From: Sasha Levin Date: Sun, 30 May 2021 20:40:30 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.271~53 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59074a38ab29c89d15dceec2d98c194d103cf3ea;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch b/queue-5.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch new file mode 100644 index 00000000000..29c302b2d5d --- /dev/null +++ b/queue-5.4/alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch @@ -0,0 +1,45 @@ +From c5a194b883ad82be25a994bc6cc48d25ddb06ea0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:02 +0200 +Subject: ALSA: sb8: Add a comment note regarding an unused pointer + +From: Atul Gopinathan + +[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ] + +The field "fm_res" of "struct snd_sb8" is never used/dereferenced +throughout the sb8.c code. Therefore there is no need for any null value +check after the "request_region()". + +Add a comment note to make developers know about this and prevent any +"NULL check" patches on this part of code. + +Cc: Takashi Iwai +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-36-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb8.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c +index 6f1fc8789676..4386c24d2dcc 100644 +--- a/sound/isa/sb/sb8.c ++++ b/sound/isa/sb/sb8.c +@@ -94,7 +94,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) + acard = card->private_data; + card->private_free = snd_sb8_free; + +- /* block the 0x388 port to avoid PnP conflicts */ ++ /* ++ * Block the 0x388 port to avoid PnP conflicts. ++ * No need to check this value after request_region, ++ * as we never do anything with it. ++ */ + acard->fm_res = request_region(0x388, 4, "SoundBlaster FM"); + + if (port[dev] != SNDRV_AUTO_PORT) { +-- +2.30.2 + diff --git a/queue-5.4/asoc-cs43130-handle-errors-in-cs43130_probe-properly.patch b/queue-5.4/asoc-cs43130-handle-errors-in-cs43130_probe-properly.patch new file mode 100644 index 00000000000..572ab00d1e3 --- /dev/null +++ b/queue-5.4/asoc-cs43130-handle-errors-in-cs43130_probe-properly.patch @@ -0,0 +1,78 @@ +From 0870582652393060af6ca261382ae37fe967b3bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:24 +0200 +Subject: ASoC: cs43130: handle errors in cs43130_probe() properly + +From: Greg Kroah-Hartman + +[ Upstream commit 2da441a6491d93eff8ffff523837fd621dc80389 ] + +cs43130_probe() does not do any valid error checking of things it +initializes, OR what it does, it does not unwind properly if there are +errors. + +Fix this up by moving the sysfs files to an attribute group so the +driver core will correctly add/remove them all at once and handle errors +with them, and correctly check for creating a new workqueue and +unwinding if that fails. + +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210503115736.2104747-58-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index bb46e993c353..8f70dee95878 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -1735,6 +1735,14 @@ static DEVICE_ATTR(hpload_dc_r, 0444, cs43130_show_dc_r, NULL); + static DEVICE_ATTR(hpload_ac_l, 0444, cs43130_show_ac_l, NULL); + static DEVICE_ATTR(hpload_ac_r, 0444, cs43130_show_ac_r, NULL); + ++static struct attribute *hpload_attrs[] = { ++ &dev_attr_hpload_dc_l.attr, ++ &dev_attr_hpload_dc_r.attr, ++ &dev_attr_hpload_ac_l.attr, ++ &dev_attr_hpload_ac_r.attr, ++}; ++ATTRIBUTE_GROUPS(hpload); ++ + static struct reg_sequence hp_en_cal_seq[] = { + {CS43130_INT_MASK_4, CS43130_INT_MASK_ALL}, + {CS43130_HP_MEAS_LOAD_1, 0}, +@@ -2302,23 +2310,15 @@ static int cs43130_probe(struct snd_soc_component *component) + + cs43130->hpload_done = false; + if (cs43130->dc_meas) { +- ret = device_create_file(component->dev, &dev_attr_hpload_dc_l); +- if (ret < 0) +- return ret; +- +- ret = device_create_file(component->dev, &dev_attr_hpload_dc_r); +- if (ret < 0) +- return ret; +- +- ret = device_create_file(component->dev, &dev_attr_hpload_ac_l); +- if (ret < 0) +- return ret; +- +- ret = device_create_file(component->dev, &dev_attr_hpload_ac_r); +- if (ret < 0) ++ ret = sysfs_create_groups(&component->dev->kobj, hpload_groups); ++ if (ret) + return ret; + + cs43130->wq = create_singlethread_workqueue("cs43130_hp"); ++ if (!cs43130->wq) { ++ sysfs_remove_groups(&component->dev->kobj, hpload_groups); ++ return -ENOMEM; ++ } + INIT_WORK(&cs43130->work, cs43130_imp_meas); + } + +-- +2.30.2 + diff --git a/queue-5.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch b/queue-5.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch new file mode 100644 index 00000000000..007d7fb598c --- /dev/null +++ b/queue-5.4/ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch @@ -0,0 +1,64 @@ +From 586be2b3d9b91bde15013fd955c81b7538bd7495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:10 +0200 +Subject: ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd() + +From: Anirudh Rayabharam + +[ Upstream commit 54433367840b46a1555c8ed36c4c0cfc5dbf1358 ] + +Propagate error code from failure of ath6kl_wmi_cmd_send() to the +caller. + +Signed-off-by: Anirudh Rayabharam +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-44-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/debug.c | 5 ++++- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c +index 54337d60f288..085a134069f7 100644 +--- a/drivers/net/wireless/ath/ath6kl/debug.c ++++ b/drivers/net/wireless/ath/ath6kl/debug.c +@@ -1027,14 +1027,17 @@ static ssize_t ath6kl_lrssi_roam_write(struct file *file, + { + struct ath6kl *ar = file->private_data; + unsigned long lrssi_roam_threshold; ++ int ret; + + if (kstrtoul_from_user(user_buf, count, 0, &lrssi_roam_threshold)) + return -EINVAL; + + ar->lrssi_roam_threshold = lrssi_roam_threshold; + +- ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); ++ ret = ath6kl_wmi_set_roam_lrssi_cmd(ar->wmi, ar->lrssi_roam_threshold); + ++ if (ret) ++ return ret; + return count; + } + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index d27b4088b874..c610fe21c85c 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -776,10 +776,8 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi) + cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR; + cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS; + +- ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, ++ return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, + NO_SYNC_WMIFLAG); +- +- return 0; + } + + int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid) +-- +2.30.2 + diff --git a/queue-5.4/brcmfmac-properly-check-for-bus-register-errors.patch b/queue-5.4/brcmfmac-properly-check-for-bus-register-errors.patch new file mode 100644 index 00000000000..6db8a81d500 --- /dev/null +++ b/queue-5.4/brcmfmac-properly-check-for-bus-register-errors.patch @@ -0,0 +1,197 @@ +From 01ddff59a0e48e6c6267f8236b3cf1f940416f0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:36 +0200 +Subject: brcmfmac: properly check for bus register errors + +From: Greg Kroah-Hartman + +[ Upstream commit 419b4a142a7ece36cebcd434f8ce2af59ef94b85 ] + +The brcmfmac driver ignores any errors on initialization with the +different busses by deferring the initialization to a workqueue and +ignoring all possible errors that might happen. Fix up all of this by +only allowing the module to load if all bus registering worked properly. + +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-70-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/bcmsdh.c | 8 +--- + .../broadcom/brcm80211/brcmfmac/bus.h | 19 ++++++++- + .../broadcom/brcm80211/brcmfmac/core.c | 42 ++++++++----------- + .../broadcom/brcm80211/brcmfmac/pcie.c | 9 +--- + .../broadcom/brcm80211/brcmfmac/pcie.h | 5 --- + .../broadcom/brcm80211/brcmfmac/usb.c | 4 +- + 6 files changed, 41 insertions(+), 46 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +index fc12598b2dd3..c492d2d2db1d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -1168,13 +1168,9 @@ static struct sdio_driver brcmf_sdmmc_driver = { + }, + }; + +-void brcmf_sdio_register(void) ++int brcmf_sdio_register(void) + { +- int ret; +- +- ret = sdio_register_driver(&brcmf_sdmmc_driver); +- if (ret) +- brcmf_err("sdio_register_driver failed: %d\n", ret); ++ return sdio_register_driver(&brcmf_sdmmc_driver); + } + + void brcmf_sdio_exit(void) +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h +index 623c0168da79..8b27494a5d3d 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h +@@ -274,11 +274,26 @@ void brcmf_bus_add_txhdrlen(struct device *dev, uint len); + + #ifdef CONFIG_BRCMFMAC_SDIO + void brcmf_sdio_exit(void); +-void brcmf_sdio_register(void); ++int brcmf_sdio_register(void); ++#else ++static inline void brcmf_sdio_exit(void) { } ++static inline int brcmf_sdio_register(void) { return 0; } + #endif ++ + #ifdef CONFIG_BRCMFMAC_USB + void brcmf_usb_exit(void); +-void brcmf_usb_register(void); ++int brcmf_usb_register(void); ++#else ++static inline void brcmf_usb_exit(void) { } ++static inline int brcmf_usb_register(void) { return 0; } ++#endif ++ ++#ifdef CONFIG_BRCMFMAC_PCIE ++void brcmf_pcie_exit(void); ++int brcmf_pcie_register(void); ++#else ++static inline void brcmf_pcie_exit(void) { } ++static inline int brcmf_pcie_register(void) { return 0; } + #endif + + #endif /* BRCMFMAC_BUS_H */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index e9bb8dbdc9aa..edb79e9665dc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -1438,40 +1438,34 @@ void brcmf_bus_change_state(struct brcmf_bus *bus, enum brcmf_bus_state state) + } + } + +-static void brcmf_driver_register(struct work_struct *work) +-{ +-#ifdef CONFIG_BRCMFMAC_SDIO +- brcmf_sdio_register(); +-#endif +-#ifdef CONFIG_BRCMFMAC_USB +- brcmf_usb_register(); +-#endif +-#ifdef CONFIG_BRCMFMAC_PCIE +- brcmf_pcie_register(); +-#endif +-} +-static DECLARE_WORK(brcmf_driver_work, brcmf_driver_register); +- + int __init brcmf_core_init(void) + { +- if (!schedule_work(&brcmf_driver_work)) +- return -EBUSY; ++ int err; ++ ++ err = brcmf_sdio_register(); ++ if (err) ++ return err; ++ ++ err = brcmf_usb_register(); ++ if (err) ++ goto error_usb_register; + ++ err = brcmf_pcie_register(); ++ if (err) ++ goto error_pcie_register; + return 0; ++ ++error_pcie_register: ++ brcmf_usb_exit(); ++error_usb_register: ++ brcmf_sdio_exit(); ++ return err; + } + + void __exit brcmf_core_exit(void) + { +- cancel_work_sync(&brcmf_driver_work); +- +-#ifdef CONFIG_BRCMFMAC_SDIO + brcmf_sdio_exit(); +-#endif +-#ifdef CONFIG_BRCMFMAC_USB + brcmf_usb_exit(); +-#endif +-#ifdef CONFIG_BRCMFMAC_PCIE + brcmf_pcie_exit(); +-#endif + } + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index cb68f54a9c56..bda042138e96 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -2137,15 +2137,10 @@ static struct pci_driver brcmf_pciedrvr = { + }; + + +-void brcmf_pcie_register(void) ++int brcmf_pcie_register(void) + { +- int err; +- + brcmf_dbg(PCIE, "Enter\n"); +- err = pci_register_driver(&brcmf_pciedrvr); +- if (err) +- brcmf_err(NULL, "PCIE driver registration failed, err=%d\n", +- err); ++ return pci_register_driver(&brcmf_pciedrvr); + } + + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h +index d026401d2001..8e6c227e8315 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.h +@@ -11,9 +11,4 @@ struct brcmf_pciedev { + struct brcmf_pciedev_info *devinfo; + }; + +- +-void brcmf_pcie_exit(void); +-void brcmf_pcie_register(void); +- +- + #endif /* BRCMFMAC_PCIE_H */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +index 6f41d28930e4..3b897f040371 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -1558,8 +1558,8 @@ void brcmf_usb_exit(void) + usb_deregister(&brcmf_usbdrvr); + } + +-void brcmf_usb_register(void) ++int brcmf_usb_register(void) + { + brcmf_dbg(USB, "Enter\n"); +- usb_register(&brcmf_usbdrvr); ++ return usb_register(&brcmf_usbdrvr); + } +-- +2.30.2 + diff --git a/queue-5.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch b/queue-5.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch new file mode 100644 index 00000000000..e83ecd385d9 --- /dev/null +++ b/queue-5.4/btrfs-do-not-bug_on-in-link_to_fixup_dir.patch @@ -0,0 +1,76 @@ +From f23d3f37f40148a520a5f735e8cd6760157775ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 10:56:16 -0400 +Subject: btrfs: do not BUG_ON in link_to_fixup_dir + +From: Josef Bacik + +[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ] + +While doing error injection testing I got the following panic + + kernel BUG at fs/btrfs/tree-log.c:1862! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:link_to_fixup_dir+0xd5/0xe0 + RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216 + RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0 + RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000 + RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001 + R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800 + R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065 + FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0 + Call Trace: + replay_one_buffer+0x409/0x470 + ? btree_read_extent_buffer_pages+0xd0/0x110 + walk_up_log_tree+0x157/0x1e0 + walk_log_tree+0xa6/0x1d0 + btrfs_recover_log_trees+0x1da/0x360 + ? replay_one_extent+0x7b0/0x7b0 + open_ctree+0x1486/0x1720 + btrfs_mount_root.cold+0x12/0xea + ? __kmalloc_track_caller+0x12f/0x240 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + vfs_kern_mount.part.0+0x71/0xb0 + btrfs_mount+0x10d/0x380 + ? vfs_parse_fs_string+0x4d/0x90 + legacy_get_tree+0x24/0x40 + vfs_get_tree+0x22/0xb0 + path_mount+0x433/0xa10 + __x64_sys_mount+0xe3/0x120 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +We can get -EIO or any number of legitimate errors from +btrfs_search_slot(), panicing here is not the appropriate response. The +error path for this code handles errors properly, simply return the +error. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index de53e5166997..54647eb9c6ed 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -1846,8 +1846,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, + ret = btrfs_update_inode(trans, root, inode); + } else if (ret == -EEXIST) { + ret = 0; +- } else { +- BUG(); /* Logic Error */ + } + iput(inode); + +-- +2.30.2 + diff --git a/queue-5.4/btrfs-return-whole-extents-in-fiemap.patch b/queue-5.4/btrfs-return-whole-extents-in-fiemap.patch new file mode 100644 index 00000000000..77e8879f844 --- /dev/null +++ b/queue-5.4/btrfs-return-whole-extents-in-fiemap.patch @@ -0,0 +1,86 @@ +From b3d7caf9e7ac90b9dd00f632b5d4f84b89e957c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 15:31:18 -0700 +Subject: btrfs: return whole extents in fiemap + +From: Boris Burkov + +[ Upstream commit 15c7745c9a0078edad1f7df5a6bb7b80bc8cca23 ] + + `xfs_io -c 'fiemap ' ` + +can give surprising results on btrfs that differ from xfs. + +btrfs prints out extents trimmed to fit the user input. If the user's +fiemap request has an offset, then rather than returning each whole +extent which intersects that range, we also trim the start extent to not +have start < off. + +Documentation in filesystems/fiemap.txt and the xfs_io man page suggests +that returning the whole extent is expected. + +Some cases which all yield the same fiemap in xfs, but not btrfs: + dd if=/dev/zero of=$f bs=4k count=1 + sudo xfs_io -c 'fiemap 0 1024' $f + 0: [0..7]: 26624..26631 + sudo xfs_io -c 'fiemap 2048 1024' $f + 0: [4..7]: 26628..26631 + sudo xfs_io -c 'fiemap 2048 4096' $f + 0: [4..7]: 26628..26631 + sudo xfs_io -c 'fiemap 3584 512' $f + 0: [7..7]: 26631..26631 + sudo xfs_io -c 'fiemap 4091 5' $f + 0: [7..6]: 26631..26630 + +I believe this is a consequence of the logic for merging contiguous +extents represented by separate extent items. That logic needs to track +the last offset as it loops through the extent items, which happens to +pick up the start offset on the first iteration, and trim off the +beginning of the full extent. To fix it, start `off` at 0 rather than +`start` so that we keep the iteration/merging intact without cutting off +the start of the extent. + +after the fix, all the above commands give: + + 0: [0..7]: 26624..26631 + +The merging logic is exercised by fstest generic/483, and I have written +a new fstest for checking we don't have backwards or zero-length fiemaps +for cases like those above. + +Reviewed-by: Josef Bacik +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 95205bde240f..eca3abc1a7cd 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4648,7 +4648,7 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + __u64 start, __u64 len) + { + int ret = 0; +- u64 off = start; ++ u64 off; + u64 max = start + len; + u32 flags = 0; + u32 found_type; +@@ -4684,6 +4684,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, + goto out_free_ulist; + } + ++ /* ++ * We can't initialize that to 'start' as this could miss extents due ++ * to extent item merging ++ */ ++ off = 0; + start = round_down(start, btrfs_inode_sectorsize(inode)); + len = round_up(max, btrfs_inode_sectorsize(inode)) - start; + +-- +2.30.2 + diff --git a/queue-5.4/char-hpet-add-checks-after-calling-ioremap.patch b/queue-5.4/char-hpet-add-checks-after-calling-ioremap.patch new file mode 100644 index 00000000000..393b5072d45 --- /dev/null +++ b/queue-5.4/char-hpet-add-checks-after-calling-ioremap.patch @@ -0,0 +1,46 @@ +From 46015436372ae700cb40ec6023f98adbbab03d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:56 +0200 +Subject: char: hpet: add checks after calling ioremap + +From: Tom Seewald + +[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ] + +The function hpet_resources() calls ioremap() two times, but in both +cases it does not check if ioremap() returned a null pointer. Fix this +by adding null pointer checks and returning an appropriate error. + +Signed-off-by: Tom Seewald +Link: https://lore.kernel.org/r/20210503115736.2104747-30-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/hpet.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index 3e31740444f1..d390ab5e51d3 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -969,6 +969,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + if (ACPI_SUCCESS(status)) { + hdp->hd_phys_address = addr.address.minimum; + hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +@@ -982,6 +984,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + hdp->hd_phys_address = fixmem32->address; + hdp->hd_address = ioremap(fixmem32->address, + HPET_RANGE_SIZE); ++ if (!hdp->hd_address) ++ return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +-- +2.30.2 + diff --git a/queue-5.4/dmaengine-qcom_hidma-comment-platform_driver_registe.patch b/queue-5.4/dmaengine-qcom_hidma-comment-platform_driver_registe.patch new file mode 100644 index 00000000000..ead9262dc02 --- /dev/null +++ b/queue-5.4/dmaengine-qcom_hidma-comment-platform_driver_registe.patch @@ -0,0 +1,52 @@ +From 009fb21f2a248a1f55a9cfa71a98dcb525ead4b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:18 +0200 +Subject: dmaengine: qcom_hidma: comment platform_driver_register call + +From: Phillip Potter + +[ Upstream commit 4df2a8b0ad634d98a67e540a4e18a60f943e7d9f ] + +Place a comment in hidma_mgmt_init explaining why success must +currently be assumed, due to the cleanup issue that would need to +be considered were this module ever to be unloadable or were this +platform_driver_register call ever to fail. + +Acked-By: Vinod Koul +Acked-By: Sinan Kaya +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-52-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/hidma_mgmt.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c +index fe87b01f7a4e..62026607f3f8 100644 +--- a/drivers/dma/qcom/hidma_mgmt.c ++++ b/drivers/dma/qcom/hidma_mgmt.c +@@ -418,6 +418,20 @@ static int __init hidma_mgmt_init(void) + hidma_mgmt_of_populate_channels(child); + } + #endif ++ /* ++ * We do not check for return value here, as it is assumed that ++ * platform_driver_register must not fail. The reason for this is that ++ * the (potential) hidma_mgmt_of_populate_channels calls above are not ++ * cleaned up if it does fail, and to do this work is quite ++ * complicated. In particular, various calls of of_address_to_resource, ++ * of_irq_to_resource, platform_device_register_full, of_dma_configure, ++ * and of_msi_configure which then call other functions and so on, must ++ * be cleaned up - this is not a trivial exercise. ++ * ++ * Currently, this module is not intended to be unloaded, and there is ++ * no module_exit function defined which does the needed cleanup. For ++ * this reason, we have to assume success here. ++ */ + platform_driver_register(&hidma_mgmt_driver); + + return 0; +-- +2.30.2 + diff --git a/queue-5.4/drm-amd-amdgpu-fix-a-potential-deadlock-in-gpu-reset.patch b/queue-5.4/drm-amd-amdgpu-fix-a-potential-deadlock-in-gpu-reset.patch new file mode 100644 index 00000000000..1b86a4f150a --- /dev/null +++ b/queue-5.4/drm-amd-amdgpu-fix-a-potential-deadlock-in-gpu-reset.patch @@ -0,0 +1,94 @@ +From 89ace37380123df3511f5858f57fe25f20b51002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:47:20 +0800 +Subject: drm/amd/amdgpu: fix a potential deadlock in gpu reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lang Yu + +[ Upstream commit 9c2876d56f1ce9b6b2072f1446fb1e8d1532cb3d ] + +When amdgpu_ib_ring_tests failed, the reset logic called +amdgpu_device_ip_suspend twice, then deadlock occurred. +Deadlock log: + +[ 805.655192] amdgpu 0000:04:00.0: amdgpu: ib ring test failed (-110). +[ 806.290952] [drm] free PSP TMR buffer + +[ 806.319406] ============================================ +[ 806.320315] WARNING: possible recursive locking detected +[ 806.321225] 5.11.0-custom #1 Tainted: G W OEL +[ 806.322135] -------------------------------------------- +[ 806.323043] cat/2593 is trying to acquire lock: +[ 806.323825] ffff888136b1cdc8 (&adev->dm.dc_lock){+.+.}-{3:3}, at: dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.325668] + but task is already holding lock: +[ 806.326664] ffff888136b1cdc8 (&adev->dm.dc_lock){+.+.}-{3:3}, at: dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.328430] + other info that might help us debug this: +[ 806.329539] Possible unsafe locking scenario: + +[ 806.330549] CPU0 +[ 806.330983] ---- +[ 806.331416] lock(&adev->dm.dc_lock); +[ 806.332086] lock(&adev->dm.dc_lock); +[ 806.332738] + *** DEADLOCK *** + +[ 806.333747] May be due to missing lock nesting notation + +[ 806.334899] 3 locks held by cat/2593: +[ 806.335537] #0: ffff888100d3f1b8 (&attr->mutex){+.+.}-{3:3}, at: simple_attr_read+0x4e/0x110 +[ 806.337009] #1: ffff888136b1fd78 (&adev->reset_sem){++++}-{3:3}, at: amdgpu_device_lock_adev+0x42/0x94 [amdgpu] +[ 806.339018] #2: ffff888136b1cdc8 (&adev->dm.dc_lock){+.+.}-{3:3}, at: dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.340869] + stack backtrace: +[ 806.341621] CPU: 6 PID: 2593 Comm: cat Tainted: G W OEL 5.11.0-custom #1 +[ 806.342921] Hardware name: AMD Celadon-CZN/Celadon-CZN, BIOS WLD0C23N_Weekly_20_12_2 12/23/2020 +[ 806.344413] Call Trace: +[ 806.344849] dump_stack+0x93/0xbd +[ 806.345435] __lock_acquire.cold+0x18a/0x2cf +[ 806.346179] lock_acquire+0xca/0x390 +[ 806.346807] ? dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.347813] __mutex_lock+0x9b/0x930 +[ 806.348454] ? dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.349434] ? amdgpu_device_indirect_rreg+0x58/0x70 [amdgpu] +[ 806.350581] ? _raw_spin_unlock_irqrestore+0x47/0x50 +[ 806.351437] ? dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.352437] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 806.353252] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 806.354064] mutex_lock_nested+0x1b/0x20 +[ 806.354747] ? mutex_lock_nested+0x1b/0x20 +[ 806.355457] dm_suspend+0xb8/0x1d0 [amdgpu] +[ 806.356427] ? soc15_common_set_clockgating_state+0x17d/0x19 [amdgpu] +[ 806.357736] amdgpu_device_ip_suspend_phase1+0x78/0xd0 [amdgpu] +[ 806.360394] amdgpu_device_ip_suspend+0x21/0x70 [amdgpu] +[ 806.362926] amdgpu_device_pre_asic_reset+0xb3/0x270 [amdgpu] +[ 806.365560] amdgpu_device_gpu_recover.cold+0x679/0x8eb [amdgpu] + +Signed-off-by: Lang Yu +Acked-by: Christian KÃnig +Reviewed-by: Andrey Grodzovsky +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 3b3fc9a426e9..765f9a6c4640 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -3704,7 +3704,6 @@ out: + r = amdgpu_ib_ring_tests(tmp_adev); + if (r) { + dev_err(tmp_adev->dev, "ib ring test failed (%d).\n", r); +- r = amdgpu_device_ip_suspend(tmp_adev); + need_full_reset = true; + r = -EAGAIN; + goto end; +-- +2.30.2 + diff --git a/queue-5.4/drm-amd-amdgpu-fix-refcount-leak.patch b/queue-5.4/drm-amd-amdgpu-fix-refcount-leak.patch new file mode 100644 index 00000000000..3107324171c --- /dev/null +++ b/queue-5.4/drm-amd-amdgpu-fix-refcount-leak.patch @@ -0,0 +1,49 @@ +From 42cbbf10390b9edbd04a96807245ec87876ff98e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:16:10 +0800 +Subject: drm/amd/amdgpu: fix refcount leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jingwen Chen + +[ Upstream commit fa7e6abc75f3d491bc561734312d065dc9dc2a77 ] + +[Why] +the gem object rfb->base.obj[0] is get according to num_planes +in amdgpufb_create, but is not put according to num_planes + +[How] +put rfb->base.obj[0] in amdgpu_fbdev_destroy according to num_planes + +Signed-off-by: Jingwen Chen +Acked-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +index fd94a17fb2c6..46522804c7d8 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c +@@ -289,10 +289,13 @@ out: + static int amdgpu_fbdev_destroy(struct drm_device *dev, struct amdgpu_fbdev *rfbdev) + { + struct amdgpu_framebuffer *rfb = &rfbdev->rfb; ++ int i; + + drm_fb_helper_unregister_fbi(&rfbdev->helper); + + if (rfb->base.obj[0]) { ++ for (i = 0; i < rfb->base.format->num_planes; i++) ++ drm_gem_object_put(rfb->base.obj[0]); + amdgpufb_destroy_pinned_object(rfb->base.obj[0]); + rfb->base.obj[0] = NULL; + drm_framebuffer_unregister_private(&rfb->base); +-- +2.30.2 + diff --git a/queue-5.4/drm-amd-display-disconnect-non-dp-with-no-edid.patch b/queue-5.4/drm-amd-display-disconnect-non-dp-with-no-edid.patch new file mode 100644 index 00000000000..433402fdf0d --- /dev/null +++ b/queue-5.4/drm-amd-display-disconnect-non-dp-with-no-edid.patch @@ -0,0 +1,63 @@ +From 112f95069591b2d2f7c4e413d3eefcb5bc9ae732 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 16:20:55 -0400 +Subject: drm/amd/display: Disconnect non-DP with no EDID + +From: Chris Park + +[ Upstream commit 080039273b126eeb0185a61c045893a25dbc046e ] + +[Why] +Active DP dongles return no EDID when dongle +is connected, but VGA display is taken out. +Current driver behavior does not remove the +active display when this happens, and this is +a gap between dongle DTP and dongle behavior. + +[How] +For active DP dongles and non-DP scenario, +disconnect sink on detection when no EDID +is read due to timeout. + +Signed-off-by: Chris Park +Reviewed-by: Nicholas Kazlauskas +Acked-by: Stylon Wang +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 40041c61a100..6b03267021ea 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -936,6 +936,24 @@ bool dc_link_detect(struct dc_link *link, enum dc_detect_reason reason) + dc_is_dvi_signal(link->connector_signal)) { + if (prev_sink != NULL) + dc_sink_release(prev_sink); ++ link_disconnect_sink(link); ++ ++ return false; ++ } ++ /* ++ * Abort detection for DP connectors if we have ++ * no EDID and connector is active converter ++ * as there are no display downstream ++ * ++ */ ++ if (dc_is_dp_sst_signal(link->connector_signal) && ++ (link->dpcd_caps.dongle_type == ++ DISPLAY_DONGLE_DP_VGA_CONVERTER || ++ link->dpcd_caps.dongle_type == ++ DISPLAY_DONGLE_DP_DVI_CONVERTER)) { ++ if (prev_sink) ++ dc_sink_release(prev_sink); ++ link_disconnect_sink(link); + + return false; + } +-- +2.30.2 + diff --git a/queue-5.4/drm-amdgpu-fix-a-use-after-free.patch b/queue-5.4/drm-amdgpu-fix-a-use-after-free.patch new file mode 100644 index 00000000000..91b5c4a6467 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-a-use-after-free.patch @@ -0,0 +1,52 @@ +From 756f8c3beb482b6ace642965c35bdfbc5b784de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 10:56:07 +0800 +Subject: drm/amdgpu: Fix a use-after-free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ] + +looks like we forget to set ttm->sg to NULL. +Hit panic below + +[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI +[ 1235.989074] Call Trace: +[ 1235.991751] sg_free_table+0x17/0x20 +[ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] +[ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] +[ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] +[ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] +[ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] +[ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] +[ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] +[ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] +[ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] +[ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu] + +Signed-off-by: xinhui pan +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +index 91e3a87b1de8..58e14d3040f0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -1300,6 +1300,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm) + if (gtt && gtt->userptr) { + amdgpu_ttm_tt_set_user_pages(ttm, NULL); + kfree(ttm->sg); ++ ttm->sg = NULL; + ttm->page_flags &= ~TTM_PAGE_FLAG_SG; + return; + } +-- +2.30.2 + diff --git a/queue-5.4/gpio-cadence-add-missing-module_device_table.patch b/queue-5.4/gpio-cadence-add-missing-module_device_table.patch new file mode 100644 index 00000000000..990d97486fe --- /dev/null +++ b/queue-5.4/gpio-cadence-add-missing-module_device_table.patch @@ -0,0 +1,36 @@ +From c9ca6e2e2fba19c86556a0b473b5ec1fa3ee6f10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:17:47 +0800 +Subject: gpio: cadence: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 1e948b1752b58c9c570989ab29ceef5b38fdccda ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-cadence.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpio-cadence.c b/drivers/gpio/gpio-cadence.c +index a4d3239d2594..4ab3fcd9b9ba 100644 +--- a/drivers/gpio/gpio-cadence.c ++++ b/drivers/gpio/gpio-cadence.c +@@ -278,6 +278,7 @@ static const struct of_device_id cdns_of_ids[] = { + { .compatible = "cdns,gpio-r1p02" }, + { /* sentinel */ }, + }; ++MODULE_DEVICE_TABLE(of, cdns_of_ids); + + static struct platform_driver cdns_gpio_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.4/isdn-misdn-correctly-handle-ph_info-allocation-failu.patch b/queue-5.4/isdn-misdn-correctly-handle-ph_info-allocation-failu.patch new file mode 100644 index 00000000000..7a94aee97c0 --- /dev/null +++ b/queue-5.4/isdn-misdn-correctly-handle-ph_info-allocation-failu.patch @@ -0,0 +1,104 @@ +From 4dd195f1a7bfdd5864b5925fec3d96d100c78b4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:14 +0200 +Subject: isdn: mISDN: correctly handle ph_info allocation failure in + hfcsusb_ph_info + +From: Phillip Potter + +[ Upstream commit 5265db2ccc735e2783b790d6c19fb5cee8c025ed ] + +Modify return type of hfcusb_ph_info to int, so that we can pass error +value up the call stack when allocation of ph_info fails. Also change +three of four call sites to actually account for the memory failure. +The fourth, in ph_state_nt, is infeasible to change as it is in turn +called by ph_state which is used as a function pointer argument to +mISDN_initdchannel, which would necessitate changing its signature +and updating all the places where it is used (too many). + +Fixes original flawed commit (38d22659803a) from the University of +Minnesota. + +Cc: David S. Miller +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-48-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c +index 7a051435c406..1f89378b5623 100644 +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -46,7 +46,7 @@ static void hfcsusb_start_endpoint(struct hfcsusb *hw, int channel); + static void hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel); + static int hfcsusb_setup_bch(struct bchannel *bch, int protocol); + static void deactivate_bchannel(struct bchannel *bch); +-static void hfcsusb_ph_info(struct hfcsusb *hw); ++static int hfcsusb_ph_info(struct hfcsusb *hw); + + /* start next background transfer for control channel */ + static void +@@ -241,7 +241,7 @@ hfcusb_l2l1B(struct mISDNchannel *ch, struct sk_buff *skb) + * send full D/B channel status information + * as MPH_INFORMATION_IND + */ +-static void ++static int + hfcsusb_ph_info(struct hfcsusb *hw) + { + struct ph_info *phi; +@@ -249,6 +249,9 @@ hfcsusb_ph_info(struct hfcsusb *hw) + int i; + + phi = kzalloc(struct_size(phi, bch, dch->dev.nrbchan), GFP_ATOMIC); ++ if (!phi) ++ return -ENOMEM; ++ + phi->dch.ch.protocol = hw->protocol; + phi->dch.ch.Flags = dch->Flags; + phi->dch.state = dch->state; +@@ -261,6 +264,8 @@ hfcsusb_ph_info(struct hfcsusb *hw) + sizeof(struct ph_info_dch) + dch->dev.nrbchan * + sizeof(struct ph_info_ch), phi, GFP_ATOMIC); + kfree(phi); ++ ++ return 0; + } + + /* +@@ -345,8 +350,7 @@ hfcusb_l2l1D(struct mISDNchannel *ch, struct sk_buff *skb) + ret = l1_event(dch->l1, hh->prim); + break; + case MPH_INFORMATION_REQ: +- hfcsusb_ph_info(hw); +- ret = 0; ++ ret = hfcsusb_ph_info(hw); + break; + } + +@@ -401,8 +405,7 @@ hfc_l1callback(struct dchannel *dch, u_int cmd) + hw->name, __func__, cmd); + return -1; + } +- hfcsusb_ph_info(hw); +- return 0; ++ return hfcsusb_ph_info(hw); + } + + static int +@@ -744,8 +747,7 @@ hfcsusb_setup_bch(struct bchannel *bch, int protocol) + handle_led(hw, (bch->nr == 1) ? LED_B1_OFF : + LED_B2_OFF); + } +- hfcsusb_ph_info(hw); +- return 0; ++ return hfcsusb_ph_info(hw); + } + + static void +-- +2.30.2 + diff --git a/queue-5.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch b/queue-5.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch new file mode 100644 index 00000000000..d0b5c206f40 --- /dev/null +++ b/queue-5.4/isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch @@ -0,0 +1,99 @@ +From 7cbe662552bb327fb179f68505b6842c0ce92cb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:08 +0200 +Subject: isdn: mISDNinfineon: check/cleanup ioremap failure correctly in + setup_io + +From: Phillip Potter + +[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ] + +Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode +and hw->ci->addr_mode respectively, to be before the subsequent checks +for memory IO mode (and possible ioremap calls in this case). + +Also introduce ioremap error checks at both locations. This allows +resources to be properly freed on ioremap failure, as when the caller +of setup_io then subsequently calls release_io via its error path, +release_io can now correctly determine the mode as it has been set +before the ioremap call. + +Finally, refactor release_io function so that it will call +release_mem_region in the memory IO case, regardless of whether or not +hw->cfg.p/hw->addr.p are NULL. This means resources are then properly +released on failure. + +This properly implements the original reverted commit (d721fe99f6ad) +from the University of Minnesota, whilst also implementing the ioremap +check for the hw->ci->cfg_mode if block as well. + +Cc: David S. Miller +Signed-off-by: Phillip Potter +Link: https://lore.kernel.org/r/20210503115736.2104747-42-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++------- + 1 file changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +index d62006bab9c6..3cf0c6f5a1dc 100644 +--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c ++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +@@ -630,17 +630,19 @@ static void + release_io(struct inf_hw *hw) + { + if (hw->cfg.mode) { +- if (hw->cfg.p) { ++ if (hw->cfg.mode == AM_MEMIO) { + release_mem_region(hw->cfg.start, hw->cfg.size); +- iounmap(hw->cfg.p); ++ if (hw->cfg.p) ++ iounmap(hw->cfg.p); + } else + release_region(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = AM_NONE; + } + if (hw->addr.mode) { +- if (hw->addr.p) { ++ if (hw->addr.mode == AM_MEMIO) { + release_mem_region(hw->addr.start, hw->addr.size); +- iounmap(hw->addr.p); ++ if (hw->addr.p) ++ iounmap(hw->addr.p); + } else + release_region(hw->addr.start, hw->addr.size); + hw->addr.mode = AM_NONE; +@@ -670,9 +672,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->cfg.start, (ulong)hw->cfg.size); + return err; + } +- if (hw->ci->cfg_mode == AM_MEMIO) +- hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); + hw->cfg.mode = hw->ci->cfg_mode; ++ if (hw->ci->cfg_mode == AM_MEMIO) { ++ hw->cfg.p = ioremap(hw->cfg.start, hw->cfg.size); ++ if (!hw->cfg.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->cfg.start, +@@ -697,9 +702,12 @@ setup_io(struct inf_hw *hw) + (ulong)hw->addr.start, (ulong)hw->addr.size); + return err; + } +- if (hw->ci->addr_mode == AM_MEMIO) +- hw->addr.p = ioremap(hw->addr.start, hw->addr.size); + hw->addr.mode = hw->ci->addr_mode; ++ if (hw->ci->addr_mode == AM_MEMIO) { ++ hw->addr.p = ioremap(hw->addr.start, hw->addr.size); ++ if (!hw->addr.p) ++ return -ENOMEM; ++ } + if (debug & DEBUG_HW) + pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", + hw->name, (ulong)hw->addr.start, +-- +2.30.2 + diff --git a/queue-5.4/libertas-register-sysfs-groups-properly.patch b/queue-5.4/libertas-register-sysfs-groups-properly.patch new file mode 100644 index 00000000000..98a8943080e --- /dev/null +++ b/queue-5.4/libertas-register-sysfs-groups-properly.patch @@ -0,0 +1,94 @@ +From be6e98eec46c997d6d4880abf404e9f6337d9933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:20 +0200 +Subject: libertas: register sysfs groups properly + +From: Greg Kroah-Hartman + +[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ] + +The libertas driver was trying to register sysfs groups "by hand" which +causes them to be created _after_ the device is initialized and +announced to userspace, which causes races and can prevent userspace +tools from seeing the sysfs files correctly. + +Fix this up by using the built-in sysfs_groups pointers in struct +net_device which were created for this very reason, fixing the race +condition, and properly allowing for any error that might have occured +to be handled properly. + +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-54-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/mesh.c | 28 +++----------------- + 1 file changed, 4 insertions(+), 24 deletions(-) + +diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c +index a21c86d446fa..050fd403110e 100644 +--- a/drivers/net/wireless/marvell/libertas/mesh.c ++++ b/drivers/net/wireless/marvell/libertas/mesh.c +@@ -801,19 +801,6 @@ static const struct attribute_group mesh_ie_group = { + .attrs = mesh_ie_attrs, + }; + +-static void lbs_persist_config_init(struct net_device *dev) +-{ +- int ret; +- ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); +- ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- +-static void lbs_persist_config_remove(struct net_device *dev) +-{ +- sysfs_remove_group(&(dev->dev.kobj), &boot_opts_group); +- sysfs_remove_group(&(dev->dev.kobj), &mesh_ie_group); +-} +- + + /*************************************************************************** + * Initializing and starting, stopping mesh +@@ -1014,6 +1001,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + SET_NETDEV_DEV(priv->mesh_dev, priv->dev->dev.parent); + + mesh_dev->flags |= IFF_BROADCAST | IFF_MULTICAST; ++ mesh_dev->sysfs_groups[0] = &lbs_mesh_attr_group; ++ mesh_dev->sysfs_groups[1] = &boot_opts_group; ++ mesh_dev->sysfs_groups[2] = &mesh_ie_group; ++ + /* Register virtual mesh interface */ + ret = register_netdev(mesh_dev); + if (ret) { +@@ -1021,19 +1012,10 @@ static int lbs_add_mesh(struct lbs_private *priv) + goto err_free_netdev; + } + +- ret = sysfs_create_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- if (ret) +- goto err_unregister; +- +- lbs_persist_config_init(mesh_dev); +- + /* Everything successful */ + ret = 0; + goto done; + +-err_unregister: +- unregister_netdev(mesh_dev); +- + err_free_netdev: + free_netdev(mesh_dev); + +@@ -1054,8 +1036,6 @@ void lbs_remove_mesh(struct lbs_private *priv) + + netif_stop_queue(mesh_dev); + netif_carrier_off(mesh_dev); +- sysfs_remove_group(&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); +- lbs_persist_config_remove(mesh_dev); + unregister_netdev(mesh_dev); + priv->mesh_dev = NULL; + kfree(mesh_dev->ieee80211_ptr); +-- +2.30.2 + diff --git a/queue-5.4/media-dvb-add-check-on-sp8870_readreg-return.patch b/queue-5.4/media-dvb-add-check-on-sp8870_readreg-return.patch new file mode 100644 index 00000000000..5e0d2d602e0 --- /dev/null +++ b/queue-5.4/media-dvb-add-check-on-sp8870_readreg-return.patch @@ -0,0 +1,40 @@ +From 812d1fd6180c7f90d9f582aa82356c760471a602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:26 +0200 +Subject: media: dvb: Add check on sp8870_readreg return + +From: Alaa Emad + +[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ] + +The function sp8870_readreg returns a negative value when i2c_transfer +fails so properly check for this and return the error if it happens. + +Cc: Sean Young +Cc: Mauro Carvalho Chehab +Signed-off-by: Alaa Emad +Link: https://lore.kernel.org/r/20210503115736.2104747-60-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/sp8870.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c +index ee893a2f2261..9767159aeb9b 100644 +--- a/drivers/media/dvb-frontends/sp8870.c ++++ b/drivers/media/dvb-frontends/sp8870.c +@@ -280,7 +280,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) + sp8870_writereg(state, 0xc05, reg0xc05); + + // read status reg in order to clear pending irqs +- sp8870_readreg(state, 0x200); ++ err = sp8870_readreg(state, 0x200); ++ if (err < 0) ++ return err; + + // system controller start + sp8870_microcontroller_start(state); +-- +2.30.2 + diff --git a/queue-5.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch b/queue-5.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch new file mode 100644 index 00000000000..4906354d65b --- /dev/null +++ b/queue-5.4/media-gspca-mt9m111-check-write_bridge-for-timeout.patch @@ -0,0 +1,61 @@ +From a3a5294c2586082a1fbc005b71f4cf47d49083df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:28 +0200 +Subject: media: gspca: mt9m111: Check write_bridge for timeout + +From: Alaa Emad + +[ Upstream commit e932f5b458eee63d013578ea128b9ff8ef5f5496 ] + +If m5602_write_bridge times out, it will return a negative error value. +So properly check for this and handle the error correctly instead of +just ignoring it. + +Cc: Mauro Carvalho Chehab +Signed-off-by: Alaa Emad +Link: https://lore.kernel.org/r/20210503115736.2104747-62-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +index 50481dc928d0..bf1af6ed9131 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c ++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +@@ -195,7 +195,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = { + int mt9m111_probe(struct sd *sd) + { + u8 data[2] = {0x00, 0x00}; +- int i; ++ int i, err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -213,15 +213,17 @@ int mt9m111_probe(struct sd *sd) + /* Do the preinit */ + for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) { + if (preinit_mt9m111[i][0] == BRIDGE) { +- m5602_write_bridge(sd, +- preinit_mt9m111[i][1], +- preinit_mt9m111[i][2]); ++ err = m5602_write_bridge(sd, ++ preinit_mt9m111[i][1], ++ preinit_mt9m111[i][2]); + } else { + data[0] = preinit_mt9m111[i][2]; + data[1] = preinit_mt9m111[i][3]; +- m5602_write_sensor(sd, +- preinit_mt9m111[i][1], data, 2); ++ err = m5602_write_sensor(sd, ++ preinit_mt9m111[i][1], data, 2); + } ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2)) +-- +2.30.2 + diff --git a/queue-5.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch b/queue-5.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch new file mode 100644 index 00000000000..3b4138dfce4 --- /dev/null +++ b/queue-5.4/media-gspca-properly-check-for-errors-in-po1030_prob.patch @@ -0,0 +1,52 @@ +From 060b38f2f56ba0df2d2f518af93845cfc0b16619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:30 +0200 +Subject: media: gspca: properly check for errors in po1030_probe() + +From: Greg Kroah-Hartman + +[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ] + +If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to +initialize the device but return the error to the calling funtion. + +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-64-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c +index 7bdbb8065146..8fd99ceee4b6 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c ++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c +@@ -155,6 +155,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { + int po1030_probe(struct sd *sd) + { + u8 dev_id_h = 0, i; ++ int err; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -173,10 +174,13 @@ int po1030_probe(struct sd *sd) + for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { + u8 data = preinit_po1030[i][2]; + if (preinit_po1030[i][0] == SENSOR) +- m5602_write_sensor(sd, +- preinit_po1030[i][1], &data, 1); ++ err = m5602_write_sensor(sd, preinit_po1030[i][1], ++ &data, 1); + else +- m5602_write_bridge(sd, preinit_po1030[i][1], data); ++ err = m5602_write_bridge(sd, preinit_po1030[i][1], ++ data); ++ if (err < 0) ++ return err; + } + + if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) +-- +2.30.2 + diff --git a/queue-5.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch b/queue-5.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch new file mode 100644 index 00000000000..c0fb58b3aae --- /dev/null +++ b/queue-5.4/net-caif-remove-bug_on-dev-null-in-caif_xmit.patch @@ -0,0 +1,80 @@ +From d5bf76a21b01aa31827cf9acec23b6aeaf191976 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:46 +0200 +Subject: net: caif: remove BUG_ON(dev == NULL) in caif_xmit + +From: Du Cheng + +[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ] + +The condition of dev == NULL is impossible in caif_xmit(), hence it is +for the removal. + +Explanation: +The static caif_xmit() is only called upon via a function pointer +`ndo_start_xmit` defined in include/linux/netdevice.h: +``` +struct net_device_ops { + ... + netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev); + ... +} +``` + +The exhausive list of call points are: +``` +drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c + dev->netdev_ops->ndo_start_xmit(skb, dev); + ^ ^ + +drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c + struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev); + ^ ^ + return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first + ^ ^ + +drivers/usb/gadget/function/f_ncm.c + ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev); + ^ ^ + +include/linux/netdevice.h +static inline netdev_tx_t __netdev_start_xmit(... +{ + return ops->ndo_start_xmit(skb, dev); + ^ +} + + const struct net_device_ops *ops = dev->netdev_ops; + ^ + rc = __netdev_start_xmit(ops, skb, dev, more); + ^ +``` + +In each of the enumerated scenarios, it is impossible for the NULL-valued dev to +reach the caif_xmit() without crashing the kernel earlier, therefore `BUG_ON(dev == +NULL)` is rather useless, hence the removal. + +Cc: David S. Miller +Signed-off-by: Du Cheng +Link: https://lore.kernel.org/r/20210503115736.2104747-20-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/caif/caif_serial.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c +index 40b079162804..0f2bee59a82b 100644 +--- a/drivers/net/caif/caif_serial.c ++++ b/drivers/net/caif/caif_serial.c +@@ -270,7 +270,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct ser_device *ser; + +- BUG_ON(dev == NULL); + ser = netdev_priv(dev); + + /* Send flow off once, on high water mark */ +-- +2.30.2 + diff --git a/queue-5.4/net-fujitsu-fix-potential-null-ptr-deref.patch b/queue-5.4/net-fujitsu-fix-potential-null-ptr-deref.patch new file mode 100644 index 00000000000..46f3d66ac83 --- /dev/null +++ b/queue-5.4/net-fujitsu-fix-potential-null-ptr-deref.patch @@ -0,0 +1,42 @@ +From 18dbcd88c2e08ec220f7e5d99d242a3c1ded57c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:42 +0200 +Subject: net: fujitsu: fix potential null-ptr-deref + +From: Anirudh Rayabharam + +[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ] + +In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer +deref. To fix this, check the return value of ioremap and return -1 +to the caller in case of failure. + +Cc: "David S. Miller" +Acked-by: Dominik Brodowski +Signed-off-by: Anirudh Rayabharam +Link: https://lore.kernel.org/r/20210503115736.2104747-16-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +index a69cd19a55ae..b8fc9bbeca2c 100644 +--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c ++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) + return -1; + + base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); ++ if (!base) { ++ pcmcia_release_window(link, link->resource[2]); ++ return -1; ++ } ++ + pcmcia_map_mem_page(link, link->resource[2], 0); + + /* +-- +2.30.2 + diff --git a/queue-5.4/net-liquidio-add-missing-null-pointer-checks.patch b/queue-5.4/net-liquidio-add-missing-null-pointer-checks.patch new file mode 100644 index 00000000000..76c0a59c966 --- /dev/null +++ b/queue-5.4/net-liquidio-add-missing-null-pointer-checks.patch @@ -0,0 +1,235 @@ +From 6c34e11eb774da5c9f2577f71b906ebd622835a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:32 +0200 +Subject: net: liquidio: Add missing null pointer checks + +From: Tom Seewald + +[ Upstream commit dbc97bfd3918ed9268bfc174cae8a7d6b3d51aad ] + +The functions send_rx_ctrl_cmd() in both liquidio/lio_main.c and +liquidio/lio_vf_main.c do not check if the call to +octeon_alloc_soft_command() fails and returns a null pointer. Both +functions also return void so errors are not propagated back to the +caller. + +Fix these issues by updating both instances of send_rx_ctrl_cmd() to +return an integer rather than void, and have them return -ENOMEM if an +allocation failure occurs. Also update all callers of send_rx_ctrl_cmd() +so that they now check the return value. + +Cc: David S. Miller +Signed-off-by: Tom Seewald +Link: https://lore.kernel.org/r/20210503115736.2104747-66-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../net/ethernet/cavium/liquidio/lio_main.c | 28 +++++++++++++------ + .../ethernet/cavium/liquidio/lio_vf_main.c | 27 +++++++++++++----- + 2 files changed, 40 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index f2d486583e2f..d0c77ff9dbb1 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -1179,7 +1179,7 @@ static void octeon_destroy_resources(struct octeon_device *oct) + * @param lio per-network private data + * @param start_stop whether to start or stop + */ +-static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) ++static int send_rx_ctrl_cmd(struct lio *lio, int start_stop) + { + struct octeon_soft_command *sc; + union octnet_cmd *ncmd; +@@ -1187,11 +1187,16 @@ static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) + int retval; + + if (oct->props[lio->ifidx].rx_on == start_stop) +- return; ++ return 0; + + sc = (struct octeon_soft_command *) + octeon_alloc_soft_command(oct, OCTNET_CMD_SIZE, + 16, 0); ++ if (!sc) { ++ netif_info(lio, rx_err, lio->netdev, ++ "Failed to allocate octeon_soft_command struct\n"); ++ return -ENOMEM; ++ } + + ncmd = (union octnet_cmd *)sc->virtdptr; + +@@ -1213,18 +1218,19 @@ static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) + if (retval == IQ_SEND_FAILED) { + netif_info(lio, rx_err, lio->netdev, "Failed to send RX Control message\n"); + octeon_free_soft_command(oct, sc); +- return; + } else { + /* Sleep on a wait queue till the cond flag indicates that the + * response arrived or timed-out. + */ + retval = wait_for_sc_completion_timeout(oct, sc, 0); + if (retval) +- return; ++ return retval; + + oct->props[lio->ifidx].rx_on = start_stop; + WRITE_ONCE(sc->caller_is_done, true); + } ++ ++ return retval; + } + + /** +@@ -1811,6 +1817,7 @@ static int liquidio_open(struct net_device *netdev) + struct octeon_device_priv *oct_priv = + (struct octeon_device_priv *)oct->priv; + struct napi_struct *napi, *n; ++ int ret = 0; + + if (oct->props[lio->ifidx].napi_enabled == 0) { + tasklet_disable(&oct_priv->droq_tasklet); +@@ -1846,7 +1853,9 @@ static int liquidio_open(struct net_device *netdev) + netif_info(lio, ifup, lio->netdev, "Interface Open, ready for traffic\n"); + + /* tell Octeon to start forwarding packets to host */ +- send_rx_ctrl_cmd(lio, 1); ++ ret = send_rx_ctrl_cmd(lio, 1); ++ if (ret) ++ return ret; + + /* start periodical statistics fetch */ + INIT_DELAYED_WORK(&lio->stats_wk.work, lio_fetch_stats); +@@ -1857,7 +1866,7 @@ static int liquidio_open(struct net_device *netdev) + dev_info(&oct->pci_dev->dev, "%s interface is opened\n", + netdev->name); + +- return 0; ++ return ret; + } + + /** +@@ -1871,6 +1880,7 @@ static int liquidio_stop(struct net_device *netdev) + struct octeon_device_priv *oct_priv = + (struct octeon_device_priv *)oct->priv; + struct napi_struct *napi, *n; ++ int ret = 0; + + ifstate_reset(lio, LIO_IFSTATE_RUNNING); + +@@ -1887,7 +1897,9 @@ static int liquidio_stop(struct net_device *netdev) + lio->link_changes++; + + /* Tell Octeon that nic interface is down. */ +- send_rx_ctrl_cmd(lio, 0); ++ ret = send_rx_ctrl_cmd(lio, 0); ++ if (ret) ++ return ret; + + if (OCTEON_CN23XX_PF(oct)) { + if (!oct->msix_on) +@@ -1922,7 +1934,7 @@ static int liquidio_stop(struct net_device *netdev) + + dev_info(&oct->pci_dev->dev, "%s interface is stopped\n", netdev->name); + +- return 0; ++ return ret; + } + + /** +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +index 370d76822ee0..929da9e9fe9a 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_main.c +@@ -598,7 +598,7 @@ static void octeon_destroy_resources(struct octeon_device *oct) + * @param lio per-network private data + * @param start_stop whether to start or stop + */ +-static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) ++static int send_rx_ctrl_cmd(struct lio *lio, int start_stop) + { + struct octeon_device *oct = (struct octeon_device *)lio->oct_dev; + struct octeon_soft_command *sc; +@@ -606,11 +606,16 @@ static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) + int retval; + + if (oct->props[lio->ifidx].rx_on == start_stop) +- return; ++ return 0; + + sc = (struct octeon_soft_command *) + octeon_alloc_soft_command(oct, OCTNET_CMD_SIZE, + 16, 0); ++ if (!sc) { ++ netif_info(lio, rx_err, lio->netdev, ++ "Failed to allocate octeon_soft_command struct\n"); ++ return -ENOMEM; ++ } + + ncmd = (union octnet_cmd *)sc->virtdptr; + +@@ -638,11 +643,13 @@ static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) + */ + retval = wait_for_sc_completion_timeout(oct, sc, 0); + if (retval) +- return; ++ return retval; + + oct->props[lio->ifidx].rx_on = start_stop; + WRITE_ONCE(sc->caller_is_done, true); + } ++ ++ return retval; + } + + /** +@@ -909,6 +916,7 @@ static int liquidio_open(struct net_device *netdev) + struct octeon_device_priv *oct_priv = + (struct octeon_device_priv *)oct->priv; + struct napi_struct *napi, *n; ++ int ret = 0; + + if (!oct->props[lio->ifidx].napi_enabled) { + tasklet_disable(&oct_priv->droq_tasklet); +@@ -935,11 +943,13 @@ static int liquidio_open(struct net_device *netdev) + (LIQUIDIO_NDEV_STATS_POLL_TIME_MS)); + + /* tell Octeon to start forwarding packets to host */ +- send_rx_ctrl_cmd(lio, 1); ++ ret = send_rx_ctrl_cmd(lio, 1); ++ if (ret) ++ return ret; + + dev_info(&oct->pci_dev->dev, "%s interface is opened\n", netdev->name); + +- return 0; ++ return ret; + } + + /** +@@ -953,9 +963,12 @@ static int liquidio_stop(struct net_device *netdev) + struct octeon_device_priv *oct_priv = + (struct octeon_device_priv *)oct->priv; + struct napi_struct *napi, *n; ++ int ret = 0; + + /* tell Octeon to stop forwarding packets to host */ +- send_rx_ctrl_cmd(lio, 0); ++ ret = send_rx_ctrl_cmd(lio, 0); ++ if (ret) ++ return ret; + + netif_info(lio, ifdown, lio->netdev, "Stopping interface!\n"); + /* Inform that netif carrier is down */ +@@ -989,7 +1002,7 @@ static int liquidio_stop(struct net_device *netdev) + + dev_info(&oct->pci_dev->dev, "%s interface is stopped\n", netdev->name); + +- return 0; ++ return ret; + } + + /** +-- +2.30.2 + diff --git a/queue-5.4/openrisc-define-memory-barrier-mb.patch b/queue-5.4/openrisc-define-memory-barrier-mb.patch new file mode 100644 index 00000000000..9126f569fe6 --- /dev/null +++ b/queue-5.4/openrisc-define-memory-barrier-mb.patch @@ -0,0 +1,48 @@ +From df064ef8d829100e7f5cb573b2b1bc9dc8c07ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Apr 2021 14:45:43 +0200 +Subject: openrisc: Define memory barrier mb + +From: Peter Zijlstra + +[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ] + +This came up in the discussion of the requirements of qspinlock on an +architecture. OpenRISC uses qspinlock, but it was noticed that the +memmory barrier was not defined. + +Peter defined it in the mail thread writing: + + As near as I can tell this should do. The arch spec only lists + this one instruction and the text makes it sound like a completion + barrier. + +This is correct so applying this patch. + +Signed-off-by: Peter Zijlstra +[shorne@gmail.com:Turned the mail into a patch] +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/include/asm/barrier.h | 9 +++++++++ + 1 file changed, 9 insertions(+) + create mode 100644 arch/openrisc/include/asm/barrier.h + +diff --git a/arch/openrisc/include/asm/barrier.h b/arch/openrisc/include/asm/barrier.h +new file mode 100644 +index 000000000000..7538294721be +--- /dev/null ++++ b/arch/openrisc/include/asm/barrier.h +@@ -0,0 +1,9 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_BARRIER_H ++#define __ASM_BARRIER_H ++ ++#define mb() asm volatile ("l.msync" ::: "memory") ++ ++#include ++ ++#endif /* __ASM_BARRIER_H */ +-- +2.30.2 + diff --git a/queue-5.4/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch b/queue-5.4/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch new file mode 100644 index 00000000000..13ed8922e8c --- /dev/null +++ b/queue-5.4/platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch @@ -0,0 +1,43 @@ +From 01634480c45702a947e64135a26a42e6f2d65c80 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 23:30:47 +0530 +Subject: platform/x86: hp-wireless: add AMD's hardware id to the supported + list + +From: Shyam Sundar S K + +[ Upstream commit f048630bdd55eb5379ef35f971639fe52fabe499 ] + +Newer AMD based laptops uses AMDI0051 as the hardware id to support the +airplane mode button. Adding this to the supported list. + +Signed-off-by: Shyam Sundar S K +Link: https://lore.kernel.org/r/20210514180047.1697543-1-Shyam-sundar.S-k@amd.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp-wireless.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/hp-wireless.c b/drivers/platform/x86/hp-wireless.c +index 12c31fd5d5ae..0753ef18e721 100644 +--- a/drivers/platform/x86/hp-wireless.c ++++ b/drivers/platform/x86/hp-wireless.c +@@ -17,12 +17,14 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Alex Hung"); + MODULE_ALIAS("acpi*:HPQ6001:*"); + MODULE_ALIAS("acpi*:WSTADEF:*"); ++MODULE_ALIAS("acpi*:AMDI0051:*"); + + static struct input_dev *hpwl_input_dev; + + static const struct acpi_device_id hpwl_ids[] = { + {"HPQ6001", 0}, + {"WSTADEF", 0}, ++ {"AMDI0051", 0}, + {"", 0}, + }; + +-- +2.30.2 + diff --git a/queue-5.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch b/queue-5.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch new file mode 100644 index 00000000000..8597711d3ee --- /dev/null +++ b/queue-5.4/platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch @@ -0,0 +1,95 @@ +From ba40552f0dd79802bdfe9cc64c56355111176aba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:07:35 +0800 +Subject: platform/x86: hp_accel: Avoid invoking _INI to speed up resume +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ] + +hp_accel can take almost two seconds to resume on some HP laptops. + +The bottleneck is on evaluating _INI, which is only needed to run once. + +Resolve the issue by only invoking _INI when it's necessary. Namely, on +probe and on hibernation restore. + +Signed-off-by: Kai-Heng Feng +Acked-by: Éric Piel +Link: https://lore.kernel.org/r/20210430060736.590321-1-kai.heng.feng@canonical.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/misc/lis3lv02d/lis3lv02d.h | 1 + + drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++- + 2 files changed, 22 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/lis3lv02d/lis3lv02d.h b/drivers/misc/lis3lv02d/lis3lv02d.h +index 1b0c99883c57..c008eecfdfe8 100644 +--- a/drivers/misc/lis3lv02d/lis3lv02d.h ++++ b/drivers/misc/lis3lv02d/lis3lv02d.h +@@ -271,6 +271,7 @@ struct lis3lv02d { + int regs_size; + u8 *reg_cache; + bool regs_stored; ++ bool init_required; + u8 odr_mask; /* ODR bit mask */ + u8 whoami; /* indicates measurement precision */ + s16 (*read_data) (struct lis3lv02d *lis3, int reg); +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 799cbe2ffcf3..8c0867bda828 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -88,6 +88,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids); + static int lis3lv02d_acpi_init(struct lis3lv02d *lis3) + { + struct acpi_device *dev = lis3->bus_priv; ++ if (!lis3->init_required) ++ return 0; ++ + if (acpi_evaluate_object(dev->handle, METHOD_NAME__INI, + NULL, NULL) != AE_OK) + return -EINVAL; +@@ -356,6 +359,7 @@ static int lis3lv02d_add(struct acpi_device *device) + } + + /* call the core layer do its init */ ++ lis3_dev.init_required = true; + ret = lis3lv02d_init_device(&lis3_dev); + if (ret) + return ret; +@@ -403,11 +407,27 @@ static int lis3lv02d_suspend(struct device *dev) + + static int lis3lv02d_resume(struct device *dev) + { ++ lis3_dev.init_required = false; ++ lis3lv02d_poweron(&lis3_dev); ++ return 0; ++} ++ ++static int lis3lv02d_restore(struct device *dev) ++{ ++ lis3_dev.init_required = true; + lis3lv02d_poweron(&lis3_dev); + return 0; + } + +-static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); ++static const struct dev_pm_ops hp_accel_pm = { ++ .suspend = lis3lv02d_suspend, ++ .resume = lis3lv02d_resume, ++ .freeze = lis3lv02d_suspend, ++ .thaw = lis3lv02d_resume, ++ .poweroff = lis3lv02d_suspend, ++ .restore = lis3lv02d_restore, ++}; ++ + #define HP_ACCEL_PM (&hp_accel_pm) + #else + #define HP_ACCEL_PM NULL +-- +2.30.2 + diff --git a/queue-5.4/platform-x86-intel_punit_ipc-append-module_device_ta.patch b/queue-5.4/platform-x86-intel_punit_ipc-append-module_device_ta.patch new file mode 100644 index 00000000000..8b5510d34ee --- /dev/null +++ b/queue-5.4/platform-x86-intel_punit_ipc-append-module_device_ta.patch @@ -0,0 +1,38 @@ +From 0987532a6f89f3084e0e2ab2eb14294556c10fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 13:15:21 +0300 +Subject: platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI + +From: Andy Shevchenko + +[ Upstream commit bc1eca606d8084465e6f89fd646cc71defbad490 ] + +The intel_punit_ipc driver might be compiled as a module. +When udev handles the event of the devices appearing +the intel_punit_ipc module is missing. + +Append MODULE_DEVICE_TABLE for ACPI case to fix the loading issue. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210519101521.79338-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_punit_ipc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index fa97834fdb78..ccb44f2eb240 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -328,6 +328,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = { + { "INT34D4", 0 }, + { } + }; ++MODULE_DEVICE_TABLE(acpi, punit_ipc_acpi_ids); + + static struct platform_driver intel_punit_ipc_driver = { + .probe = intel_punit_ipc_probe, +-- +2.30.2 + diff --git a/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-mediac.patch b/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-mediac.patch new file mode 100644 index 00000000000..52f5a8f4f3a --- /dev/null +++ b/queue-5.4/platform-x86-touchscreen_dmi-add-info-for-the-mediac.patch @@ -0,0 +1,44 @@ +From 5a8d104b1880be5fab929bee5f7c81c334450abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 20:57:46 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for the Mediacom Winpad 7.0 + W700 tablet + +From: Teava Radu + +[ Upstream commit 39a6172ea88b3117353ae16cbb0a53cd80a9340a ] + +Add touchscreen info for the Mediacom Winpad 7.0 W700 tablet. +Tested on 5.11 hirsute. +Note: it's hw clone to Wintron surftab 7. + +Signed-off-by: Teava Radu +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210504185746.175461-6-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 7ed1189a7200..515c66ca1aec 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -838,6 +838,14 @@ static const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BIOS_VERSION, "jumperx.T87.KFBNEEA"), + }, + }, ++ { ++ /* Mediacom WinPad 7.0 W700 (same hw as Wintron surftab 7") */ ++ .driver_data = (void *)&trekstor_surftab_wintron70_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "MEDIACOM"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "WinPad 7 W10 - WPW700"), ++ }, ++ }, + { + /* Mediacom Flexbook Edge 11 (same hw as TS Primebook C11) */ + .driver_data = (void *)&trekstor_primebook_c11_data, +-- +2.30.2 + diff --git a/queue-5.4/revert-alsa-gus-add-a-check-of-the-status-of-snd_ctl.patch b/queue-5.4/revert-alsa-gus-add-a-check-of-the-status-of-snd_ctl.patch new file mode 100644 index 00000000000..0a4bdf04c88 --- /dev/null +++ b/queue-5.4/revert-alsa-gus-add-a-check-of-the-status-of-snd_ctl.patch @@ -0,0 +1,59 @@ +From 9a3f12b7c692861274be224c76e21080f6f5da8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:59 +0200 +Subject: Revert "ALSA: gus: add a check of the status of snd_ctl_add" + +From: Greg Kroah-Hartman + +[ Upstream commit 1dacca7fa1ebea47d38d20cd2df37094805d2649 ] + +This reverts commit 0f25e000cb4398081748e54f62a902098aa79ec1. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit did nothing if there was an error, except to print +out a message, which is pointless. So remove the commit as it gives a +"false sense of doing something". + +Cc: Kangjie Lu +Reviewed-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210503115736.2104747-33-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/gus/gus_main.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/sound/isa/gus/gus_main.c b/sound/isa/gus/gus_main.c +index af6b4d89d695..39911a637e80 100644 +--- a/sound/isa/gus/gus_main.c ++++ b/sound/isa/gus/gus_main.c +@@ -77,17 +77,8 @@ static const struct snd_kcontrol_new snd_gus_joystick_control = { + + static void snd_gus_init_control(struct snd_gus_card *gus) + { +- int ret; +- +- if (!gus->ace_flag) { +- ret = +- snd_ctl_add(gus->card, +- snd_ctl_new1(&snd_gus_joystick_control, +- gus)); +- if (ret) +- snd_printk(KERN_ERR "gus: snd_ctl_add failed: %d\n", +- ret); +- } ++ if (!gus->ace_flag) ++ snd_ctl_add(gus->card, snd_ctl_new1(&snd_gus_joystick_control, gus)); + } + + /* +-- +2.30.2 + diff --git a/queue-5.4/revert-alsa-sb-fix-a-missing-check-of-snd_ctl_add.patch b/queue-5.4/revert-alsa-sb-fix-a-missing-check-of-snd_ctl_add.patch new file mode 100644 index 00000000000..523153f5d95 --- /dev/null +++ b/queue-5.4/revert-alsa-sb-fix-a-missing-check-of-snd_ctl_add.patch @@ -0,0 +1,53 @@ +From a3f1bd198505e9ba632ca52f2e73abf20ecd2034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:34 +0200 +Subject: Revert "ALSA: sb: fix a missing check of snd_ctl_add" + +From: Greg Kroah-Hartman + +[ Upstream commit 4b059ce1f4b368208c2310925f49be77f15e527b ] + +This reverts commit beae77170c60aa786f3e4599c18ead2854d8694d. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It is safe to ignore this error as the +mixer element is optional, and the driver is very legacy. + +Cc: Aditya Pakki +Reviewed-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210503115736.2104747-8-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb16_main.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/sound/isa/sb/sb16_main.c b/sound/isa/sb/sb16_main.c +index 0768bbf8fd71..679f9f48370f 100644 +--- a/sound/isa/sb/sb16_main.c ++++ b/sound/isa/sb/sb16_main.c +@@ -864,14 +864,10 @@ int snd_sb16dsp_pcm(struct snd_sb *chip, int device) + snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK, &snd_sb16_playback_ops); + snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, &snd_sb16_capture_ops); + +- if (chip->dma16 >= 0 && chip->dma8 != chip->dma16) { +- err = snd_ctl_add(card, snd_ctl_new1( +- &snd_sb16_dma_control, chip)); +- if (err) +- return err; +- } else { ++ if (chip->dma16 >= 0 && chip->dma8 != chip->dma16) ++ snd_ctl_add(card, snd_ctl_new1(&snd_sb16_dma_control, chip)); ++ else + pcm->info_flags = SNDRV_PCM_INFO_HALF_DUPLEX; +- } + + snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, + card->dev, +-- +2.30.2 + diff --git a/queue-5.4/revert-alsa-usx2y-fix-potential-null-pointer-derefer.patch b/queue-5.4/revert-alsa-usx2y-fix-potential-null-pointer-derefer.patch new file mode 100644 index 00000000000..d898ec783c2 --- /dev/null +++ b/queue-5.4/revert-alsa-usx2y-fix-potential-null-pointer-derefer.patch @@ -0,0 +1,51 @@ +From 433195391da8d569e8811c8677fcb0dc0bebf6df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:03 +0200 +Subject: Revert "ALSA: usx2y: Fix potential NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit 4667a6fc1777ce071504bab570d3599107f4790f ] + +This reverts commit a2c6433ee5a35a8de6d563f6512a26f87835ea0f. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original patch was incorrect, and would leak memory if the error +path the patch added was hit. + +Cc: Aditya Pakki +Reviewed-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210503115736.2104747-37-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/usb/usx2y/usb_stream.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c +index 091c071b270a..6bba17bf689a 100644 +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -91,12 +91,7 @@ static int init_urbs(struct usb_stream_kernel *sk, unsigned use_packsize, + + for (u = 0; u < USB_STREAM_NURBS; ++u) { + sk->inurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL); +- if (!sk->inurb[u]) +- return -ENOMEM; +- + sk->outurb[u] = usb_alloc_urb(sk->n_o_ps, GFP_KERNEL); +- if (!sk->outurb[u]) +- return -ENOMEM; + } + + if (init_pipe_urbs(sk, use_packsize, sk->inurb, indata, dev, in_pipe) || +-- +2.30.2 + diff --git a/queue-5.4/revert-asoc-cs43130-fix-a-null-pointer-dereference.patch b/queue-5.4/revert-asoc-cs43130-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..5831619d5a4 --- /dev/null +++ b/queue-5.4/revert-asoc-cs43130-fix-a-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From 45562846fe504d230ff20b78d3c2701404898470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:23 +0200 +Subject: Revert "ASoC: cs43130: fix a NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit fdda0dd2686ecd1f2e616c9e0366ea71b40c485d ] + +This reverts commit a2be42f18d409213bb7e7a736e3ef6ba005115bb. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original patch here is not correct, sysfs files that were created +are not unwound. + +Cc: Kangjie Lu +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210503115736.2104747-57-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs43130.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c +index 7fb34422a2a4..bb46e993c353 100644 +--- a/sound/soc/codecs/cs43130.c ++++ b/sound/soc/codecs/cs43130.c +@@ -2319,8 +2319,6 @@ static int cs43130_probe(struct snd_soc_component *component) + return ret; + + cs43130->wq = create_singlethread_workqueue("cs43130_hp"); +- if (!cs43130->wq) +- return -ENOMEM; + INIT_WORK(&cs43130->work, cs43130_imp_meas); + } + +-- +2.30.2 + diff --git a/queue-5.4/revert-ath6kl-return-error-code-in-ath6kl_wmi_set_ro.patch b/queue-5.4/revert-ath6kl-return-error-code-in-ath6kl_wmi_set_ro.patch new file mode 100644 index 00000000000..e89b66ee16f --- /dev/null +++ b/queue-5.4/revert-ath6kl-return-error-code-in-ath6kl_wmi_set_ro.patch @@ -0,0 +1,52 @@ +From 3bf7332196a7323050b545ba7f3ee0622d3b2ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:09 +0200 +Subject: Revert "ath6kl: return error code in ath6kl_wmi_set_roam_lrssi_cmd()" + +From: Greg Kroah-Hartman + +[ Upstream commit efba106f89fc6848726716c101f4c84e88720a9c ] + +This reverts commit fc6a6521556c8250e356ddc6a3f2391aa62dc976. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The change being reverted does NOTHING as the caller to this function +does not even look at the return value of the call. So the "claim" that +this fixed an an issue is not true. It will be fixed up properly in a +future patch by propagating the error up the stack correctly. + +Cc: Kangjie Lu +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-43-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index c610fe21c85c..d27b4088b874 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -776,8 +776,10 @@ int ath6kl_wmi_set_roam_lrssi_cmd(struct wmi *wmi, u8 lrssi) + cmd->info.params.roam_rssi_floor = DEF_LRSSI_ROAM_FLOOR; + cmd->roam_ctrl = WMI_SET_LRSSI_SCAN_PARAMS; + +- return ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, ++ ath6kl_wmi_cmd_send(wmi, 0, skb, WMI_SET_ROAM_CTRL_CMDID, + NO_SYNC_WMIFLAG); ++ ++ return 0; + } + + int ath6kl_wmi_force_roam_cmd(struct wmi *wmi, const u8 *bssid) +-- +2.30.2 + diff --git a/queue-5.4/revert-brcmfmac-add-a-check-for-the-status-of-usb_re.patch b/queue-5.4/revert-brcmfmac-add-a-check-for-the-status-of-usb_re.patch new file mode 100644 index 00000000000..6f4949d157c --- /dev/null +++ b/queue-5.4/revert-brcmfmac-add-a-check-for-the-status-of-usb_re.patch @@ -0,0 +1,51 @@ +From 3232df609b0ff4cf1b4bc1cc15b086c8607656bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:35 +0200 +Subject: Revert "brcmfmac: add a check for the status of usb_register" + +From: Greg Kroah-Hartman + +[ Upstream commit 30a350947692f794796f563029d29764497f2887 ] + +This reverts commit 42daad3343be4a4e1ee03e30a5f5cc731dadfef5. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit here did nothing to actually help if usb_register() +failed, so it gives a "false sense of security" when there is none. The +correct solution is to correctly unwind from this error. + +Cc: Kangjie Lu +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-69-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +index 575ed19e9195..6f41d28930e4 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c +@@ -1560,10 +1560,6 @@ void brcmf_usb_exit(void) + + void brcmf_usb_register(void) + { +- int ret; +- + brcmf_dbg(USB, "Enter\n"); +- ret = usb_register(&brcmf_usbdrvr); +- if (ret) +- brcmf_err("usb_register failed %d\n", ret); ++ usb_register(&brcmf_usbdrvr); + } +-- +2.30.2 + diff --git a/queue-5.4/revert-char-hpet-fix-a-missing-check-of-ioremap.patch b/queue-5.4/revert-char-hpet-fix-a-missing-check-of-ioremap.patch new file mode 100644 index 00000000000..bcb0381b707 --- /dev/null +++ b/queue-5.4/revert-char-hpet-fix-a-missing-check-of-ioremap.patch @@ -0,0 +1,48 @@ +From 5d6a1501641e76c9a92caecd0477a09a031ed402 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:55 +0200 +Subject: Revert "char: hpet: fix a missing check of ioremap" + +From: Greg Kroah-Hartman + +[ Upstream commit 566f53238da74801b48e985788e5f7c9159e5940 ] + +This reverts commit 13bd14a41ce3105d5b1f3cd8b4d1e249d17b6d9b. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +While this is technically correct, it is only fixing ONE of these errors +in this function, so the patch is not fully correct. I'll leave this +revert and provide a fix for this later that resolves this same +"problem" everywhere in this function. + +Cc: Kangjie Lu +Link: https://lore.kernel.org/r/20210503115736.2104747-29-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/hpet.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c +index f69609b47fef..3e31740444f1 100644 +--- a/drivers/char/hpet.c ++++ b/drivers/char/hpet.c +@@ -969,8 +969,6 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) + if (ACPI_SUCCESS(status)) { + hdp->hd_phys_address = addr.address.minimum; + hdp->hd_address = ioremap(addr.address.minimum, addr.address.address_length); +- if (!hdp->hd_address) +- return AE_ERROR; + + if (hpet_is_known(hdp)) { + iounmap(hdp->hd_address); +-- +2.30.2 + diff --git a/queue-5.4/revert-dmaengine-qcom_hidma-check-for-driver-registe.patch b/queue-5.4/revert-dmaengine-qcom_hidma-check-for-driver-registe.patch new file mode 100644 index 00000000000..d6ef5bd63b8 --- /dev/null +++ b/queue-5.4/revert-dmaengine-qcom_hidma-check-for-driver-registe.patch @@ -0,0 +1,51 @@ +From 9e543891b050c32ecb0c932c2e525db70649e8af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:17 +0200 +Subject: Revert "dmaengine: qcom_hidma: Check for driver register failure" + +From: Greg Kroah-Hartman + +[ Upstream commit 43ed0fcf613a87dd0221ec72d1ade4d6544f2ffc ] + +This reverts commit a474b3f0428d6b02a538aa10b3c3b722751cb382. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original change is NOT correct, as it does not correctly unwind from +the resources that was allocated before the call to +platform_driver_register(). + +Cc: Aditya Pakki +Acked-By: Vinod Koul +Acked-By: Sinan Kaya +Link: https://lore.kernel.org/r/20210503115736.2104747-51-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/dma/qcom/hidma_mgmt.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/qcom/hidma_mgmt.c b/drivers/dma/qcom/hidma_mgmt.c +index 806ca02c52d7..fe87b01f7a4e 100644 +--- a/drivers/dma/qcom/hidma_mgmt.c ++++ b/drivers/dma/qcom/hidma_mgmt.c +@@ -418,8 +418,9 @@ static int __init hidma_mgmt_init(void) + hidma_mgmt_of_populate_channels(child); + } + #endif +- return platform_driver_register(&hidma_mgmt_driver); ++ platform_driver_register(&hidma_mgmt_driver); + ++ return 0; + } + module_init(hidma_mgmt_init); + MODULE_LICENSE("GPL v2"); +-- +2.30.2 + diff --git a/queue-5.4/revert-isdn-misdn-fix-potential-null-pointer-derefer.patch b/queue-5.4/revert-isdn-misdn-fix-potential-null-pointer-derefer.patch new file mode 100644 index 00000000000..4468d2fdef5 --- /dev/null +++ b/queue-5.4/revert-isdn-misdn-fix-potential-null-pointer-derefer.patch @@ -0,0 +1,50 @@ +From 27aa0cf464fd8208713dce666de392242ea208e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:13 +0200 +Subject: Revert "isdn: mISDN: Fix potential NULL pointer dereference of + kzalloc" + +From: Greg Kroah-Hartman + +[ Upstream commit 36a2c87f7ed9e305d05b9a5c044cc6c494771504 ] + +This reverts commit 38d22659803a033b1b66cd2624c33570c0dde77d. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +While it looks like the original change is correct, it is not, as none +of the setup actually happens, and the error value is not propagated +upwards. + +Cc: Aditya Pakki +Cc: David S. Miller +Link: https://lore.kernel.org/r/20210503115736.2104747-47-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c +index 008a74a1ed44..7a051435c406 100644 +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -249,9 +249,6 @@ hfcsusb_ph_info(struct hfcsusb *hw) + int i; + + phi = kzalloc(struct_size(phi, bch, dch->dev.nrbchan), GFP_ATOMIC); +- if (!phi) +- return; +- + phi->dch.ch.protocol = hw->protocol; + phi->dch.ch.Flags = dch->Flags; + phi->dch.state = dch->state; +-- +2.30.2 + diff --git a/queue-5.4/revert-isdn-misdninfineon-fix-potential-null-pointer.patch b/queue-5.4/revert-isdn-misdninfineon-fix-potential-null-pointer.patch new file mode 100644 index 00000000000..159cb613329 --- /dev/null +++ b/queue-5.4/revert-isdn-misdninfineon-fix-potential-null-pointer.patch @@ -0,0 +1,55 @@ +From 707d2dc3c9e43aa1cf2dece38b375f057d19a08e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:07 +0200 +Subject: Revert "isdn: mISDNinfineon: fix potential NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit abd7bca23bd4247124265152d00ffd4b2b0d6877 ] + +This reverts commit d721fe99f6ada070ae8fc0ec3e01ce5a42def0d9. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit was incorrect, it should have never have used +"unlikely()" and if it ever does trigger, resources are left grabbed. + +Given there are no users for this code around, I'll just revert this and +leave it "as is" as the odds that ioremap() will ever fail here is +horrendiously low. + +Cc: Kangjie Lu +Cc: David S. Miller +Link: https://lore.kernel.org/r/20210503115736.2104747-41-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/mISDNinfineon.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/isdn/hardware/mISDN/mISDNinfineon.c b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +index f4cb29766888..d62006bab9c6 100644 +--- a/drivers/isdn/hardware/mISDN/mISDNinfineon.c ++++ b/drivers/isdn/hardware/mISDN/mISDNinfineon.c +@@ -697,11 +697,8 @@ setup_io(struct inf_hw *hw) + (ulong)hw->addr.start, (ulong)hw->addr.size); + return err; + } +- if (hw->ci->addr_mode == AM_MEMIO) { ++ if (hw->ci->addr_mode == AM_MEMIO) + hw->addr.p = ioremap(hw->addr.start, hw->addr.size); +- if (unlikely(!hw->addr.p)) +- return -ENOMEM; +- } + hw->addr.mode = hw->ci->addr_mode; + if (debug & DEBUG_HW) + pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", +-- +2.30.2 + diff --git a/queue-5.4/revert-libertas-add-checks-for-the-return-value-of-s.patch b/queue-5.4/revert-libertas-add-checks-for-the-return-value-of-s.patch new file mode 100644 index 00000000000..64bbfdcac4c --- /dev/null +++ b/queue-5.4/revert-libertas-add-checks-for-the-return-value-of-s.patch @@ -0,0 +1,55 @@ +From 9183317a0621c79451d04bab99c8dbb0cd998ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:19 +0200 +Subject: Revert "libertas: add checks for the return value of + sysfs_create_group" + +From: Greg Kroah-Hartman + +[ Upstream commit 46651077765c80a0d6f87f3469129a72e49ce91b ] + +This reverts commit 434256833d8eb988cb7f3b8a41699e2fe48d9332. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit was incorrect, the error needs to be propagated back +to the caller AND if the second group call fails, the first needs to be +removed. There are much better ways to solve this, the driver should +NOT be calling sysfs_create_group() on its own as it is racing userspace +and loosing. + +Cc: Kangjie Lu +Cc: Kalle Valo +Link: https://lore.kernel.org/r/20210503115736.2104747-53-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas/mesh.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/wireless/marvell/libertas/mesh.c b/drivers/net/wireless/marvell/libertas/mesh.c +index 2747c957d18c..a21c86d446fa 100644 +--- a/drivers/net/wireless/marvell/libertas/mesh.c ++++ b/drivers/net/wireless/marvell/libertas/mesh.c +@@ -805,12 +805,7 @@ static void lbs_persist_config_init(struct net_device *dev) + { + int ret; + ret = sysfs_create_group(&(dev->dev.kobj), &boot_opts_group); +- if (ret) +- pr_err("failed to create boot_opts_group.\n"); +- + ret = sysfs_create_group(&(dev->dev.kobj), &mesh_ie_group); +- if (ret) +- pr_err("failed to create mesh_ie_group.\n"); + } + + static void lbs_persist_config_remove(struct net_device *dev) +-- +2.30.2 + diff --git a/queue-5.4/revert-media-dvb-add-check-on-sp8870_readreg.patch b/queue-5.4/revert-media-dvb-add-check-on-sp8870_readreg.patch new file mode 100644 index 00000000000..aa7997e62f5 --- /dev/null +++ b/queue-5.4/revert-media-dvb-add-check-on-sp8870_readreg.patch @@ -0,0 +1,50 @@ +From df1b213b85bcea8a71371eef3e3d6612a32a76c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:25 +0200 +Subject: Revert "media: dvb: Add check on sp8870_readreg" + +From: Greg Kroah-Hartman + +[ Upstream commit 47e4ff06fa7f5ba4860543a2913bbd0c164640aa ] + +This reverts commit 467a37fba93f2b4fe3ab597ff6a517b22b566882. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +This commit is not properly checking for an error at all, so if a +read succeeds from this device, it will error out. + +Cc: Aditya Pakki +Cc: Sean Young +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-59-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-frontends/sp8870.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/dvb-frontends/sp8870.c b/drivers/media/dvb-frontends/sp8870.c +index 655db8272268..ee893a2f2261 100644 +--- a/drivers/media/dvb-frontends/sp8870.c ++++ b/drivers/media/dvb-frontends/sp8870.c +@@ -280,9 +280,7 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe) + sp8870_writereg(state, 0xc05, reg0xc05); + + // read status reg in order to clear pending irqs +- err = sp8870_readreg(state, 0x200); +- if (err) +- return err; ++ sp8870_readreg(state, 0x200); + + // system controller start + sp8870_microcontroller_start(state); +-- +2.30.2 + diff --git a/queue-5.4/revert-media-gspca-check-the-return-value-of-write_b.patch b/queue-5.4/revert-media-gspca-check-the-return-value-of-write_b.patch new file mode 100644 index 00000000000..6abb6398c7a --- /dev/null +++ b/queue-5.4/revert-media-gspca-check-the-return-value-of-write_b.patch @@ -0,0 +1,64 @@ +From d2fedf9e54003a6892654de1f6abf2ff5c1da8e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:29 +0200 +Subject: Revert "media: gspca: Check the return value of write_bridge for + timeout" + +From: Greg Kroah-Hartman + +[ Upstream commit 8e23e83c752b54e98102627a1cc09281ad71a299 ] + +This reverts commit a21a0eb56b4e8fe4a330243af8030f890cde2283. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +Different error values should never be "OR" together and expect anything +sane to come out of the result. + +Cc: Aditya Pakki +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-63-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_po1030.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_po1030.c b/drivers/media/usb/gspca/m5602/m5602_po1030.c +index d680b777f097..7bdbb8065146 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_po1030.c ++++ b/drivers/media/usb/gspca/m5602/m5602_po1030.c +@@ -154,7 +154,6 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = { + + int po1030_probe(struct sd *sd) + { +- int rc = 0; + u8 dev_id_h = 0, i; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + +@@ -174,14 +173,11 @@ int po1030_probe(struct sd *sd) + for (i = 0; i < ARRAY_SIZE(preinit_po1030); i++) { + u8 data = preinit_po1030[i][2]; + if (preinit_po1030[i][0] == SENSOR) +- rc |= m5602_write_sensor(sd, ++ m5602_write_sensor(sd, + preinit_po1030[i][1], &data, 1); + else +- rc |= m5602_write_bridge(sd, preinit_po1030[i][1], +- data); ++ m5602_write_bridge(sd, preinit_po1030[i][1], data); + } +- if (rc < 0) +- return rc; + + if (m5602_read_sensor(sd, PO1030_DEVID_H, &dev_id_h, 1)) + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.4/revert-media-gspca-mt9m111-check-write_bridge-for-ti.patch b/queue-5.4/revert-media-gspca-mt9m111-check-write_bridge-for-ti.patch new file mode 100644 index 00000000000..5cd215bb977 --- /dev/null +++ b/queue-5.4/revert-media-gspca-mt9m111-check-write_bridge-for-ti.patch @@ -0,0 +1,68 @@ +From 70a3d71fb79a6fe00608c58ff3db7a58346d3537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:27 +0200 +Subject: Revert "media: gspca: mt9m111: Check write_bridge for timeout" + +From: Greg Kroah-Hartman + +[ Upstream commit d8c3be2fb2079d0cb4cd29d6aba58dbe54771e42 ] + +This reverts commit 656025850074f5c1ba2e05be37bda57ba2b8d491. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +Different error values should never be "OR" together and expect anything +sane to come out of the result. + +Cc: Aditya Pakki +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-61-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/m5602/m5602_mt9m111.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +index bfa3b381d8a2..50481dc928d0 100644 +--- a/drivers/media/usb/gspca/m5602/m5602_mt9m111.c ++++ b/drivers/media/usb/gspca/m5602/m5602_mt9m111.c +@@ -195,7 +195,7 @@ static const struct v4l2_ctrl_config mt9m111_greenbal_cfg = { + int mt9m111_probe(struct sd *sd) + { + u8 data[2] = {0x00, 0x00}; +- int i, rc = 0; ++ int i; + struct gspca_dev *gspca_dev = (struct gspca_dev *)sd; + + if (force_sensor) { +@@ -213,18 +213,16 @@ int mt9m111_probe(struct sd *sd) + /* Do the preinit */ + for (i = 0; i < ARRAY_SIZE(preinit_mt9m111); i++) { + if (preinit_mt9m111[i][0] == BRIDGE) { +- rc |= m5602_write_bridge(sd, ++ m5602_write_bridge(sd, + preinit_mt9m111[i][1], + preinit_mt9m111[i][2]); + } else { + data[0] = preinit_mt9m111[i][2]; + data[1] = preinit_mt9m111[i][3]; +- rc |= m5602_write_sensor(sd, ++ m5602_write_sensor(sd, + preinit_mt9m111[i][1], data, 2); + } + } +- if (rc < 0) +- return rc; + + if (m5602_read_sensor(sd, MT9M111_SC_CHIPVER, data, 2)) + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.4/revert-media-usb-gspca-add-a-missed-check-for-goto_l.patch b/queue-5.4/revert-media-usb-gspca-add-a-missed-check-for-goto_l.patch new file mode 100644 index 00000000000..c84bcc46b47 --- /dev/null +++ b/queue-5.4/revert-media-usb-gspca-add-a-missed-check-for-goto_l.patch @@ -0,0 +1,55 @@ +From cad1327a4de32e0615d21762d652f03e16418748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:33 +0200 +Subject: Revert "media: usb: gspca: add a missed check for goto_low_power" + +From: Greg Kroah-Hartman + +[ Upstream commit fd013265e5b5576a74a033920d6c571e08d7c423 ] + +This reverts commit 5b711870bec4dc9a6d705d41e127e73944fa3650. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to do does nothing useful as a user +can do nothing with this information and if an error did happen, the +code would continue on as before. Because of this, just revert it. + +Cc: Kangjie Lu +Cc: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210503115736.2104747-7-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/cpia1.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c +index a4f7431486f3..d93d384286c1 100644 +--- a/drivers/media/usb/gspca/cpia1.c ++++ b/drivers/media/usb/gspca/cpia1.c +@@ -1424,7 +1424,6 @@ static int sd_config(struct gspca_dev *gspca_dev, + { + struct sd *sd = (struct sd *) gspca_dev; + struct cam *cam; +- int ret; + + sd->mainsFreq = FREQ_DEF == V4L2_CID_POWER_LINE_FREQUENCY_60HZ; + reset_camera_params(gspca_dev); +@@ -1436,10 +1435,7 @@ static int sd_config(struct gspca_dev *gspca_dev, + cam->cam_mode = mode; + cam->nmodes = ARRAY_SIZE(mode); + +- ret = goto_low_power(gspca_dev); +- if (ret) +- gspca_err(gspca_dev, "Cannot go to low power mode: %d\n", +- ret); ++ goto_low_power(gspca_dev); + /* Check the firmware version. */ + sd->params.version.firmwareVersion = 0; + get_version_information(gspca_dev); +-- +2.30.2 + diff --git a/queue-5.4/revert-net-fujitsu-fix-a-potential-null-pointer-dere.patch b/queue-5.4/revert-net-fujitsu-fix-a-potential-null-pointer-dere.patch new file mode 100644 index 00000000000..f6dab50f170 --- /dev/null +++ b/queue-5.4/revert-net-fujitsu-fix-a-potential-null-pointer-dere.patch @@ -0,0 +1,53 @@ +From 67aea3eea94f7c40f1714e6c8e73dc6a9060436f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:41 +0200 +Subject: Revert "net: fujitsu: fix a potential NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit 5f94eaa4ee23e80841fa359a372f84cfe25daee1 ] + +This reverts commit 9f4d6358e11bbc7b839f9419636188e4151fb6e4. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original change does not change any behavior as the caller of this +function onlyu checks for "== -1" as an error condition so this error is +not handled properly. Remove this change and it will be fixed up +properly in a later commit. + +Cc: Kangjie Lu +Cc: David S. Miller +Reviewed-by: Dominik Brodowski +Link: https://lore.kernel.org/r/20210503115736.2104747-15-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +index 1eca0fdb9933..a69cd19a55ae 100644 +--- a/drivers/net/ethernet/fujitsu/fmvj18x_cs.c ++++ b/drivers/net/ethernet/fujitsu/fmvj18x_cs.c +@@ -547,11 +547,6 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id) + return -1; + + base = ioremap(link->resource[2]->start, resource_size(link->resource[2])); +- if (!base) { +- pcmcia_release_window(link, link->resource[2]); +- return -ENOMEM; +- } +- + pcmcia_map_mem_page(link, link->resource[2], 0); + + /* +-- +2.30.2 + diff --git a/queue-5.4/revert-net-liquidio-fix-a-null-pointer-dereference.patch b/queue-5.4/revert-net-liquidio-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..8fb8bdbf8dd --- /dev/null +++ b/queue-5.4/revert-net-liquidio-fix-a-null-pointer-dereference.patch @@ -0,0 +1,52 @@ +From 80b9776ad9148a9bfef47646676485eb986a1d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:57:31 +0200 +Subject: Revert "net: liquidio: fix a NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit 4fd798a5a89114c1892574c50f2aebd49bc5b4f5 ] + +This reverts commit fe543b2f174f34a7a751aa08b334fe6b105c4569. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +While the original commit does keep the immediate "NULL dereference" +from happening, it does not properly propagate the error back to the +callers, AND it does not fix this same identical issue in the +drivers/net/ethernet/cavium/liquidio/lio_vf_main.c for some reason. + +Cc: Kangjie Lu +Cc: David S. Miller +Link: https://lore.kernel.org/r/20210503115736.2104747-65-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/liquidio/lio_main.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c +index 7f3b2e3b0868..f2d486583e2f 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_main.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c +@@ -1192,11 +1192,6 @@ static void send_rx_ctrl_cmd(struct lio *lio, int start_stop) + sc = (struct octeon_soft_command *) + octeon_alloc_soft_command(oct, OCTNET_CMD_SIZE, + 16, 0); +- if (!sc) { +- netif_info(lio, rx_err, lio->netdev, +- "Failed to allocate octeon_soft_command\n"); +- return; +- } + + ncmd = (union octnet_cmd *)sc->virtdptr; + +-- +2.30.2 + diff --git a/queue-5.4/revert-net-smc-fix-a-null-pointer-dereference.patch b/queue-5.4/revert-net-smc-fix-a-null-pointer-dereference.patch new file mode 100644 index 00000000000..eec3b302e67 --- /dev/null +++ b/queue-5.4/revert-net-smc-fix-a-null-pointer-dereference.patch @@ -0,0 +1,52 @@ +From a8ab710beb46282948308c13d422626626dfebaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:43 +0200 +Subject: Revert "net/smc: fix a NULL pointer dereference" + +From: Greg Kroah-Hartman + +[ Upstream commit 5369ead83f5aff223b6418c99cb1fe9a8f007363 ] + +This reverts commit e183d4e414b64711baf7a04e214b61969ca08dfa. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +The original commit causes a memory leak and does not properly fix the +issue it claims to fix. I will send a follow-on patch to resolve this +properly. + +Cc: Kangjie Lu +Cc: Ursula Braun +Cc: David S. Miller +Link: https://lore.kernel.org/r/20210503115736.2104747-17-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + net/smc/smc_ism.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/net/smc/smc_ism.c b/net/smc/smc_ism.c +index e89e918b88e0..2fff79db1a59 100644 +--- a/net/smc/smc_ism.c ++++ b/net/smc/smc_ism.c +@@ -289,11 +289,6 @@ struct smcd_dev *smcd_alloc_dev(struct device *parent, const char *name, + INIT_LIST_HEAD(&smcd->vlan); + smcd->event_wq = alloc_ordered_workqueue("ism_evt_wq-%s)", + WQ_MEM_RECLAIM, name); +- if (!smcd->event_wq) { +- kfree(smcd->conn); +- kfree(smcd); +- return NULL; +- } + return smcd; + } + EXPORT_SYMBOL_GPL(smcd_alloc_dev); +-- +2.30.2 + diff --git a/queue-5.4/revert-serial-max310x-pass-return-value-of-spi_regis.patch b/queue-5.4/revert-serial-max310x-pass-return-value-of-spi_regis.patch new file mode 100644 index 00000000000..e7050616537 --- /dev/null +++ b/queue-5.4/revert-serial-max310x-pass-return-value-of-spi_regis.patch @@ -0,0 +1,51 @@ +From 4f0a3f1d8de80608cc007257ab99acbb400373fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:37 +0200 +Subject: Revert "serial: max310x: pass return value of spi_register_driver" + +From: Greg Kroah-Hartman + +[ Upstream commit b0a85abbe92e1a6f3e8580a4590fa7245de7090b ] + +This reverts commit 51f689cc11333944c7a457f25ec75fcb41e99410. + +Because of recent interactions with developers from @umn.edu, all +commits from them have been recently re-reviewed to ensure if they were +correct or not. + +Upon review, this commit was found to be incorrect for the reasons +below, so it must be reverted. It will be fixed up "correctly" in a +later kernel change. + +This change did not properly unwind from the error condition, so it was +not correct. + +Cc: Kangjie Lu +Acked-by: Jiri Slaby +Link: https://lore.kernel.org/r/20210503115736.2104747-11-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index 8434bd5a8ec7..f60b7b86d099 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1527,10 +1527,10 @@ static int __init max310x_uart_init(void) + return ret; + + #ifdef CONFIG_SPI_MASTER +- ret = spi_register_driver(&max310x_spi_driver); ++ spi_register_driver(&max310x_spi_driver); + #endif + +- return ret; ++ return 0; + } + module_init(max310x_uart_init); + +-- +2.30.2 + diff --git a/queue-5.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch b/queue-5.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch new file mode 100644 index 00000000000..4a3bc06e4a8 --- /dev/null +++ b/queue-5.4/scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch @@ -0,0 +1,65 @@ +From 58aa7aedd39c609a7abbf6bc3afbb5c7f356dccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 03:04:37 +0000 +Subject: scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic + +From: Matt Wang + +[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ] + +Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit") +introduced a serious issue for 64-bit systems. With this commit, +64-bit kernel will enumerate 8*15 non-existing disks. This is caused +by the broken CCB structure. The change from u32 data to void *data +increased CCB length on 64-bit system, which introduced an extra 4 +byte offset of the CDB. This leads to incorrect response to INQUIRY +commands during enumeration. + +Fix disk enumeration failure by reverting the portion of the commit +above which switched the data pointer from u32 to void. + +Link: https://lore.kernel.org/r/C325637F-1166-4340-8F0F-3BCCD59D4D54@vmware.com +Acked-by: Khalid Aziz +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/BusLogic.c | 6 +++--- + drivers/scsi/BusLogic.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/BusLogic.c b/drivers/scsi/BusLogic.c +index c25e8a54e869..6e988233fb81 100644 +--- a/drivers/scsi/BusLogic.c ++++ b/drivers/scsi/BusLogic.c +@@ -3077,11 +3077,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, + ccb->opcode = BLOGIC_INITIATOR_CCB_SG; + ccb->datalen = count * sizeof(struct blogic_sg_seg); + if (blogic_multimaster_type(adapter)) +- ccb->data = (void *)((unsigned int) ccb->dma_handle + ++ ccb->data = (unsigned int) ccb->dma_handle + + ((unsigned long) &ccb->sglist - +- (unsigned long) ccb)); ++ (unsigned long) ccb); + else +- ccb->data = ccb->sglist; ++ ccb->data = virt_to_32bit_virt(ccb->sglist); + + scsi_for_each_sg(command, sg, count, i) { + ccb->sglist[i].segbytes = sg_dma_len(sg); +diff --git a/drivers/scsi/BusLogic.h b/drivers/scsi/BusLogic.h +index 6182cc8a0344..e081ad47d1cf 100644 +--- a/drivers/scsi/BusLogic.h ++++ b/drivers/scsi/BusLogic.h +@@ -814,7 +814,7 @@ struct blogic_ccb { + unsigned char cdblen; /* Byte 2 */ + unsigned char sense_datalen; /* Byte 3 */ + u32 datalen; /* Bytes 4-7 */ +- void *data; /* Bytes 8-11 */ ++ u32 data; /* Bytes 8-11 */ + unsigned char:8; /* Byte 12 */ + unsigned char:8; /* Byte 13 */ + enum blogic_adapter_status adapter_status; /* Byte 14 */ +-- +2.30.2 + diff --git a/queue-5.4/serial-max310x-unregister-uart-driver-in-case-of-fai.patch b/queue-5.4/serial-max310x-unregister-uart-driver-in-case-of-fai.patch new file mode 100644 index 00000000000..f69455d4c16 --- /dev/null +++ b/queue-5.4/serial-max310x-unregister-uart-driver-in-case-of-fai.patch @@ -0,0 +1,49 @@ +From 8ebd4f0c52113129e9d4934e372d7539e5edf5ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 13:56:38 +0200 +Subject: serial: max310x: unregister uart driver in case of failure and abort + +From: Atul Gopinathan + +[ Upstream commit 3890e3dea315f1a257d1b940a2a4e2fa16a7b095 ] + +The macro "spi_register_driver" invokes the function +"__spi_register_driver()" which has a return type of int and can fail, +returning a negative value in such a case. This is currently ignored and +the init() function yields success even if the spi driver failed to +register. + +Fix this by collecting the return value of "__spi_register_driver()" and +also unregister the uart driver in case of failure. + +Cc: Jiri Slaby +Signed-off-by: Atul Gopinathan +Link: https://lore.kernel.org/r/20210503115736.2104747-12-gregkh@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/max310x.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/max310x.c b/drivers/tty/serial/max310x.c +index f60b7b86d099..5bf8dd6198bb 100644 +--- a/drivers/tty/serial/max310x.c ++++ b/drivers/tty/serial/max310x.c +@@ -1527,10 +1527,12 @@ static int __init max310x_uart_init(void) + return ret; + + #ifdef CONFIG_SPI_MASTER +- spi_register_driver(&max310x_spi_driver); ++ ret = spi_register_driver(&max310x_spi_driver); ++ if (ret) ++ uart_unregister_driver(&max310x_uart); + #endif + +- return 0; ++ return ret; + } + module_init(max310x_uart_init); + +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 987a37d8e56..cce790d3528 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -83,3 +83,52 @@ i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch perf-jevents-fix-getting-maximum-number-of-fds.patch +platform-x86-hp_accel-avoid-invoking-_ini-to-speed-u.patch +gpio-cadence-add-missing-module_device_table.patch +revert-media-usb-gspca-add-a-missed-check-for-goto_l.patch +revert-alsa-sb-fix-a-missing-check-of-snd_ctl_add.patch +revert-serial-max310x-pass-return-value-of-spi_regis.patch +serial-max310x-unregister-uart-driver-in-case-of-fai.patch +revert-net-fujitsu-fix-a-potential-null-pointer-dere.patch +net-fujitsu-fix-potential-null-ptr-deref.patch +revert-net-smc-fix-a-null-pointer-dereference.patch +net-caif-remove-bug_on-dev-null-in-caif_xmit.patch +revert-char-hpet-fix-a-missing-check-of-ioremap.patch +char-hpet-add-checks-after-calling-ioremap.patch +revert-alsa-gus-add-a-check-of-the-status-of-snd_ctl.patch +alsa-sb8-add-a-comment-note-regarding-an-unused-poin.patch +revert-alsa-usx2y-fix-potential-null-pointer-derefer.patch +revert-isdn-misdninfineon-fix-potential-null-pointer.patch +isdn-misdninfineon-check-cleanup-ioremap-failure-cor.patch +revert-ath6kl-return-error-code-in-ath6kl_wmi_set_ro.patch +ath6kl-return-error-code-in-ath6kl_wmi_set_roam_lrss.patch +revert-isdn-misdn-fix-potential-null-pointer-derefer.patch +isdn-misdn-correctly-handle-ph_info-allocation-failu.patch +revert-dmaengine-qcom_hidma-check-for-driver-registe.patch +dmaengine-qcom_hidma-comment-platform_driver_registe.patch +revert-libertas-add-checks-for-the-return-value-of-s.patch +libertas-register-sysfs-groups-properly.patch +revert-asoc-cs43130-fix-a-null-pointer-dereference.patch +asoc-cs43130-handle-errors-in-cs43130_probe-properly.patch +revert-media-dvb-add-check-on-sp8870_readreg.patch +media-dvb-add-check-on-sp8870_readreg-return.patch +revert-media-gspca-mt9m111-check-write_bridge-for-ti.patch +media-gspca-mt9m111-check-write_bridge-for-timeout.patch +revert-media-gspca-check-the-return-value-of-write_b.patch +media-gspca-properly-check-for-errors-in-po1030_prob.patch +revert-net-liquidio-fix-a-null-pointer-dereference.patch +net-liquidio-add-missing-null-pointer-checks.patch +revert-brcmfmac-add-a-check-for-the-status-of-usb_re.patch +brcmfmac-properly-check-for-bus-register-errors.patch +btrfs-return-whole-extents-in-fiemap.patch +scsi-buslogic-fix-64-bit-system-enumeration-error-fo.patch +openrisc-define-memory-barrier-mb.patch +btrfs-do-not-bug_on-in-link_to_fixup_dir.patch +platform-x86-hp-wireless-add-amd-s-hardware-id-to-th.patch +platform-x86-intel_punit_ipc-append-module_device_ta.patch +platform-x86-touchscreen_dmi-add-info-for-the-mediac.patch +smb3-incorrect-file-id-in-requests-compounded-with-o.patch +drm-amd-display-disconnect-non-dp-with-no-edid.patch +drm-amd-amdgpu-fix-refcount-leak.patch +drm-amdgpu-fix-a-use-after-free.patch +drm-amd-amdgpu-fix-a-potential-deadlock-in-gpu-reset.patch diff --git a/queue-5.4/smb3-incorrect-file-id-in-requests-compounded-with-o.patch b/queue-5.4/smb3-incorrect-file-id-in-requests-compounded-with-o.patch new file mode 100644 index 00000000000..09e7624ad9d --- /dev/null +++ b/queue-5.4/smb3-incorrect-file-id-in-requests-compounded-with-o.patch @@ -0,0 +1,42 @@ +From 8ae6844d239f1a0a519710c7826968a2c6e0c768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 09:52:22 -0500 +Subject: SMB3: incorrect file id in requests compounded with open + +From: Steve French + +[ Upstream commit c0d46717b95735b0eacfddbcca9df37a49de9c7a ] + +See MS-SMB2 3.2.4.1.4, file ids in compounded requests should be set to +0xFFFFFFFFFFFFFFFF (we were treating it as u32 not u64 and setting +it incorrectly). + +Signed-off-by: Steve French +Reported-by: Stefan Metzmacher +Reviewed-by: Shyam Prasad N +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index c02983ebd763..e068f82ffedd 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -3611,10 +3611,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len, + * Related requests use info from previous read request + * in chain. + */ +- shdr->SessionId = 0xFFFFFFFF; ++ shdr->SessionId = 0xFFFFFFFFFFFFFFFF; + shdr->TreeId = 0xFFFFFFFF; +- req->PersistentFileId = 0xFFFFFFFF; +- req->VolatileFileId = 0xFFFFFFFF; ++ req->PersistentFileId = 0xFFFFFFFFFFFFFFFF; ++ req->VolatileFileId = 0xFFFFFFFFFFFFFFFF; + } + } + if (remaining_bytes > io_parms->length) +-- +2.30.2 +