pvid_val); -- if (ret < 0) { -- dev_err(smi->dev, "could not lookup PVID for port %d\n", -- port); -- return; -- } -- if (pvid_val == 0) { -- ret = rtl8366_set_pvid(smi, port, vid); -- if (ret < 0) -- return; -- } -- - ret = rtl8366_set_vlan(smi, vid, member, untag, 0); - if (ret) - dev_err(smi->dev, - "failed to set up VLAN %04x", - vid); -+ -+ ret = rtl8366_set_pvid(smi, port, vid); -+ if (ret) -+ dev_err(smi->dev, -+ "failed to set PVID on port %d to VLAN %04x", -+ port, vid); -+ -+ if (!ret) -+ dev_dbg(smi->dev, "VLAN add: added VLAN %d with PVID on port %d\n", -+ vid, port); - } - } - EXPORT_SYMBOL_GPL(rtl8366_vlan_add); --- -2.25.1 - diff --git a/queue-4.19/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch b/queue-4.19/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch deleted file mode 100644 index 86a3e4fd3c2..00000000000 --- a/queue-4.19/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 6d6b0ed11a9c5ecf3d486e06295aff3a9891c10b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 19 Sep 2020 00:29:54 +0200 -Subject: net: dsa: rtl8366: Skip PVID setting if not requested - -From: Linus Walleij - -[ Upstream commit 3dfe8dde093a07e82fa472c0f8c29a7f6a2006a5 ] - -We go to lengths to determine whether the PVID should be set -for this port or not, and then fail to take it into account. -Fix this oversight. - -Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") -Signed-off-by: Linus Walleij -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - drivers/net/dsa/rtl8366.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c -index 4e1a2427fc314..dddbc86429bd9 100644 ---- a/drivers/net/dsa/rtl8366.c -+++ b/drivers/net/dsa/rtl8366.c -@@ -436,6 +436,9 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, - "failed to set up VLAN %04x", - vid); - -+ if (!pvid) -+ continue; -+ - ret = rtl8366_set_pvid(smi, port, vid); - if (ret) - dev_err(smi->dev, --- -2.25.1 - diff --git a/queue-4.19/net-dsa-rtl8366rb-support-all-4096-vlans.patch b/queue-4.19/net-dsa-rtl8366rb-support-all-4096-vlans.patch deleted file mode 100644 index 468b6e56813..00000000000 --- a/queue-4.19/net-dsa-rtl8366rb-support-all-4096-vlans.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 8f3a7bb21bf5fff990dd7ba2beaa6732141364ea Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 20 Sep 2020 22:37:33 +0200 -Subject: net: dsa: rtl8366rb: Support all 4096 VLANs - -From: Linus Walleij - -[ Upstream commit a7920efdd86d8a0d74402dbc80ead03b023294ba ] - -There is an off-by-one error in rtl8366rb_is_vlan_valid() -making VLANs 0..4094 valid while it should be 1..4095. -Fix it. - -Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") -Signed-off-by: Linus Walleij -Reviewed-by: Florian Fainelli -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - drivers/net/dsa/rtl8366rb.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c -index f4b14b6acd22d..5aefd7a4696a5 100644 ---- a/drivers/net/dsa/rtl8366rb.c -+++ b/drivers/net/dsa/rtl8366rb.c -@@ -1270,7 +1270,7 @@ static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan) - if (smi->vlan4k_enabled) - max = RTL8366RB_NUM_VIDS - 1; - -- if (vlan == 0 || vlan >= max) -+ if (vlan == 0 || vlan > max) - return false; - - return true; --- -2.25.1 - diff --git a/queue-4.19/net-enic-cure-the-enic-api-locking-trainwreck.patch b/queue-4.19/net-enic-cure-the-enic-api-locking-trainwreck.patch deleted file mode 100644 index 7b4191da34c..00000000000 --- a/queue-4.19/net-enic-cure-the-enic-api-locking-trainwreck.patch +++ /dev/null @@ -1,157 +0,0 @@ -From b8b7235581b6a60527ac20a59d6be3479e877c25 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 29 Sep 2020 22:25:10 +0200 -Subject: net: enic: Cure the enic api locking trainwreck - -From: Thomas Gleixner - -[ Upstream commit a53b59ece86c86d16d12ccdaa1ad0c78250a9d96 ] - -enic_dev_wait() has a BUG_ON(in_interrupt()). - -Chasing the callers of enic_dev_wait() revealed the gems of enic_reset() -and enic_tx_hang_reset() which are both invoked through work queues in -order to be able to call rtnl_lock(). So far so good. - -After locking rtnl both functions acquire enic::enic_api_lock which -serializes against the (ab)use from infiniband. This is where the -trainwreck starts. - -enic::enic_api_lock is a spin_lock() which implicitly disables preemption, -but both functions invoke a ton of functions under that lock which can -sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it -can't detect the preempt disabled condition. - -This clearly has never been tested with any of the mandatory debug options -for 7+ years, which would have caught that for sure. - -Cure it by adding a enic_api_busy member to struct enic, which is modified -and evaluated with enic::enic_api_lock held. - -If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true, -it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to -become false. - -It would be smarter to wait for a completion of that busy period, but -enic_api_devcmd_proxy_by_index() is called with other spin locks held which -obviously can't sleep. - -Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and -with proper debugging enabled the problem would have been caught from the -debug checks in schedule_timeout(). - -Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware") -Signed-off-by: Thomas Gleixner -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - drivers/net/ethernet/cisco/enic/enic.h | 1 + - drivers/net/ethernet/cisco/enic/enic_api.c | 6 +++++ - drivers/net/ethernet/cisco/enic/enic_main.c | 27 ++++++++++++++++----- - 3 files changed, 28 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h -index 0dd64acd2a3fb..08cac1bfacafb 100644 ---- a/drivers/net/ethernet/cisco/enic/enic.h -+++ b/drivers/net/ethernet/cisco/enic/enic.h -@@ -171,6 +171,7 @@ struct enic { - u16 num_vfs; - #endif - spinlock_t enic_api_lock; -+ bool enic_api_busy; - struct enic_port_profile *pp; - - /* work queue cache line section */ -diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c -index b161f24522b87..b028ea2dec2b9 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_api.c -+++ b/drivers/net/ethernet/cisco/enic/enic_api.c -@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, - struct vnic_dev *vdev = enic->vdev; - - spin_lock(&enic->enic_api_lock); -+ while (enic->enic_api_busy) { -+ spin_unlock(&enic->enic_api_lock); -+ cpu_relax(); -+ spin_lock(&enic->enic_api_lock); -+ } -+ - spin_lock_bh(&enic->devcmd_lock); - - vnic_dev_cmd_proxy_by_index_start(vdev, vf); -diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c -index 026a3bd71204f..810cbe2210463 100644 ---- a/drivers/net/ethernet/cisco/enic/enic_main.c -+++ b/drivers/net/ethernet/cisco/enic/enic_main.c -@@ -2142,8 +2142,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, - int done; - int err; - -- BUG_ON(in_interrupt()); -- - err = start(vdev, arg); - if (err) - return err; -@@ -2331,6 +2329,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) - rss_hash_bits, rss_base_cpu, rss_enable); - } - -+static void enic_set_api_busy(struct enic *enic, bool busy) -+{ -+ spin_lock(&enic->enic_api_lock); -+ enic->enic_api_busy = busy; -+ spin_unlock(&enic->enic_api_lock); -+} -+ - static void enic_reset(struct work_struct *work) - { - struct enic *enic = container_of(work, struct enic, reset); -@@ -2340,7 +2345,9 @@ static void enic_reset(struct work_struct *work) - - rtnl_lock(); - -- spin_lock(&enic->enic_api_lock); -+ /* Stop any activity from infiniband */ -+ enic_set_api_busy(enic, true); -+ - enic_stop(enic->netdev); - enic_dev_soft_reset(enic); - enic_reset_addr_lists(enic); -@@ -2348,7 +2355,10 @@ static void enic_reset(struct work_struct *work) - enic_set_rss_nic_cfg(enic); - enic_dev_set_ig_vlan_rewrite_mode(enic); - enic_open(enic->netdev); -- spin_unlock(&enic->enic_api_lock); -+ -+ /* Allow infiniband to fiddle with the device again */ -+ enic_set_api_busy(enic, false); -+ - call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); - - rtnl_unlock(); -@@ -2360,7 +2370,9 @@ static void enic_tx_hang_reset(struct work_struct *work) - - rtnl_lock(); - -- spin_lock(&enic->enic_api_lock); -+ /* Stop any activity from infiniband */ -+ enic_set_api_busy(enic, true); -+ - enic_dev_hang_notify(enic); - enic_stop(enic->netdev); - enic_dev_hang_reset(enic); -@@ -2369,7 +2381,10 @@ static void enic_tx_hang_reset(struct work_struct *work) - enic_set_rss_nic_cfg(enic); - enic_dev_set_ig_vlan_rewrite_mode(enic); - enic_open(enic->netdev); -- spin_unlock(&enic->enic_api_lock); -+ -+ /* Allow infiniband to fiddle with the device again */ -+ enic_set_api_busy(enic, false); -+ - call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); - - rtnl_unlock(); --- -2.25.1 - diff --git a/queue-4.19/net-fec-fix-phy-init-after-phy_reset_after_clk_enable.patch b/queue-4.19/net-fec-fix-phy-init-after-phy_reset_after_clk_enable.patch deleted file mode 100644 index 38b71d2c232..00000000000 --- a/queue-4.19/net-fec-fix-phy-init-after-phy_reset_after_clk_enable.patch +++ /dev/null @@ -1,55 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Marek Vasut -Date: Tue, 6 Oct 2020 15:52:53 +0200 -Subject: net: fec: Fix PHY init after phy_reset_after_clk_enable() - -From: Marek Vasut - -[ Upstream commit 0da1ccbbefb662915228bc17e1c7d4ad28b3ddab ] - -The phy_reset_after_clk_enable() does a PHY reset, which means the PHY -loses its register settings. The fec_enet_mii_probe() starts the PHY -and does the necessary calls to configure the PHY via PHY framework, -and loads the correct register settings into the PHY. Therefore, -fec_enet_mii_probe() should be called only after the PHY has been -reset, not before as it is now. - -Fixes: 1b0a83ac04e3 ("net: fec: add phy_reset_after_clk_enable() support") -Reviewed-by: Andrew Lunn -Tested-by: Richard Leitner -Signed-off-by: Marek Vasut -Cc: Christoph Niedermaier -Cc: David S. Miller -Cc: NXP Linux Team -Cc: Shawn Guo -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/freescale/fec_main.c | 10 +++++----- - 1 file changed, 5 insertions(+), 5 deletions(-) - ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -2950,17 +2950,17 @@ fec_enet_open(struct net_device *ndev) - /* Init MAC prior to mii bus probe */ - fec_restart(ndev); - -- /* Probe and connect to PHY when open the interface */ -- ret = fec_enet_mii_probe(ndev); -- if (ret) -- goto err_enet_mii_probe; -- - /* Call phy_reset_after_clk_enable() again if it failed during - * phy_reset_after_clk_enable() before because the PHY wasn't probed. - */ - if (reset_again) - fec_enet_phy_reset_after_clk_enable(ndev); - -+ /* Probe and connect to PHY when open the interface */ -+ ret = fec_enet_mii_probe(ndev); -+ if (ret) -+ goto err_enet_mii_probe; -+ - if (fep->quirks & FEC_QUIRK_ERR006687) - imx6q_cpuidle_fec_irqs_used(); - diff --git a/queue-4.19/net-fec-fix-phy_device-lookup-for-phy_reset_after_clk_enable.patch b/queue-4.19/net-fec-fix-phy_device-lookup-for-phy_reset_after_clk_enable.patch deleted file mode 100644 index cb2b9f79be1..00000000000 --- a/queue-4.19/net-fec-fix-phy_device-lookup-for-phy_reset_after_clk_enable.patch +++ /dev/null @@ -1,83 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Marek Vasut -Date: Sat, 10 Oct 2020 11:10:00 +0200 -Subject: net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() - -From: Marek Vasut - -[ Upstream commit 64a632da538a6827fad0ea461925cedb9899ebe2 ] - -The phy_reset_after_clk_enable() is always called with ndev->phydev, -however that pointer may be NULL even though the PHY device instance -already exists and is sufficient to perform the PHY reset. - -This condition happens in fec_open(), where the clock must be enabled -first, then the PHY must be reset, and then the PHY IDs can be read -out of the PHY. - -If the PHY still is not bound to the MAC, but there is OF PHY node -and a matching PHY device instance already, use the OF PHY node to -obtain the PHY device instance, and then use that PHY device instance -when triggering the PHY reset. - -Fixes: 1b0a83ac04e3 ("net: fec: add phy_reset_after_clk_enable() support") -Signed-off-by: Marek Vasut -Cc: Christoph Niedermaier -Cc: David S. Miller -Cc: NXP Linux Team -Cc: Richard Leitner -Cc: Shawn Guo -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/freescale/fec_main.c | 25 +++++++++++++++++++++++-- - 1 file changed, 23 insertions(+), 2 deletions(-) - ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -1897,6 +1897,27 @@ static int fec_enet_mdio_write(struct mi - return ret; - } - -+static void fec_enet_phy_reset_after_clk_enable(struct net_device *ndev) -+{ -+ struct fec_enet_private *fep = netdev_priv(ndev); -+ struct phy_device *phy_dev = ndev->phydev; -+ -+ if (phy_dev) { -+ phy_reset_after_clk_enable(phy_dev); -+ } else if (fep->phy_node) { -+ /* -+ * If the PHY still is not bound to the MAC, but there is -+ * OF PHY node and a matching PHY device instance already, -+ * use the OF PHY node to obtain the PHY device instance, -+ * and then use that PHY device instance when triggering -+ * the PHY reset. -+ */ -+ phy_dev = of_phy_find_device(fep->phy_node); -+ phy_reset_after_clk_enable(phy_dev); -+ put_device(&phy_dev->mdio.dev); -+ } -+} -+ - static int fec_enet_clk_enable(struct net_device *ndev, bool enable) - { - struct fec_enet_private *fep = netdev_priv(ndev); -@@ -1923,7 +1944,7 @@ static int fec_enet_clk_enable(struct ne - if (ret) - goto failed_clk_ref; - -- phy_reset_after_clk_enable(ndev->phydev); -+ fec_enet_phy_reset_after_clk_enable(ndev); - } else { - clk_disable_unprepare(fep->clk_enet_out); - if (fep->clk_ptp) { -@@ -2938,7 +2959,7 @@ fec_enet_open(struct net_device *ndev) - * phy_reset_after_clk_enable() before because the PHY wasn't probed. - */ - if (reset_again) -- phy_reset_after_clk_enable(ndev->phydev); -+ fec_enet_phy_reset_after_clk_enable(ndev); - - if (fep->quirks & FEC_QUIRK_ERR006687) - imx6q_cpuidle_fec_irqs_used(); diff --git a/queue-4.19/net-fix-pos-incrementment-in-ipv6_route_seq_next.patch b/queue-4.19/net-fix-pos-incrementment-in-ipv6_route_seq_next.patch deleted file mode 100644 index 4723272e5b5..00000000000 --- a/queue-4.19/net-fix-pos-incrementment-in-ipv6_route_seq_next.patch +++ /dev/null @@ -1,90 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Yonghong Song -Date: Wed, 14 Oct 2020 07:46:12 -0700 -Subject: net: fix pos incrementment in ipv6_route_seq_next - -From: Yonghong Song - -[ Upstream commit 6617dfd440149e42ce4d2be615eb31a4755f4d30 ] - -Commit 4fc427e05158 ("ipv6_route_seq_next should increase position index") -tried to fix the issue where seq_file pos is not increased -if a NULL element is returned with seq_ops->next(). See bug - https://bugzilla.kernel.org/show_bug.cgi?id=206283 -The commit effectively does: - - increase pos for all seq_ops->start() - - increase pos for all seq_ops->next() - -For ipv6_route, increasing pos for all seq_ops->next() is correct. -But increasing pos for seq_ops->start() is not correct -since pos is used to determine how many items to skip during -seq_ops->start(): - iter->skip = *pos; -seq_ops->start() just fetches the *current* pos item. -The item can be skipped only after seq_ops->show() which essentially -is the beginning of seq_ops->next(). - -For example, I have 7 ipv6 route entries, - root@arch-fb-vm1:~/net-next dd if=/proc/net/ipv6_route bs=4096 - 00000000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000001 00000000 00000001 eth0 - fe800000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000001 00000000 00000001 eth0 - 00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200 lo - 00000000000000000000000000000001 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000003 00000000 80200001 lo - fe800000000000002050e3fffebd3be8 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000002 00000000 80200001 eth0 - ff000000000000000000000000000000 08 00000000000000000000000000000000 00 00000000000000000000000000000000 00000100 00000004 00000000 00000001 eth0 - 00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200 lo - 0+1 records in - 0+1 records out - 1050 bytes (1.0 kB, 1.0 KiB) copied, 0.00707908 s, 148 kB/s - root@arch-fb-vm1:~/net-next - -In the above, I specify buffer size 4096, so all records can be returned -to user space with a single trip to the kernel. - -If I use buffer size 128, since each record size is 149, internally -kernel seq_read() will read 149 into its internal buffer and return the data -to user space in two read() syscalls. Then user read() syscall will trigger -next seq_ops->start(). Since the current implementation increased pos even -for seq_ops->start(), it will skip record #2, #4 and #6, assuming the first -record is #1. - - root@arch-fb-vm1:~/net-next dd if=/proc/net/ipv6_route bs=128 - 00000000000000000000000000000000 40 00000000000000000000000000000000 00 00000000000000000000000000000000 00000400 00000001 00000000 00000001 eth0 - 00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200 lo - fe800000000000002050e3fffebd3be8 80 00000000000000000000000000000000 00 00000000000000000000000000000000 00000000 00000002 00000000 80200001 eth0 - 00000000000000000000000000000000 00 00000000000000000000000000000000 00 00000000000000000000000000000000 ffffffff 00000001 00000000 00200200 lo -4+1 records in -4+1 records out -600 bytes copied, 0.00127758 s, 470 kB/s - -To fix the problem, create a fake pos pointer so seq_ops->start() -won't actually increase seq_file pos. With this fix, the -above `dd` command with `bs=128` will show correct result. - -Fixes: 4fc427e05158 ("ipv6_route_seq_next should increase position index") -Cc: Alexei Starovoitov -Suggested-by: Vasily Averin -Reviewed-by: Vasily Averin -Signed-off-by: Yonghong Song -Acked-by: Martin KaFai Lau -Acked-by: Andrii Nakryiko -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv6/ip6_fib.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -2417,8 +2417,10 @@ static void *ipv6_route_seq_start(struct - iter->skip = *pos; - - if (iter->tbl) { -+ loff_t p = 0; -+ - ipv6_route_seq_setup_walk(iter, net); -- return ipv6_route_seq_next(seq, NULL, pos); -+ return ipv6_route_seq_next(seq, NULL, &p); - } else { - return NULL; - } diff --git a/queue-4.19/net-hdlc-in-hdlc_rcv-check-to-make-sure-dev-is-an-hdlc-device.patch b/queue-4.19/net-hdlc-in-hdlc_rcv-check-to-make-sure-dev-is-an-hdlc-device.patch deleted file mode 100644 index af3d51c17de..00000000000 --- a/queue-4.19/net-hdlc-in-hdlc_rcv-check-to-make-sure-dev-is-an-hdlc-device.patch +++ /dev/null @@ -1,56 +0,0 @@ -From foo@baz Sat Oct 24 11:10:05 AM CEST 2020 -From: Xie He -Date: Mon, 19 Oct 2020 18:31:52 -0700 -Subject: net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device - -From: Xie He - -[ Upstream commit 01c4ceae0a38a0bdbfea6896f41efcd985a9c064 ] - -The hdlc_rcv function is used as hdlc_packet_type.func to process any -skb received in the kernel with skb->protocol == htons(ETH_P_HDLC). -The purpose of this function is to provide second-stage processing for -skbs not assigned a "real" L3 skb->protocol value in the first stage. - -This function assumes the device from which the skb is received is an -HDLC device (a device created by this module). It assumes that -netdev_priv(dev) returns a pointer to "struct hdlc_device". - -However, it is possible that some driver in the kernel (not necessarily -in our control) submits a received skb with skb->protocol == -htons(ETH_P_HDLC), from a non-HDLC device. In this case, the skb would -still be received by hdlc_rcv. This will cause problems. - -hdlc_rcv should be able to recognize and drop invalid skbs. It should -first make sure "dev" is actually an HDLC device, before starting its -processing. This patch adds this check to hdlc_rcv. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Cc: Krzysztof Halasa -Signed-off-by: Xie He -Link: https://lore.kernel.org/r/20201020013152.89259-1-xie.he.0141@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/wan/hdlc.c | 10 +++++++++- - 1 file changed, 9 insertions(+), 1 deletion(-) - ---- a/drivers/net/wan/hdlc.c -+++ b/drivers/net/wan/hdlc.c -@@ -49,7 +49,15 @@ static struct hdlc_proto *first_proto; - static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev, - struct packet_type *p, struct net_device *orig_dev) - { -- struct hdlc_device *hdlc = dev_to_hdlc(dev); -+ struct hdlc_device *hdlc; -+ -+ /* First make sure "dev" is an HDLC device */ -+ if (!(dev->priv_flags & IFF_WAN_HDLC)) { -+ kfree_skb(skb); -+ return NET_RX_SUCCESS; -+ } -+ -+ hdlc = dev_to_hdlc(dev); - - if (!net_eq(dev_net(dev), &init_net)) { - kfree_skb(skb); diff --git a/queue-4.19/net-hdlc_raw_eth-clear-the-iff_tx_skb_sharing-flag-after-calling-ether_setup.patch b/queue-4.19/net-hdlc_raw_eth-clear-the-iff_tx_skb_sharing-flag-after-calling-ether_setup.patch deleted file mode 100644 index baa047145c7..00000000000 --- a/queue-4.19/net-hdlc_raw_eth-clear-the-iff_tx_skb_sharing-flag-after-calling-ether_setup.patch +++ /dev/null @@ -1,38 +0,0 @@ -From foo@baz Sat Oct 24 11:10:06 AM CEST 2020 -From: Xie He -Date: Mon, 19 Oct 2020 23:34:20 -0700 -Subject: net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup - -From: Xie He - -[ Upstream commit 5fce1e43e2d5bf2f7e3224d7b99b1c65ab2c26e2 ] - -This driver calls ether_setup to set up the network device. -The ether_setup function would add the IFF_TX_SKB_SHARING flag to the -device. This flag indicates that it is safe to transmit shared skbs to -the device. - -However, this is not true. This driver may pad the frame (in eth_tx) -before transmission, so the skb may be modified. - -Fixes: 550fd08c2ceb ("net: Audit drivers to identify those needing IFF_TX_SKB_SHARING cleared") -Cc: Neil Horman -Cc: Krzysztof Halasa -Signed-off-by: Xie He -Link: https://lore.kernel.org/r/20201020063420.187497-1-xie.he.0141@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/wan/hdlc_raw_eth.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/wan/hdlc_raw_eth.c -+++ b/drivers/net/wan/hdlc_raw_eth.c -@@ -102,6 +102,7 @@ static int raw_eth_ioctl(struct net_devi - old_qlen = dev->tx_queue_len; - ether_setup(dev); - dev->tx_queue_len = old_qlen; -+ dev->priv_flags &= ~IFF_TX_SKB_SHARING; - eth_hw_addr_random(dev); - call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev); - netif_dormant_off(dev); diff --git a/queue-4.19/net-ipv4-always-honour-route-mtu-during-forwarding.patch b/queue-4.19/net-ipv4-always-honour-route-mtu-during-forwarding.patch deleted file mode 100644 index b18d4fbde87..00000000000 --- a/queue-4.19/net-ipv4-always-honour-route-mtu-during-forwarding.patch +++ /dev/null @@ -1,80 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: "Maciej Å»enczykowski" -Date: Wed, 23 Sep 2020 13:18:15 -0700 -Subject: net/ipv4: always honour route mtu during forwarding - -From: "Maciej Å»enczykowski" - -[ Upstream commit 02a1b175b0e92d9e0fa5df3957ade8d733ceb6a0 ] - -Documentation/networking/ip-sysctl.txt:46 says: - ip_forward_use_pmtu - BOOLEAN - By default we don't trust protocol path MTUs while forwarding - because they could be easily forged and can lead to unwanted - fragmentation by the router. - You only need to enable this if you have user-space software - which tries to discover path mtus by itself and depends on the - kernel honoring this information. This is normally not the case. - Default: 0 (disabled) - Possible values: - 0 - disabled - 1 - enabled - -Which makes it pretty clear that setting it to 1 is a potential -security/safety/DoS issue, and yet it is entirely reasonable to want -forwarded traffic to honour explicitly administrator configured -route mtus (instead of defaulting to device mtu). - -Indeed, I can't think of a single reason why you wouldn't want to. -Since you configured a route mtu you probably know better... - -It is pretty common to have a higher device mtu to allow receiving -large (jumbo) frames, while having some routes via that interface -(potentially including the default route to the internet) specify -a lower mtu. - -Note that ipv6 forwarding uses device mtu unless the route is locked -(in which case it will use the route mtu). - -This approach is not usable for IPv4 where an 'mtu lock' on a route -also has the side effect of disabling TCP path mtu discovery via -disabling the IPv4 DF (don't frag) bit on all outgoing frames. - -I'm not aware of a way to lock a route from an IPv6 RA, so that also -potentially seems wrong. - -Signed-off-by: Maciej Å»enczykowski -Cc: Eric Dumazet -Cc: Willem de Bruijn -Cc: Lorenzo Colitti -Cc: Sunmeet Gill (Sunny) -Cc: Vinay Paradkar -Cc: Tyler Wear -Cc: David Ahern -Reviewed-by: Eric Dumazet -Signed-off-by: Greg Kroah-Hartman ---- - include/net/ip.h | 6 ++++++ - 1 file changed, 6 insertions(+) - ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -399,12 +399,18 @@ static inline unsigned int ip_dst_mtu_ma - bool forwarding) - { - struct net *net = dev_net(dst->dev); -+ unsigned int mtu; - - if (net->ipv4.sysctl_ip_fwd_use_pmtu || - ip_mtu_locked(dst) || - !forwarding) - return dst_mtu(dst); - -+ /* 'forwarding = true' case should always honour route mtu */ -+ mtu = dst_metric_raw(dst, RTAX_MTU); -+ if (mtu) -+ return mtu; -+ - return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); - } - diff --git a/queue-4.19/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch b/queue-4.19/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch deleted file mode 100644 index 287d0515974..00000000000 --- a/queue-4.19/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 0f667890392280fa2ef19dd4ba4cf431a56c52bb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 12 Oct 2020 00:03:29 +0200 -Subject: net: korina: fix kfree of rx/tx descriptor array - -From: Valentin Vidic - -[ Upstream commit 3af5f0f5c74ecbaf757ef06c3f80d56751277637 ] - -kmalloc returns KSEG0 addresses so convert back from KSEG1 -in kfree. Also make sure array is freed when the driver is -unloaded from the kernel. - -Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC") -Signed-off-by: Valentin Vidic -Acked-by: Willem de Bruijn -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin ---- - drivers/net/ethernet/korina.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c -index ae195f8adff58..5bdff77c0ad10 100644 ---- a/drivers/net/ethernet/korina.c -+++ b/drivers/net/ethernet/korina.c -@@ -1113,7 +1113,7 @@ static int korina_probe(struct platform_device *pdev) - return rc; - - probe_err_register: -- kfree(lp->td_ring); -+ kfree(KSEG0ADDR(lp->td_ring)); - probe_err_td_ring: - iounmap(lp->tx_dma_regs); - probe_err_dma_tx: -@@ -1133,6 +1133,7 @@ static int korina_remove(struct platform_device *pdev) - iounmap(lp->eth_regs); - iounmap(lp->rx_dma_regs); - iounmap(lp->tx_dma_regs); -+ kfree(KSEG0ADDR(lp->td_ring)); - - unregister_netdev(bif->dev); - free_netdev(bif->dev); --- -2.25.1 - diff --git a/queue-4.19/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch b/queue-4.19/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch deleted file mode 100644 index 41995cc1f23..00000000000 --- a/queue-4.19/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch +++ /dev/null @@ -1,38 +0,0 @@ -From ffb8b02942c8fc1a38b8eb50cf7c9b650eb93f26 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 16 Jun 2020 12:07:10 +0300 -Subject: net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow - -From: Eran Ben Elisha - -[ Upstream commit 0d2ffdc8d4002a62de31ff7aa3bef28c843c3cbe ] - -Before calling timecounter_cyc2time(), clock->lock must be taken. -Use mlx5_timecounter_cyc2time instead which guarantees a safe access. - -Fixes: afc98a0b46d8 ("net/mlx5: Update ptp_clock_event foreach PPS event") -Signed-off-by: Eran Ben Elisha -Signed-off-by: Sasha Levin ---- - drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index d359e850dbf07..0fd62510fb277 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -475,8 +475,9 @@ void mlx5_pps_event(struct mlx5_core_dev *mdev, - switch (clock->ptp_info.pin_config[pin].func) { - case PTP_PF_EXTTS: - ptp_event.index = pin; -- ptp_event.timestamp = timecounter_cyc2time(&clock->tc, -- be64_to_cpu(eqe->data.pps.time_stamp)); -+ ptp_event.timestamp = -+ mlx5_timecounter_cyc2time(clock, -+ be64_to_cpu(eqe->data.pps.time_stamp)); - if (clock->pps_info.enabled) { - ptp_event.type = PTP_CLOCK_PPSUSR; - ptp_event.pps_times.ts_real = --- -2.25.1 - diff --git a/queue-4.19/net-sched-act_tunnel_key-fix-oob-write-in-case-of-ipv6-erspan-tunnels.patch b/queue-4.19/net-sched-act_tunnel_key-fix-oob-write-in-case-of-ipv6-erspan-tunnels.patch deleted file mode 100644 index 8b086bb74f2..00000000000 --- a/queue-4.19/net-sched-act_tunnel_key-fix-oob-write-in-case-of-ipv6-erspan-tunnels.patch +++ /dev/null @@ -1,121 +0,0 @@ -From foo@baz Sat Oct 24 11:10:06 AM CEST 2020 -From: Davide Caratti -Date: Wed, 21 Oct 2020 00:02:40 +0200 -Subject: net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels - -From: Davide Caratti - -[ Upstream commit a7a12b5a0f950bc6b9f7153390634ea798738db9 ] - -the following command - - # tc action add action tunnel_key \ - > set src_ip 2001:db8::1 dst_ip 2001:db8::2 id 10 erspan_opts 1:6789:0:0 - -generates the following splat: - - BUG: KASAN: slab-out-of-bounds in tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key] - Write of size 4 at addr ffff88813f5f1cc8 by task tc/873 - - CPU: 2 PID: 873 Comm: tc Not tainted 5.9.0+ #282 - Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 - Call Trace: - dump_stack+0x99/0xcb - print_address_description.constprop.7+0x1e/0x230 - kasan_report.cold.13+0x37/0x7c - tunnel_key_copy_opts+0xcc9/0x1010 [act_tunnel_key] - tunnel_key_init+0x160c/0x1f40 [act_tunnel_key] - tcf_action_init_1+0x5b5/0x850 - tcf_action_init+0x15d/0x370 - tcf_action_add+0xd9/0x2f0 - tc_ctl_action+0x29b/0x3a0 - rtnetlink_rcv_msg+0x341/0x8d0 - netlink_rcv_skb+0x120/0x380 - netlink_unicast+0x439/0x630 - netlink_sendmsg+0x719/0xbf0 - sock_sendmsg+0xe2/0x110 - ____sys_sendmsg+0x5ba/0x890 - ___sys_sendmsg+0xe9/0x160 - __sys_sendmsg+0xd3/0x170 - do_syscall_64+0x33/0x40 - entry_SYSCALL_64_after_hwframe+0x44/0xa9 - RIP: 0033:0x7f872a96b338 - Code: 89 02 48 c7 c0 ff ff ff ff eb b5 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 8d 05 25 43 2c 00 8b 00 85 c0 75 17 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 41 54 41 89 d4 55 - RSP: 002b:00007ffffe367518 EFLAGS: 00000246 ORIG_RAX: 000000000000002e - RAX: ffffffffffffffda RBX: 000000005f8f5aed RCX: 00007f872a96b338 - RDX: 0000000000000000 RSI: 00007ffffe367580 RDI: 0000000000000003 - RBP: 0000000000000000 R08: 0000000000000001 R09: 000000000000001c - R10: 000000000000000b R11: 0000000000000246 R12: 0000000000000001 - R13: 0000000000686760 R14: 0000000000000601 R15: 0000000000000000 - - Allocated by task 873: - kasan_save_stack+0x19/0x40 - __kasan_kmalloc.constprop.7+0xc1/0xd0 - __kmalloc+0x151/0x310 - metadata_dst_alloc+0x20/0x40 - tunnel_key_init+0xfff/0x1f40 [act_tunnel_key] - tcf_action_init_1+0x5b5/0x850 - tcf_action_init+0x15d/0x370 - tcf_action_add+0xd9/0x2f0 - tc_ctl_action+0x29b/0x3a0 - rtnetlink_rcv_msg+0x341/0x8d0 - netlink_rcv_skb+0x120/0x380 - netlink_unicast+0x439/0x630 - netlink_sendmsg+0x719/0xbf0 - sock_sendmsg+0xe2/0x110 - ____sys_sendmsg+0x5ba/0x890 - ___sys_sendmsg+0xe9/0x160 - __sys_sendmsg+0xd3/0x170 - do_syscall_64+0x33/0x40 - entry_SYSCALL_64_after_hwframe+0x44/0xa9 - - The buggy address belongs to the object at ffff88813f5f1c00 - which belongs to the cache kmalloc-256 of size 256 - The buggy address is located 200 bytes inside of - 256-byte region [ffff88813f5f1c00, ffff88813f5f1d00) - The buggy address belongs to the page: - page:0000000011b48a19 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13f5f0 - head:0000000011b48a19 order:1 compound_mapcount:0 - flags: 0x17ffffc0010200(slab|head) - raw: 0017ffffc0010200 0000000000000000 0000000d00000001 ffff888107c43400 - raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 - page dumped because: kasan: bad access detected - - Memory state around the buggy address: - ffff88813f5f1b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ffff88813f5f1c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 - >ffff88813f5f1c80: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc - ^ - ffff88813f5f1d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - ffff88813f5f1d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc - -using IPv6 tunnels, act_tunnel_key allocates a fixed amount of memory for -the tunnel metadata, but then it expects additional bytes to store tunnel -specific metadata with tunnel_key_copy_opts(). - -Fix the arguments of __ipv6_tun_set_dst(), so that 'md_size' contains the -size previously computed by tunnel_key_get_opts_len(), like it's done for -IPv4 tunnels. - -Fixes: 0ed5269f9e41 ("net/sched: add tunnel option support to act_tunnel_key") -Reported-by: Shuang Li -Signed-off-by: Davide Caratti -Acked-by: Cong Wang -Link: https://lore.kernel.org/r/36ebe969f6d13ff59912d6464a4356fe6f103766.1603231100.git.dcaratti@redhat.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/sched/act_tunnel_key.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/sched/act_tunnel_key.c -+++ b/net/sched/act_tunnel_key.c -@@ -314,7 +314,7 @@ static int tunnel_key_init(struct net *n - - metadata = __ipv6_tun_set_dst(&saddr, &daddr, tos, ttl, dst_port, - 0, flags, -- key_id, 0); -+ key_id, opts_len); - } else { - NL_SET_ERR_MSG(extack, "Missing either ipv4 or ipv6 src and dst"); - ret = -EINVAL; diff --git a/queue-4.19/net-smc-fix-valid-dmbe-buffer-sizes.patch b/queue-4.19/net-smc-fix-valid-dmbe-buffer-sizes.patch deleted file mode 100644 index 2a680ae3513..00000000000 --- a/queue-4.19/net-smc-fix-valid-dmbe-buffer-sizes.patch +++ /dev/null @@ -1,33 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Karsten Graul -Date: Wed, 14 Oct 2020 19:43:28 +0200 -Subject: net/smc: fix valid DMBE buffer sizes - -From: Karsten Graul - -[ Upstream commit ef12ad45880b696eb993d86c481ca891836ab593 ] - -The SMCD_DMBE_SIZES should include all valid DMBE buffer sizes, so the -correct value is 6 which means 1MB. With 7 the registration of an ISM -buffer would always fail because of the invalid size requested. -Fix that and set the value to 6. - -Fixes: c6ba7c9ba43d ("net/smc: add base infrastructure for SMC-D and ISM") -Signed-off-by: Karsten Graul -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/smc/smc_core.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/smc/smc_core.c -+++ b/net/smc/smc_core.c -@@ -770,7 +770,7 @@ static struct smc_buf_desc *smcr_new_buf - return buf_desc; - } - --#define SMCD_DMBE_SIZES 7 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ -+#define SMCD_DMBE_SIZES 6 /* 0 -> 16KB, 1 -> 32KB, .. 6 -> 1MB */ - - static struct smc_buf_desc *smcd_new_buf_create(struct smc_link_group *lgr, - bool is_dmb, int bufsize) diff --git a/queue-4.19/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch b/queue-4.19/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch deleted file mode 100644 index a4f0336641c..00000000000 --- a/queue-4.19/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 7452988e57fadd35390c3c6767ef4f9688c8d0ac Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 15 Sep 2020 09:28:40 +0800 -Subject: net: stmmac: use netif_tx_start|stop_all_queues() function - -From: Ong Boon Leong - -[ Upstream commit 9f19306d166688a73356aa636c62e698bf2063cc ] - -The current implementation of stmmac_stop_all_queues() and -stmmac_start_all_queues() will not work correctly when the value of -tx_queues_to_use is changed through ethtool -L DEVNAME rx N tx M command. - -Also, netif_tx_start|stop_all_queues() are only needed in driver open() -and close() only. - -Fixes: c22a3f48 net: stmmac: adding multiple napi mechanism - -Signed-off-by: Ong Boon Leong -Signed-off-by: Voon Weifeng -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin ---- - .../net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +------------------ - 1 file changed, 1 insertion(+), 32 deletions(-) - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index c41879a955b57..2872684906e14 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -177,32 +177,6 @@ static void stmmac_enable_all_queues(struct stmmac_priv *priv) - } - } - --/** -- * stmmac_stop_all_queues - Stop all queues -- * @priv: driver private structure -- */ --static void stmmac_stop_all_queues(struct stmmac_priv *priv) --{ -- u32 tx_queues_cnt = priv->plat->tx_queues_to_use; -- u32 queue; -- -- for (queue = 0; queue < tx_queues_cnt; queue++) -- netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue)); --} -- --/** -- * stmmac_start_all_queues - Start all queues -- * @priv: driver private structure -- */ --static void stmmac_start_all_queues(struct stmmac_priv *priv) --{ -- u32 tx_queues_cnt = priv->plat->tx_queues_to_use; -- u32 queue; -- -- for (queue = 0; queue < tx_queues_cnt; queue++) -- netif_tx_start_queue(netdev_get_tx_queue(priv->dev, queue)); --} -- - static void stmmac_service_event_schedule(struct stmmac_priv *priv) - { - if (!test_bit(STMMAC_DOWN, &priv->state) && -@@ -2678,7 +2652,7 @@ static int stmmac_open(struct net_device *dev) - } - - stmmac_enable_all_queues(priv); -- stmmac_start_all_queues(priv); -+ netif_tx_start_all_queues(priv->dev); - - return 0; - -@@ -2724,8 +2698,6 @@ static int stmmac_release(struct net_device *dev) - phy_disconnect(dev->phydev); - } - -- stmmac_stop_all_queues(priv); -- - stmmac_disable_all_queues(priv); - - for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) -@@ -4519,7 +4491,6 @@ int stmmac_suspend(struct device *dev) - mutex_lock(&priv->lock); - - netif_device_detach(ndev); -- stmmac_stop_all_queues(priv); - - stmmac_disable_all_queues(priv); - -@@ -4628,8 +4599,6 @@ int stmmac_resume(struct device *dev) - - stmmac_enable_all_queues(priv); - -- stmmac_start_all_queues(priv); -- - mutex_unlock(&priv->lock); - - if (ndev->phydev) --- -2.25.1 - diff --git a/queue-4.19/net-tls-sendfile-fails-with-ktls-offload.patch b/queue-4.19/net-tls-sendfile-fails-with-ktls-offload.patch deleted file mode 100644 index 1917da3bafe..00000000000 --- a/queue-4.19/net-tls-sendfile-fails-with-ktls-offload.patch +++ /dev/null @@ -1,66 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Rohit Maheshwari -Date: Thu, 8 Oct 2020 00:10:21 +0530 -Subject: net/tls: sendfile fails with ktls offload - -From: Rohit Maheshwari - -[ Upstream commit ea1dd3e9d080c961b9a451130b61c72dc9a5397b ] - -At first when sendpage gets called, if there is more data, 'more' in -tls_push_data() gets set which later sets pending_open_record_frags, but -when there is no more data in file left, and last time tls_push_data() -gets called, pending_open_record_frags doesn't get reset. And later when -2 bytes of encrypted alert comes as sendmsg, it first checks for -pending_open_record_frags, and since this is set, it creates a record with -0 data bytes to encrypt, meaning record length is prepend_size + tag_size -only, which causes problem. - We should set/reset pending_open_record_frags based on more bit. - -Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") -Signed-off-by: Rohit Maheshwari -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/tls/tls_device.c | 11 ++++++----- - 1 file changed, 6 insertions(+), 5 deletions(-) - ---- a/net/tls/tls_device.c -+++ b/net/tls/tls_device.c -@@ -351,13 +351,13 @@ static int tls_push_data(struct sock *sk - struct tls_context *tls_ctx = tls_get_ctx(sk); - struct tls_offload_context_tx *ctx = tls_offload_ctx_tx(tls_ctx); - int tls_push_record_flags = flags | MSG_SENDPAGE_NOTLAST; -- int more = flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE); - struct tls_record_info *record = ctx->open_record; - struct page_frag *pfrag; - size_t orig_size = size; - u32 max_open_record_len; -- int copy, rc = 0; -+ bool more = false; - bool done = false; -+ int copy, rc = 0; - long timeo; - - if (flags & -@@ -422,9 +422,8 @@ handle_error: - if (!size) { - last_record: - tls_push_record_flags = flags; -- if (more) { -- tls_ctx->pending_open_record_frags = -- record->num_frags; -+ if (flags & (MSG_SENDPAGE_NOTLAST | MSG_MORE)) { -+ more = true; - break; - } - -@@ -445,6 +444,8 @@ last_record: - } - } while (!done); - -+ tls_ctx->pending_open_record_frags = more; -+ - if (orig_size - size > 0) - rc = orig_size - size; - diff --git a/queue-4.19/net-usb-qmi_wwan-add-cellient-mpl200-card.patch b/queue-4.19/net-usb-qmi_wwan-add-cellient-mpl200-card.patch deleted file mode 100644 index df970e05be7..00000000000 --- a/queue-4.19/net-usb-qmi_wwan-add-cellient-mpl200-card.patch +++ /dev/null @@ -1,29 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Wilken Gottwalt -Date: Thu, 8 Oct 2020 09:21:38 +0200 -Subject: net: usb: qmi_wwan: add Cellient MPL200 card - -From: Wilken Gottwalt - -[ Upstream commit 28802e7c0c9954218d1830f7507edc9d49b03a00 ] - -Add usb ids of the Cellient MPL200 card. - -Signed-off-by: Wilken Gottwalt -Acked-by: Bjørn Mork -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/usb/qmi_wwan.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -1312,6 +1312,7 @@ static const struct usb_device_id produc - {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */ - {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */ - {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/ -+ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */ - - /* 4. Gobi 1000 devices */ - {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ diff --git a/queue-4.19/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch b/queue-4.19/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch deleted file mode 100644 index e8d2f2e8157..00000000000 --- a/queue-4.19/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 8fe555fad731a4f04aeae38ce83ab310aadf90f7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 12 Oct 2020 17:06:06 +0200 -Subject: netfilter: nf_log: missing vlan offload tag and proto - -From: Pablo Neira Ayuso - -[ Upstream commit 0d9826bc18ce356e8909919ad681ad65d0a6061e ] - -Dump vlan tag and proto for the usual vlan offload case if the -NF_LOG_MACDECODE flag is set on. Without this information the logging is -misleading as there is no reference to the VLAN header. - -[12716.993704] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0800 SRC=192.168.10.2 DST=172.217.168.163 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2548 DF PROTO=TCP SPT=55848 DPT=80 WINDOW=501 RES=0x00 ACK FIN URGP=0 -[12721.157643] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0806 ARP HTYPE=1 PTYPE=0x0800 OPCODE=2 MACSRC=86:6c:92:ea:d6:73 IPSRC=192.168.10.2 MACDST=0e:3b:eb:86:73:76 IPDST=192.168.10.1 - -Fixes: 83e96d443b37 ("netfilter: log: split family specific code to nf_log_{ip,ip6,common}.c files") -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin ---- - include/net/netfilter/nf_log.h | 1 + - net/ipv4/netfilter/nf_log_arp.c | 19 +++++++++++++++++-- - net/ipv4/netfilter/nf_log_ipv4.c | 6 ++++-- - net/ipv6/netfilter/nf_log_ipv6.c | 8 +++++--- - net/netfilter/nf_log_common.c | 12 ++++++++++++ - 5 files changed, 39 insertions(+), 7 deletions(-) - -diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h -index 0d3920896d502..716db4a0fed89 100644 ---- a/include/net/netfilter/nf_log.h -+++ b/include/net/netfilter/nf_log.h -@@ -108,6 +108,7 @@ int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb, - unsigned int logflags); - void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m, - struct sock *sk); -+void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb); - void nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf, - unsigned int hooknum, const struct sk_buff *skb, - const struct net_device *in, -diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c -index df5c2a2061a4b..19fff2c589fac 100644 ---- a/net/ipv4/netfilter/nf_log_arp.c -+++ b/net/ipv4/netfilter/nf_log_arp.c -@@ -46,16 +46,31 @@ static void dump_arp_packet(struct nf_log_buf *m, - const struct nf_loginfo *info, - const struct sk_buff *skb, unsigned int nhoff) - { -- const struct arphdr *ah; -- struct arphdr _arph; - const struct arppayload *ap; - struct arppayload _arpp; -+ const struct arphdr *ah; -+ unsigned int logflags; -+ struct arphdr _arph; - - ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); - if (ah == NULL) { - nf_log_buf_add(m, "TRUNCATED"); - return; - } -+ -+ if (info->type == NF_LOG_TYPE_LOG) -+ logflags = info->u.log.logflags; -+ else -+ logflags = NF_LOG_DEFAULT_MASK; -+ -+ if (logflags & NF_LOG_MACDECODE) { -+ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", -+ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); -+ nf_log_dump_vlan(m, skb); -+ nf_log_buf_add(m, "MACPROTO=%04x ", -+ ntohs(eth_hdr(skb)->h_proto)); -+ } -+ - nf_log_buf_add(m, "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d", - ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op)); - -diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c -index 1e6f28c97d3a2..cde1918607e9c 100644 ---- a/net/ipv4/netfilter/nf_log_ipv4.c -+++ b/net/ipv4/netfilter/nf_log_ipv4.c -@@ -287,8 +287,10 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, - - switch (dev->type) { - case ARPHRD_ETHER: -- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ", -- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, -+ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", -+ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); -+ nf_log_dump_vlan(m, skb); -+ nf_log_buf_add(m, "MACPROTO=%04x ", - ntohs(eth_hdr(skb)->h_proto)); - return; - default: -diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c -index c6bf580d0f331..c456e2f902b93 100644 ---- a/net/ipv6/netfilter/nf_log_ipv6.c -+++ b/net/ipv6/netfilter/nf_log_ipv6.c -@@ -300,9 +300,11 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, - - switch (dev->type) { - case ARPHRD_ETHER: -- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ", -- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, -- ntohs(eth_hdr(skb)->h_proto)); -+ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", -+ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); -+ nf_log_dump_vlan(m, skb); -+ nf_log_buf_add(m, "MACPROTO=%04x ", -+ ntohs(eth_hdr(skb)->h_proto)); - return; - default: - break; -diff --git a/net/netfilter/nf_log_common.c b/net/netfilter/nf_log_common.c -index a8c5c846aec10..b164a0e1e0536 100644 ---- a/net/netfilter/nf_log_common.c -+++ b/net/netfilter/nf_log_common.c -@@ -176,6 +176,18 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf, - } - EXPORT_SYMBOL_GPL(nf_log_dump_packet_common); - -+void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb) -+{ -+ u16 vid; -+ -+ if (!skb_vlan_tag_present(skb)) -+ return; -+ -+ vid = skb_vlan_tag_get(skb); -+ nf_log_buf_add(m, "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid); -+} -+EXPORT_SYMBOL_GPL(nf_log_dump_vlan); -+ - /* bridge and netdev logging families share this code. */ - void nf_log_l2packet(struct net *net, u_int8_t pf, - __be16 protocol, --- -2.25.1 - diff --git a/queue-4.19/nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download.patch b/queue-4.19/nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download.patch deleted file mode 100644 index d29feaf781f..00000000000 --- a/queue-4.19/nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download.patch +++ /dev/null @@ -1,37 +0,0 @@ -From foo@baz Sat Oct 24 11:10:06 AM CEST 2020 -From: Defang Bo -Date: Mon, 19 Oct 2020 19:38:58 +0800 -Subject: nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() - -From: Defang Bo - -[ Upstream commit 280e3ebdafb863b3cb50d5842f056267e15bf40c ] - -Check that the NFC_ATTR_FIRMWARE_NAME attributes are provided by -the netlink client prior to accessing them.This prevents potential -unhandled NULL pointer dereference exceptions which can be triggered -by malicious user-mode programs, if they omit one or both of these -attributes. - -Similar to commit a0323b979f81 ("nfc: Ensure presence of required attributes in the activate_target handler"). - -Fixes: 9674da8759df ("NFC: Add firmware upload netlink command") -Signed-off-by: Defang Bo -Link: https://lore.kernel.org/r/1603107538-4744-1-git-send-email-bodefang@126.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/nfc/netlink.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -1235,7 +1235,7 @@ static int nfc_genl_fw_download(struct s - u32 idx; - char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1]; - -- if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) -+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME]) - return -EINVAL; - - idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); diff --git a/queue-4.19/nl80211-fix-non-split-wiphy-information.patch b/queue-4.19/nl80211-fix-non-split-wiphy-information.patch deleted file mode 100644 index 5d4be65913d..00000000000 --- a/queue-4.19/nl80211-fix-non-split-wiphy-information.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 9682388b48023d16745b87ebeb6250a65de11a74 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 28 Sep 2020 13:07:18 +0200 -Subject: nl80211: fix non-split wiphy information - -From: Johannes Berg - -[ Upstream commit ab10c22bc3b2024f0c9eafa463899a071eac8d97 ] - -When dumping wiphy information, we try to split the data into -many submessages, but for old userspace we still support the -old mode where this doesn't happen. - -However, in this case we were not resetting our state correctly -and dumping multiple messages for each wiphy, which would have -broken such older userspace. - -This was broken pretty much immediately afterwards because it -only worked in the original commit where non-split dumps didn't -have any more data than split dumps... - -Fixes: fe1abafd942f ("nl80211: re-add channel width and extended capa advertising") -Signed-off-by: Johannes Berg -Link: https://lore.kernel.org/r/20200928130717.3e6d9c6bada2.Ie0f151a8d0d00a8e1e18f6a8c9244dd02496af67@changeid -Signed-off-by: Johannes Berg -Signed-off-by: Sasha Levin ---- - net/wireless/nl80211.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 4e41792099822..fbc8875502c3e 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -1950,7 +1950,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, - * case we'll continue with more data in the next round, - * but break unconditionally so unsplit data stops here. - */ -- state->split_start++; -+ if (state->split) -+ state->split_start++; -+ else -+ state->split_start = 0; - break; - case 9: - if (rdev->wiphy.extended_capabilities && --- -2.25.1 - diff --git a/queue-4.19/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch b/queue-4.19/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch deleted file mode 100644 index fd14a1e2399..00000000000 --- a/queue-4.19/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 9265e9e6065ea72b5c79a69b478e1888a9d60d68 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 14 Sep 2020 17:40:26 +0300 -Subject: pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB - -From: Necip Fazil Yildiran - -[ Upstream commit 513034d8b089b9a49dab57845aee70e830fe7334 ] - -When PINCTRL_BCM2835 is enabled and GPIOLIB is disabled, it results in the -following Kbuild warning: - -WARNING: unmet direct dependencies detected for GPIOLIB_IRQCHIP - Depends on [n]: GPIOLIB [=n] - Selected by [y]: - - PINCTRL_BCM2835 [=y] && PINCTRL [=y] && OF [=y] && (ARCH_BCM2835 [=n] || ARCH_BRCMSTB [=n] || COMPILE_TEST [=y]) - -The reason is that PINCTRL_BCM2835 selects GPIOLIB_IRQCHIP without -depending on or selecting GPIOLIB while GPIOLIB_IRQCHIP is subordinate to -GPIOLIB. - -Honor the kconfig menu hierarchy to remove kconfig dependency warnings. - -Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP") -Signed-off-by: Necip Fazil Yildiran -Link: https://lore.kernel.org/r/20200914144025.371370-1-fazilyildiran@gmail.com -Signed-off-by: Linus Walleij -Signed-off-by: Sasha Levin ---- - drivers/pinctrl/bcm/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/pinctrl/bcm/Kconfig b/drivers/pinctrl/bcm/Kconfig -index 0f38d51f47c64..e6cd314919de1 100644 ---- a/drivers/pinctrl/bcm/Kconfig -+++ b/drivers/pinctrl/bcm/Kconfig -@@ -21,6 +21,7 @@ config PINCTRL_BCM2835 - select PINMUX - select PINCONF - select GENERIC_PINCONF -+ select GPIOLIB - select GPIOLIB_IRQCHIP - - config PINCTRL_IPROC_GPIO --- -2.25.1 - diff --git a/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch b/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch deleted file mode 100644 index 2467eb2d6da..00000000000 --- a/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 159efe9706062badec2925825785f6bc6d819fe9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 28 Aug 2020 22:32:26 +0100 -Subject: pinctrl: mcp23s08: Fix mcp23x17 precious range - -From: Thomas Preston - -[ Upstream commit b9b7fb29433b906635231d0a111224efa009198c ] - -On page 23 of the datasheet [0] it says "The register remains unchanged -until the interrupt is cleared via a read of INTCAP or GPIO." Include -INTCAPA and INTCAPB registers in precious range, so that they aren't -accidentally cleared when we read via debugfs. - -[0] https://ww1.microchip.com/downloads/en/DeviceDoc/20001952C.pdf - -Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") -Signed-off-by: Thomas Preston -Reviewed-by: Andy Shevchenko -Link: https://lore.kernel.org/r/20200828213226.1734264-3-thomas.preston@codethink.co.uk -Signed-off-by: Linus Walleij -Signed-off-by: Sasha Levin ---- - drivers/pinctrl/pinctrl-mcp23s08.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c -index 5f0cea13bb5ce..5b5a4323ae63d 100644 ---- a/drivers/pinctrl/pinctrl-mcp23s08.c -+++ b/drivers/pinctrl/pinctrl-mcp23s08.c -@@ -142,7 +142,7 @@ static const struct regmap_access_table mcp23x17_volatile_table = { - }; - - static const struct regmap_range mcp23x17_precious_range = { -- .range_min = MCP_GPIO << 1, -+ .range_min = MCP_INTCAP << 1, - .range_max = MCP_GPIO << 1, - }; - --- -2.25.1 - diff --git a/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch b/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch deleted file mode 100644 index d782cf7e9e8..00000000000 --- a/queue-4.19/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch +++ /dev/null @@ -1,84 +0,0 @@ -From b0e38fa4c84664f0a23c59f5f655e65bf6dc99da Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 28 Aug 2020 22:32:25 +0100 -Subject: pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser - -From: Thomas Preston - -[ Upstream commit b445f6237744df5e8d4f56f8733b2108c611220a ] - -The mcp23x17_regmap is initialised with structs named "mcp23x16". -However, the mcp23s08 driver doesn't support the MCP23016 device yet, so -this appears to be a typo. - -Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") -Signed-off-by: Thomas Preston -Reviewed-by: Andy Shevchenko -Link: https://lore.kernel.org/r/20200828213226.1734264-2-thomas.preston@codethink.co.uk -Signed-off-by: Linus Walleij -Signed-off-by: Sasha Levin ---- - drivers/pinctrl/pinctrl-mcp23s08.c | 22 +++++++++++----------- - 1 file changed, 11 insertions(+), 11 deletions(-) - -diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c -index 33c3eca0ece97..5f0cea13bb5ce 100644 ---- a/drivers/pinctrl/pinctrl-mcp23s08.c -+++ b/drivers/pinctrl/pinctrl-mcp23s08.c -@@ -120,7 +120,7 @@ static const struct regmap_config mcp23x08_regmap = { - .max_register = MCP_OLAT, - }; - --static const struct reg_default mcp23x16_defaults[] = { -+static const struct reg_default mcp23x17_defaults[] = { - {.reg = MCP_IODIR << 1, .def = 0xffff}, - {.reg = MCP_IPOL << 1, .def = 0x0000}, - {.reg = MCP_GPINTEN << 1, .def = 0x0000}, -@@ -131,23 +131,23 @@ static const struct reg_default mcp23x16_defaults[] = { - {.reg = MCP_OLAT << 1, .def = 0x0000}, - }; - --static const struct regmap_range mcp23x16_volatile_range = { -+static const struct regmap_range mcp23x17_volatile_range = { - .range_min = MCP_INTF << 1, - .range_max = MCP_GPIO << 1, - }; - --static const struct regmap_access_table mcp23x16_volatile_table = { -- .yes_ranges = &mcp23x16_volatile_range, -+static const struct regmap_access_table mcp23x17_volatile_table = { -+ .yes_ranges = &mcp23x17_volatile_range, - .n_yes_ranges = 1, - }; - --static const struct regmap_range mcp23x16_precious_range = { -+static const struct regmap_range mcp23x17_precious_range = { - .range_min = MCP_GPIO << 1, - .range_max = MCP_GPIO << 1, - }; - --static const struct regmap_access_table mcp23x16_precious_table = { -- .yes_ranges = &mcp23x16_precious_range, -+static const struct regmap_access_table mcp23x17_precious_table = { -+ .yes_ranges = &mcp23x17_precious_range, - .n_yes_ranges = 1, - }; - -@@ -157,10 +157,10 @@ static const struct regmap_config mcp23x17_regmap = { - - .reg_stride = 2, - .max_register = MCP_OLAT << 1, -- .volatile_table = &mcp23x16_volatile_table, -- .precious_table = &mcp23x16_precious_table, -- .reg_defaults = mcp23x16_defaults, -- .num_reg_defaults = ARRAY_SIZE(mcp23x16_defaults), -+ .volatile_table = &mcp23x17_volatile_table, -+ .precious_table = &mcp23x17_precious_table, -+ .reg_defaults = mcp23x17_defaults, -+ .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), - .cache_type = REGCACHE_FLAT, - .val_format_endian = REGMAP_ENDIAN_LITTLE, - }; --- -2.25.1 - diff --git a/queue-4.19/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch b/queue-4.19/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch deleted file mode 100644 index 405e18778c0..00000000000 --- a/queue-4.19/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 9306c4761912961dc228c32b0de99571c3932928 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 23 Sep 2020 20:20:49 +0300 -Subject: platform/x86: mlx-platform: Remove PSU EEPROM configuration - -From: Vadim Pasternak - -[ Upstream commit c071afcea6ecf24a3c119f25ce9f71ffd55b5dc2 ] - -Remove PSU EEPROM configuration for systems class equipped with -Mellanox chip Spectrume-2. Till now all the systems from this class -used few types of power units, all equipped with EEPROM device with -address space two bytes. Thus, all these devices have been handled by -EEPROM driver "24c32". -There is a new requirement is to support power unit replacement by "off -the shelf" device, matching electrical required parameters. Such device -could be equipped with different EEPROM type, which could be one byte -address space addressing or even could be not equipped with EEPROM. -In such case "24c32" will not work. - -Fixes: 1bd42d94ccab ("platform/x86: mlx-platform: Add support for new 200G IB and Ethernet systems") -Signed-off-by: Vadim Pasternak -Reviewed-by: Hans de Goede -Link: https://lore.kernel.org/r/20200923172053.26296-2-vadimp@nvidia.com -Signed-off-by: Hans de Goede -Signed-off-by: Sasha Levin ---- - drivers/platform/x86/mlx-platform.c | 15 ++------------- - 1 file changed, 2 insertions(+), 13 deletions(-) - -diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c -index 69e28c12d5915..0c72de95b5ccd 100644 ---- a/drivers/platform/x86/mlx-platform.c -+++ b/drivers/platform/x86/mlx-platform.c -@@ -221,15 +221,6 @@ static struct i2c_board_info mlxplat_mlxcpld_psu[] = { - }, - }; - --static struct i2c_board_info mlxplat_mlxcpld_ng_psu[] = { -- { -- I2C_BOARD_INFO("24c32", 0x51), -- }, -- { -- I2C_BOARD_INFO("24c32", 0x50), -- }, --}; -- - static struct i2c_board_info mlxplat_mlxcpld_pwr[] = { - { - I2C_BOARD_INFO("dps460", 0x59), -@@ -589,15 +580,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_ng_psu_items_data[] = { - .label = "psu1", - .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, - .mask = BIT(0), -- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[0], -- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, -+ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, - }, - { - .label = "psu2", - .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, - .mask = BIT(1), -- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[1], -- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, -+ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, - }, - }; - --- -2.25.1 - diff --git a/queue-4.19/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch b/queue-4.19/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch deleted file mode 100644 index a703441017b..00000000000 --- a/queue-4.19/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 7f508e06d0cfec5b6b3033830868ff697604a6b9 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 4 Jul 2018 10:03:27 +0200 -Subject: powerpc/icp-hv: Fix missing of_node_put() in success path - -From: Nicholas Mc Guire - -[ Upstream commit d3e669f31ec35856f5e85df9224ede5bdbf1bc7b ] - -Both of_find_compatible_node() and of_find_node_by_type() will return -a refcounted node on success - thus for the success path the node must -be explicitly released with a of_node_put(). - -Fixes: 0b05ac6e2480 ("powerpc/xics: Rewrite XICS driver") -Signed-off-by: Nicholas Mc Guire -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/1530691407-3991-1-git-send-email-hofrat@osadl.org -Signed-off-by: Sasha Levin ---- - arch/powerpc/sysdev/xics/icp-hv.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c -index bbc839a98c414..003deaabb5680 100644 ---- a/arch/powerpc/sysdev/xics/icp-hv.c -+++ b/arch/powerpc/sysdev/xics/icp-hv.c -@@ -179,6 +179,7 @@ int icp_hv_init(void) - - icp_ops = &icp_hv_ops; - -+ of_node_put(np); - return 0; - } - --- -2.25.1 - diff --git a/queue-4.19/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch b/queue-4.19/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch deleted file mode 100644 index db08cb24645..00000000000 --- a/queue-4.19/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 3dd18ef7e212c25032b5074263d13a35d3012deb Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 13 Aug 2020 10:11:31 -0500 -Subject: powerpc/pseries: explicitly reschedule during drmem_lmb list - traversal - -From: Nathan Lynch - -[ Upstream commit 9d6792ffe140240ae54c881cc4183f9acc24b4df ] - -The drmem lmb list can have hundreds of thousands of entries, and -unfortunately lookups take the form of linear searches. As long as -this is the case, traversals have the potential to monopolize the CPU -and provoke lockup reports, workqueue stalls, and the like unless -they explicitly yield. - -Rather than placing cond_resched() calls within various -for_each_drmem_lmb() loop blocks in the code, put it in the iteration -expression of the loop macro itself so users can't omit it. - -Introduce a drmem_lmb_next() iteration helper function which calls -cond_resched() at a regular interval during array traversal. Each -iteration of the loop in DLPAR code paths can involve around ten RTAS -calls which can each take up to 250us, so this ensures the check is -performed at worst every few milliseconds. - -Fixes: 6c6ea53725b3 ("powerpc/mm: Separate ibm, dynamic-memory data from DT format") -Signed-off-by: Nathan Lynch -Reviewed-by: Christophe Leroy -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/20200813151131.2070161-1-nathanl@linux.ibm.com -Signed-off-by: Sasha Levin ---- - arch/powerpc/include/asm/drmem.h | 18 +++++++++++++++++- - 1 file changed, 17 insertions(+), 1 deletion(-) - -diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h -index 9e516fe3daaba..668d8a121f1a0 100644 ---- a/arch/powerpc/include/asm/drmem.h -+++ b/arch/powerpc/include/asm/drmem.h -@@ -12,6 +12,8 @@ - #ifndef _ASM_POWERPC_LMB_H - #define _ASM_POWERPC_LMB_H - -+#include -+ - struct drmem_lmb { - u64 base_addr; - u32 drc_index; -@@ -27,8 +29,22 @@ struct drmem_lmb_info { - - extern struct drmem_lmb_info *drmem_info; - -+static inline struct drmem_lmb *drmem_lmb_next(struct drmem_lmb *lmb, -+ const struct drmem_lmb *start) -+{ -+ /* -+ * DLPAR code paths can take several milliseconds per element -+ * when interacting with firmware. Ensure that we don't -+ * unfairly monopolize the CPU. -+ */ -+ if (((++lmb - start) % 16) == 0) -+ cond_resched(); -+ -+ return lmb; -+} -+ - #define for_each_drmem_lmb_in_range(lmb, start, end) \ -- for ((lmb) = (start); (lmb) < (end); (lmb)++) -+ for ((lmb) = (start); (lmb) < (end); lmb = drmem_lmb_next(lmb, start)) - - #define for_each_drmem_lmb(lmb) \ - for_each_drmem_lmb_in_range((lmb), \ --- -2.25.1 - diff --git a/queue-4.19/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch b/queue-4.19/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch deleted file mode 100644 index e6804c960c9..00000000000 --- a/queue-4.19/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 86ba2821f5e29dfaa214be99a9eb3a07a0f8f6f6 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 2 Jul 2018 11:08:16 +0200 -Subject: powerpc/pseries: Fix missing of_node_put() in rng_init() - -From: Nicholas Mc Guire - -[ Upstream commit 67c3e59443f5fc77be39e2ce0db75fbfa78c7965 ] - -The call to of_find_compatible_node() returns a node pointer with -refcount incremented thus it must be explicitly decremented here -before returning. - -Fixes: a489043f4626 ("powerpc/pseries: Implement arch_get_random_long() based on H_RANDOM") -Signed-off-by: Nicholas Mc Guire -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/1530522496-14816-1-git-send-email-hofrat@osadl.org -Signed-off-by: Sasha Levin ---- - arch/powerpc/platforms/pseries/rng.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c -index 31ca557af60bc..262b8c5e1b9d0 100644 ---- a/arch/powerpc/platforms/pseries/rng.c -+++ b/arch/powerpc/platforms/pseries/rng.c -@@ -40,6 +40,7 @@ static __init int rng_init(void) - - ppc_md.get_random_seed = pseries_get_random_long; - -+ of_node_put(dn); - return 0; - } - machine_subsys_initcall(pseries, rng_init); --- -2.25.1 - diff --git a/queue-4.19/powerpc-tau-convert-from-timer-to-workqueue.patch b/queue-4.19/powerpc-tau-convert-from-timer-to-workqueue.patch deleted file mode 100644 index f7c9d61972a..00000000000 --- a/queue-4.19/powerpc-tau-convert-from-timer-to-workqueue.patch +++ /dev/null @@ -1,153 +0,0 @@ -From a8a2537533a479ab3f1bc79daf758054da0e0b9e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 5 Sep 2020 09:02:20 +1000 -Subject: powerpc/tau: Convert from timer to workqueue - -From: Finn Thain - -[ Upstream commit b1c6a0a10bfaf36ec82fde6f621da72407fa60a1 ] - -Since commit 19dbdcb8039cf ("smp: Warn on function calls from softirq -context") the Thermal Assist Unit driver causes a warning like the -following when CONFIG_SMP is enabled. - - ------------[ cut here ]------------ - WARNING: CPU: 0 PID: 0 at kernel/smp.c:428 smp_call_function_many_cond+0xf4/0x38c - Modules linked in: - CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-pmac #3 - NIP: c00b37a8 LR: c00b3abc CTR: c001218c - REGS: c0799c60 TRAP: 0700 Not tainted (5.7.0-pmac) - MSR: 00029032 CR: 42000224 XER: 00000000 - GPR00: c00b3abc c0799d18 c076e300 c079ef5c c0011fec 00000000 00000000 00000000 - GPR08: 00000100 00000100 00008000 ffffffff 42000224 00000000 c079d040 c079d044 - GPR16: 00000001 00000000 00000004 c0799da0 c079f054 c07a0000 c07a0000 00000000 - GPR24: c0011fec 00000000 c079ef5c c079ef5c 00000000 00000000 00000000 00000000 - NIP [c00b37a8] smp_call_function_many_cond+0xf4/0x38c - LR [c00b3abc] on_each_cpu+0x38/0x68 - Call Trace: - [c0799d18] [ffffffff] 0xffffffff (unreliable) - [c0799d68] [c00b3abc] on_each_cpu+0x38/0x68 - [c0799d88] [c0096704] call_timer_fn.isra.26+0x20/0x7c - [c0799d98] [c0096b40] run_timer_softirq+0x1d4/0x3fc - [c0799df8] [c05b4368] __do_softirq+0x118/0x240 - [c0799e58] [c0039c44] irq_exit+0xc4/0xcc - [c0799e68] [c000ade8] timer_interrupt+0x1b0/0x230 - [c0799ea8] [c0013520] ret_from_except+0x0/0x14 - --- interrupt: 901 at arch_cpu_idle+0x24/0x6c - LR = arch_cpu_idle+0x24/0x6c - [c0799f70] [00000001] 0x1 (unreliable) - [c0799f80] [c0060990] do_idle+0xd8/0x17c - [c0799fa0] [c0060ba8] cpu_startup_entry+0x24/0x28 - [c0799fb0] [c072d220] start_kernel+0x434/0x44c - [c0799ff0] [00003860] 0x3860 - Instruction dump: - 8129f204 2f890000 40beff98 3d20c07a 8929eec4 2f890000 40beff88 0fe00000 - 81220000 552805de 550802ef 4182ff84 <0fe00000> 3860ffff 7f65db78 7f44d378 - ---[ end trace 34a886e47819c2eb ]--- - -Don't call on_each_cpu() from a timer callback, call it from a worker -thread instead. - -Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") -Tested-by: Stan Johnson -Signed-off-by: Finn Thain -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/bb61650bea4f4c91fb8e24b9a6f130a1438651a7.1599260540.git.fthain@telegraphics.com.au -Signed-off-by: Sasha Levin ---- - arch/powerpc/kernel/tau_6xx.c | 38 +++++++++++++++++------------------ - 1 file changed, 18 insertions(+), 20 deletions(-) - -diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c -index 976d5bc1b5176..268205cc347da 100644 ---- a/arch/powerpc/kernel/tau_6xx.c -+++ b/arch/powerpc/kernel/tau_6xx.c -@@ -13,13 +13,14 @@ - */ - - #include --#include - #include - #include - #include - #include - #include - #include -+#include -+#include - - #include - #include -@@ -39,8 +40,6 @@ static struct tau_temp - unsigned char grew; - } tau[NR_CPUS]; - --struct timer_list tau_timer; -- - #undef DEBUG - - /* TODO: put these in a /proc interface, with some sanity checks, and maybe -@@ -50,7 +49,7 @@ struct timer_list tau_timer; - #define step_size 2 /* step size when temp goes out of range */ - #define window_expand 1 /* expand the window by this much */ - /* configurable values for shrinking the window */ --#define shrink_timer 2*HZ /* period between shrinking the window */ -+#define shrink_timer 2000 /* period between shrinking the window */ - #define min_window 2 /* minimum window size, degrees C */ - - static void set_thresholds(unsigned long cpu) -@@ -187,14 +186,18 @@ static void tau_timeout(void * info) - local_irq_restore(flags); - } - --static void tau_timeout_smp(struct timer_list *unused) --{ -+static struct workqueue_struct *tau_workq; - -- /* schedule ourselves to be run again */ -- mod_timer(&tau_timer, jiffies + shrink_timer) ; -+static void tau_work_func(struct work_struct *work) -+{ -+ msleep(shrink_timer); - on_each_cpu(tau_timeout, NULL, 0); -+ /* schedule ourselves to be run again */ -+ queue_work(tau_workq, work); - } - -+DECLARE_WORK(tau_work, tau_work_func); -+ - /* - * setup the TAU - * -@@ -227,21 +230,16 @@ static int __init TAU_init(void) - return 1; - } - -- -- /* first, set up the window shrinking timer */ -- timer_setup(&tau_timer, tau_timeout_smp, 0); -- tau_timer.expires = jiffies + shrink_timer; -- add_timer(&tau_timer); -+ tau_workq = alloc_workqueue("tau", WQ_UNBOUND, 1); -+ if (!tau_workq) -+ return -ENOMEM; - - on_each_cpu(TAU_init_smp, NULL, 0); - -- printk("Thermal assist unit "); --#ifdef CONFIG_TAU_INT -- printk("using interrupts, "); --#else -- printk("using timers, "); --#endif -- printk("shrink_timer: %d jiffies\n", shrink_timer); -+ queue_work(tau_workq, &tau_work); -+ -+ pr_info("Thermal assist unit using %s, shrink_timer: %d ms\n", -+ IS_ENABLED(CONFIG_TAU_INT) ? "interrupts" : "workqueue", shrink_timer); - tau_initialized = 1; - - return 0; --- -2.25.1 - diff --git a/queue-4.19/powerpc-tau-remove-duplicated-set_thresholds-call.patch b/queue-4.19/powerpc-tau-remove-duplicated-set_thresholds-call.patch deleted file mode 100644 index 0c05cb7783d..00000000000 --- a/queue-4.19/powerpc-tau-remove-duplicated-set_thresholds-call.patch +++ /dev/null @@ -1,44 +0,0 @@ -From a3f83831059a51d193b582e763cb94830947b4e4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 5 Sep 2020 09:02:20 +1000 -Subject: powerpc/tau: Remove duplicated set_thresholds() call - -From: Finn Thain - -[ Upstream commit 420ab2bc7544d978a5d0762ee736412fe9c796ab ] - -The commentary at the call site seems to disagree with the code. The -conditional prevents calling set_thresholds() via the exception handler, -which appears to crash. Perhaps that's because it immediately triggers -another TAU exception. Anyway, calling set_thresholds() from TAUupdate() -is redundant because tau_timeout() does so. - -Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") -Signed-off-by: Finn Thain -Tested-by: Stan Johnson -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/d7c7ee33232cf72a6a6bbb6ef05838b2e2b113c0.1599260540.git.fthain@telegraphics.com.au -Signed-off-by: Sasha Levin ---- - arch/powerpc/kernel/tau_6xx.c | 5 ----- - 1 file changed, 5 deletions(-) - -diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c -index 268205cc347da..b8d7e7d498e0a 100644 ---- a/arch/powerpc/kernel/tau_6xx.c -+++ b/arch/powerpc/kernel/tau_6xx.c -@@ -110,11 +110,6 @@ static void TAUupdate(int cpu) - #ifdef DEBUG - printk("grew = %d\n", tau[cpu].grew); - #endif -- --#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */ -- set_thresholds(cpu); --#endif -- - } - - #ifdef CONFIG_TAU_INT --- -2.25.1 - diff --git a/queue-4.19/powerpc-tau-use-appropriate-temperature-sample-inter.patch b/queue-4.19/powerpc-tau-use-appropriate-temperature-sample-inter.patch deleted file mode 100644 index adf5a0f4fad..00000000000 --- a/queue-4.19/powerpc-tau-use-appropriate-temperature-sample-inter.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 3f68a142df7b56a5543c2e2d81c568fc84c518b6 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 5 Sep 2020 09:02:20 +1000 -Subject: powerpc/tau: Use appropriate temperature sample interval - -From: Finn Thain - -[ Upstream commit 66943005cc41f48e4d05614e8f76c0ca1812f0fd ] - -According to the MPC750 Users Manual, the SITV value in Thermal -Management Register 3 is 13 bits long. The present code calculates the -SITV value as 60 * 500 cycles. This would overflow to give 10 us on -a 500 MHz CPU rather than the intended 60 us. (But according to the -Microprocessor Datasheet, there is also a factor of 266 that has to be -applied to this value on certain parts i.e. speed sort above 266 MHz.) -Always use the maximum cycle count, as recommended by the Datasheet. - -Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") -Signed-off-by: Finn Thain -Tested-by: Stan Johnson -Signed-off-by: Michael Ellerman -Link: https://lore.kernel.org/r/896f542e5f0f1d6cf8218524c2b67d79f3d69b3c.1599260540.git.fthain@telegraphics.com.au -Signed-off-by: Sasha Levin ---- - arch/powerpc/include/asm/reg.h | 2 +- - arch/powerpc/kernel/tau_6xx.c | 12 ++++-------- - 2 files changed, 5 insertions(+), 9 deletions(-) - -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index af99716615122..494b0283f2129 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -788,7 +788,7 @@ - #define THRM1_TIN (1 << 31) - #define THRM1_TIV (1 << 30) - #define THRM1_THRES(x) ((x&0x7f)<<23) --#define THRM3_SITV(x) ((x&0x3fff)<<1) -+#define THRM3_SITV(x) ((x & 0x1fff) << 1) - #define THRM1_TID (1<<2) - #define THRM1_TIE (1<<1) - #define THRM1_V (1<<0) -diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c -index e2ab8a111b693..976d5bc1b5176 100644 ---- a/arch/powerpc/kernel/tau_6xx.c -+++ b/arch/powerpc/kernel/tau_6xx.c -@@ -178,15 +178,11 @@ static void tau_timeout(void * info) - * complex sleep code needs to be added. One mtspr every time - * tau_timeout is called is probably not a big deal. - * -- * Enable thermal sensor and set up sample interval timer -- * need 20 us to do the compare.. until a nice 'cpu_speed' function -- * call is implemented, just assume a 500 mhz clock. It doesn't really -- * matter if we take too long for a compare since it's all interrupt -- * driven anyway. -- * -- * use a extra long time.. (60 us @ 500 mhz) -+ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" -+ * recommends that "the maximum value be set in THRM3 under all -+ * conditions." - */ -- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E); -+ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); - - local_irq_restore(flags); - } --- -2.25.1 - diff --git a/queue-4.19/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch b/queue-4.19/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch deleted file mode 100644 index a1e8946f290..00000000000 --- a/queue-4.19/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 5b9495a8c52114132a94cee53546387e0532a654 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 14:00:45 +0200 -Subject: pty: do tty_flip_buffer_push without port->lock in pty_write - -From: Artem Savkov - -[ Upstream commit 71a174b39f10b4b93223d374722aa894b5d8a82e ] - -b6da31b2c07c "tty: Fix data race in tty_insert_flip_string_fixed_flag" -puts tty_flip_buffer_push under port->lock introducing the following -possible circular locking dependency: - -[30129.876566] ====================================================== -[30129.876566] WARNING: possible circular locking dependency detected -[30129.876567] 5.9.0-rc2+ #3 Tainted: G S W -[30129.876568] ------------------------------------------------------ -[30129.876568] sysrq.sh/1222 is trying to acquire lock: -[30129.876569] ffffffff92c39480 (console_owner){....}-{0:0}, at: console_unlock+0x3fe/0xa90 - -[30129.876572] but task is already holding lock: -[30129.876572] ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca - -[30129.876576] which lock already depends on the new lock. - -[30129.876577] the existing dependency chain (in reverse order) is: - -[30129.876578] -> #3 (&pool->lock/1){-.-.}-{2:2}: -[30129.876581] _raw_spin_lock+0x30/0x70 -[30129.876581] __queue_work+0x1a3/0x10f0 -[30129.876582] queue_work_on+0x78/0x80 -[30129.876582] pty_write+0x165/0x1e0 -[30129.876583] n_tty_write+0x47f/0xf00 -[30129.876583] tty_write+0x3d6/0x8d0 -[30129.876584] vfs_write+0x1a8/0x650 - -[30129.876588] -> #2 (&port->lock#2){-.-.}-{2:2}: -[30129.876590] _raw_spin_lock_irqsave+0x3b/0x80 -[30129.876591] tty_port_tty_get+0x1d/0xb0 -[30129.876592] tty_port_default_wakeup+0xb/0x30 -[30129.876592] serial8250_tx_chars+0x3d6/0x970 -[30129.876593] serial8250_handle_irq.part.12+0x216/0x380 -[30129.876593] serial8250_default_handle_irq+0x82/0xe0 -[30129.876594] serial8250_interrupt+0xdd/0x1b0 -[30129.876595] __handle_irq_event_percpu+0xfc/0x850 - -[30129.876602] -> #1 (&port->lock){-.-.}-{2:2}: -[30129.876605] _raw_spin_lock_irqsave+0x3b/0x80 -[30129.876605] serial8250_console_write+0x12d/0x900 -[30129.876606] console_unlock+0x679/0xa90 -[30129.876606] register_console+0x371/0x6e0 -[30129.876607] univ8250_console_init+0x24/0x27 -[30129.876607] console_init+0x2f9/0x45e - -[30129.876609] -> #0 (console_owner){....}-{0:0}: -[30129.876611] __lock_acquire+0x2f70/0x4e90 -[30129.876612] lock_acquire+0x1ac/0xad0 -[30129.876612] console_unlock+0x460/0xa90 -[30129.876613] vprintk_emit+0x130/0x420 -[30129.876613] printk+0x9f/0xc5 -[30129.876614] show_pwq+0x154/0x618 -[30129.876615] show_workqueue_state.cold.55+0x193/0x6ca -[30129.876615] __handle_sysrq+0x244/0x460 -[30129.876616] write_sysrq_trigger+0x48/0x4a -[30129.876616] proc_reg_write+0x1a6/0x240 -[30129.876617] vfs_write+0x1a8/0x650 - -[30129.876619] other info that might help us debug this: - -[30129.876620] Chain exists of: -[30129.876621] console_owner --> &port->lock#2 --> &pool->lock/1 - -[30129.876625] Possible unsafe locking scenario: - -[30129.876626] CPU0 CPU1 -[30129.876626] ---- ---- -[30129.876627] lock(&pool->lock/1); -[30129.876628] lock(&port->lock#2); -[30129.876630] lock(&pool->lock/1); -[30129.876631] lock(console_owner); - -[30129.876633] *** DEADLOCK *** - -[30129.876634] 5 locks held by sysrq.sh/1222: -[30129.876634] #0: ffff8881d3ce0470 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x359/0x650 -[30129.876637] #1: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: __handle_sysrq+0x4d/0x460 -[30129.876640] #2: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: show_workqueue_state+0x5/0xf0 -[30129.876642] #3: ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca -[30129.876645] #4: ffffffff92c39980 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x123/0x420 - -[30129.876648] stack backtrace: -[30129.876649] CPU: 3 PID: 1222 Comm: sysrq.sh Tainted: G S W 5.9.0-rc2+ #3 -[30129.876649] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012 -[30129.876650] Call Trace: -[30129.876650] dump_stack+0x9d/0xe0 -[30129.876651] check_noncircular+0x34f/0x410 -[30129.876653] __lock_acquire+0x2f70/0x4e90 -[30129.876656] lock_acquire+0x1ac/0xad0 -[30129.876658] console_unlock+0x460/0xa90 -[30129.876660] vprintk_emit+0x130/0x420 -[30129.876660] printk+0x9f/0xc5 -[30129.876661] show_pwq+0x154/0x618 -[30129.876662] show_workqueue_state.cold.55+0x193/0x6ca -[30129.876664] __handle_sysrq+0x244/0x460 -[30129.876665] write_sysrq_trigger+0x48/0x4a -[30129.876665] proc_reg_write+0x1a6/0x240 -[30129.876666] vfs_write+0x1a8/0x650 - -It looks like the commit was aimed to protect tty_insert_flip_string and -there is no need for tty_flip_buffer_push to be under this lock. - -Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag") -Signed-off-by: Artem Savkov -Acked-by: Jiri Slaby -Link: https://lore.kernel.org/r/20200902120045.3693075-1-asavkov@redhat.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/tty/pty.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index 00099a8439d21..c6a1d8c4e6894 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -120,10 +120,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) - spin_lock_irqsave(&to->port->lock, flags); - /* Stuff the data into the input queue of the other end */ - c = tty_insert_flip_string(to->port, buf, c); -+ spin_unlock_irqrestore(&to->port->lock, flags); - /* And shovel */ - if (c) - tty_flip_buffer_push(to->port); -- spin_unlock_irqrestore(&to->port->lock, flags); - } - return c; - } --- -2.25.1 - diff --git a/queue-4.19/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch b/queue-4.19/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch deleted file mode 100644 index 0a7714fec8e..00000000000 --- a/queue-4.19/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 0311770c0aaf6953290a9189fc90d719dd8f1cae Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 3 Sep 2020 13:23:24 +0200 -Subject: pwm: lpss: Add range limit check for the base_unit register value - -From: Hans de Goede - -[ Upstream commit ef9f60daab309558c8bb3e086a9a11ee40bd6061 ] - -When the user requests a high enough period ns value, then the -calculations in pwm_lpss_prepare() might result in a base_unit value of 0. - -But according to the data-sheet the way the PWM controller works is that -each input clock-cycle the base_unit gets added to a N bit counter and -that counter overflowing determines the PWM output frequency. Adding 0 -to the counter is a no-op. The data-sheet even explicitly states that -writing 0 to the base_unit bits will result in the PWM outputting a -continuous 0 signal. - -When the user requestes a low enough period ns value, then the -calculations in pwm_lpss_prepare() might result in a base_unit value -which is bigger then base_unit_range - 1. Currently the codes for this -deals with this by applying a mask: - - base_unit &= (base_unit_range - 1); - -But this means that we let the value overflow the range, we throw away the -higher bits and store whatever value is left in the lower bits into the -register leading to a random output frequency, rather then clamping the -output frequency to the highest frequency which the hardware can do. - -This commit fixes both issues by clamping the base_unit value to be -between 1 and (base_unit_range - 1). - -Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit") -Reviewed-by: Andy Shevchenko -Acked-by: Thierry Reding -Signed-off-by: Hans de Goede -Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-5-hdegoede@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/pwm/pwm-lpss.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c -index da63c029aa286..69f8be065919e 100644 ---- a/drivers/pwm/pwm-lpss.c -+++ b/drivers/pwm/pwm-lpss.c -@@ -109,6 +109,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, - freq *= base_unit_range; - - base_unit = DIV_ROUND_CLOSEST_ULL(freq, c); -+ /* base_unit must not be 0 and we also want to avoid overflowing it */ -+ base_unit = clamp_val(base_unit, 1, base_unit_range - 1); - - on_time_div = 255ULL * duty_ns; - do_div(on_time_div, period_ns); -@@ -117,7 +119,6 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, - orig_ctrl = ctrl = pwm_lpss_read(pwm); - ctrl &= ~PWM_ON_TIME_DIV_MASK; - ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT); -- base_unit &= (base_unit_range - 1); - ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT; - ctrl |= on_time_div; - --- -2.25.1 - diff --git a/queue-4.19/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch b/queue-4.19/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch deleted file mode 100644 index f5f11c5e42b..00000000000 --- a/queue-4.19/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch +++ /dev/null @@ -1,68 +0,0 @@ -From af477ccfb2fe7b1c65ca345fa87677c3ffeb3664 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 3 Sep 2020 13:23:23 +0200 -Subject: pwm: lpss: Fix off by one error in base_unit math in - pwm_lpss_prepare() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Hans de Goede - -[ Upstream commit 181f4d2f44463fe09fe4df02e03095cb87151c29 ] - -According to the data-sheet the way the PWM controller works is that -each input clock-cycle the base_unit gets added to a N bit counter and -that counter overflowing determines the PWM output frequency. - -So assuming e.g. a 16 bit counter this means that if base_unit is set to 1, -after 65535 input clock-cycles the counter has been increased from 0 to -65535 and it will overflow on the next cycle, so it will overflow after -every 65536 clock cycles and thus the calculations done in -pwm_lpss_prepare() should use 65536 and not 65535. - -This commit fixes this. Note this also aligns the calculations in -pwm_lpss_prepare() with those in pwm_lpss_get_state(). - -Note this effectively reverts commit 684309e5043e ("pwm: lpss: Avoid -potential overflow of base_unit"). The next patch in this series really -fixes the potential overflow of the base_unit value. - -Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit") -Reviewed-by: Andy Shevchenko -Acked-by: Uwe Kleine-König -Acked-by: Thierry Reding -Signed-off-by: Hans de Goede -Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-4-hdegoede@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/pwm/pwm-lpss.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c -index 7a4a6406cf69a..da63c029aa286 100644 ---- a/drivers/pwm/pwm-lpss.c -+++ b/drivers/pwm/pwm-lpss.c -@@ -105,7 +105,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, - * The equation is: - * base_unit = round(base_unit_range * freq / c) - */ -- base_unit_range = BIT(lpwm->info->base_unit_bits) - 1; -+ base_unit_range = BIT(lpwm->info->base_unit_bits); - freq *= base_unit_range; - - base_unit = DIV_ROUND_CLOSEST_ULL(freq, c); -@@ -116,8 +116,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, - - orig_ctrl = ctrl = pwm_lpss_read(pwm); - ctrl &= ~PWM_ON_TIME_DIV_MASK; -- ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT); -- base_unit &= base_unit_range; -+ ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT); -+ base_unit &= (base_unit_range - 1); - ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT; - ctrl |= on_time_div; - --- -2.25.1 - diff --git a/queue-4.19/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch b/queue-4.19/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch deleted file mode 100644 index e891a1bad87..00000000000 --- a/queue-4.19/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 3b7528e417c471da7fbcb1f748751ddfc37d7421 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 25 Sep 2020 14:22:24 +0100 -Subject: qtnfmac: fix resource leaks on unsupported iftype error return path - -From: Colin Ian King - -[ Upstream commit 63f6982075d890d7563e2469643f05a37d193f01 ] - -Currently if an unsupported iftype is detected the error return path -does not free the cmd_skb leading to a resource leak. Fix this by -free'ing cmd_skb. - -Addresses-Coverity: ("Resource leak") -Fixes: 805b28c05c8e ("qtnfmac: prepare for AP_VLAN interface type support") -Signed-off-by: Colin Ian King -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200925132224.21638-1-colin.king@canonical.com -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/quantenna/qtnfmac/commands.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c -index 734844b34c266..dd473b206f123 100644 ---- a/drivers/net/wireless/quantenna/qtnfmac/commands.c -+++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c -@@ -894,6 +894,7 @@ int qtnf_cmd_send_del_intf(struct qtnf_vif *vif) - default: - pr_warn("VIF%u.%u: unsupported iftype %d\n", vif->mac->macid, - vif->vifid, vif->wdev.iftype); -+ dev_kfree_skb(cmd_skb); - ret = -EINVAL; - goto out; - } -@@ -2212,6 +2213,7 @@ int qtnf_cmd_send_change_sta(struct qtnf_vif *vif, const u8 *mac, - break; - default: - pr_err("unsupported iftype %d\n", vif->wdev.iftype); -+ dev_kfree_skb(cmd_skb); - ret = -EINVAL; - goto out; - } --- -2.25.1 - diff --git a/queue-4.19/quota-clear-padding-in-v2r1_mem2diskdqb.patch b/queue-4.19/quota-clear-padding-in-v2r1_mem2diskdqb.patch deleted file mode 100644 index d1afa5bb30f..00000000000 --- a/queue-4.19/quota-clear-padding-in-v2r1_mem2diskdqb.patch +++ /dev/null @@ -1,114 +0,0 @@ -From e5f2e701c083b6d9f9db4f99310b19830b4b866d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 24 Sep 2020 11:36:19 -0700 -Subject: quota: clear padding in v2r1_mem2diskdqb() - -From: Eric Dumazet - -[ Upstream commit 3d3dc274ce736227e3197868ff749cff2f175f63 ] - -Freshly allocated memory contains garbage, better make sure -to init all struct v2r1_disk_dqblk fields to avoid KMSAN report: - -BUG: KMSAN: uninit-value in qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218 -CPU: 0 PID: 23373 Comm: syz-executor.1 Not tainted 5.9.0-rc4-syzkaller #0 -Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 -Call Trace: - __dump_stack lib/dump_stack.c:77 [inline] - dump_stack+0x21c/0x280 lib/dump_stack.c:118 - kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122 - __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:219 - qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218 - v2r1_mem2diskdqb+0x43d/0x710 fs/quota/quota_v2.c:285 - qtree_write_dquot+0x226/0x870 fs/quota/quota_tree.c:394 - v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333 - dquot_commit+0x4af/0x600 fs/quota/dquot.c:482 - ext4_write_dquot fs/ext4/super.c:5934 [inline] - ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985 - mark_dquot_dirty fs/quota/dquot.c:347 [inline] - mark_all_dquot_dirty fs/quota/dquot.c:385 [inline] - dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755 - __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155 - ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686 - vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283 - do_tmpfile fs/namei.c:3316 [inline] - path_openat+0x4035/0x6a90 fs/namei.c:3359 - do_filp_open+0x2b8/0x710 fs/namei.c:3395 - do_sys_openat2+0xa88/0x1140 fs/open.c:1168 - do_sys_open fs/open.c:1184 [inline] - __do_compat_sys_openat fs/open.c:1242 [inline] - __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240 - __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240 - do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] - __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 - do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 - do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 - entry_SYSENTER_compat_after_hwframe+0x4d/0x5c -RIP: 0023:0xf7ff4549 -Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 -RSP: 002b:00000000f55cd0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000127 -RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000000 -RDX: 0000000000410481 RSI: 0000000000000000 RDI: 0000000000000000 -RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 -R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 -R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 - -Uninit was created at: - kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline] - kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:126 - kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80 - slab_alloc_node mm/slub.c:2907 [inline] - slab_alloc mm/slub.c:2916 [inline] - __kmalloc+0x2bb/0x4b0 mm/slub.c:3982 - kmalloc include/linux/slab.h:559 [inline] - getdqbuf+0x56/0x150 fs/quota/quota_tree.c:52 - qtree_write_dquot+0xf2/0x870 fs/quota/quota_tree.c:378 - v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333 - dquot_commit+0x4af/0x600 fs/quota/dquot.c:482 - ext4_write_dquot fs/ext4/super.c:5934 [inline] - ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985 - mark_dquot_dirty fs/quota/dquot.c:347 [inline] - mark_all_dquot_dirty fs/quota/dquot.c:385 [inline] - dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755 - __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155 - ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686 - vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283 - do_tmpfile fs/namei.c:3316 [inline] - path_openat+0x4035/0x6a90 fs/namei.c:3359 - do_filp_open+0x2b8/0x710 fs/namei.c:3395 - do_sys_openat2+0xa88/0x1140 fs/open.c:1168 - do_sys_open fs/open.c:1184 [inline] - __do_compat_sys_openat fs/open.c:1242 [inline] - __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240 - __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240 - do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] - __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 - do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 - do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 - entry_SYSENTER_compat_after_hwframe+0x4d/0x5c - -Fixes: 498c60153ebb ("quota: Implement quota format with 64-bit space and inode limits") -Link: https://lore.kernel.org/r/20200924183619.4176790-1-edumazet@google.com -Signed-off-by: Eric Dumazet -Cc: Jan Kara -Signed-off-by: Jan Kara -Signed-off-by: Sasha Levin ---- - fs/quota/quota_v2.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c -index a73e5b34db418..5d4dc0f84f202 100644 ---- a/fs/quota/quota_v2.c -+++ b/fs/quota/quota_v2.c -@@ -283,6 +283,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot) - d->dqb_curspace = cpu_to_le64(m->dqb_curspace); - d->dqb_btime = cpu_to_le64(m->dqb_btime); - d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id)); -+ d->dqb_pad = 0; - if (qtree_entry_unused(info, dp)) - d->dqb_itime = cpu_to_le64(1); - } --- -2.25.1 - diff --git a/queue-4.19/r8169-fix-data-corruption-issue-on-rtl8402.patch b/queue-4.19/r8169-fix-data-corruption-issue-on-rtl8402.patch deleted file mode 100644 index cbb2b7ab2f8..00000000000 --- a/queue-4.19/r8169-fix-data-corruption-issue-on-rtl8402.patch +++ /dev/null @@ -1,92 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Heiner Kallweit -Date: Thu, 1 Oct 2020 09:23:02 +0200 -Subject: r8169: fix data corruption issue on RTL8402 - -From: Heiner Kallweit - -[ Upstream commit ef9da46ddef071e1bbb943afbbe9b38771855554 ] - -Petr reported that after resume from suspend RTL8402 partially -truncates incoming packets, and re-initializing register RxConfig -before the actual chip re-initialization sequence is needed to avoid -the issue. - -Reported-by: Petr Tesarik -Proposed-by: Petr Tesarik -Tested-by: Petr Tesarik -Signed-off-by: Heiner Kallweit -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/realtek/r8169.c | 46 +++++++++++++++++++---------------- - 1 file changed, 25 insertions(+), 21 deletions(-) - ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -4111,6 +4111,27 @@ static void rtl_rar_set(struct rtl8169_p - rtl_unlock_work(tp); - } - -+static void rtl_init_rxcfg(struct rtl8169_private *tp) -+{ -+ switch (tp->mac_version) { -+ case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06: -+ case RTL_GIGA_MAC_VER_10 ... RTL_GIGA_MAC_VER_17: -+ RTL_W32(tp, RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); -+ break; -+ case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24: -+ case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_36: -+ case RTL_GIGA_MAC_VER_38: -+ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); -+ break; -+ case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51: -+ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -+ break; -+ default: -+ RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST); -+ break; -+ } -+} -+ - static int rtl_set_mac_address(struct net_device *dev, void *p) - { - struct rtl8169_private *tp = netdev_priv(dev); -@@ -4128,6 +4149,10 @@ static int rtl_set_mac_address(struct ne - - pm_runtime_put_noidle(d); - -+ /* Reportedly at least Asus X453MA truncates packets otherwise */ -+ if (tp->mac_version == RTL_GIGA_MAC_VER_37) -+ rtl_init_rxcfg(tp); -+ - return 0; - } - -@@ -4289,27 +4314,6 @@ static void rtl_pll_power_up(struct rtl8 - } - } - --static void rtl_init_rxcfg(struct rtl8169_private *tp) --{ -- switch (tp->mac_version) { -- case RTL_GIGA_MAC_VER_01 ... RTL_GIGA_MAC_VER_06: -- case RTL_GIGA_MAC_VER_10 ... RTL_GIGA_MAC_VER_17: -- RTL_W32(tp, RxConfig, RX_FIFO_THRESH | RX_DMA_BURST); -- break; -- case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24: -- case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_36: -- case RTL_GIGA_MAC_VER_38: -- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST); -- break; -- case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_51: -- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF); -- break; -- default: -- RTL_W32(tp, RxConfig, RX128_INT_EN | RX_DMA_BURST); -- break; -- } --} -- - static void rtl8169_init_ring_indexes(struct rtl8169_private *tp) - { - tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0; diff --git a/queue-4.19/r8169-fix-operation-under-forced-interrupt-threading.patch b/queue-4.19/r8169-fix-operation-under-forced-interrupt-threading.patch deleted file mode 100644 index 56f4c5d2035..00000000000 --- a/queue-4.19/r8169-fix-operation-under-forced-interrupt-threading.patch +++ /dev/null @@ -1,58 +0,0 @@ -From foo@baz Sat Oct 24 11:10:06 AM CEST 2020 -From: Heiner Kallweit -Date: Sun, 18 Oct 2020 18:38:59 +0200 -Subject: r8169: fix operation under forced interrupt threading - -From: Heiner Kallweit - -[ Upstream commit 424a646e072a887aa87283b53aa6f8b19c2a7bef ] - -For several network drivers it was reported that using -__napi_schedule_irqoff() is unsafe with forced threading. One way to -fix this is switching back to __napi_schedule, but then we lose the -benefit of the irqoff version in general. As stated by Eric it doesn't -make sense to make the minimal hard irq handlers in drivers using NAPI -a thread. Therefore ensure that the hard irq handler is never -thread-ified. - -Fixes: 9a899a35b0d6 ("r8169: switch to napi_schedule_irqoff") -Link: https://lkml.org/lkml/2020/10/18/19 -Signed-off-by: Heiner Kallweit -Link: https://lore.kernel.org/r/4d3ef84a-c812-5072-918a-22a6f6468310@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/realtek/r8169.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -6830,7 +6830,7 @@ static int rtl8169_close(struct net_devi - - phy_disconnect(dev->phydev); - -- pci_free_irq(pdev, 0, tp); -+ free_irq(pci_irq_vector(pdev, 0), tp); - - dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray, - tp->RxPhyAddr); -@@ -6885,8 +6885,8 @@ static int rtl_open(struct net_device *d - - rtl_request_firmware(tp); - -- retval = pci_request_irq(pdev, 0, rtl8169_interrupt, NULL, tp, -- dev->name); -+ retval = request_irq(pci_irq_vector(pdev, 0), rtl8169_interrupt, -+ IRQF_NO_THREAD | IRQF_SHARED, dev->name, tp); - if (retval < 0) - goto err_release_fw_2; - -@@ -6919,7 +6919,7 @@ out: - return retval; - - err_free_irq: -- pci_free_irq(pdev, 0, tp); -+ free_irq(pci_irq_vector(pdev, 0), tp); - err_release_fw_2: - rtl_release_firmware(tp); - rtl8169_rx_clear(tp); diff --git a/queue-4.19/rdma-qedr-fix-inline-size-returned-for-iwarp.patch b/queue-4.19/rdma-qedr-fix-inline-size-returned-for-iwarp.patch deleted file mode 100644 index c125fb4f0f1..00000000000 --- a/queue-4.19/rdma-qedr-fix-inline-size-returned-for-iwarp.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 15c72fa117b67d8126ef6a39964671643e1162b7 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 19:57:40 +0300 -Subject: RDMA/qedr: Fix inline size returned for iWARP - -From: Michal Kalderon - -[ Upstream commit fbf58026b2256e9cd5f241a4801d79d3b2b7b89d ] - -commit 59e8970b3798 ("RDMA/qedr: Return max inline data in QP query -result") changed query_qp max_inline size to return the max roce inline -size. When iwarp was introduced, this should have been modified to return -the max inline size based on protocol. This size is cached in the device -attributes - -Fixes: 69ad0e7fe845 ("RDMA/qedr: Add support for iWARP in user space") -Link: https://lore.kernel.org/r/20200902165741.8355-8-michal.kalderon@marvell.com -Signed-off-by: Michal Kalderon -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/hw/qedr/verbs.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c -index 7b26afc7fef35..f847f0a9f204d 100644 ---- a/drivers/infiniband/hw/qedr/verbs.c -+++ b/drivers/infiniband/hw/qedr/verbs.c -@@ -2522,7 +2522,7 @@ int qedr_query_qp(struct ib_qp *ibqp, - qp_attr->cap.max_recv_wr = qp->rq.max_wr; - qp_attr->cap.max_send_sge = qp->sq.max_sges; - qp_attr->cap.max_recv_sge = qp->rq.max_sges; -- qp_attr->cap.max_inline_data = ROCE_REQ_MAX_INLINE_DATA_SIZE; -+ qp_attr->cap.max_inline_data = dev->attr.max_inline; - qp_init_attr->cap = qp_attr->cap; - - qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE; --- -2.25.1 - diff --git a/queue-4.19/rdma-qedr-fix-use-of-uninitialized-field.patch b/queue-4.19/rdma-qedr-fix-use-of-uninitialized-field.patch deleted file mode 100644 index 42c77728949..00000000000 --- a/queue-4.19/rdma-qedr-fix-use-of-uninitialized-field.patch +++ /dev/null @@ -1,37 +0,0 @@ -From b847e072a2d9a3f731f88982d322666f3f87b9f3 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 2 Sep 2020 19:57:36 +0300 -Subject: RDMA/qedr: Fix use of uninitialized field - -From: Michal Kalderon - -[ Upstream commit a379ad54e55a12618cae7f6333fd1b3071de9606 ] - -dev->attr.page_size_caps was used uninitialized when setting device -attributes - -Fixes: ec72fce401c6 ("qedr: Add support for RoCE HW init") -Link: https://lore.kernel.org/r/20200902165741.8355-4-michal.kalderon@marvell.com -Signed-off-by: Michal Kalderon -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/hw/qedr/main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c -index d1680d3b58250..2a82661620fe7 100644 ---- a/drivers/infiniband/hw/qedr/main.c -+++ b/drivers/infiniband/hw/qedr/main.c -@@ -604,7 +604,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev) - qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx); - - /* Part 2 - check capabilities */ -- page_size = ~dev->attr.page_size_caps + 1; -+ page_size = ~qed_attr->page_size_caps + 1; - if (page_size > PAGE_SIZE) { - DP_ERR(dev, - "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", --- -2.25.1 - diff --git a/queue-4.19/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch b/queue-4.19/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch deleted file mode 100644 index ebd8358463a..00000000000 --- a/queue-4.19/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch +++ /dev/null @@ -1,38 +0,0 @@ -From ddee81c301392589bff83b3c963e1fed75b02b80 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 18 Aug 2020 15:05:22 +0300 -Subject: RDMA/ucma: Add missing locking around rdma_leave_multicast() - -From: Jason Gunthorpe - -[ Upstream commit 38e03d092699891c3237b5aee9e8029d4ede0956 ] - -All entry points to the rdma_cm from a ULP must be single threaded, -even this error unwinds. Add the missing locking. - -Fixes: 7c11910783a1 ("RDMA/ucma: Put a lock around every call to the rdma_cm layer") -Link: https://lore.kernel.org/r/20200818120526.702120-11-leon@kernel.org -Signed-off-by: Leon Romanovsky -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/core/ucma.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 0c095c8c0ac5b..01052de6bedbf 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -1476,7 +1476,9 @@ static ssize_t ucma_process_join(struct ucma_file *file, - return 0; - - err3: -+ mutex_lock(&ctx->mutex); - rdma_leave_multicast(ctx->cm_id, (struct sockaddr *) &mc->addr); -+ mutex_unlock(&ctx->mutex); - ucma_cleanup_mc_events(mc); - err2: - mutex_lock(&mut); --- -2.25.1 - diff --git a/queue-4.19/rdma-ucma-fix-locking-for-ctx-events_reported.patch b/queue-4.19/rdma-ucma-fix-locking-for-ctx-events_reported.patch deleted file mode 100644 index e4f39099cbd..00000000000 --- a/queue-4.19/rdma-ucma-fix-locking-for-ctx-events_reported.patch +++ /dev/null @@ -1,58 +0,0 @@ -From de8a786a08ae3efd94e198a201ad8f3574fdc934 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 18 Aug 2020 15:05:21 +0300 -Subject: RDMA/ucma: Fix locking for ctx->events_reported - -From: Jason Gunthorpe - -[ Upstream commit 98837c6c3d7285f6eca86480b6f7fac6880e27a8 ] - -This value is locked under the file->mut, ensure it is held whenever -touching it. - -The case in ucma_migrate_id() is a race, while in ucma_free_uctx() it is -already not possible for the write side to run, the movement is just for -clarity. - -Fixes: 88314e4dda1e ("RDMA/cma: add support for rdma_migrate_id()") -Link: https://lore.kernel.org/r/20200818120526.702120-10-leon@kernel.org -Signed-off-by: Leon Romanovsky -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/core/ucma.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index 2acc30c3d5b2d..0c095c8c0ac5b 100644 ---- a/drivers/infiniband/core/ucma.c -+++ b/drivers/infiniband/core/ucma.c -@@ -588,6 +588,7 @@ static int ucma_free_ctx(struct ucma_context *ctx) - list_move_tail(&uevent->list, &list); - } - list_del(&ctx->list); -+ events_reported = ctx->events_reported; - mutex_unlock(&ctx->file->mut); - - list_for_each_entry_safe(uevent, tmp, &list, list) { -@@ -597,7 +598,6 @@ static int ucma_free_ctx(struct ucma_context *ctx) - kfree(uevent); - } - -- events_reported = ctx->events_reported; - mutex_destroy(&ctx->mutex); - kfree(ctx); - return events_reported; -@@ -1644,7 +1644,9 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, - - cur_file = ctx->file; - if (cur_file == new_file) { -+ mutex_lock(&cur_file->mut); - resp.events_reported = ctx->events_reported; -+ mutex_unlock(&cur_file->mut); - goto response; - } - --- -2.25.1 - diff --git a/queue-4.19/regulator-resolve-supply-after-creating-regulator.patch b/queue-4.19/regulator-resolve-supply-after-creating-regulator.patch deleted file mode 100644 index 56f9ecea169..00000000000 --- a/queue-4.19/regulator-resolve-supply-after-creating-regulator.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 5baf19bcff016515a750bd9cfa7164d0ca575fe6 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sat, 26 Sep 2020 23:32:41 +0200 -Subject: regulator: resolve supply after creating regulator -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Michał Mirosław - -[ Upstream commit aea6cb99703e17019e025aa71643b4d3e0a24413 ] - -When creating a new regulator its supply cannot create the sysfs link -because the device is not yet published. Remove early supply resolving -since it will be done later anyway. This makes the following error -disappear and the symlinks get created instead. - - DCDC_REG1: supplied by VSYS - VSYS: could not add device link regulator.3 err -2 - -Note: It doesn't fix the problem for bypassed regulators, though. - -Fixes: 45389c47526d ("regulator: core: Add early supply resolution for regulators") -Signed-off-by: Michał Mirosław -Link: https://lore.kernel.org/r/ba09e0a8617ffeeb25cb4affffe6f3149319cef8.1601155770.git.mirq-linux@rere.qmqm.pl -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin ---- - drivers/regulator/core.c | 21 +++++++++++++-------- - 1 file changed, 13 insertions(+), 8 deletions(-) - -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 37e6270749eef..c290c89421314 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4363,15 +4363,20 @@ regulator_register(const struct regulator_desc *regulator_desc, - else if (regulator_desc->supply_name) - rdev->supply_name = regulator_desc->supply_name; - -- /* -- * Attempt to resolve the regulator supply, if specified, -- * but don't return an error if we fail because we will try -- * to resolve it again later as more regulators are added. -- */ -- if (regulator_resolve_supply(rdev)) -- rdev_dbg(rdev, "unable to resolve supply\n"); -- - ret = set_machine_constraints(rdev, constraints); -+ if (ret == -EPROBE_DEFER) { -+ /* Regulator might be in bypass mode and so needs its supply -+ * to set the constraints */ -+ /* FIXME: this currently triggers a chicken-and-egg problem -+ * when creating -SUPPLY symlink in sysfs to a regulator -+ * that is just being created */ -+ ret = regulator_resolve_supply(rdev); -+ if (!ret) -+ ret = set_machine_constraints(rdev, constraints); -+ else -+ rdev_dbg(rdev, "unable to resolve supply early: %pe\n", -+ ERR_PTR(ret)); -+ } - if (ret < 0) - goto wash; - --- -2.25.1 - diff --git a/queue-4.19/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch b/queue-4.19/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch deleted file mode 100644 index fedbf54e3e3..00000000000 --- a/queue-4.19/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 2e2adfc93f459d4c59866e4277ddcabb32b8da19 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 28 Sep 2020 12:13:00 +0300 -Subject: scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() - -From: Dan Carpenter - -[ Upstream commit 38b2db564d9ab7797192ef15d7aade30633ceeae ] - -The be_fill_queue() function can only fail when "eq_vaddress" is NULL and -since it's non-NULL here that means the function call can't fail. But -imagine if it could, then in that situation we would want to store the -"paddr" so that dma memory can be released. - -Link: https://lore.kernel.org/r/20200928091300.GD377727@mwanda -Fixes: bfead3b2cb46 ("[SCSI] be2iscsi: Adding msix and mcc_rings V3") -Signed-off-by: Dan Carpenter -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/be2iscsi/be_main.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c -index 3660059784f74..6221a8372cee2 100644 ---- a/drivers/scsi/be2iscsi/be_main.c -+++ b/drivers/scsi/be2iscsi/be_main.c -@@ -3039,6 +3039,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, - goto create_eq_error; - } - -+ mem->dma = paddr; - mem->va = eq_vaddress; - ret = be_fill_queue(eq, phba->params.num_eq_entries, - sizeof(struct be_eq_entry), eq_vaddress); -@@ -3048,7 +3049,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, - goto create_eq_error; - } - -- mem->dma = paddr; - ret = beiscsi_cmd_eq_create(&phba->ctrl, eq, - BEISCSI_EQ_DELAY_DEF); - if (ret) { -@@ -3105,6 +3105,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, - goto create_cq_error; - } - -+ mem->dma = paddr; - ret = be_fill_queue(cq, phba->params.num_cq_entries, - sizeof(struct sol_cqe), cq_vaddress); - if (ret) { -@@ -3114,7 +3115,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, - goto create_cq_error; - } - -- mem->dma = paddr; - ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false, - false, 0); - if (ret) { --- -2.25.1 - diff --git a/queue-4.19/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch b/queue-4.19/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch deleted file mode 100644 index a04710e58fc..00000000000 --- a/queue-4.19/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch +++ /dev/null @@ -1,38 +0,0 @@ -From b801e7aa153cc5c9413fb05964c9efd63c88449e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 19:15:31 +0800 -Subject: scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() - -From: Tianjia Zhang - -[ Upstream commit 44f4daf8678ae5f08c93bbe70792f90cd88e4649 ] - -On an error exit path, a negative error code should be returned instead of -a positive return value. - -Link: https://lore.kernel.org/r/20200802111531.5065-1-tianjia.zhang@linux.alibaba.com -Fixes: f40e74ffa3de ("csiostor:firmware upgrade fix") -Cc: Praveen Madhavan -Signed-off-by: Tianjia Zhang -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/csiostor/csio_hw.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c -index e519238864758..1b6f9351b43f9 100644 ---- a/drivers/scsi/csiostor/csio_hw.c -+++ b/drivers/scsi/csiostor/csio_hw.c -@@ -2384,7 +2384,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info, - FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), - FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), - FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); -- ret = EINVAL; -+ ret = -EINVAL; - goto bye; - } - --- -2.25.1 - diff --git a/queue-4.19/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch b/queue-4.19/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch deleted file mode 100644 index 7a0af0b54ce..00000000000 --- a/queue-4.19/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 7976e1c2a75247fc88a125e20e55ee45274dd5d8 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 19:15:30 +0800 -Subject: scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() - -From: Tianjia Zhang - -[ Upstream commit ca4fb89a3d714a770e9c73c649da830f3f4a5326 ] - -On an error exit path, a negative error code should be returned instead of -a positive return value. - -Link: https://lore.kernel.org/r/20200802111530.5020-1-tianjia.zhang@linux.alibaba.com -Fixes: 8777e4314d39 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine") -Cc: Quinn Tran -Signed-off-by: Tianjia Zhang -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/qla2xxx/qla_nvme.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 3e2f8ce1d9a97..7821c1695e824 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -676,7 +676,7 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha) - struct nvme_fc_port_template *tmpl; - struct qla_hw_data *ha; - struct nvme_fc_port_info pinfo; -- int ret = EINVAL; -+ int ret = -EINVAL; - - if (!IS_ENABLED(CONFIG_NVME_FC)) - return ret; --- -2.25.1 - diff --git a/queue-4.19/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch b/queue-4.19/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch deleted file mode 100644 index 3da09befb73..00000000000 --- a/queue-4.19/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 324e95f7c365d384ea00f9070d8f4ac8cdc06b55 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 12:15:27 +0200 -Subject: scsi: qla4xxx: Fix an error handling path in - 'qla4xxx_get_host_stats()' - -From: Christophe JAILLET - -[ Upstream commit 574918e69720fe62ab3eb42ec3750230c8d16b06 ] - -Update the size used in 'dma_free_coherent()' in order to match the one -used in the corresponding 'dma_alloc_coherent()'. - -Link: https://lore.kernel.org/r/20200802101527.676054-1-christophe.jaillet@wanadoo.fr -Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support") -Signed-off-by: Christophe JAILLET -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/scsi/qla4xxx/ql4_os.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c -index f59b8982b2883..4ba9f46fcf748 100644 ---- a/drivers/scsi/qla4xxx/ql4_os.c -+++ b/drivers/scsi/qla4xxx/ql4_os.c -@@ -1221,7 +1221,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len) - le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error); - exit_host_stats: - if (ql_iscsi_stats) -- dma_free_coherent(&ha->pdev->dev, host_stats_size, -+ dma_free_coherent(&ha->pdev->dev, stats_size, - ql_iscsi_stats, iscsi_stats_dma); - - ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", --- -2.25.1 - diff --git a/queue-4.19/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch b/queue-4.19/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch deleted file mode 100644 index 4e69961f15e..00000000000 --- a/queue-4.19/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 5fe72ebcf53c124de588af5e38c4a98f9f4c6d80 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 23 Sep 2020 17:19:20 -0700 -Subject: scsi: target: tcmu: Fix warning: 'page' may be used uninitialized - -From: John Donnelly - -[ Upstream commit 61741d8699e1fc764a309ebd20211bb1cb193110 ] - -Corrects drivers/target/target_core_user.c:688:6: warning: 'page' may be -used uninitialized. - -Link: https://lore.kernel.org/r/20200924001920.43594-1-john.p.donnelly@oracle.com -Fixes: 3c58f737231e ("scsi: target: tcmu: Optimize use of flush_dcache_page") -Cc: Mike Christie -Acked-by: Mike Christie -Signed-off-by: John Donnelly -Signed-off-by: Martin K. Petersen -Signed-off-by: Sasha Levin ---- - drivers/target/target_core_user.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index 99314e5162447..0219b5a865bee 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -680,7 +680,7 @@ static void scatter_data_area(struct tcmu_dev *udev, - void *from, *to = NULL; - size_t copy_bytes, to_offset, offset; - struct scatterlist *sg; -- struct page *page; -+ struct page *page = NULL; - - for_each_sg(data_sg, sg, data_nents, i) { - int sg_remaining = sg->length; --- -2.25.1 - diff --git a/queue-4.19/series b/queue-4.19/series index 10090b0a0fb..02da4960eab 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,149 +1,3 @@ -#ibmveth-switch-order-of-ibmveth_helper-calls.patch -#ibmveth-identify-ingress-large-send-packets.patch -#ipv4-restore-flowi4_oif-update-before-call-to-xfrm_lookup_route.patch -#mlx4-handle-non-napi-callers-to-napi_poll.patch -#net-fec-fix-phy_device-lookup-for-phy_reset_after_clk_enable.patch -#net-fec-fix-phy-init-after-phy_reset_after_clk_enable.patch -#net-fix-pos-incrementment-in-ipv6_route_seq_next.patch -#net-smc-fix-valid-dmbe-buffer-sizes.patch -#net-usb-qmi_wwan-add-cellient-mpl200-card.patch -#tipc-fix-the-skb_unshare-in-tipc_buf_append.patch -#net-ipv4-always-honour-route-mtu-during-forwarding.patch -#r8169-fix-data-corruption-issue-on-rtl8402.patch -#net-tls-sendfile-fails-with-ktls-offload.patch -#binder-fix-uaf-when-releasing-todo-list.patch -#alsa-bebob-potential-info-leak-in-hwdep_read.patch -#chelsio-chtls-fix-socket-lock.patch -#chelsio-chtls-correct-netdevice-for-vlan-interface.patch -#chelsio-chtls-correct-function-return-and-return-type.patch -#net-hdlc-in-hdlc_rcv-check-to-make-sure-dev-is-an-hdlc-device.patch -#net-hdlc_raw_eth-clear-the-iff_tx_skb_sharing-flag-after-calling-ether_setup.patch -#net-sched-act_tunnel_key-fix-oob-write-in-case-of-ipv6-erspan-tunnels.patch -#nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download.patch -#tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch -#r8169-fix-operation-under-forced-interrupt-threading.patch -#icmp-randomize-the-global-rate-limiter.patch -#alsa-hda-realtek-enable-audio-jacks-of-asus-d700sa-with-alc887.patch -#cifs-remove-bogus-debug-code.patch -#cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch -#kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch -#kvm-svm-initialize-prev_ga_tag-before-use.patch -#ima-don-t-ignore-errors-from-crypto_shash_update.patch -#crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch -#edac-i5100-fix-error-handling-order-in-i5100_init_on.patch -#edac-ti-fix-handling-of-platform_get_irq-error.patch -#x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch -#drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch -#x86-nmi-fix-nmi_handle-duration-miscalculation.patch -#x86-events-amd-iommu-fix-sizeof-mismatch.patch -#crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch -#crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch -#crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch -#crypto-picoxcell-fix-potential-race-condition-bug.patch -#media-tuner-simple-fix-regression-in-simple_set_radi.patch -#media-revert-media-exynos4-is-add-missed-check-for-p.patch -#media-m5mols-check-function-pointer-in-m5mols_sensor.patch -#media-uvcvideo-set-media-controller-entity-functions.patch -#media-uvcvideo-silence-shift-out-of-bounds-warning.patch -#media-omap3isp-fix-memleak-in-isp_probe.patch -#crypto-omap-sham-fix-digcnt-register-handling-with-e.patch -#hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch -#cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch -#media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch -#media-tc358743-initialize-variable.patch -#media-tc358743-cleanup-tc358743_cec_isr.patch -#media-rcar-vin-fix-a-reference-count-leak.patch -#media-rockchip-rga-fix-a-reference-count-leak.patch -#media-platform-fcp-fix-a-reference-count-leak.patch -#media-camss-fix-a-reference-count-leak.patch -#media-s5p-mfc-fix-a-reference-count-leak.patch -#media-stm32-dcmi-fix-a-reference-count-leak.patch -#media-ti-vpe-fix-a-missing-check-and-reference-count.patch -#regulator-resolve-supply-after-creating-regulator.patch -#pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch -#spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch -#spi-spi-s3c64xx-check-return-values.patch -#ath10k-provide-survey-info-as-accumulated-data.patch -#bluetooth-hci_uart-cancel-init-work-before-unregiste.patch -#ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch -#ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch -#ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch -#wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch -#asoc-qcom-lpass-platform-fix-memory-leak.patch -#asoc-qcom-lpass-cpu-fix-concurrency-issue.patch -#brcmfmac-check-ndev-pointer.patch -#mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch -#staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch -#drm-gma500-fix-error-check.patch -#scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch -#scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch -#scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch -#backlight-sky81452-backlight-fix-refcount-imbalance-.patch -#vmci-check-return-value-of-get_user_pages_fast-for-e.patch -#tty-serial-earlycon-dependency.patch -#tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch -#pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch -#pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch -#pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch -#drivers-virt-fsl_hypervisor-fix-error-handling-path.patch -#video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch -#video-fbdev-sis-fix-null-ptr-dereference.patch -#video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch -#hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch -#pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch -#pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch -#net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch -#net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch -#cpufreq-armada-37xx-add-missing-module_device_table.patch -#net-dsa-rtl8366-check-validity-of-passed-vlans.patch -#net-dsa-rtl8366-refactor-vlan-pvid-init.patch -#net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch -#net-dsa-rtl8366rb-support-all-4096-vlans.patch -#ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch -#misc-mic-scif-fix-error-handling-path.patch -#alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch -#usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch -#quota-clear-padding-in-v2r1_mem2diskdqb.patch -#slimbus-core-check-get_addr-before-removing-laddr-id.patch -#slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch -#slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch -#hid-hid-input-fix-stylus-battery-reporting.patch -#nvmem-core-fix-possibly-memleak-when-use-nvmem_cell_.patch -#qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch -#net-enic-cure-the-enic-api-locking-trainwreck.patch -#mfd-sm501-fix-leaks-in-probe.patch -#iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch -#usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch -#usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch -#nl80211-fix-non-split-wiphy-information.patch -#usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch -#scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch -#scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch -#platform-x86-mlx-platform-remove-psu-eeprom-configur.patch -#mwifiex-fix-double-free.patch -#ipvs-clear-skb-tstamp-in-forwarding-path.patch -#net-korina-fix-kfree-of-rx-tx-descriptor-array.patch -#netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch -#mm-memcg-fix-device-private-memcg-accounting.patch -#mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch -#ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch -#ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch -#powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch -#powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch -#rdma-ucma-fix-locking-for-ctx-events_reported.patch -#rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch -#mtd-lpddr-fix-excessive-stack-usage-with-clang.patch -#powerpc-pseries-explicitly-reschedule-during-drmem_l.patch -#mtd-mtdoops-don-t-write-panic-data-twice.patch -#arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch -#arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch -#xfs-limit-entries-returned-when-counting-fsmap-recor.patch -#xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch -#rdma-qedr-fix-use-of-uninitialized-field.patch -#rdma-qedr-fix-inline-size-returned-for-iwarp.patch -#powerpc-tau-use-appropriate-temperature-sample-inter.patch -#powerpc-tau-convert-from-timer-to-workqueue.patch -#powerpc-tau-remove-duplicated-set_thresholds-call.patch powerpc-tau-check-processor-type-before-enabling-tau.patch powerpc-tau-disable-tau-between-measurements.patch powerpc-64s-radix-fix-mm_cpumask-trimming-race-vs-kt.patch diff --git a/queue-4.19/slimbus-core-check-get_addr-before-removing-laddr-id.patch b/queue-4.19/slimbus-core-check-get_addr-before-removing-laddr-id.patch deleted file mode 100644 index 8ec71e43b64..00000000000 --- a/queue-4.19/slimbus-core-check-get_addr-before-removing-laddr-id.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 974a453eb3aefba8a6dd9f92c4ca1a97cac36e23 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 25 Sep 2020 10:55:18 +0100 -Subject: slimbus: core: check get_addr before removing laddr ida - -From: Srinivas Kandagatla - -[ Upstream commit f97769fde678e111a1b7b165b380d8a3dfe54f4e ] - -logical address can be either assigned by the SLIMBus controller or the core. -Core uses IDA in cases where get_addr callback is not provided by the -controller. -Core already has this check while allocating IDR, however during absence -reporting this is not checked. This patch fixes this issue. - -Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20200925095520.27316-2-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/slimbus/core.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c -index 943172806a8a7..6e690aaacad1e 100644 ---- a/drivers/slimbus/core.c -+++ b/drivers/slimbus/core.c -@@ -297,8 +297,8 @@ void slim_report_absent(struct slim_device *sbdev) - mutex_lock(&ctrl->lock); - sbdev->is_laddr_valid = false; - mutex_unlock(&ctrl->lock); -- -- ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr); -+ if (!ctrl->get_laddr) -+ ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr); - slim_device_update_status(sbdev, SLIM_DEVICE_STATUS_DOWN); - } - EXPORT_SYMBOL_GPL(slim_report_absent); --- -2.25.1 - diff --git a/queue-4.19/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch b/queue-4.19/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch deleted file mode 100644 index 2d0fe252ad8..00000000000 --- a/queue-4.19/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch +++ /dev/null @@ -1,38 +0,0 @@ -From dfe09c625b6d98a0f9e8f9e60d86ad88c20a5992 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 25 Sep 2020 10:55:19 +0100 -Subject: slimbus: core: do not enter to clock pause mode in core - -From: Srinivas Kandagatla - -[ Upstream commit df2c471c4ae07e18a0396db670dca2ef867c5153 ] - -Let the controller logic decide when to enter into clock pause mode! -Entering in to pause mode during unregistration does not really make -sense as the controller is totally going down at that point in time. - -Fixes: 4b14e62ad3c9e ("slimbus: Add support for 'clock-pause' feature") -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20200925095520.27316-3-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/slimbus/core.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c -index 6e690aaacad1e..3e63e4ce45b04 100644 ---- a/drivers/slimbus/core.c -+++ b/drivers/slimbus/core.c -@@ -255,8 +255,6 @@ int slim_unregister_controller(struct slim_controller *ctrl) - { - /* Remove all clients */ - device_for_each_child(ctrl->dev, NULL, slim_ctrl_remove_device); -- /* Enter Clock Pause */ -- slim_ctrl_clk_pause(ctrl, false, 0); - ida_simple_remove(&ctrl_ida, ctrl->id); - - return 0; --- -2.25.1 - diff --git a/queue-4.19/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch b/queue-4.19/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch deleted file mode 100644 index c8cf163aa26..00000000000 --- a/queue-4.19/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch +++ /dev/null @@ -1,45 +0,0 @@ -From b3c1de0c196842f28d28edc8703b033a98df2f36 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 25 Sep 2020 10:55:20 +0100 -Subject: slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback - -From: Srinivas Kandagatla - -[ Upstream commit 709ec3f7fc5773ac4aa6fb22c3f0ac8103c674db ] - -In QMI new server notification we enable the NGD however during -delete server notification we do not disable the NGD. - -This can lead to multiple instances of NGD being enabled, so make -sure that we disable NGD in delete server callback to fix this issue! - -Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") -Signed-off-by: Srinivas Kandagatla -Link: https://lore.kernel.org/r/20200925095520.27316-4-srinivas.kandagatla@linaro.org -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/slimbus/qcom-ngd-ctrl.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c -index f40ac8dcb0817..522a87fc573a6 100644 ---- a/drivers/slimbus/qcom-ngd-ctrl.c -+++ b/drivers/slimbus/qcom-ngd-ctrl.c -@@ -1272,9 +1272,13 @@ static void qcom_slim_ngd_qmi_del_server(struct qmi_handle *hdl, - { - struct qcom_slim_ngd_qmi *qmi = - container_of(hdl, struct qcom_slim_ngd_qmi, svc_event_hdl); -+ struct qcom_slim_ngd_ctrl *ctrl = -+ container_of(qmi, struct qcom_slim_ngd_ctrl, qmi); - - qmi->svc_info.sq_node = 0; - qmi->svc_info.sq_port = 0; -+ -+ qcom_slim_ngd_enable(ctrl, false); - } - - static struct qmi_ops qcom_slim_ngd_qmi_svc_event_ops = { --- -2.25.1 - diff --git a/queue-4.19/spi-spi-s3c64xx-check-return-values.patch b/queue-4.19/spi-spi-s3c64xx-check-return-values.patch deleted file mode 100644 index 22ea5189bbd..00000000000 --- a/queue-4.19/spi-spi-s3c64xx-check-return-values.patch +++ /dev/null @@ -1,183 +0,0 @@ -From 6952ca5db180e719467e83e74648f78829433697 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 2 Oct 2020 14:22:37 +0200 -Subject: spi: spi-s3c64xx: Check return values -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Łukasz Stelmach - -[ Upstream commit 2f4db6f705c5cba85d23836c19b44d9687dc1334 ] - -Check return values in prepare_dma() and s3c64xx_spi_config() and -propagate errors upwards. - -Fixes: 788437273fa8 ("spi: s3c64xx: move to generic dmaengine API") -Reviewed-by: Krzysztof Kozlowski -Signed-off-by: Łukasz Stelmach -Link: https://lore.kernel.org/r/20201002122243.26849-4-l.stelmach@samsung.com -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin ---- - drivers/spi/spi-s3c64xx.c | 50 ++++++++++++++++++++++++++++++++------- - 1 file changed, 41 insertions(+), 9 deletions(-) - -diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c -index 322f75f89c713..1d948fee1a039 100644 ---- a/drivers/spi/spi-s3c64xx.c -+++ b/drivers/spi/spi-s3c64xx.c -@@ -122,6 +122,7 @@ - - struct s3c64xx_spi_dma_data { - struct dma_chan *ch; -+ dma_cookie_t cookie; - enum dma_transfer_direction direction; - }; - -@@ -264,12 +265,13 @@ static void s3c64xx_spi_dmacb(void *data) - spin_unlock_irqrestore(&sdd->lock, flags); - } - --static void prepare_dma(struct s3c64xx_spi_dma_data *dma, -+static int prepare_dma(struct s3c64xx_spi_dma_data *dma, - struct sg_table *sgt) - { - struct s3c64xx_spi_driver_data *sdd; - struct dma_slave_config config; - struct dma_async_tx_descriptor *desc; -+ int ret; - - memset(&config, 0, sizeof(config)); - -@@ -293,12 +295,24 @@ static void prepare_dma(struct s3c64xx_spi_dma_data *dma, - - desc = dmaengine_prep_slave_sg(dma->ch, sgt->sgl, sgt->nents, - dma->direction, DMA_PREP_INTERRUPT); -+ if (!desc) { -+ dev_err(&sdd->pdev->dev, "unable to prepare %s scatterlist", -+ dma->direction == DMA_DEV_TO_MEM ? "rx" : "tx"); -+ return -ENOMEM; -+ } - - desc->callback = s3c64xx_spi_dmacb; - desc->callback_param = dma; - -- dmaengine_submit(desc); -+ dma->cookie = dmaengine_submit(desc); -+ ret = dma_submit_error(dma->cookie); -+ if (ret) { -+ dev_err(&sdd->pdev->dev, "DMA submission failed"); -+ return -EIO; -+ } -+ - dma_async_issue_pending(dma->ch); -+ return 0; - } - - static void s3c64xx_spi_set_cs(struct spi_device *spi, bool enable) -@@ -348,11 +362,12 @@ static bool s3c64xx_spi_can_dma(struct spi_master *master, - return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1; - } - --static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, -+static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, - struct spi_transfer *xfer, int dma_mode) - { - void __iomem *regs = sdd->regs; - u32 modecfg, chcfg; -+ int ret = 0; - - modecfg = readl(regs + S3C64XX_SPI_MODE_CFG); - modecfg &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON); -@@ -378,7 +393,7 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, - chcfg |= S3C64XX_SPI_CH_TXCH_ON; - if (dma_mode) { - modecfg |= S3C64XX_SPI_MODE_TXDMA_ON; -- prepare_dma(&sdd->tx_dma, &xfer->tx_sg); -+ ret = prepare_dma(&sdd->tx_dma, &xfer->tx_sg); - } else { - switch (sdd->cur_bpw) { - case 32: -@@ -410,12 +425,17 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, - writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff) - | S3C64XX_SPI_PACKET_CNT_EN, - regs + S3C64XX_SPI_PACKET_CNT); -- prepare_dma(&sdd->rx_dma, &xfer->rx_sg); -+ ret = prepare_dma(&sdd->rx_dma, &xfer->rx_sg); - } - } - -+ if (ret) -+ return ret; -+ - writel(modecfg, regs + S3C64XX_SPI_MODE_CFG); - writel(chcfg, regs + S3C64XX_SPI_CH_CFG); -+ -+ return 0; - } - - static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd, -@@ -548,9 +568,10 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd, - return 0; - } - --static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) -+static int s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) - { - void __iomem *regs = sdd->regs; -+ int ret; - u32 val; - - /* Disable Clock */ -@@ -598,7 +619,9 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) - - if (sdd->port_conf->clk_from_cmu) { - /* The src_clk clock is divided internally by 2 */ -- clk_set_rate(sdd->src_clk, sdd->cur_speed * 2); -+ ret = clk_set_rate(sdd->src_clk, sdd->cur_speed * 2); -+ if (ret) -+ return ret; - } else { - /* Configure Clock */ - val = readl(regs + S3C64XX_SPI_CLK_CFG); -@@ -612,6 +635,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) - val |= S3C64XX_SPI_ENCLK_ENABLE; - writel(val, regs + S3C64XX_SPI_CLK_CFG); - } -+ -+ return 0; - } - - #define XFER_DMAADDR_INVALID DMA_BIT_MASK(32) -@@ -654,7 +679,9 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, - sdd->cur_bpw = bpw; - sdd->cur_speed = speed; - sdd->cur_mode = spi->mode; -- s3c64xx_spi_config(sdd); -+ status = s3c64xx_spi_config(sdd); -+ if (status) -+ return status; - } - - if (!is_polling(sdd) && (xfer->len > fifo_len) && -@@ -681,10 +708,15 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, - /* Start the signals */ - s3c64xx_spi_set_cs(spi, true); - -- s3c64xx_enable_datapath(sdd, xfer, use_dma); -+ status = s3c64xx_enable_datapath(sdd, xfer, use_dma); - - spin_unlock_irqrestore(&sdd->lock, flags); - -+ if (status) { -+ dev_err(&spi->dev, "failed to enable data path for transfer: %d\n", status); -+ break; -+ } -+ - if (use_dma) - status = s3c64xx_wait_for_dma(sdd, xfer); - else --- -2.25.1 - diff --git a/queue-4.19/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch b/queue-4.19/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch deleted file mode 100644 index b08f955832a..00000000000 --- a/queue-4.19/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 128780ae666548caafbeca19b996172a7de9de90 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 2 Oct 2020 14:22:35 +0200 -Subject: spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and - s3c64xx_enable_datapath() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Łukasz Stelmach - -[ Upstream commit 581e2b41977dfc2d4c26c8e976f89c43bb92f9bf ] - -Fix issues with DMA transfers bigger than 512 bytes on Exynos3250. Without -the patches such transfers fail to complete. This solution to the problem -is found in the vendor kernel for ARTIK5 boards based on Exynos3250. - -Reviewed-by: Krzysztof Kozlowski -Signed-off-by: Łukasz Stelmach -Link: https://lore.kernel.org/r/20201002122243.26849-2-l.stelmach@samsung.com -Signed-off-by: Mark Brown -Signed-off-by: Sasha Levin ---- - drivers/spi/spi-s3c64xx.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c -index 7b7151ec14c8a..322f75f89c713 100644 ---- a/drivers/spi/spi-s3c64xx.c -+++ b/drivers/spi/spi-s3c64xx.c -@@ -678,11 +678,11 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, - sdd->state &= ~RXBUSY; - sdd->state &= ~TXBUSY; - -- s3c64xx_enable_datapath(sdd, xfer, use_dma); -- - /* Start the signals */ - s3c64xx_spi_set_cs(spi, true); - -+ s3c64xx_enable_datapath(sdd, xfer, use_dma); -+ - spin_unlock_irqrestore(&sdd->lock, flags); - - if (use_dma) --- -2.25.1 - diff --git a/queue-4.19/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch b/queue-4.19/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch deleted file mode 100644 index 4ac8def8555..00000000000 --- a/queue-4.19/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch +++ /dev/null @@ -1,47 +0,0 @@ -From a97c4a5d0e4061aad0aac8d0303908835e6ae31d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 13 Aug 2020 19:34:58 +0200 -Subject: staging: rtl8192u: Do not use GFP_KERNEL in atomic context - -From: Christophe JAILLET - -[ Upstream commit acac75bb451fd39344eb54fad6602dfc9482e970 ] - -'rtl8192_irq_rx_tasklet()' is a tasklet initialized in -'rtl8192_init_priv_task()'. ->From this function it is possible to allocate some memory with the -GFP_KERNEL flag, which is not allowed in the atomic context of a tasklet. - -Use GFP_ATOMIC instead. - -The call chain is: - rtl8192_irq_rx_tasklet (in r8192U_core.c) - --> rtl8192_rx_nomal (in r8192U_core.c) - --> ieee80211_rx (in ieee80211/ieee80211_rx.c) - --> RxReorderIndicatePacket (in ieee80211/ieee80211_rx.c) - -Fixes: 79a5ccd97209 ("staging: rtl8192u: fix large frame size compiler warning") -Signed-off-by: Christophe JAILLET -Link: https://lore.kernel.org/r/20200813173458.758284-1-christophe.jaillet@wanadoo.fr -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c -index 28cae82d795c7..fb824c5174497 100644 ---- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c -+++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c -@@ -599,7 +599,7 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee, - - prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE, - sizeof(struct ieee80211_rxb *), -- GFP_KERNEL); -+ GFP_ATOMIC); - if (!prxbIndicateArray) - return; - --- -2.25.1 - diff --git a/queue-4.19/tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch b/queue-4.19/tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch deleted file mode 100644 index b4a90ecf7d1..00000000000 --- a/queue-4.19/tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch +++ /dev/null @@ -1,65 +0,0 @@ -From foo@baz Sat Oct 24 11:10:06 AM CEST 2020 -From: Neal Cardwell -Date: Thu, 22 Oct 2020 10:33:31 -0400 -Subject: tcp: fix to update snd_wl1 in bulk receiver fast path - -From: Neal Cardwell - -[ Upstream commit 18ded910b589839e38a51623a179837ab4cc3789 ] - -In the header prediction fast path for a bulk data receiver, if no -data is newly acknowledged then we do not call tcp_ack() and do not -call tcp_ack_update_window(). This means that a bulk receiver that -receives large amounts of data can have the incoming sequence numbers -wrap, so that the check in tcp_may_update_window fails: - after(ack_seq, tp->snd_wl1) - -If the incoming receive windows are zero in this state, and then the -connection that was a bulk data receiver later wants to send data, -that connection can find itself persistently rejecting the window -updates in incoming ACKs. This means the connection can persistently -fail to discover that the receive window has opened, which in turn -means that the connection is unable to send anything, and the -connection's sending process can get permanently "stuck". - -The fix is to update snd_wl1 in the header prediction fast path for a -bulk data receiver, so that it keeps up and does not see wrapping -problems. - -This fix is based on a very nice and thorough analysis and diagnosis -by Apollon Oikonomopoulos (see link below). - -This is a stable candidate but there is no Fixes tag here since the -bug predates current git history. Just for fun: looks like the bug -dates back to when header prediction was added in Linux v2.1.8 in Nov -1996. In that version tcp_rcv_established() was added, and the code -only updates snd_wl1 in tcp_ack(), and in the new "Bulk data transfer: -receiver" code path it does not call tcp_ack(). This fix seems to -apply cleanly at least as far back as v3.2. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Signed-off-by: Neal Cardwell -Reported-by: Apollon Oikonomopoulos -Tested-by: Apollon Oikonomopoulos -Link: https://www.spinics.net/lists/netdev/msg692430.html -Acked-by: Soheil Hassas Yeganeh -Acked-by: Yuchung Cheng -Signed-off-by: Eric Dumazet -Link: https://lore.kernel.org/r/20201022143331.1887495-1-ncardwell.kernel@gmail.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/tcp_input.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -5631,6 +5631,8 @@ void tcp_rcv_established(struct sock *sk - tcp_data_snd_check(sk); - if (!inet_csk_ack_scheduled(sk)) - goto no_ack; -+ } else { -+ tcp_update_wl(tp, TCP_SKB_CB(skb)->seq); - } - - __tcp_ack_snd_check(sk, 0); diff --git a/queue-4.19/tipc-fix-the-skb_unshare-in-tipc_buf_append.patch b/queue-4.19/tipc-fix-the-skb_unshare-in-tipc_buf_append.patch deleted file mode 100644 index 3d74c989fdc..00000000000 --- a/queue-4.19/tipc-fix-the-skb_unshare-in-tipc_buf_append.patch +++ /dev/null @@ -1,41 +0,0 @@ -From foo@baz Sat Oct 17 12:48:24 PM CEST 2020 -From: Cong Wang -Date: Wed, 7 Oct 2020 21:12:50 -0700 -Subject: tipc: fix the skb_unshare() in tipc_buf_append() - -From: Cong Wang - -[ Upstream commit ed42989eab57d619667d7e87dfbd8fe207db54fe ] - -skb_unshare() drops a reference count on the old skb unconditionally, -so in the failure case, we end up freeing the skb twice here. -And because the skb is allocated in fclone and cloned by caller -tipc_msg_reassemble(), the consequence is actually freeing the -original skb too, thus triggered the UAF by syzbot. - -Fix this by replacing this skb_unshare() with skb_cloned()+skb_copy(). - -Fixes: ff48b6222e65 ("tipc: use skb_unshare() instead in tipc_buf_append()") -Reported-and-tested-by: syzbot+e96a7ba46281824cc46a@syzkaller.appspotmail.com -Cc: Jon Maloy -Cc: Ying Xue -Signed-off-by: Cong Wang -Reviewed-by: Xin Long -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/tipc/msg.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/net/tipc/msg.c -+++ b/net/tipc/msg.c -@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **hea - if (fragid == FIRST_FRAGMENT) { - if (unlikely(head)) - goto err; -- frag = skb_unshare(frag, GFP_ATOMIC); -+ if (skb_cloned(frag)) -+ frag = skb_copy(frag, GFP_ATOMIC); - if (unlikely(!frag)) - goto err; - head = *headbuf = frag; diff --git a/queue-4.19/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch b/queue-4.19/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch deleted file mode 100644 index 603f577ff15..00000000000 --- a/queue-4.19/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 65e443a6d3a22fb47cf727f659849ae16b4ad4f3 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 20 Aug 2020 18:46:38 -0500 -Subject: tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() - -From: Tyrel Datwyler - -[ Upstream commit 63ffcbdad738e3d1c857027789a2273df3337624 ] - -The code currently NULLs tty->driver_data in hvcs_close() with the -intent of informing the next call to hvcs_open() that device needs to be -reconfigured. However, when hvcs_cleanup() is called we copy hvcsd from -tty->driver_data which was previoulsy NULLed by hvcs_close() and our -call to tty_port_put(&hvcsd->port) doesn't actually do anything since -&hvcsd->port ends up translating to NULL by chance. This has the side -effect that when hvcs_remove() is called we have one too many port -references preventing hvcs_destuct_port() from ever being called. This -also prevents us from reusing the /dev/hvcsX node in a future -hvcs_probe() and we can eventually run out of /dev/hvcsX devices. - -Fix this by waiting to NULL tty->driver_data in hvcs_cleanup(). - -Fixes: 27bf7c43a19c ("TTY: hvcs, add tty install") -Signed-off-by: Tyrel Datwyler -Link: https://lore.kernel.org/r/20200820234643.70412-1-tyreld@linux.ibm.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/tty/hvc/hvcs.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c -index cb4db1b3ca3c0..7853c6375325d 100644 ---- a/drivers/tty/hvc/hvcs.c -+++ b/drivers/tty/hvc/hvcs.c -@@ -1218,13 +1218,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) - - tty_wait_until_sent(tty, HVCS_CLOSE_WAIT); - -- /* -- * This line is important because it tells hvcs_open that this -- * device needs to be re-configured the next time hvcs_open is -- * called. -- */ -- tty->driver_data = NULL; -- - free_irq(irq, hvcsd); - return; - } else if (hvcsd->port.count < 0) { -@@ -1239,6 +1232,13 @@ static void hvcs_cleanup(struct tty_struct * tty) - { - struct hvcs_struct *hvcsd = tty->driver_data; - -+ /* -+ * This line is important because it tells hvcs_open that this -+ * device needs to be re-configured the next time hvcs_open is -+ * called. -+ */ -+ tty->driver_data = NULL; -+ - tty_port_put(&hvcsd->port); - } - --- -2.25.1 - diff --git a/queue-4.19/tty-serial-earlycon-dependency.patch b/queue-4.19/tty-serial-earlycon-dependency.patch deleted file mode 100644 index 8bb4176a372..00000000000 --- a/queue-4.19/tty-serial-earlycon-dependency.patch +++ /dev/null @@ -1,38 +0,0 @@ -From f70afd01ac8b31675ddf06b0cc1ca6295f0fcdc2 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 28 Aug 2020 08:39:50 -0400 -Subject: tty: serial: earlycon dependency - -From: Tong Zhang - -[ Upstream commit 0fb9342d06b0f667b915ba58bfefc030e534a218 ] - -parse_options() in drivers/tty/serial/earlycon.c calls uart_parse_earlycon -in drivers/tty/serial/serial_core.c therefore selecting SERIAL_EARLYCON -should automatically select SERIAL_CORE, otherwise will result in symbol -not found error during linking if SERIAL_CORE is not configured as builtin - -Fixes: 9aac5887595b ("tty/serial: add generic serial earlycon") -Signed-off-by: Tong Zhang -Link: https://lore.kernel.org/r/20200828123949.2642-1-ztong0001@gmail.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/tty/serial/Kconfig | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig -index df8bd0c7b97db..cd13065095bc3 100644 ---- a/drivers/tty/serial/Kconfig -+++ b/drivers/tty/serial/Kconfig -@@ -9,6 +9,7 @@ menu "Serial drivers" - - config SERIAL_EARLYCON - bool -+ depends on SERIAL_CORE - help - Support for early consoles with the earlycon parameter. This enables - the console before standard serial driver is probed. The console is --- -2.25.1 - diff --git a/queue-4.19/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch b/queue-4.19/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch deleted file mode 100644 index 4e16221b2cc..00000000000 --- a/queue-4.19/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 56396dff6d19e90616189a40a7453502ec3deaa5 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 24 Sep 2020 18:08:39 +0400 -Subject: usb: dwc2: Fix INTR OUT transfers in DDMA mode. - -From: Minas Harutyunyan - -[ Upstream commit b2c586eb07efab982419f32b7c3bd96829bc8bcd ] - -In DDMA mode if INTR OUT transfers mps not multiple of 4 then single packet -corresponds to single descriptor. - -Descriptor limit set to mps and desc chain limit set to mps * -MAX_DMA_DESC_NUM_GENERIC. On that descriptors complete, to calculate -transfer size should be considered correction value for each descriptor. - -In start request function, if "continue" is true then dma buffer address -should be incremmented by offset for all type of transfers, not only for -Control DATA_OUT transfers. - -Fixes: cf77b5fb9b394 ("usb: dwc2: gadget: Transfer length limit checking for DDMA") -Fixes: e02f9aa6119e0 ("usb: dwc2: gadget: EP 0 specific DDMA programming") -Fixes: aa3e8bc81311e ("usb: dwc2: gadget: DDMA transfer start and complete") - -Signed-off-by: Minas Harutyunyan -Signed-off-by: Felipe Balbi -Signed-off-by: Sasha Levin ---- - drivers/usb/dwc2/gadget.c | 40 ++++++++++++++++++++++++++++++++------- - 1 file changed, 33 insertions(+), 7 deletions(-) - -diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c -index f18aa3f59e519..8e98b4df9b109 100644 ---- a/drivers/usb/dwc2/gadget.c -+++ b/drivers/usb/dwc2/gadget.c -@@ -671,8 +671,11 @@ static u32 dwc2_hsotg_read_frameno(struct dwc2_hsotg *hsotg) - */ - static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) - { -+ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; - int is_isoc = hs_ep->isochronous; - unsigned int maxsize; -+ u32 mps = hs_ep->ep.maxpacket; -+ int dir_in = hs_ep->dir_in; - - if (is_isoc) - maxsize = (hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT : -@@ -681,6 +684,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) - else - maxsize = DEV_DMA_NBYTES_LIMIT * MAX_DMA_DESC_NUM_GENERIC; - -+ /* Interrupt OUT EP with mps not multiple of 4 */ -+ if (hs_ep->index) -+ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) -+ maxsize = mps * MAX_DMA_DESC_NUM_GENERIC; -+ - return maxsize; - } - -@@ -696,11 +704,14 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) - * Isochronous - descriptor rx/tx bytes bitfield limit, - * Control In/Bulk/Interrupt - multiple of mps. This will allow to not - * have concatenations from various descriptors within one packet. -+ * Interrupt OUT - if mps not multiple of 4 then a single packet corresponds -+ * to a single descriptor. - * - * Selects corresponding mask for RX/TX bytes as well. - */ - static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask) - { -+ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; - u32 mps = hs_ep->ep.maxpacket; - int dir_in = hs_ep->dir_in; - u32 desc_size = 0; -@@ -724,6 +735,13 @@ static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask) - desc_size -= desc_size % mps; - } - -+ /* Interrupt OUT EP with mps not multiple of 4 */ -+ if (hs_ep->index) -+ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) { -+ desc_size = mps; -+ *mask = DEV_DMA_NBYTES_MASK; -+ } -+ - return desc_size; - } - -@@ -1044,13 +1062,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg, - length += (mps - (length % mps)); - } - -- /* -- * If more data to send, adjust DMA for EP0 out data stage. -- * ureq->dma stays unchanged, hence increment it by already -- * passed passed data count before starting new transaction. -- */ -- if (!index && hsotg->ep0_state == DWC2_EP0_DATA_OUT && -- continuing) -+ if (continuing) - offset = ureq->actual; - - /* Fill DDMA chain entries */ -@@ -2220,22 +2232,36 @@ static void dwc2_hsotg_change_ep_iso_parity(struct dwc2_hsotg *hsotg, - */ - static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep) - { -+ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; - struct dwc2_hsotg *hsotg = hs_ep->parent; - unsigned int bytes_rem = 0; -+ unsigned int bytes_rem_correction = 0; - struct dwc2_dma_desc *desc = hs_ep->desc_list; - int i; - u32 status; -+ u32 mps = hs_ep->ep.maxpacket; -+ int dir_in = hs_ep->dir_in; - - if (!desc) - return -EINVAL; - -+ /* Interrupt OUT EP with mps not multiple of 4 */ -+ if (hs_ep->index) -+ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) -+ bytes_rem_correction = 4 - (mps % 4); -+ - for (i = 0; i < hs_ep->desc_count; ++i) { - status = desc->status; - bytes_rem += status & DEV_DMA_NBYTES_MASK; -+ bytes_rem -= bytes_rem_correction; - - if (status & DEV_DMA_STS_MASK) - dev_err(hsotg->dev, "descriptor %d closed with %x\n", - i, status & DEV_DMA_STS_MASK); -+ -+ if (status & DEV_DMA_L) -+ break; -+ - desc++; - } - --- -2.25.1 - diff --git a/queue-4.19/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch b/queue-4.19/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch deleted file mode 100644 index 462fdc5b436..00000000000 --- a/queue-4.19/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch +++ /dev/null @@ -1,88 +0,0 @@ -From 1dfe32d36f91b1f6967a72343023f8c49f6df07b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Fri, 24 Jul 2020 23:03:54 -0700 -Subject: usb: dwc2: Fix parameter type in function pointer prototype - -From: Nathan Chancellor - -[ Upstream commit 362b9398c962c9ec563653444e15ef9032ef3a90 ] - -When booting up on a Raspberry Pi 4 with Control Flow Integrity checking -enabled, the following warning/panic happens: - -[ 1.626435] CFI failure (target: dwc2_set_bcm_params+0x0/0x4): -[ 1.632408] WARNING: CPU: 0 PID: 32 at kernel/cfi.c:30 __cfi_check_fail+0x54/0x5c -[ 1.640021] Modules linked in: -[ 1.643137] CPU: 0 PID: 32 Comm: kworker/0:1 Not tainted 5.8.0-rc6-next-20200724-00051-g89ba619726de #1 -[ 1.652693] Hardware name: Raspberry Pi 4 Model B Rev 1.2 (DT) -[ 1.658637] Workqueue: events deferred_probe_work_func -[ 1.663870] pstate: 60000005 (nZCv daif -PAN -UAO BTYPE=--) -[ 1.669542] pc : __cfi_check_fail+0x54/0x5c -[ 1.673798] lr : __cfi_check_fail+0x54/0x5c -[ 1.678050] sp : ffff8000102bbaa0 -[ 1.681419] x29: ffff8000102bbaa0 x28: ffffab09e21c7000 -[ 1.686829] x27: 0000000000000402 x26: ffff0000f6e7c228 -[ 1.692238] x25: 00000000fb7cdb0d x24: 0000000000000005 -[ 1.697647] x23: ffffab09e2515000 x22: ffffab09e069a000 -[ 1.703055] x21: 4c550309df1cf4c1 x20: ffffab09e2433c60 -[ 1.708462] x19: ffffab09e160dc50 x18: ffff0000f6e8cc78 -[ 1.713870] x17: 0000000000000041 x16: ffffab09e0bce6f8 -[ 1.719278] x15: ffffab09e1c819b7 x14: 0000000000000003 -[ 1.724686] x13: 00000000ffffefff x12: 0000000000000000 -[ 1.730094] x11: 0000000000000000 x10: 00000000ffffffff -[ 1.735501] x9 : c932f7abfc4bc600 x8 : c932f7abfc4bc600 -[ 1.740910] x7 : 077207610770075f x6 : ffff0000f6c38f00 -[ 1.746317] x5 : 0000000000000000 x4 : 0000000000000000 -[ 1.751723] x3 : 0000000000000000 x2 : 0000000000000000 -[ 1.757129] x1 : ffff8000102bb7d8 x0 : 0000000000000032 -[ 1.762539] Call trace: -[ 1.765030] __cfi_check_fail+0x54/0x5c -[ 1.768938] __cfi_check+0x5fa6c/0x66afc -[ 1.772932] dwc2_init_params+0xd74/0xd78 -[ 1.777012] dwc2_driver_probe+0x484/0x6ec -[ 1.781180] platform_drv_probe+0xb4/0x100 -[ 1.785350] really_probe+0x228/0x63c -[ 1.789076] driver_probe_device+0x80/0xc0 -[ 1.793247] __device_attach_driver+0x114/0x160 -[ 1.797857] bus_for_each_drv+0xa8/0x128 -[ 1.801851] __device_attach.llvm.14901095709067289134+0xc0/0x170 -[ 1.808050] bus_probe_device+0x44/0x100 -[ 1.812044] deferred_probe_work_func+0x78/0xb8 -[ 1.816656] process_one_work+0x204/0x3c4 -[ 1.820736] worker_thread+0x2f0/0x4c4 -[ 1.824552] kthread+0x174/0x184 -[ 1.827837] ret_from_fork+0x10/0x18 - -CFI validates that all indirect calls go to a function with the same -exact function pointer prototype. In this case, dwc2_set_bcm_params -is the target, which has a parameter of type 'struct dwc2_hsotg *', -but it is being implicitly cast to have a parameter of type 'void *' -because that is the set_params function pointer prototype. Make the -function pointer protoype match the definitions so that there is no -more violation. - -Fixes: 7de1debcd2de ("usb: dwc2: Remove platform static params") -Link: https://github.com/ClangBuiltLinux/linux/issues/1107 -Signed-off-by: Nathan Chancellor -Signed-off-by: Felipe Balbi -Signed-off-by: Sasha Levin ---- - drivers/usb/dwc2/params.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c -index a93415f33bf36..6d7861cba3f56 100644 ---- a/drivers/usb/dwc2/params.c -+++ b/drivers/usb/dwc2/params.c -@@ -808,7 +808,7 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg) - int dwc2_init_params(struct dwc2_hsotg *hsotg) - { - const struct of_device_id *match; -- void (*set_params)(void *data); -+ void (*set_params)(struct dwc2_hsotg *data); - - dwc2_set_default_params(hsotg); - dwc2_get_device_properties(hsotg); --- -2.25.1 - diff --git a/queue-4.19/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch b/queue-4.19/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch deleted file mode 100644 index 62427b3ce32..00000000000 --- a/queue-4.19/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch +++ /dev/null @@ -1,70 +0,0 @@ -From b00d96d3ec255e8cccc7bb0f93239175becff1e4 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 25 Aug 2020 14:55:03 +0900 -Subject: usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Lorenzo Colitti - -[ Upstream commit 986499b1569af980a819817f17238015b27793f6 ] - -Currently, SuperSpeed NCM gadgets report a speed of 851 Mbps -in USB_CDC_NOTIFY_SPEED_CHANGE. But the calculation appears to -assume 16 packets per microframe, and USB 3 and above no longer -use microframes. - -Maximum speed is actually much higher. On a direct connection, -theoretical throughput is at most 3.86 Gbps for gen1x1 and -9.36 Gbps for gen2x1, and I have seen gadget->host iperf -throughput of >2 Gbps for gen1x1 and >4 Gbps for gen2x1. - -Unfortunately the ConnectionSpeedChange defined in the CDC spec -only uses 32-bit values, so we can't report accurate numbers for -10Gbps and above. So, report 3.75Gbps for SuperSpeed (which is -roughly maximum theoretical performance) and 4.25Gbps for -SuperSpeed Plus (which is close to the maximum that we can report -in a 32-bit unsigned integer). - -This results in: - -[50879.191272] cdc_ncm 2-2:1.0 enx228b127e050c: renamed from usb0 -[50879.234778] cdc_ncm 2-2:1.0 enx228b127e050c: 3750 mbit/s downlink 3750 mbit/s uplink - -on SuperSpeed and: - -[50798.434527] cdc_ncm 8-2:1.0 enx228b127e050c: renamed from usb0 -[50798.524278] cdc_ncm 8-2:1.0 enx228b127e050c: 4250 mbit/s downlink 4250 mbit/s uplink - -on SuperSpeed Plus. - -Fixes: 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors for CDC NCM") -Reviewed-by: Maciej Å»enczykowski -Signed-off-by: Lorenzo Colitti -Signed-off-by: Felipe Balbi -Signed-off-by: Sasha Levin ---- - drivers/usb/gadget/function/f_ncm.c | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c -index e2eefdd8bf786..09bc917d407d4 100644 ---- a/drivers/usb/gadget/function/f_ncm.c -+++ b/drivers/usb/gadget/function/f_ncm.c -@@ -86,8 +86,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f) - /* peak (theoretical) bulk transfer rate in bits-per-second */ - static inline unsigned ncm_bitrate(struct usb_gadget *g) - { -- if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) -- return 13 * 1024 * 8 * 1000 * 8; -+ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) -+ return 4250000000U; -+ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) -+ return 3750000000U; - else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) - return 13 * 512 * 8 * 1000 * 8; - else --- -2.25.1 - diff --git a/queue-4.19/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch b/queue-4.19/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch deleted file mode 100644 index a2241fdcf8e..00000000000 --- a/queue-4.19/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 641a40739d777c5f7ab90f193d6c8883a0576e00 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 19 Aug 2020 01:19:49 +0900 -Subject: usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Lorenzo Colitti - -[ Upstream commit 4eea21dc67b0c6ba15ae41b1defa113a680a858e ] - -The u_ether driver has a qmult setting that multiplies the -transmit queue length (which by default is 2). - -The intent is that it should be enabled at high/super speed, but -because the code does not explicitly check for USB_SUPER_PLUS, -it is disabled at that speed. - -Fix this by ensuring that the queue multiplier is enabled for any -wired link at high speed or above. Using >= for USB_SPEED_* -constants seems correct because it is what the gadget_is_xxxspeed -functions do. - -The queue multiplier substantially helps performance at higher -speeds. On a direct SuperSpeed Plus link to a Linux laptop, -iperf3 single TCP stream: - -Before (qmult=1): 1.3 Gbps -After (qmult=5): 3.2 Gbps - -Fixes: 04617db7aa68 ("usb: gadget: add SS descriptors to Ethernet gadget") -Reviewed-by: Maciej Å»enczykowski -Signed-off-by: Lorenzo Colitti -Signed-off-by: Felipe Balbi -Signed-off-by: Sasha Levin ---- - drivers/usb/gadget/function/u_ether.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c -index 0ef00315ec737..39ebc1b03698b 100644 ---- a/drivers/usb/gadget/function/u_ether.c -+++ b/drivers/usb/gadget/function/u_ether.c -@@ -93,7 +93,7 @@ struct eth_dev { - static inline int qlen(struct usb_gadget *gadget, unsigned qmult) - { - if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH || -- gadget->speed == USB_SPEED_SUPER)) -+ gadget->speed >= USB_SPEED_SUPER)) - return qmult * DEFAULT_QLEN; - else - return DEFAULT_QLEN; --- -2.25.1 - diff --git a/queue-4.19/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch b/queue-4.19/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch deleted file mode 100644 index ad8ce8bdd28..00000000000 --- a/queue-4.19/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 01a897bdfc242b4185672df05a84311c0115ec3d Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 25 Aug 2020 14:29:00 +0800 -Subject: video: fbdev: radeon: Fix memleak in radeonfb_pci_register - -From: Dinghao Liu - -[ Upstream commit fe6c6a4af2be8c15bac77f7ea160f947c04840d1 ] - -When radeon_kick_out_firmware_fb() fails, info should be -freed just like the subsequent error paths. - -Fixes: 069ee21a82344 ("fbdev: Fix loading of module radeonfb on PowerMac") -Signed-off-by: Dinghao Liu -Reviewed-by: Mathieu Malaterre -Cc: Kangjie Lu -Cc: Benjamin Herrenschmidt -Signed-off-by: Bartlomiej Zolnierkiewicz -Link: https://patchwork.freedesktop.org/patch/msgid/20200825062900.11210-1-dinghao.liu@zju.edu.cn -Signed-off-by: Sasha Levin ---- - drivers/video/fbdev/aty/radeon_base.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c -index e8594bbaea609..c6109a385cac9 100644 ---- a/drivers/video/fbdev/aty/radeon_base.c -+++ b/drivers/video/fbdev/aty/radeon_base.c -@@ -2327,7 +2327,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev, - - ret = radeon_kick_out_firmware_fb(pdev); - if (ret) -- return ret; -+ goto err_release_fb; - - /* request the mem regions */ - ret = pci_request_region(pdev, 0, "radeonfb framebuffer"); --- -2.25.1 - diff --git a/queue-4.19/video-fbdev-sis-fix-null-ptr-dereference.patch b/queue-4.19/video-fbdev-sis-fix-null-ptr-dereference.patch deleted file mode 100644 index 897980be215..00000000000 --- a/queue-4.19/video-fbdev-sis-fix-null-ptr-dereference.patch +++ /dev/null @@ -1,78 +0,0 @@ -From bea5a8e615ac656972109f834f603b7a25138b6e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Wed, 5 Aug 2020 07:52:08 -0700 -Subject: video: fbdev: sis: fix null ptr dereference - -From: Tom Rix - -[ Upstream commit ad6f93e9cd56f0b10e9b22e3e137d17a1a035242 ] - -Clang static analysis reports this representative error - -init.c:2501:18: warning: Array access (from variable 'queuedata') results - in a null pointer dereference - templ |= ((queuedata[i] & 0xc0) << 3); - -This is the problem block of code - - if(ModeNo > 0x13) { - ... - if(SiS_Pr->ChipType == SIS_730) { - queuedata = &FQBQData730[0]; - } else { - queuedata = &FQBQData[0]; - } - } else { - - } - -queuedata is not set in the else block - -Reviewing the old code, the arrays FQBQData730 and FQBQData were -used directly. - -So hoist the setting of queuedata out of the if-else block. - -Fixes: 544393fe584d ("[PATCH] sisfb update") -Signed-off-by: Tom Rix -Cc: Thomas Winischhofer -Cc: Andrew Morton -Signed-off-by: Bartlomiej Zolnierkiewicz -Link: https://patchwork.freedesktop.org/patch/msgid/20200805145208.17727-1-trix@redhat.com -Signed-off-by: Sasha Levin ---- - drivers/video/fbdev/sis/init.c | 11 +++++------ - 1 file changed, 5 insertions(+), 6 deletions(-) - -diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c -index dfe3eb769638b..fde27feae5d0c 100644 ---- a/drivers/video/fbdev/sis/init.c -+++ b/drivers/video/fbdev/sis/init.c -@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, - - i = 0; - -+ if (SiS_Pr->ChipType == SIS_730) -+ queuedata = &FQBQData730[0]; -+ else -+ queuedata = &FQBQData[0]; -+ - if(ModeNo > 0x13) { - - /* Get VCLK */ -@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, - /* Get half colordepth */ - colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)]; - -- if(SiS_Pr->ChipType == SIS_730) { -- queuedata = &FQBQData730[0]; -- } else { -- queuedata = &FQBQData[0]; -- } -- - do { - templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth; - --- -2.25.1 - diff --git a/queue-4.19/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch b/queue-4.19/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch deleted file mode 100644 index d5ea704cb38..00000000000 --- a/queue-4.19/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 4da361fe887080d3036d5dcb1b0be9cb33cfdc10 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 23 Jul 2020 18:02:27 +0100 -Subject: video: fbdev: vga16fb: fix setting of pixclock because a - pass-by-value error - -From: Colin Ian King - -[ Upstream commit c72fab81ceaa54408b827a2f0486d9a0f4be34cf ] - -The pixclock is being set locally because it is being passed as a -pass-by-value argument rather than pass-by-reference, so the computed -pixclock is never being set in var->pixclock. Fix this by passing -by reference. - -[This dates back to 2002, I found the offending commit from the git -history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git ] - -Addresses-Coverity: ("Unused value") -Signed-off-by: Colin Ian King -Cc: Daniel Vetter -Cc: Jani Nikula -[b.zolnierkie: minor patch summary fixup] -[b.zolnierkie: removed "Fixes:" tag (not in upstream tree)] -Signed-off-by: Bartlomiej Zolnierkiewicz -Link: https://patchwork.freedesktop.org/patch/msgid/20200723170227.996229-1-colin.king@canonical.com -Signed-off-by: Sasha Levin ---- - drivers/video/fbdev/vga16fb.c | 14 +++++++------- - 1 file changed, 7 insertions(+), 7 deletions(-) - -diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c -index 4b83109202b1c..3c4d20618de4c 100644 ---- a/drivers/video/fbdev/vga16fb.c -+++ b/drivers/video/fbdev/vga16fb.c -@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info) - } - - static void vga16fb_clock_chip(struct vga16fb_par *par, -- unsigned int pixclock, -+ unsigned int *pixclock, - const struct fb_info *info, - int mul, int div) - { -@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, - { 0 /* bad */, 0x00, 0x00}}; - int err; - -- pixclock = (pixclock * mul) / div; -+ *pixclock = (*pixclock * mul) / div; - best = vgaclocks; -- err = pixclock - best->pixclock; -+ err = *pixclock - best->pixclock; - if (err < 0) err = -err; - for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) { - int tmp; - -- tmp = pixclock - ptr->pixclock; -+ tmp = *pixclock - ptr->pixclock; - if (tmp < 0) tmp = -tmp; - if (tmp < err) { - err = tmp; -@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, - } - par->misc |= best->misc; - par->clkdiv = best->seq_clock_mode; -- pixclock = (best->pixclock * div) / mul; -+ *pixclock = (best->pixclock * div) / mul; - } - - #define FAIL(X) return -EINVAL -@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var, - - if (mode & MODE_8BPP) - /* pixel clock == vga clock / 2 */ -- vga16fb_clock_chip(par, var->pixclock, info, 1, 2); -+ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2); - else - /* pixel clock == vga clock */ -- vga16fb_clock_chip(par, var->pixclock, info, 1, 1); -+ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1); - - var->red.offset = var->green.offset = var->blue.offset = - var->transp.offset = 0; --- -2.25.1 - diff --git a/queue-4.19/vmci-check-return-value-of-get_user_pages_fast-for-e.patch b/queue-4.19/vmci-check-return-value-of-get_user_pages_fast-for-e.patch deleted file mode 100644 index adb90fc544d..00000000000 --- a/queue-4.19/vmci-check-return-value-of-get_user_pages_fast-for-e.patch +++ /dev/null @@ -1,57 +0,0 @@ -From d1f9db575cdaaa9a70af2a6e2482e11788356082 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 25 Aug 2020 17:45:18 +0100 -Subject: VMCI: check return value of get_user_pages_fast() for errors - -From: Alex Dewar - -[ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ] - -In a couple of places in qp_host_get_user_memory(), -get_user_pages_fast() is called without properly checking for errors. If -e.g. -EFAULT is returned, this negative value will then be passed on to -qp_release_pages(), which expects a u64 as input. - -Fix this by only calling qp_release_pages() when we have a positive -number returned. - -Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") -Signed-off-by: Alex Dewar -Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Sasha Levin ---- - drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - -diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c -index bd52f29b4a4e2..5e0d1ac67f73f 100644 ---- a/drivers/misc/vmw_vmci/vmci_queue_pair.c -+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c -@@ -671,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva, - if (retval < (int)produce_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(produce) failed (retval=%d)", - retval); -- qp_release_pages(produce_q->kernel_if->u.h.header_page, -- retval, false); -+ if (retval > 0) -+ qp_release_pages(produce_q->kernel_if->u.h.header_page, -+ retval, false); - err = VMCI_ERROR_NO_MEM; - goto out; - } -@@ -683,8 +684,9 @@ static int qp_host_get_user_memory(u64 produce_uva, - if (retval < (int)consume_q->kernel_if->num_pages) { - pr_debug("get_user_pages_fast(consume) failed (retval=%d)", - retval); -- qp_release_pages(consume_q->kernel_if->u.h.header_page, -- retval, false); -+ if (retval > 0) -+ qp_release_pages(consume_q->kernel_if->u.h.header_page, -+ retval, false); - qp_release_pages(produce_q->kernel_if->u.h.header_page, - produce_q->kernel_if->num_pages, false); - err = VMCI_ERROR_NO_MEM; --- -2.25.1 - diff --git a/queue-4.19/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch b/queue-4.19/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch deleted file mode 100644 index cc30fbba8f9..00000000000 --- a/queue-4.19/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 1e3f88bf7f55cba105dea197627e06871b0eaf1e Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Sun, 2 Aug 2020 01:48:24 +0100 -Subject: wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 - -From: Bryan O'Donoghue - -[ Upstream commit 3b9fb6791e7113679b1eb472e6ce1659e80f5797 ] - -Qualcomm's document "80-WL007-1 Rev. J" states that the highest rx rate for -the WCN3660 and WCN3680 on MCS 7 is 150 Mbps not the 72 Mbps stated here. - -This patch fixes the data-rate declared in the 5GHz table. - -Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 -hardware") - -Signed-off-by: Bryan O'Donoghue -Signed-off-by: Kalle Valo -Link: https://lore.kernel.org/r/20200802004824.1307124-1-bryan.odonoghue@linaro.org -Signed-off-by: Sasha Levin ---- - drivers/net/wireless/ath/wcn36xx/main.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index ad051f34e65b2..46ae4ec4ad47d 100644 ---- a/drivers/net/wireless/ath/wcn36xx/main.c -+++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -163,7 +163,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { - .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, - .mcs = { - .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, -- .rx_highest = cpu_to_le16(72), -+ .rx_highest = cpu_to_le16(150), - .tx_params = IEEE80211_HT_MCS_TX_DEFINED, - } - } --- -2.25.1 - diff --git a/queue-4.19/x b/queue-4.19/x deleted file mode 100644 index a0918d6c4c1..00000000000 --- a/queue-4.19/x +++ /dev/null @@ -1,147 +0,0 @@ -Unused: net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch -Unused: iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch -Unused: chelsio-chtls-correct-function-return-and-return-type.patch -Unused: pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch -Unused: net-fix-pos-incrementment-in-ipv6_route_seq_next.patch -Unused: x86-nmi-fix-nmi_handle-duration-miscalculation.patch -Unused: pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch -Unused: ibmveth-identify-ingress-large-send-packets.patch -Unused: media-omap3isp-fix-memleak-in-isp_probe.patch -Unused: crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch -Unused: ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch -Unused: chelsio-chtls-fix-socket-lock.patch -Unused: scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch -Unused: cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch -Unused: asoc-qcom-lpass-cpu-fix-concurrency-issue.patch -Unused: net-smc-fix-valid-dmbe-buffer-sizes.patch -Unused: binder-fix-uaf-when-releasing-todo-list.patch -Unused: kvm-x86-mmu-commit-zap-of-remaining-invalid-pages-when-recovering-lpages.patch -Unused: x -Unused: platform-x86-mlx-platform-remove-psu-eeprom-configur.patch -Unused: crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch -Unused: bluetooth-hci_uart-cancel-init-work-before-unregiste.patch -Unused: media-stm32-dcmi-fix-a-reference-count-leak.patch -Unused: drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch -Unused: mtd-mtdoops-don-t-write-panic-data-twice.patch -Unused: scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch -Unused: misc-mic-scif-fix-error-handling-path.patch -Unused: net-sched-act_tunnel_key-fix-oob-write-in-case-of-ipv6-erspan-tunnels.patch -Unused: drivers-virt-fsl_hypervisor-fix-error-handling-path.patch -Unused: crypto-picoxcell-fix-potential-race-condition-bug.patch -Unused: vmci-check-return-value-of-get_user_pages_fast-for-e.patch -Unused: media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch -Unused: net-dsa-rtl8366-refactor-vlan-pvid-init.patch -Unused: media-revert-media-exynos4-is-add-missed-check-for-p.patch -Unused: media-rcar-vin-fix-a-reference-count-leak.patch -Unused: slimbus-core-check-get_addr-before-removing-laddr-id.patch -Unused: net-korina-fix-kfree-of-rx-tx-descriptor-array.patch -Unused: media-camss-fix-a-reference-count-leak.patch -Unused: nl80211-fix-non-split-wiphy-information.patch -Unused: media-uvcvideo-set-media-controller-entity-functions.patch -Unused: usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch -Unused: rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch -Unused: xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch -Unused: crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch -Unused: regulator-resolve-supply-after-creating-regulator.patch -Unused: backlight-sky81452-backlight-fix-refcount-imbalance-.patch -Unused: x86-events-amd-iommu-fix-sizeof-mismatch.patch -Unused: mfd-sm501-fix-leaks-in-probe.patch -Unused: hid-hid-input-fix-stylus-battery-reporting.patch -Unused: ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch -Unused: ima-don-t-ignore-errors-from-crypto_shash_update.patch -Unused: mm-memcg-fix-device-private-memcg-accounting.patch -Unused: cifs-return-the-error-from-crypt_message-when-enc-dec-key-not-found.patch -Unused: video-fbdev-sis-fix-null-ptr-dereference.patch -Unused: icmp-randomize-the-global-rate-limiter.patch -Unused: net-dsa-rtl8366-check-validity-of-passed-vlans.patch -Unused: x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch -Unused: series -Unused: rdma-qedr-fix-use-of-uninitialized-field.patch -Unused: video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch -Unused: powerpc-tau-convert-from-timer-to-workqueue.patch -Unused: net-fec-fix-phy_device-lookup-for-phy_reset_after_clk_enable.patch -Unused: media-tuner-simple-fix-regression-in-simple_set_radi.patch -Unused: slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch -Unused: media-uvcvideo-silence-shift-out-of-bounds-warning.patch -Unused: crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch -Unused: media-ti-vpe-fix-a-missing-check-and-reference-count.patch -Unused: net-enic-cure-the-enic-api-locking-trainwreck.patch -Unused: alsa-bebob-potential-info-leak-in-hwdep_read.patch -Unused: usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch -Unused: quota-clear-padding-in-v2r1_mem2diskdqb.patch -Unused: qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch -Unused: alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch -Unused: net-tls-sendfile-fails-with-ktls-offload.patch -Unused: scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch -Unused: ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch -Unused: nfc-ensure-presence-of-nfc_attr_firmware_name-attribute-in-nfc_genl_fw_download.patch -Unused: media-rockchip-rga-fix-a-reference-count-leak.patch -Unused: pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch -Unused: scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch -Unused: tty-serial-earlycon-dependency.patch -Unused: edac-ti-fix-handling-of-platform_get_irq-error.patch -Unused: ipvs-clear-skb-tstamp-in-forwarding-path.patch -Unused: crypto-omap-sham-fix-digcnt-register-handling-with-e.patch -Unused: net-dsa-rtl8366rb-support-all-4096-vlans.patch -Unused: media-m5mols-check-function-pointer-in-m5mols_sensor.patch -Unused: ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch -Unused: tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch -Unused: r8169-fix-data-corruption-issue-on-rtl8402.patch -Unused: net-usb-qmi_wwan-add-cellient-mpl200-card.patch -Unused: rdma-ucma-fix-locking-for-ctx-events_reported.patch -Unused: pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch -Unused: ibmveth-switch-order-of-ibmveth_helper-calls.patch -Unused: asoc-qcom-lpass-platform-fix-memory-leak.patch -Unused: scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch -Unused: mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch -Unused: video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch -Unused: media-tc358743-initialize-variable.patch -Unused: xfs-limit-entries-returned-when-counting-fsmap-recor.patch -Unused: tcp-fix-to-update-snd_wl1-in-bulk-receiver-fast-path.patch -Unused: mlx4-handle-non-napi-callers-to-napi_poll.patch -Unused: powerpc-tau-remove-duplicated-set_thresholds-call.patch -Unused: staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch -Unused: netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch -Unused: pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch -Unused: rdma-qedr-fix-inline-size-returned-for-iwarp.patch -Unused: net-ipv4-always-honour-route-mtu-during-forwarding.patch -Unused: mwifiex-fix-double-free.patch -Unused: net-hdlc-in-hdlc_rcv-check-to-make-sure-dev-is-an-hdlc-device.patch -Unused: edac-i5100-fix-error-handling-order-in-i5100_init_on.patch -Unused: ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch -Unused: arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch -Unused: media-s5p-mfc-fix-a-reference-count-leak.patch -Unused: usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch -Unused: alsa-hda-realtek-enable-audio-jacks-of-asus-d700sa-with-alc887.patch -Unused: powerpc-tau-use-appropriate-temperature-sample-inter.patch -Unused: usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch -Unused: net-hdlc_raw_eth-clear-the-iff_tx_skb_sharing-flag-after-calling-ether_setup.patch -Unused: ath10k-provide-survey-info-as-accumulated-data.patch -Unused: powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch -Unused: kvm-svm-initialize-prev_ga_tag-before-use.patch -Unused: media-tc358743-cleanup-tc358743_cec_isr.patch -Unused: ipv4-restore-flowi4_oif-update-before-call-to-xfrm_lookup_route.patch -Unused: tipc-fix-the-skb_unshare-in-tipc_buf_append.patch -Unused: hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch -Unused: mtd-lpddr-fix-excessive-stack-usage-with-clang.patch -Unused: cifs-remove-bogus-debug-code.patch -Unused: mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch -Unused: arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch -Unused: cpufreq-armada-37xx-add-missing-module_device_table.patch -Unused: net-fec-fix-phy-init-after-phy_reset_after_clk_enable.patch -Unused: net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch -Unused: powerpc-pseries-explicitly-reschedule-during-drmem_l.patch -Unused: wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch -Unused: spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch -Unused: powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch -Unused: ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch -Unused: pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch -Unused: hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch -Unused: drm-gma500-fix-error-check.patch -Unused: spi-spi-s3c64xx-check-return-values.patch -Unused: brcmfmac-check-ndev-pointer.patch -Unused: media-platform-fcp-fix-a-reference-count-leak.patch -Unused: net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch -Unused: r8169-fix-operation-under-forced-interrupt-threading.patch -Unused: slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch -Unused: chelsio-chtls-correct-netdevice-for-vlan-interface.patch diff --git a/queue-4.19/x86-events-amd-iommu-fix-sizeof-mismatch.patch b/queue-4.19/x86-events-amd-iommu-fix-sizeof-mismatch.patch deleted file mode 100644 index c809543fb88..00000000000 --- a/queue-4.19/x86-events-amd-iommu-fix-sizeof-mismatch.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 1914aa2c06f0ace910fc39ae75a0c6a83831a8aa Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 1 Oct 2020 12:39:00 +0100 -Subject: x86/events/amd/iommu: Fix sizeof mismatch - -From: Colin Ian King - -[ Upstream commit 59d5396a4666195f89a67e118e9e627ddd6f53a1 ] - -An incorrect sizeof is being used, struct attribute ** is not correct, -it should be struct attribute *. Note that since ** is the same size as -* this is not causing any issues. Improve this fix by using sizeof(*attrs) -as this allows us to not even reference the type of the pointer. - -Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") -Fixes: 51686546304f ("x86/events/amd/iommu: Fix sysfs perf attribute groups") -Signed-off-by: Colin Ian King -Signed-off-by: Peter Zijlstra (Intel) -Link: https://lkml.kernel.org/r/20201001113900.58889-1-colin.king@canonical.com -Signed-off-by: Sasha Levin ---- - arch/x86/events/amd/iommu.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c -index 3210fee27e7f9..0014d26391fa6 100644 ---- a/arch/x86/events/amd/iommu.c -+++ b/arch/x86/events/amd/iommu.c -@@ -387,7 +387,7 @@ static __init int _init_events_attrs(void) - while (amd_iommu_v2_event_descs[i].attr.attr.name) - i++; - -- attrs = kcalloc(i + 1, sizeof(struct attribute **), GFP_KERNEL); -+ attrs = kcalloc(i + 1, sizeof(*attrs), GFP_KERNEL); - if (!attrs) - return -ENOMEM; - --- -2.25.1 - diff --git a/queue-4.19/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch b/queue-4.19/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch deleted file mode 100644 index 5027633e607..00000000000 --- a/queue-4.19/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch +++ /dev/null @@ -1,102 +0,0 @@ -From 0d1d35198a6286b70206ef821520b497c5cd1085 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 7 Sep 2020 17:39:19 -0400 -Subject: x86/fpu: Allow multiple bits in clearcpuid= parameter - -From: Arvind Sankar - -[ Upstream commit 0a4bb5e5507a585532cc413125b921c8546fc39f ] - -Commit - - 0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument") - -changed clearcpuid parsing from __setup() to cmdline_find_option(). -While the __setup() function would have been called for each clearcpuid= -parameter on the command line, cmdline_find_option() will only return -the last one, so the change effectively made it impossible to disable -more than one bit. - -Allow a comma-separated list of bit numbers as the argument for -clearcpuid to allow multiple bits to be disabled again. Log the bits -being disabled for informational purposes. - -Also fix the check on the return value of cmdline_find_option(). It -returns -1 when the option is not found, so testing as a boolean is -incorrect. - -Fixes: 0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument") -Signed-off-by: Arvind Sankar -Signed-off-by: Borislav Petkov -Link: https://lkml.kernel.org/r/20200907213919.2423441-1-nivedita@alum.mit.edu -Signed-off-by: Sasha Levin ---- - .../admin-guide/kernel-parameters.txt | 2 +- - arch/x86/kernel/fpu/init.c | 30 ++++++++++++++----- - 2 files changed, 23 insertions(+), 9 deletions(-) - -diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt -index 30752db575870..fb129272240c9 100644 ---- a/Documentation/admin-guide/kernel-parameters.txt -+++ b/Documentation/admin-guide/kernel-parameters.txt -@@ -558,7 +558,7 @@ - loops can be debugged more effectively on production - systems. - -- clearcpuid=BITNUM [X86] -+ clearcpuid=BITNUM[,BITNUM...] [X86] - Disable CPUID feature X for the kernel. See - arch/x86/include/asm/cpufeatures.h for the valid bit - numbers. Note the Linux specific bits are not necessarily -diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c -index 6abd83572b016..9692ccc583bb3 100644 ---- a/arch/x86/kernel/fpu/init.c -+++ b/arch/x86/kernel/fpu/init.c -@@ -249,9 +249,9 @@ static void __init fpu__init_system_ctx_switch(void) - */ - static void __init fpu__init_parse_early_param(void) - { -- char arg[32]; -+ char arg[128]; - char *argptr = arg; -- int bit; -+ int arglen, res, bit; - - if (cmdline_find_option_bool(boot_command_line, "no387")) - setup_clear_cpu_cap(X86_FEATURE_FPU); -@@ -271,12 +271,26 @@ static void __init fpu__init_parse_early_param(void) - if (cmdline_find_option_bool(boot_command_line, "noxsaves")) - setup_clear_cpu_cap(X86_FEATURE_XSAVES); - -- if (cmdline_find_option(boot_command_line, "clearcpuid", arg, -- sizeof(arg)) && -- get_option(&argptr, &bit) && -- bit >= 0 && -- bit < NCAPINTS * 32) -- setup_clear_cpu_cap(bit); -+ arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg)); -+ if (arglen <= 0) -+ return; -+ -+ pr_info("Clearing CPUID bits:"); -+ do { -+ res = get_option(&argptr, &bit); -+ if (res == 0 || res == 3) -+ break; -+ -+ /* If the argument was too long, the last bit may be cut off */ -+ if (res == 1 && arglen >= sizeof(arg)) -+ break; -+ -+ if (bit >= 0 && bit < NCAPINTS * 32) { -+ pr_cont(" " X86_CAP_FMT, x86_cap_flag(bit)); -+ setup_clear_cpu_cap(bit); -+ } -+ } while (res == 2); -+ pr_cont("\n"); - } - - /* --- -2.25.1 - diff --git a/queue-4.19/x86-nmi-fix-nmi_handle-duration-miscalculation.patch b/queue-4.19/x86-nmi-fix-nmi_handle-duration-miscalculation.patch deleted file mode 100644 index a205cbd1381..00000000000 --- a/queue-4.19/x86-nmi-fix-nmi_handle-duration-miscalculation.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 73b1edf46669a5d0f2b25847026756591a2eee59 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 20 Aug 2020 10:56:41 +0800 -Subject: x86/nmi: Fix nmi_handle() duration miscalculation - -From: Libing Zhou - -[ Upstream commit f94c91f7ba3ba7de2bc8aa31be28e1abb22f849e ] - -When nmi_check_duration() is checking the time an NMI handler took to -execute, the whole_msecs value used should be read from the @duration -argument, not from the ->max_duration, the latter being used to store -the current maximal duration. - - [ bp: Rewrite commit message. ] - -Fixes: 248ed51048c4 ("x86/nmi: Remove irq_work from the long duration NMI handler") -Suggested-by: Peter Zijlstra (Intel) -Signed-off-by: Libing Zhou -Signed-off-by: Borislav Petkov -Cc: Changbin Du -Link: https://lkml.kernel.org/r/20200820025641.44075-1-libing.zhou@nokia-sbell.com -Signed-off-by: Sasha Levin ---- - arch/x86/kernel/nmi.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - -diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c -index 0f8b9b900b0e7..996eb53f8eb75 100644 ---- a/arch/x86/kernel/nmi.c -+++ b/arch/x86/kernel/nmi.c -@@ -104,7 +104,6 @@ fs_initcall(nmi_warning_debugfs); - - static void nmi_check_duration(struct nmiaction *action, u64 duration) - { -- u64 whole_msecs = READ_ONCE(action->max_duration); - int remainder_ns, decimal_msecs; - - if (duration < nmi_longest_ns || duration < action->max_duration) -@@ -112,12 +111,12 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration) - - action->max_duration = duration; - -- remainder_ns = do_div(whole_msecs, (1000 * 1000)); -+ remainder_ns = do_div(duration, (1000 * 1000)); - decimal_msecs = remainder_ns / 1000; - - printk_ratelimited(KERN_INFO - "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n", -- action->handler, whole_msecs, decimal_msecs); -+ action->handler, duration, decimal_msecs); - } - - static int nmi_handle(unsigned int type, struct pt_regs *regs) --- -2.25.1 - diff --git a/queue-4.19/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch b/queue-4.19/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch deleted file mode 100644 index 44836d6d7f5..00000000000 --- a/queue-4.19/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 57ae99d99202c234301ae8c31ad7ca35a6640e55 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Tue, 13 Oct 2020 08:46:27 -0700 -Subject: xfs: fix high key handling in the rt allocator's query_range function - -From: Darrick J. Wong - -[ Upstream commit d88850bd5516a77c6f727e8b6cefb64e0cc929c7 ] - -Fix some off-by-one errors in xfs_rtalloc_query_range. The highest key -in the realtime bitmap is always one less than the number of rt extents, -which means that the key clamp at the start of the function is wrong. -The 4th argument to xfs_rtfind_forw is the highest rt extent that we -want to probe, which means that passing 1 less than the high key is -wrong. Finally, drop the rem variable that controls the loop because we -can compare the iteration point (rtstart) against the high key directly. - -The sordid history of this function is that the original commit (fb3c3) -incorrectly passed (high_rec->ar_startblock - 1) as the 'limit' parameter -to xfs_rtfind_forw. This was wrong because the "high key" is supposed -to be the largest key for which the caller wants result rows, not the -key for the first row that could possibly be outside the range that the -caller wants to see. - -A subsequent attempt (8ad56) to strengthen the parameter checking added -incorrect clamping of the parameters to the number of rt blocks in the -system (despite the bitmap functions all taking units of rt extents) to -avoid querying ranges past the end of rt bitmap file but failed to fix -the incorrect _rtfind_forw parameter. The original _rtfind_forw -parameter error then survived the conversion of the startblock and -blockcount fields to rt extents (a0e5c), and the most recent off-by-one -fix (a3a37) thought it was patching a problem when the end of the rt -volume is not in use, but none of these fixes actually solved the -original problem that the author was confused about the "limit" argument -to xfs_rtfind_forw. - -Sadly, all four of these patches were written by this author and even -his own usage of this function and rt testing were inadequate to get -this fixed quickly. - -Original-problem: fb3c3de2f65c ("xfs: add a couple of queries to iterate free extents in the rtbitmap") -Not-fixed-by: 8ad560d2565e ("xfs: strengthen rtalloc query range checks") -Not-fixed-by: a0e5c435babd ("xfs: fix xfs_rtalloc_rec units") -Fixes: a3a374bf1889 ("xfs: fix off-by-one error in xfs_rtalloc_query_range") -Signed-off-by: Darrick J. Wong -Reviewed-by: Chandan Babu R -Signed-off-by: Sasha Levin ---- - fs/xfs/libxfs/xfs_rtbitmap.c | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c -index b228c821bae68..fe7323032e785 100644 ---- a/fs/xfs/libxfs/xfs_rtbitmap.c -+++ b/fs/xfs/libxfs/xfs_rtbitmap.c -@@ -1020,7 +1020,6 @@ xfs_rtalloc_query_range( - struct xfs_mount *mp = tp->t_mountp; - xfs_rtblock_t rtstart; - xfs_rtblock_t rtend; -- xfs_rtblock_t rem; - int is_free; - int error = 0; - -@@ -1029,13 +1028,12 @@ xfs_rtalloc_query_range( - if (low_rec->ar_startext >= mp->m_sb.sb_rextents || - low_rec->ar_startext == high_rec->ar_startext) - return 0; -- if (high_rec->ar_startext > mp->m_sb.sb_rextents) -- high_rec->ar_startext = mp->m_sb.sb_rextents; -+ high_rec->ar_startext = min(high_rec->ar_startext, -+ mp->m_sb.sb_rextents - 1); - - /* Iterate the bitmap, looking for discrepancies. */ - rtstart = low_rec->ar_startext; -- rem = high_rec->ar_startext - rtstart; -- while (rem) { -+ while (rtstart <= high_rec->ar_startext) { - /* Is the first block free? */ - error = xfs_rtcheck_range(mp, tp, rtstart, 1, 1, &rtend, - &is_free); -@@ -1044,7 +1042,7 @@ xfs_rtalloc_query_range( - - /* How long does the extent go for? */ - error = xfs_rtfind_forw(mp, tp, rtstart, -- high_rec->ar_startext - 1, &rtend); -+ high_rec->ar_startext, &rtend); - if (error) - break; - -@@ -1057,7 +1055,6 @@ xfs_rtalloc_query_range( - break; - } - -- rem -= rtend - rtstart + 1; - rtstart = rtend + 1; - } - --- -2.25.1 - diff --git a/queue-4.19/xfs-limit-entries-returned-when-counting-fsmap-recor.patch b/queue-4.19/xfs-limit-entries-returned-when-counting-fsmap-recor.patch deleted file mode 100644 index 1034366cdf9..00000000000 --- a/queue-4.19/xfs-limit-entries-returned-when-counting-fsmap-recor.patch +++ /dev/null @@ -1,40 +0,0 @@ -From d04c0d434ba47a94d0f9f46d1b30c37795ec63d1 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Thu, 1 Oct 2020 10:56:07 -0700 -Subject: xfs: limit entries returned when counting fsmap records - -From: Darrick J. Wong - -[ Upstream commit acd1ac3aa22fd58803a12d26b1ab7f70232f8d8d ] - -If userspace asked fsmap to count the number of entries, we cannot -return more than UINT_MAX entries because fmh_entries is u32. -Therefore, stop counting if we hit this limit or else we will waste time -to return truncated results. - -Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") -Signed-off-by: Darrick J. Wong -Reviewed-by: Christoph Hellwig -Reviewed-by: Chandan Babu R -Signed-off-by: Sasha Levin ---- - fs/xfs/xfs_fsmap.c | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c -index 3d76a9e35870a..75b57b683d3e6 100644 ---- a/fs/xfs/xfs_fsmap.c -+++ b/fs/xfs/xfs_fsmap.c -@@ -259,6 +259,9 @@ xfs_getfsmap_helper( - - /* Are we just counting mappings? */ - if (info->head->fmh_count == 0) { -+ if (info->head->fmh_entries == UINT_MAX) -+ return -ECANCELED; -+ - if (rec_daddr > info->next_daddr) - info->head->fmh_entries++; - --- -2.25.1 -